# ------------------------------------------------------------------------
# OWASP CRS ver.4.9.0
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
# Copyright (c) 2021-2024 CRS project. All rights reserved.
#
# The OWASP CRS is distributed under
# Apache Software License (ASL) version 2
# Please see the enclosed LICENSE file for full details.
# ------------------------------------------------------------------------

#
# The purpose of this file is to hold LOCAL exceptions for your site.  The
# types of rules that would go into this file are one where you want to
# short-circuit inspection and allow certain transactions to pass through
# inspection or if you want to alter rules that are applied.
#
# This file is named REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example for a
# very specific reason. Files affixed with the .example extension are designed
# to contain user created/modified data. The '.example'. extension should be
# renamed to end in .conf. The advantage of this is that when OWASP CRS is
# updated, the updates will not overwrite a user generated configuration file.
#
# As a result of this design paradigm users are encouraged NOT to directly
# modify rules. Instead they should use this
# REQUEST-900-EXCLUSION-RULES-BEFORE-CRS and the
# RESPONSE-999-EXCLUSION-RULES-AFTER-CRS file to modify OWASP rules using
# methods similar to the examples specified below.
#
# REQUEST-900-EXCLUSION-RULES-BEFORE-CRS and
# RESPONSE-999-EXCLUSION-RULES-AFTER-CRS serve different purposes. ModSecurity
# effectively maintains two different context: startup, and per transaction.
# As a rule, directives are processed within the startup context. While they
# can affect the per transaction context they generally remain fixed during the
# execution of ModSecurity.
#
# As a result if one wanted to disable a rule at bootup the SecRuleRemoveById
# directive or one of its siblings would have to be placed AFTER the rule is
# listed, otherwise it will not have knowledge of the rules existence (since
# these rules are read in at the same time). This means that when using
# directives that effect SecRules, these exceptions should be placed AFTER all
# the existing rules. This is why RESPONSE-999-EXCLUSION-RULES-AFTER-CRS is
# designed such that it loads LAST.
#
# Conversely, ModSecurity supports several actions that can change the state of
# the underlying configuration during the per transaction context, this is when
# rules are being processed. Generally, these are accomplished by using the
# 'ctl' action. As these are part of a rule, they will be evaluated in the
# order rules are applied (by physical location, considering phases). As a
# result of this ordering a 'ctl' action should be placed with consideration to
# when it will be executed. This is particularly relevant for the 'ctl' options
# that involve modifying ID's (such as ruleRemoveById). In these cases it is
# important that such rules are placed BEFORE the rule ID they will affect.
# Unlike the setup context, by the time we process rules in the per-transaction
# context, we are already aware of all the rule ID's. It is by this logic that
# we include rules such as this BEFORE all the remaining rules.  As a result
# REQUEST-900-EXCLUSION-RULES-BEFORE-CRS is designed to load FIRST.
#
# As a general rule:
# ctl:ruleEngine            -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
# ctl:ruleRemoveById        -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
# ctl:ruleRemoveByMsg       -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
# ctl:ruleRemoveByTag       -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
# ctl:ruleRemoveTargetById  -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
# ctl:ruleRemoveTargetByMsg -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
# ctl:ruleRemoveTargetByTag -> place in REQUEST-900-EXCLUSION-RULES-BEFORE-CRS
#
# SecRuleRemoveById         -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
# SecRuleRemoveByMsg        -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
# SecRuleRemoveByTag        -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
# SecRuleUpdateActionById   -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
# SecRuleUpdateTargetById   -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
# SecRuleUpdateTargetByMsg  -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
# SecRuleUpdateTargetByTag  -> place in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS
#
#
# What follows are a group of examples that show you how to perform rule
# exclusions.
#
#
# Example Exclusion Rule: Disable inspection for an authorized client
#
# This ruleset allows you to control how ModSecurity will handle traffic
# originating from Authorized Vulnerability Scanning (AVS) sources.  See
# related blog post -
# https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/updated-advanced-topic-of-the-week-handling-authorized-scanning-traffic/
#
# Allow List ASV network block (no blocking or logging of AVS traffic) Update
# IP network block as appropriate for your AVS traffic
#
# ModSec Rule Exclusion: Disable Rule Engine for known ASV IP
# SecRule REMOTE_ADDR "@ipMatch 192.168.1.100" \
#     "id:1000,\
#     phase:1,\
#     pass,\
#     nolog,\
#     ctl:ruleEngine=Off"
#
#
# Example Exclusion Rule: Removing a specific ARGS parameter from inspection
#                         for an individual rule
#
# This rule shows how to conditionally exclude the "password"
# parameter for rule 942100 when the REQUEST_URI is /index.php
# ModSecurity Rule Exclusion: 942100 SQL Injection Detected via libinjection
#
# SecRule REQUEST_URI "@beginsWith /index.php" \
#     "id:1001,\
#     phase:1,\
#     pass,\
#     nolog,\
#     ctl:ruleRemoveTargetById=942100;ARGS:password"
#
#
# Example Exclusion Rule: Removing a specific ARGS parameter from inspection
#                         for only certain attacks
#
# Attack rules within the CRS are tagged, with tags such as 'attack-lfi',
# 'attack-sqli', 'attack-xss', 'attack-injection-php', et cetera.
#
# ModSecurity Rule Exclusion: Disable inspection of ARGS:pwd
#                             for all rules tagged attack-sqli
# SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
#     "id:1002,\
#     phase:2,\
#     pass,\
#     nolog,\
#     ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:pwd"
#

# Example Exclusion Rule: Removing a specific ARGS parameter from inspection
#                         for all CRS rules
#
# This rule illustrates that we can use tagging very effectively to allow list a
# common false positive across an entire ModSecurity instance. This can be done
# because every rule in OWASP_CRS is tagged with OWASP_CRS. This will NOT
# affect custom rules.
#
# ModSecurity Rule Exclusion: Disable inspection of ARGS:pwd
#                             for all CRS rules
# SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
#     "id:1003,\
#     phase:2,\
#     pass,\
#     nolog,\
#     ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pwd"

#
# Example Exclusion Rule: Removing a range of rules
#
# This rule illustrates that we can remove a rule range via a ctl action.
# This uses the fact, that rules are grouped by topic in rule files covering
# a certain id range.
# IMPORTANT: ModSecurity v3, aka libModSecurity, does not currently support the
# use of rule ranges in a ruleRemoveById ctl action (this feature has been
# planned for v3.1). Consider using ruleRemoveByTag as a workaround, if
# appropriate.
#
# ModSecurity Rule Exclusion: Disable all SQLi and XSS rules
# SecRule REQUEST_FILENAME "@beginsWith /admin" \
#     "id:1004,\
#     phase:2,\
#     pass,\
#     nolog,\
#     ctl:ruleRemoveById=941000-942999"
#
#
# The application-specific rule exclusion plugins
# (see: https://github.com/coreruleset/plugin-registry)
# provide additional examples which can be useful then tuning a service.


#
# Example Rule: Allow monitoring tools and scripts
#
# Uncomment this rule to allow all requests from trusted IPs and User-Agent.
# This can be useful for monitoring tools like Monit, Nagios, or other agents.
# For example, if you're using AWS Load Balancer, you may need to trust all
# requests from "10.0.0.0/8" subnet that come with the user-agent
# "ELB-HealthChecker/2.0". By doing this, all requests that match these
# conditions will not be matched against the following rules:
#
# - id: 911100 (allowed methods)
# - id: 913100 (scan detection)
# - id: 920280 (missing/empty host header)
# - id: 920350 (IP address in host header)
# - tag: attack-disclosure (all RESPONSE-*-DATA-LEAKAGES rules)
#
SecRule REMOTE_ADDR "@ipMatch 10.0.0.0/8" \
   "id:1005,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET HEAD" "chain"
      SecRule REQUEST_HEADERS:User-Agent "@pm ELB-HealthChecker" \
          "ctl:ruleRemoveById=911100,\
          ctl:ruleRemoveById=913100,\
          ctl:ruleRemoveById=920280,\
          ctl:ruleRemoveById=920350,\
          ctl:ruleRemoveByTag=attack-disclosure"

# Disable some rules for GraphQL API endpoint for blocklet server and service
SecRule REQUEST_FILENAME "@endsWith /api/gql" \
   "id:1006,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleEngine=Off"

# Disable some rules for websocket endpoint for blocklet server and service
SecRule REQUEST_FILENAME "@endsWith /websocket" \
   "id:1007,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
   "chain"
      SecRule REQUEST_HEADERS:Upgrade "@streq websocket" \
          "ctl:ruleRemoveByTag=attack-protocol"

# Required for media-kit upload
SecRule REQUEST_HEADERS:tus-resumable "@rx ^1\.0\.0$" \
    "id:1008,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    chain"
    SecRule REQUEST_METHOD "@rx ^PATCH$" \
        "t:none,\
        chain"
        SecRule REQUEST_HEADERS:Content-Type "@rx ^application/offset\+octet-stream$" \
            "t:none,\
            ctl:ruleRemoveById=920420"

# Fix: did space connect and restore false positive
SecRule REQUEST_FILENAME "@rx (?:/connect-to-did-space|/one-click-authorization|/connect-to-did-domain|/restore)" \
   "id:1009,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleRemoveById=934110,\
        ctl:ruleRemoveById=931120"

# Fix: did wallet backup false positive
SecRule REQUEST_FILENAME "@endsWith /app-records.txt" \
   "id:1010,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm PUT" \
       "ctl:ruleEngine=Off"

# Fix: did resolver false positive
SecRule REQUEST_FILENAME "@contains /.well-known/did-resolver/resolve" \
   "id:1011,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleRemoveById=920440"

# Fix: did connect false positive
SecRule REQUEST_FILENAME "@contains /.well-known/service/connect" \
   "id:1012,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleRemoveById=930120"

# Fix: dockerfile assets from discuss-kit false positive
SecRule REQUEST_FILENAME "@rx /dockerfile-[A-Za-z0-9-_]{8}\.js$" \
   "id:1013,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleRemoveById=930130"

# Fix oauth callback scope false positive
SecRule REQUEST_FILENAME "@contains /.well-known/service/oauth/callback" \
   "id:1014,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleRemoveById=930120"

# Fix did-space upload false positive
SecRule REQUEST_FILENAME "@contains /api/space/" \
   "id:1015,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm PUT PATCH DELETE POST" \
       "ctl:ruleEngine=Off"

# Fix: blocklet store upload false positive
SecRule REQUEST_FILENAME "@endsWith /api/blocklets/upload" \
   "id:1016,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleEngine=Off"

# Fix did-space explorer false positive
SecRule REQUEST_FILENAME "@contains /space/" \
   "id:1017,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "chain"
   SecRule REQUEST_FILENAME "@endsWith /explorer" \
       "ctl:ruleRemoveById=930120"

# Disable some rules for ocap
SecRule REQUEST_FILENAME "@beginsWith /api" \
   "id:1018,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleRemoveByTag=attack-rce"

# Allow localhost and 127.0.0.1 in redirect_uri for OAuth
SecRule REQUEST_FILENAME|ARGS "@contains oauth" \
   "id:1019,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET POST" \
       "ctl:ruleRemoveById=932270,\
        ctl:ruleRemoveById=934110"

# Fix: did-spaces profile vcf file false positive
SecRule REQUEST_FILENAME "@endsWith /profile.vcf" \
   "id:1020,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleRemoveById=930130"

# Fix: pages-kit data-source false positive
SecRule REQUEST_FILENAME "@contains /api/data-sources/" \
   "id:1021,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST PUT" \
       "ctl:ruleEngine=Off"

# Fix: payment-kit webhook false positive
SecRule REQUEST_FILENAME "@endsWith /api/integrations/stripe/webhook" \
   "id:1022,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleEngine=Off"

# Fix: discuss-kit bookmark false positive
SecRule REQUEST_FILENAME "@endsWith /api/comments" \
   "id:1023,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleRemoveById=921110"

# Fix: pages-kit component false positive
SecRule REQUEST_FILENAME "@endsWith /api/components/preload" \
   "id:1024,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleEngine=Off"

# Allow localhost redirects
SecRule ARGS:redirect "@rx localhost|127\.0\.0\.1" \
    "id:1025,\
    phase:1,\
    pass,\
    nolog,\
    ctl:ruleRemoveByTag=attack-ssrf"

# Skip WAF for /ai-kit/ api
SecRule REQUEST_FILENAME "@contains /api/v1/chat" \
   "id:1026,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleEngine=Off"

# Fix: preferences false positive
SecRule REQUEST_FILENAME "@endsWith /.well-known/service/admin/api/preferences" \
   "id:1027,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET POST PUT" \
       "ctl:ruleEngine=Off"

# Disable some rules for /api/v2/chat endpoint for aigne-hub
SecRule REQUEST_FILENAME "@contains /api/v2/chat" \
   "id:1028,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleEngine=Off"

# Disable some rules for /discussions/add endpoint for discuss-kit
SecRule REQUEST_FILENAME "@contains /discussions/add" \
   "id:1029,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET POST PUT" \
       "ctl:ruleEngine=Off"

# Disable header injection for static assets
SecRule REQUEST_FILENAME "@beginsWith /.blocklet/proxy" \
   "id:1030,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleEngine=Off"

# Disable some rules for /parking/ path for DID Names parking page and /api/products/ path
SecRule REQUEST_FILENAME "@rx /parking/|/api/products/" \
   "id:1031,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET" \
       "ctl:ruleEngine=Off"

# Fix: CSRF token false positive - disable SQL injection check for x-csrf-token cookie
SecRule REQUEST_COOKIES:x-csrf-token "@rx .*" \
   "id:1032,\
   phase:1,\
   pass,\
   nolog,\
   ctl:ruleRemoveTargetById=942100;REQUEST_COOKIES:x-csrf-token,ctl:ruleRemoveTargetById=930120;REQUEST_COOKIES:x-csrf-token"

# Fix: pages-kit publish with zip
SecRule REQUEST_FILENAME "@endsWith /api/sdk/upload-data" \
   "id:1033,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm POST" \
       "ctl:ruleRemoveById=920420"

# Fix: API false positive
SecRule REQUEST_FILENAME "@beginsWith /.well-known/service/api" \
   "id:1034,\
   phase:1,\
   pass,\
   nolog,\
   chain"
   SecRule REQUEST_METHOD "@pm GET POST PUT" \
       "ctl:ruleRemoveById=921140"