PHP code example of flowd / phirewall-preset-owasp-crs

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

flowd / phirewall-preset-owasp-crs example snippets

use Flowd\Phirewall\Config;
use Flowd\PhirewallPresetOwaspCrs\ParanoiaLevel;
use Flowd\PhirewallPresetOwaspCrs\Presets;

$config = $config->with(
    Presets::blocklist(ParanoiaLevel::Level1),
);

$config = $config->with(
    Presets::fail2ban(ParanoiaLevel::Level1, threshold: 5, period: 600, ban: 3600),
);

$config = $config->with(Presets::blocklist(
    ParanoiaLevel::Level1,
    anomalyThreshold: 5,
    configure: static function (CoreRuleSetMatcher $matcher): void {
        $matcher->excludeTarget('ARGS:/^utm_/');
    },
    logger: $logger,
));

use Flowd\Phirewall\Config\Rule\BlocklistRule;
use Flowd\PhirewallPresetOwaspCrs\Engine\CoreRuleSetMatcher;

$coreRuleSet = Presets::coreRuleSet(ParanoiaLevel::Level2);
$coreRuleSet->disable(942430);
$config->blocklists->addRule(new BlocklistRule('my-crs-rule', new CoreRuleSetMatcher($coreRuleSet)));

$coreRuleSet = Presets::coreRuleSet(ParanoiaLevel::Level1)
    ->excludeTarget('ARGS:/^utm_/')            // all rules ignore utm_* values
    ->excludeTarget('ARGS_NAMES:/^utm_/')      // ... and the utm_* parameter names
    ->excludeTargetById(942431, 'ARGS:fbclid') // one rule ignores one parameter
    ->excludeTargetByTag('attack-sqli', 'ARGS:comment');

$coreRuleSet->excludeTargetByTag(
    'attack-sqli',
    'ARGS:token',
    when: static fn (string $variable, ?string $name, string $value): bool
        => $jwtValidator->isValid($value),
);

$matcher->applyRuleExclusions(<<<'CONF'
    # Configure-time directives: apply once, to the rules already loaded
    SecRuleRemoveById 942440 "942430-942432"
    SecRuleRemoveByTag "attack-generic"
    SecRuleUpdateTargetById 942100 "!ARGS:search"
    SecRuleUpdateTargetByTag attack-sqli "!ARGS:/^utm_/"

    # Runtime exclusion rule: evaluated before the scoring rules on every
    # request; its ctl: exclusions apply only to requests it matches.
    SecRule REQUEST_URI "@beginsWith /api/webhooks/" \
        "id:10001,phase:1,pass,nolog,\
        ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:payload"
    CONF);

use Flowd\PhirewallPresetOwaspCrs\Engine\Variable\RequestValueManipulatorInterface;

$coreRuleSet->addManipulator(
    static fn (string $variable, ?string $name, string $value): string
        => $name === 'fbclid' ? '' : $value,
);
$coreRuleSet->addManipulatorById(942431, $manipulator); // scoped to one rule

use Flowd\Phirewall\Config\Rule\BlocklistRule;
use Flowd\PhirewallPresetOwaspCrs\Engine\CoreRuleSetMatcher;
use Flowd\PhirewallPresetOwaspCrs\Engine\SecRuleLoader;

$coreRuleSet = SecRuleLoader::fromString(
    'SecRule ARGS "@rx (?i)\bunion\b.*\bselect\b" "id:942100,phase:2,deny,msg:\'SQLi\'"',
);
// or: SecRuleLoader::fromDirectory('/path/to/rules')

$config->blocklists->addRule(new BlocklistRule('owasp', new CoreRuleSetMatcher($coreRuleSet)));

use Flowd\Phirewall\Support\CompiledDataCache;

$config->setCompiledDataCache(new CompiledDataCache('/path/to/var/cache/phirewall'));
$config = $config->with(Presets::blocklist(ParanoiaLevel::Level1));

$matcher = CoreRuleSetMatcher::fromRuleFiles(ParanoiaLevel::Level1);
$matcher->disable(941110);

$config->blocklists->addRule(new BlocklistRule('owasp', $matcher));

bash
php tools/generate-rule-payloads.php