Skip to content

Commit 6d107fd

Browse files
CarlesDDrochdev
CarlesDD
authored and
rochdev
committed
Update WAF rules to v1.15.1 (#6245)
1 parent 4ac9cde commit 6d107fd

File tree

1 file changed

+271
-2
lines changed

1 file changed

+271
-2
lines changed

‎packages/dd-trace/src/appsec/recommended.json

Lines changed: 271 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": "2.2",
33
"metadata": {
4-
"rules_version": "1.15.0"
4+
"rules_version": "1.15.1"
55
},
66
"rules": [
77
{
@@ -5539,6 +5539,7 @@
55395539
"confidence": "0",
55405540
"module": "waf"
55415541
},
5542+
"max_version": "1.24.9",
55425543
"conditions": [
55435544
{
55445545
"parameters": {
@@ -6671,7 +6672,10 @@
66716672
{
66726673
"address": "graphql.server.resolver"
66736674
}
6674-
]
6675+
],
6676+
"options": {
6677+
"path-inspection": true
6678+
}
66756679
},
66766680
"operator": "ssrf_detector"
66776681
}
@@ -8916,6 +8920,271 @@
89168920
"transformers": []
89178921
}
89188922
],
8923+
"rules_compat": [
8924+
{
8925+
"id": "api-001-100",
8926+
"name": "JWT: No expiry is present",
8927+
"tags": {
8928+
"type": "jwt",
8929+
"category": "api_security",
8930+
"confidence": "0",
8931+
"module": "business-logic"
8932+
},
8933+
"min_version": "1.25.0",
8934+
"conditions": [
8935+
{
8936+
"parameters": {
8937+
"inputs": [
8938+
{
8939+
"address": "server.request.jwt",
8940+
"key_path": [
8941+
"payload",
8942+
"exp"
8943+
]
8944+
}
8945+
]
8946+
},
8947+
"operator": "!exists"
8948+
}
8949+
],
8950+
"transformers": [],
8951+
"output": {
8952+
"event": false,
8953+
"keep": false,
8954+
"attributes": {
8955+
"_dd.appsec.api.jwt.no_expiry": {
8956+
"value": 1
8957+
}
8958+
}
8959+
}
8960+
},
8961+
{
8962+
"id": "api-001-110",
8963+
"name": "JWT: Collect algorithm used",
8964+
"tags": {
8965+
"type": "jwt",
8966+
"category": "api_security",
8967+
"confidence": "0",
8968+
"module": "business-logic"
8969+
},
8970+
"min_version": "1.25.0",
8971+
"conditions": [
8972+
{
8973+
"parameters": {
8974+
"inputs": [
8975+
{
8976+
"address": "server.request.jwt",
8977+
"key_path": [
8978+
"header",
8979+
"alg"
8980+
]
8981+
}
8982+
]
8983+
},
8984+
"operator": "exists"
8985+
}
8986+
],
8987+
"transformers": [],
8988+
"output": {
8989+
"event": false,
8990+
"keep": false,
8991+
"attributes": {
8992+
"_dd.appsec.api.jwt_alg": {
8993+
"address": "server.request.jwt",
8994+
"key_path": [
8995+
"header",
8996+
"alg"
8997+
]
8998+
}
8999+
}
9000+
}
9001+
},
9002+
{
9003+
"id": "api-001-120",
9004+
"name": "JWT: No audience is specified",
9005+
"tags": {
9006+
"type": "jwt",
9007+
"category": "api_security",
9008+
"confidence": "0",
9009+
"module": "business-logic"
9010+
},
9011+
"min_version": "1.25.0",
9012+
"conditions": [
9013+
{
9014+
"parameters": {
9015+
"inputs": [
9016+
{
9017+
"address": "server.request.jwt",
9018+
"key_path": [
9019+
"payload",
9020+
"aud"
9021+
]
9022+
}
9023+
]
9024+
},
9025+
"operator": "!exists"
9026+
}
9027+
],
9028+
"transformers": [],
9029+
"output": {
9030+
"event": false,
9031+
"keep": false,
9032+
"attributes": {
9033+
"_dd.appsec.api.jwt.no_audience": {
9034+
"value": 1
9035+
}
9036+
}
9037+
}
9038+
},
9039+
{
9040+
"id": "api-001-130",
9041+
"name": "JWT: None algorithm used",
9042+
"tags": {
9043+
"type": "jwt",
9044+
"category": "api_security",
9045+
"confidence": "0",
9046+
"module": "business-logic"
9047+
},
9048+
"min_version": "1.25.0",
9049+
"conditions": [
9050+
{
9051+
"parameters": {
9052+
"inputs": [
9053+
{
9054+
"address": "server.request.jwt",
9055+
"key_path": [
9056+
"header",
9057+
"alg"
9058+
]
9059+
}
9060+
],
9061+
"list": [
9062+
"none",
9063+
"nonE",
9064+
"noNe",
9065+
"noNE",
9066+
"nOne",
9067+
"nOnE",
9068+
"nONe",
9069+
"nONE",
9070+
"None",
9071+
"NonE",
9072+
"NoNe",
9073+
"NoNE",
9074+
"NOne",
9075+
"NOnE",
9076+
"NONe",
9077+
"NONE"
9078+
]
9079+
},
9080+
"operator": "exact_match"
9081+
}
9082+
],
9083+
"transformers": [],
9084+
"output": {
9085+
"event": false,
9086+
"keep": true,
9087+
"attributes": {
9088+
"_dd.appsec.api.jwt.none_alg": {
9089+
"value": 1
9090+
}
9091+
}
9092+
}
9093+
},
9094+
{
9095+
"id": "ua0-600-551",
9096+
"name": "Datadog test scanner - scalar trace-tagging version: user-agent",
9097+
"tags": {
9098+
"type": "security_scanner",
9099+
"category": "attack_attempt",
9100+
"cwe": "200",
9101+
"capec": "1000/118/169",
9102+
"tool_name": "Datadog Canary Test",
9103+
"confidence": "1",
9104+
"module": "waf"
9105+
},
9106+
"min_version": "1.25.0",
9107+
"conditions": [
9108+
{
9109+
"parameters": {
9110+
"inputs": [
9111+
{
9112+
"address": "server.request.headers.no_cookies",
9113+
"key_path": [
9114+
"user-agent"
9115+
]
9116+
},
9117+
{
9118+
"address": "grpc.server.request.metadata",
9119+
"key_path": [
9120+
"dd-canary"
9121+
]
9122+
}
9123+
],
9124+
"regex": "^dd-test-scanner-tag-scalar(?:$|/|\\s)"
9125+
},
9126+
"operator": "match_regex"
9127+
}
9128+
],
9129+
"transformers": [],
9130+
"output": {
9131+
"event": false,
9132+
"attributes": {
9133+
"_dd.appsec.test.scanner.scalar": {
9134+
"value": 1
9135+
}
9136+
}
9137+
}
9138+
},
9139+
{
9140+
"id": "ua0-600-552",
9141+
"name": "Datadog test scanner - reference trace-tagging version: user-agent",
9142+
"tags": {
9143+
"type": "security_scanner",
9144+
"category": "attack_attempt",
9145+
"cwe": "200",
9146+
"capec": "1000/118/169",
9147+
"tool_name": "Datadog Canary Test",
9148+
"confidence": "1",
9149+
"module": "waf"
9150+
},
9151+
"min_version": "1.25.0",
9152+
"conditions": [
9153+
{
9154+
"parameters": {
9155+
"inputs": [
9156+
{
9157+
"address": "server.request.headers.no_cookies",
9158+
"key_path": [
9159+
"user-agent"
9160+
]
9161+
},
9162+
{
9163+
"address": "grpc.server.request.metadata",
9164+
"key_path": [
9165+
"dd-canary"
9166+
]
9167+
}
9168+
],
9169+
"regex": "^dd-test-scanner-tag-ref(?:$|/|\\s)"
9170+
},
9171+
"operator": "match_regex"
9172+
}
9173+
],
9174+
"transformers": [],
9175+
"output": {
9176+
"event": false,
9177+
"attributes": {
9178+
"_dd.appsec.test.scanner.reference": {
9179+
"address": "server.request.headers.no_cookies",
9180+
"key_path": [
9181+
"user-agent"
9182+
]
9183+
}
9184+
}
9185+
}
9186+
}
9187+
],
89199188
"processors": [
89209189
{
89219190
"id": "http-endpoint-fingerprint",

0 commit comments

Comments
 (0)