Merge pull request 'dev' (#15) from dev into main

Reviewed-on: #15
2026-02-02 20:22:50 +01:00
parent d08e03e28c ac36dec16c
commit 24034ad284
4 changed files with 38 additions and 27 deletions
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -2,7 +2,9 @@ name: Publish collection to Galaxy
 on:
  push:
    tags:
-      - 'v*'
+      - "v*"
+    branches:
+      - "main"

 jobs:
  publish:
@@ -20,3 +22,12 @@ jobs:
 #     - uses: actions/gitea-upload-artifact@v3
 #       with:
 #         path: /workspace/itik/bgwaf/seb4itik/byow/seb4itik-byow-0.1.2.tar.gz
+      - name: Push artifacts
+        run: |
+          GITEA_REPO_OWNER=$(echo $GITEA_REPOSITORY | cut -d"/" -f1) && \
+          GITEA_REPO_NAME=$(echo $GITEA_REPOSITORY | cut -d"/" -f2) && \
+          curl \
+            -X PUT \
+            -H "Authorization: token ${{ secrets.CI_GITEA_PACKAGES_TOKEN }}" \
+            --upload-file seb4itik-byow-${VER}.tar.gz \
+            $GITEA_SERVER_URL/api/packages/${GITEA_REPO_OWNER}/generic/${GITEA_REPO_NAME}/${GITEA_SHA}/seb4itik-byow-${VER}.tar.gz
--- a/seb4itik/byow/README.md
+++ b/seb4itik/byow/README.md
@@ -106,6 +106,7 @@ Fonctionnalités déjà implémentées:
 - Whitelist
 - Static files et FastCGI pour PHP (NON, par design !)
 - Rate limit (non distribué)
+- CORS

 Urgemment:

@@ -117,7 +118,6 @@ Urgemment:
 Fonctionnalités à ajouter:

 - Rate limiting distribué
- Revérifier gestion CORS
 - Antibot par:
  - Cookie
  - Captcha
--- a/seb4itik/byow/roles/caddy/templates/coraza.conf
+++ b/seb4itik/byow/roles/caddy/templates/coraza.conf
@@ -78,7 +78,7 @@ SecResponseBodyAccess On
 # Which response MIME types do you want to inspect? You should adjust the
 # configuration below to catch documents but avoid static files
 # (e.g., images and archives).
-SecResponseBodyMimeType text/plain text/html text/xml
+SecResponseBodyMimeType text/plain text/html text/xml application/json

 # Buffer response bodies of up to 512 KB in length.
 SecResponseBodyLimit 524288
--- a/seb4itik/byow/roles/caddy/templates/crs-setup.conf
+++ b/seb4itik/byow/roles/caddy/templates/crs-setup.conf
@@ -11,7 +11,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.blocking_crs_paranoia_level={{ site.crs_paranoia_level | default(caddy_sites_defaults.crs_paranoia_level) }}"
+    setvar:tx.blocking_paranoia_level={{ site.crs_paranoia_level | default(caddy_sites_defaults.crs_paranoia_level) }}"
 {% if site.crs_detection_paranoia_level | default(caddy_sites_defaults.crs_detection_paranoia_level) != None %}

 ## Detection paranoia level
@@ -23,7 +23,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_detection_paranoia_level={{ site.crs_detection_paranoia_level | default(caddy_sites_defaults.crs_detection_paranoia_level) }}"
+    setvar:tx.detection_paranoia_level={{ site.crs_detection_paranoia_level | default(caddy_sites_defaults.crs_detection_paranoia_level) }}"
 {% endif %}

 ## Enforce Body Processor URLENCODED
@@ -35,7 +35,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_enforce_bodyproc_urlencoded={{ site.crs_enforce_bodyproc_urlencoded | default(caddy_sites_defaults.crs_enforce_bodyproc_urlencoded) }}"
+    setvar:tx.enforce_bodyproc_urlencoded={{ site.crs_enforce_bodyproc_urlencoded | default(caddy_sites_defaults.crs_enforce_bodyproc_urlencoded) }}"

 ## Anomaly Scoring Mode Severity Levels
 SecAction \
@@ -46,10 +46,10 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_critical_anomaly_score={{ site.crs_critical_anomaly_score | default(caddy_sites_defaults.crs_critical_anomaly_score) }},\
-    setvar:tx.crs_error_anomaly_score={{ site.crs_error_anomaly_score | default(caddy_sites_defaults.crs_error_anomaly_score) }},\
-    setvar:tx.crs_warning_anomaly_score={{ site.crs_warning_anomaly_score | default(caddy_sites_defaults.crs_warning_anomaly_score) }},\
-    setvar:tx.crs_notice_anomaly_score={{ site.crs_notice_anomaly_score | default(caddy_sites_defaults.crs_notice_anomaly_score) }}"
+    setvar:tx.critical_anomaly_score={{ site.crs_critical_anomaly_score | default(caddy_sites_defaults.crs_critical_anomaly_score) }},\
+    setvar:tx.error_anomaly_score={{ site.crs_error_anomaly_score | default(caddy_sites_defaults.crs_error_anomaly_score) }},\
+    setvar:tx.warning_anomaly_score={{ site.crs_warning_anomaly_score | default(caddy_sites_defaults.crs_warning_anomaly_score) }},\
+    setvar:tx.notice_anomaly_score={{ site.crs_notice_anomaly_score | default(caddy_sites_defaults.crs_notice_anomaly_score) }}"

 ## Anomaly Scoring Mode Blocking Threshold Levels
 SecAction \
@@ -60,8 +60,8 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_inbound_anomaly_score_threshold={% if site.crs_log_only | default(caddy_sites_defaults.crs_log_only) %}1000{% else %}{{ site.crs_inbound_anomaly_score_threshold | default(caddy_sites_defaults.crs_inbound_anomaly_score_threshold) }}{% endif %},\
-    setvar:tx.crs_outbound_anomaly_score_threshold={% if site.crs_log_only | default(caddy_sites_defaults.crs_log_only) %}1000{% else %}{{ site.crs_outbound_anomaly_score_threshold | default(caddy_sites_defaults.crs_outbound_anomaly_score_threshold) }}{% endif %}"
+    setvar:tx.inbound_anomaly_score_threshold={% if site.crs_log_only | default(caddy_sites_defaults.crs_log_only) %}1000{% else %}{{ site.crs_inbound_anomaly_score_threshold | default(caddy_sites_defaults.crs_inbound_anomaly_score_threshold) }}{% endif %},\
+    setvar:tx.outbound_anomaly_score_threshold={% if site.crs_log_only | default(caddy_sites_defaults.crs_log_only) %}1000{% else %}{{ site.crs_outbound_anomaly_score_threshold | default(caddy_sites_defaults.crs_outbound_anomaly_score_threshold) }}{% endif %}"

 ## Application Specific Rule Exclusions
 # FIXME
@@ -88,7 +88,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_reporting_level={{ site.crs_reporting_level | default(caddy_sites_defaults.crs_reporting_level) }}"
+    setvar:tx.reporting_level={{ site.crs_reporting_level | default(caddy_sites_defaults.crs_reporting_level) }}"

 ## Early Anomaly Scoring Mode Blocking
 SecAction \
@@ -121,7 +121,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.crs_allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | join(" ") }}'"
+    setvar:'tx.allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | join(" ") }}'"

 ## Content-Types that a client is allowed to send in a request
 SecAction \
@@ -132,7 +132,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.crs_allowed_request_content_type={{ site.crs_allowed_request_content_type | default(caddy_sites_defaults.crs_allowed_request_content_type) | join(" ") }}'"
+    setvar:'tx.allowed_request_content_type={{ site.crs_allowed_request_content_type | default(caddy_sites_defaults.crs_allowed_request_content_type) | join(" ") }}'"

 ## Allowed HTTP versions
 SecAction \
@@ -143,7 +143,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.crs_allowed_http_versions={{ site.crs_allowed_http_versions | default(caddy_sites_defaults.crs_allowed_http_versions) | join(" ") }}'"
+    setvar:'tx.allowed_http_versions={{ site.crs_allowed_http_versions | default(caddy_sites_defaults.crs_allowed_http_versions) | join(" ") }}'"

 ## Forbidden file extensions
 SecAction \
@@ -154,7 +154,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.crs_restricted_extensions={{ site.crs_restricted_extensions | default(caddy_sites_defaults.crs_restricted_extensions) | join(" ") }}'"
+    setvar:'tx.restricted_extensions={{ site.crs_restricted_extensions | default(caddy_sites_defaults.crs_restricted_extensions) | join(" ") }}'"

 ## Restricted request headers
 SecAction \
@@ -165,7 +165,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.crs_restricted_headers_basic={{ site.crs_restricted_headers_basic | default(caddy_sites_defaults.crs_restricted_headers_basic) | join(" ") }}'"
+    setvar:'tx.restricted_headers_basic={{ site.crs_restricted_headers_basic | default(caddy_sites_defaults.crs_restricted_headers_basic) | join(" ") }}'"

 ## Extended restricted request headers (forbidden at a higher paranoia level)
 SecAction \
@@ -176,7 +176,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.crs_restricted_headers_extended={{ site.crs_restricted_headers_extended | default(caddy_sites_defaults.crs_restricted_headers_extended) | join(" ") }}'"
+    setvar:'tx.restricted_headers_extended={{ site.crs_restricted_headers_extended | default(caddy_sites_defaults.crs_restricted_headers_extended) | join(" ") }}'"

 ## Content-Types charsets that a client is allowed to send in a request
 SecAction \
@@ -187,7 +187,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.crs_allowed_request_content_type_charset={{ caddy_sites_defaults.crs_allowed_request_content_type_charset | default(caddy_sites_defaults.crs_allowed_request_content_type_charset) | join(" ") }}'"
+    setvar:'tx.allowed_request_content_type_charset={{ caddy_sites_defaults.crs_allowed_request_content_type_charset | default(caddy_sites_defaults.crs_allowed_request_content_type_charset) | join(" ") }}'"

 ## Block request if number of arguments is too high
 SecAction \
@@ -198,7 +198,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_max_num_args={{ site.crs_max_num_args | default(caddy_sites_defaults.crs_max_num_args) }}"
+    setvar:tx.max_num_args={{ site.crs_max_num_args | default(caddy_sites_defaults.crs_max_num_args) }}"

 ## Block request if the length of any argument name is too high
 SecAction \
@@ -209,7 +209,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_arg_name_length={{ site.crs_arg_name_length | default(caddy_sites_defaults.crs_arg_name_length) }}"
+    setvar:tx.name_length={{ site.crs_arg_name_length | default(caddy_sites_defaults.crs_arg_name_length) }}"

 ## Block request if the length of any argument value is too high
 SecAction \
@@ -220,7 +220,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_arg_length={{ site.crs_arg_length | default(caddy_sites_defaults.crs_arg_length) }}"
+    setvar:tx.arg_length={{ site.crs_arg_length | default(caddy_sites_defaults.crs_arg_length) }}"

 ## Block request if the total length of all combined arguments is too high
 SecAction \
@@ -231,7 +231,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_total_arg_length={{ site.crs_total_arg_length | default(caddy_sites_defaults.crs_total_arg_length) }}"
+    setvar:tx.total_arg_length={{ site.crs_total_arg_length | default(caddy_sites_defaults.crs_total_arg_length) }}"

 ## Block request if the file size of any individual uploaded file is too high
 SecAction \
@@ -242,7 +242,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_max_file_size={{ site.crs_max_file_size | default(caddy_sites_defaults.crs_max_file_size) }}"
+    setvar:tx.max_file_size={{ site.crs_max_file_size | default(caddy_sites_defaults.crs_max_file_size) }}"

 ## Block request if the total size of all combined uploaded files is too high
 SecAction \
@@ -253,7 +253,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_combined_file_sizes={{ site.crs_combined_file_sizes | default(caddy_sites_defaults.crs_combined_file_sizes) }}"
+    setvar:tx.combined_file_sizes={{ site.crs_combined_file_sizes | default(caddy_sites_defaults.crs_combined_file_sizes) }}"

 ## Easing In / Sampling Percentage
 SecAction \
@@ -263,7 +263,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:tx.crs_sampling_percentage={{ site.crs_sampling_percentage | default(caddy_sites_defaults.crs_sampling_percentage) }}"
+    setvar:tx.sampling_percentage={{ site.crs_sampling_percentage | default(caddy_sites_defaults.crs_sampling_percentage) }}"

 ## Check UTF-8 encoding
 SecAction \