From 501cfacfe63dae5a0707e6df3958e93fe47ccdc6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= <sebastien@itik.fr>
Date: Thu, 5 Feb 2026 17:31:42 +0300
Subject: [PATCH] caddy: CRS v4.22.0 -> v4.23.0

---
 seb4itik/byow/roles/caddy/defaults/main.yml        |  2 +-
 seb4itik/byow/roles/caddy/templates/crs-setup.conf | 10 ++++++++++
 seb4itik/byow/roles/caddy/vars/main.yml            |  7 +++++--
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/seb4itik/byow/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml
index 66bcef9..ded0cc4 100644
--- a/seb4itik/byow/roles/caddy/defaults/main.yml
+++ b/seb4itik/byow/roles/caddy/defaults/main.yml
@@ -32,7 +32,7 @@ caddy_go_version: "1.25.6"
 caddy_xcaddy_version: "0.4.5"
 caddy_coraza_caddy_version: "v2@v2.1.0"  # Coraza v3.3.3
 # Different sites can use different versions of OWASP CRS
-caddy_owasp_crs_versions: ["4.22.0"]
+caddy_owasp_crs_versions: ["4.23.0"]
 
 # Paths
 caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"
diff --git a/seb4itik/byow/roles/caddy/templates/crs-setup.conf b/seb4itik/byow/roles/caddy/templates/crs-setup.conf
index ede9f51..03c1dfa 100644
--- a/seb4itik/byow/roles/caddy/templates/crs-setup.conf
+++ b/seb4itik/byow/roles/caddy/templates/crs-setup.conf
@@ -123,6 +123,16 @@ SecAction \
     ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
     setvar:'tx.allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | listadddel(site.crs_allowed_methods_add | default([]), site.crs_allowed_methods_del | default([])) | join(" ") }}'"
 
+## HTTP Method Override Parameter
+SecAction \
+    "id:900210,\
+    phase:1,\
+    pass,\
+    nolog,\
+    tag:'OWASP_CRS',\
+    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
+    setvar:'tx.allow_method_override_parameter={{ site.allow_method_override_parameter | default(caddy_sites_defaults.allow_method_override_parameter) }}'"
+
 ## Content-Types that a client is allowed to send in a request
 SecAction \
     "id:900220,\
diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml
index 5887805..15d197f 100644
--- a/seb4itik/byow/roles/caddy/vars/main.yml
+++ b/seb4itik/byow/roles/caddy/vars/main.yml
@@ -307,6 +307,7 @@ caddy_global_sites_defaults:
   crs_max_file_size: 10485760        # 10 Mo
   crs_combined_file_sizes: 20970520  # 20 Mo
   crs_sampling_percentage: 100
+  crs_allow_method_override_parameter: 0
   crs_allowed_methods:
   # These variables can be used for adding and removing extensions from the list:
   # crs_allowed_methods_add: ["XXX"]
@@ -319,9 +320,7 @@ caddy_global_sites_defaults:
   # These variables can be used for adding and removing extensions from the list:
   # crs_allowed_request_content_type_add: ["|xxx/yyy|"]
   # crs_allowed_request_content_type_del: ["|zzz/aaa|"]
-    - "|application/csp-report|"
     - "|application/json|"
-    - "|application/reports+json|"
     - "|application/soap+xml|"
     - "|application/x-www-form-urlencoded|"
     - "|application/xml|"
@@ -374,6 +373,7 @@ caddy_global_sites_defaults:
     - ".inc/"
     - ".inf/"
     - ".ini/"
+    - ".jks/"
     - ".jse/"
     - ".key/"
     - ".licx/"
@@ -406,9 +406,12 @@ caddy_global_sites_defaults:
     - ".sql/"
     - ".sqlite/"
     - ".sqlite3/"
+    - ".swap/"
+    - ".swo/"
     - ".swp/"
     - ".sys/"
     - ".temp/"
+    - ".tfstate/"
     - ".tlb/"
     - ".tmp/"
     - ".vb/"