You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on May 14, 2020. It is now read-only.
Copy file name to clipboardExpand all lines: CONTRIBUTING.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ please adhere to the following contributing guidelines.
14
14
15
15
## Making Changes
16
16
17
-
* Please base your changes on branch ```v3.2/dev```
17
+
* Please base your changes on branch ```v3.3/dev```
18
18
* Create a topic branch for your feature or bug fix.
19
19
* Please fix only one problem at a time; this will help to quickly test and merge your change. If you intend to fix multiple unrelated problems, please use a separate branch for each problem.
20
20
* Make commits of logical units.
@@ -36,9 +36,9 @@ please adhere to the following contributing guidelines.
36
36
SecRule .. ..\
37
37
".."
38
38
```
39
-
- use quotes even if there is only one action, it improves readability (e.g use `"chain"`, not `chain`, or `"ctl:requestBodyAccess=Off"` instead of `ctl:requestBodyAccess=Off`)
39
+
- use quotes even if there is only one action, it improves readability (e.g., use `"chain"`, not `chain`, or `"ctl:requestBodyAccess=Off"` instead of `ctl:requestBodyAccess=Off`)
40
40
- always use numbers for phases, instead of names
41
-
- format your `SecMarker` between double quotes, using UPPERCASE and separating words using hyphens. Examples are
41
+
- format your `SecMarker` between double quotes, using UPPERCASE and separating words using hyphens. Examples are:
42
42
```
43
43
SecMarker "END-RESPONSE-959-BLOCKING-EVALUATION"
44
44
SecMarker "END-REQUEST-910-IP-REPUTATION"
@@ -75,26 +75,26 @@ please adhere to the following contributing guidelines.
75
75
skipAfter
76
76
```
77
77
78
-
## Variables naming conventions
78
+
## Variable naming conventions
79
79
80
80
* Variable names are lowercase using chars from `[a-z0-9_]`
81
81
* To somewhat reflect the fact that the syntax for variable usage is different when you define it (using setvar) and when you use it, we propose the following visual distinction:
82
-
* Lowercase letters for collection, dot as separator, variable name. E.g: `setvar:tx.foo_bar_variable`
83
-
* Capital letters for collection, colon as separator, variable name. E.g: `SecRule TX:foo_bar_variable`
82
+
* Lowercase letters for collection, dot as separator, variable name. E.g.,: `setvar:tx.foo_bar_variable`
83
+
* Capital letters for collection, colon as separator, variable name. E.g.,: `SecRule TX:foo_bar_variable`
84
84
85
85
## Rules compliance with each Paranoia Level (PL)
86
86
87
87
Rules in the CRS are organized in Paranoia Levels, which allows you to choose the desired level of rule checks.
88
88
89
-
Please read file ```crs-setup.conf.example``` for introduction and a more detailed explanation of Paranoia Levels in the section `# -- [[ Paranoia Level Initialization ]]`.
89
+
Please read file ```crs-setup.conf.example``` for an introduction and a more detailed explanation of Paranoia Levels in the section `# -- [[ Paranoia Level Initialization ]]`.
90
90
91
91
**PL0:**
92
92
93
93
* Modsec installed, but almost no rules
94
94
95
95
**PL1:**
96
96
97
-
* Default level, keep in mind that most installations will normally use this one.
97
+
* Default level, keep in mind that most installations will normally use this one
98
98
* If there is a complex memory consuming/evaluation rule it surely will be on upper levels, not this one
99
99
* Normally we will use atomic checks in single rules
100
100
* Confirmed matches only, all scores are allowed
@@ -146,8 +146,8 @@ Among the rules serving a CRS helper functionality are rules that skip rules dep
146
146
147
147
The blocking or filter rules start with 9XX100 with a step width of 10. E.g. 9XX100, 9XX110, 9XX120 etc. The rule id does not correspond directly with the paranoia level of a rule. Given the size of a rule group and the organization by lower PL rules first, PL2 and above tend to have rule IDs with higher numbers.
148
148
149
-
Within a rule file / block, there are sometimes smaller groups of rules that belong to together. They are closely linked and very often represent copies of the original rules with a stricter limit (alternatively, they can represent the same rule addressing a different target in a second rule where this was necessary). These are stricter siblings of the base rule. Stricter siblings usually share the first five digits of the rule ID and raise the rule ID by one. E.g. Base rule at 9XX160, stricter sibling at 9XX161.
149
+
Within a rule file / block, there are sometimes smaller groups of rules that belong to together. They are closely linked and very often represent copies of the original rules with a stricter limit (alternatively, they can represent the same rule addressing a different target in a second rule where this was necessary). These are stricter siblings of the base rule. Stricter siblings usually share the first five digits of the rule ID and raise the rule ID by one. E.g., Base rule at 9XX160, stricter sibling at 9XX161.
150
150
151
-
Stricter siblings often have a different paranoia level. This means that the base rule and the stricter sibling do not reside next to one another in the rule file. Instead they are ordered in their appropriate paranoia level and can be linked via the first digits of the rule id. It is a good practice to introduce stricter siblings together with the base rule in the comments of the base rule and to reference the base rule with the keyword stricter sibling in the comments of the stricter sibling. E.g. "... This is
151
+
Stricter siblings often have a different paranoia level. This means that the base rule and the stricter sibling do not reside next to one another in the rule file. Instead they are ordered in their appropriate paranoia level and can be linked via the first digits of the rule id. It is a good practice to introduce stricter siblings together with the base rule in the comments of the base rule and to reference the base rule with the keyword stricter sibling in the comments of the stricter sibling. E.g., "... This is
152
152
performed in two separate stricter siblings of this rule: 9XXXX1 and 9XXXX2", "This is a stricter sibling of rule 9XXXX0."
0 commit comments