Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit b236f6e

Browse files
fzipifzipi
committed
Correcting tags for skipping per CONTRIBUTING
1 parent fb67fae commit b236f6e

7 files changed

+29
-29
lines changed

‎rules/REQUEST-901-INITIALIZATION.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ SecRule TX:sampling_percentage "@eq 100" \
284284
phase:1,\
285285
pass,\
286286
nolog,\
287-
skipAfter:END-SAMPLING"
287+
skipAfter:'END-SAMPLING'"
288288

289289
SecRule UNIQUE_ID "@rx ^." \
290290
"id:901410,\
@@ -340,6 +340,6 @@ SecRule TX:sampling_rnd100 "!@lt %{tx.sampling_percentage}" \
340340
noauditlog,\
341341
msg:'Sampling: Disable the rule engine based on sampling_percentage \
342342
%{TX.sampling_percentage} and random number %{TX.sampling_rnd100}.',\
343-
ctl:ruleEngine=off"
343+
ctl:ruleEngine=Off"
344344

345345
SecMarker "END-SAMPLING"

‎rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ SecRule &TX:crs_exclusions_drupal|TX:crs_exclusions_drupal "@eq 0" \
6868
pass,\
6969
t:none,\
7070
nolog,\
71-
skipAfter:END-DRUPAL-RULE-EXCLUSIONS"
71+
skipAfter:'END-DRUPAL-RULE-EXCLUSIONS'"
7272

7373

7474
# [ Table of Contents ]
@@ -380,4 +380,4 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/services/rss-publishing" \
380380
ctl:ruleRemoveTargetByTag=CRS;ARGS:feed_description"
381381

382382

383-
SecMarker END-DRUPAL-RULE-EXCLUSIONS
383+
SecMarker "END-DRUPAL-RULE-EXCLUSIONS"

‎rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,15 @@ SecRule &TX:crs_exclusions_wordpress|TX:crs_exclusions_wordpress "@eq 0" \
2222
pass,\
2323
t:none,\
2424
nolog,\
25-
skipAfter:END-WORDPRESS"
25+
skipAfter:'END-WORDPRESS'"
2626

2727
SecRule &TX:crs_exclusions_wordpress|TX:crs_exclusions_wordpress "@eq 0" \
2828
"id:9002001,\
2929
phase:2,\
3030
pass,\
3131
t:none,\
3232
nolog,\
33-
skipAfter:END-WORDPRESS"
33+
skipAfter:'END-WORDPRESS'"
3434

3535

3636
#
@@ -193,15 +193,15 @@ SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
193193
pass,\
194194
t:none,\
195195
nolog,\
196-
skipAfter:END-WORDPRESS-ADMIN"
196+
skipAfter:'END-WORDPRESS-ADMIN'"
197197

198198
SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
199199
"id:9002401,\
200200
phase:2,\
201201
pass,\
202202
t:none,\
203203
nolog,\
204-
skipAfter:END-WORDPRESS-ADMIN"
204+
skipAfter:'END-WORDPRESS-ADMIN'"
205205

206206

207207
#
@@ -618,7 +618,7 @@ SecRule REQUEST_FILENAME "@rx /wp-admin/load-(?:scripts|styles)\.php$" \
618618
ctl:ruleRemoveTargetById=942432;ARGS:load[]"
619619

620620

621-
SecMarker END-WORDPRESS-ADMIN
621+
SecMarker "END-WORDPRESS-ADMIN"
622622

623623

624-
SecMarker END-WORDPRESS
624+
SecMarker "END-WORDPRESS"

‎rules/REQUEST-910-IP-REPUTATION.conf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ SecRule TX:DO_REPUT_BLOCK "@eq 1" \
4242
setvar:'tx.msg=%{rule.msg}',\
4343
severity:'CRITICAL',\
4444
chain,\
45-
skipAfter:BEGIN_REQUEST_BLOCKING_EVAL"
45+
skipAfter:'BEGIN-REQUEST-BLOCKING-EVAL'"
4646
SecRule IP:REPUT_BLOCK_FLAG "@eq 1" \
4747
"setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
4848
setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var}'"
@@ -122,7 +122,7 @@ SecRule IP:PREVIOUS_RBL_CHECK "@eq 1" \
122122
tag:'language-multi',\
123123
tag:'platform-multi',\
124124
tag:'attack-reputation-ip',\
125-
skipAfter:END_RBL_LOOKUP"
125+
skipAfter:'END-RBL-LOOKUP'"
126126

127127
#
128128
# Check Client IP against ProjectHoneypot's HTTP Blacklist
@@ -144,7 +144,7 @@ SecRule &TX:block_suspicious_ip "@eq 0" \
144144
t:none,\
145145
nolog,\
146146
chain,\
147-
skipAfter:END_RBL_CHECK"
147+
skipAfter:'END-RBL-CHECK'"
148148
SecRule &TX:block_harvester_ip "@eq 0" \
149149
"chain"
150150
SecRule &TX:block_spammer_ip "@eq 0" \
@@ -182,7 +182,7 @@ SecRule TX:block_search_ip "@eq 1" \
182182
tag:'attack-reputation-ip',\
183183
severity:'CRITICAL',\
184184
chain,\
185-
skipAfter:END_RBL_CHECK"
185+
skipAfter:'END-RBL-CHECK'"
186186
SecRule TX:httpbl_msg "@rx Search Engine" \
187187
"setvar:'tx.msg=%{rule.msg}',\
188188
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -205,7 +205,7 @@ SecRule TX:block_spammer_ip "@eq 1" \
205205
tag:'attack-reputation-ip',\
206206
severity:'CRITICAL',\
207207
chain,\
208-
skipAfter:END_RBL_CHECK"
208+
skipAfter:'END-RBL-CHECK'"
209209
SecRule TX:httpbl_msg "@rx (?i)^.*? spammer .*?$" \
210210
"setvar:'tx.msg=%{rule.msg}',\
211211
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -228,7 +228,7 @@ SecRule TX:block_suspicious_ip "@eq 1" \
228228
tag:'attack-reputation-ip',\
229229
severity:'CRITICAL',\
230230
chain,\
231-
skipAfter:END_RBL_CHECK"
231+
skipAfter:'END-RBL-CHECK'"
232232
SecRule TX:httpbl_msg "@rx (?i)^.*? suspicious .*?$" \
233233
"setvar:'tx.msg=%{rule.msg}',\
234234
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -251,7 +251,7 @@ SecRule TX:block_harvester_ip "@eq 1" \
251251
tag:'attack-reputation-ip',\
252252
severity:'CRITICAL',\
253253
chain,\
254-
skipAfter:END_RBL_CHECK"
254+
skipAfter:'END-RBL-CHECK'"
255255
SecRule TX:httpbl_msg "@rx (?i)^.*? harvester .*?$" \
256256
"setvar:'tx.msg=%{rule.msg}',\
257257
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -275,9 +275,9 @@ SecAction \
275275
setvar:'ip.previous_rbl_check=1',\
276276
expirevar:'ip.previous_rbl_check=86400'"
277277

278-
SecMarker END_RBL_LOOKUP
278+
SecMarker "END-RBL-LOOKUP"
279279

280-
SecMarker END_RBL_CHECK
280+
SecMarker "END-RBL-CHECK"
281281

282282

283283
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:1,id:910013,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"

‎rules/REQUEST-912-DOS-PROTECTION.conf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ SecRule &TX:dos_burst_time_slice "@eq 0" \
7070
t:none,\
7171
nolog,\
7272
chain,\
73-
skipAfter:END_DOS_PROTECTION_CHECKS"
73+
skipAfter:'END-DOS-PROTECTION-CHECKS'"
7474
SecRule &TX:dos_counter_threshold "@eq 0" \
7575
"chain"
7676
SecRule &TX:dos_block_timeout "@eq 0"
@@ -82,7 +82,7 @@ SecRule &TX:dos_burst_time_slice "@eq 0" \
8282
t:none,\
8383
nolog,\
8484
chain,\
85-
skipAfter:END_DOS_PROTECTION_CHECKS"
85+
skipAfter:'END-DOS-PROTECTION-CHECKS'"
8686
SecRule &TX:dos_counter_threshold "@eq 0" \
8787
"chain"
8888
SecRule &TX:dos_block_timeout "@eq 0"
@@ -152,7 +152,7 @@ SecRule IP:DOS_BLOCK "@eq 1" \
152152
tag:'language-multi',\
153153
tag:'platform-multi',\
154154
tag:'attack-dos',\
155-
skipAfter:END_DOS_PROTECTION_CHECKS"
155+
skipAfter:'END-DOS-PROTECTION-CHECKS'"
156156

157157

158158
#
@@ -294,4 +294,4 @@ SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:2,id:912018,nolog,pass,skipAfter:END-RE
294294
#
295295
SecMarker "END-REQUEST-912-DOS-PROTECTION"
296296

297-
SecMarker END_DOS_PROTECTION_CHECKS
297+
SecMarker "END-DOS-PROTECTION-CHECKS"

‎rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -613,7 +613,7 @@ SecRule &REQUEST_HEADERS:Host "@eq 0" \
613613
setvar:'tx.msg=%{rule.msg}',\
614614
setvar:'tx.anomaly_score=+%{tx.warning_anomaly_score}',\
615615
setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER-%{matched_var_name}=%{matched_var}',\
616-
skipAfter:END_HOST_CHECK"
616+
skipAfter:'END-HOST-CHECK'"
617617

618618

619619
SecRule REQUEST_HEADERS:Host "@rx ^$" \
@@ -634,7 +634,7 @@ SecRule REQUEST_HEADERS:Host "@rx ^$" \
634634
setvar:'tx.anomaly_score=+%{tx.warning_anomaly_score}',\
635635
setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER-%{matched_var_name}=%{matched_var}'"
636636

637-
SecMarker END_HOST_CHECK
637+
SecMarker "END-HOST-CHECK"
638638

639639

640640
#

‎rules/RESPONSE-980-CORRELATION.conf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ SecRule &TX:'/LEAKAGE\\\/ERRORS/' "@ge 1" \
3131
tag:'event-correlation',\
3232
severity:'EMERGENCY',\
3333
chain,\
34-
skipAfter:END_CORRELATION"
34+
skipAfter:'END-CORRELATION'"
3535
SecRule &TX:'/WEB_ATTACK/' "@ge 1" "t:none"
3636

3737
#
@@ -47,7 +47,7 @@ SecRule &TX:'/AVAILABILITY\\\/APP_NOT_AVAIL/' "@ge 1" \
4747
severity:'ALERT',\
4848
tag:'event-correlation',\
4949
chain,\
50-
skipAfter:END_CORRELATION"
50+
skipAfter:'END-CORRELATION'"
5151
SecRule &TX:'/WEB_ATTACK/' "@ge 1" "t:none"
5252

5353
SecRule TX:INBOUND_ANOMALY_SCORE "@gt 0" \
@@ -60,7 +60,7 @@ SecRule TX:INBOUND_ANOMALY_SCORE "@gt 0" \
6060
msg:'Inbound Anomaly Score (Total Inbound Score: %{TX.INBOUND_ANOMALY_SCORE}): %{tx.inbound_tx_msg}',\
6161
tag:'event-correlation',\
6262
chain,\
63-
skipAfter:END_CORRELATION"
63+
skipAfter:'END-CORRELATION'"
6464
SecRule TX:INBOUND_ANOMALY_SCORE "@lt %{tx.inbound_anomaly_score_threshold}"
6565

6666
SecRule TX:INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
@@ -83,7 +83,7 @@ SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \
8383
msg:'Outbound Anomaly Score Exceeded (score %{TX.OUTBOUND_ANOMALY_SCORE}): %{tx.msg}',\
8484
tag:'event-correlation'"
8585

86-
SecMarker END_CORRELATION
86+
SecMarker "END-CORRELATION"
8787

8888

8989
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:1,id:980011,nolog,pass,skipAfter:END-RESPONSE-980-CORRELATION"

0 commit comments

Comments
 (0)