{"action":"opened","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/591","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/591/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/591/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/591/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/591","id":179051799,"number":591,"title":"Read only mode (paranoia level 5?)","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/Feature%20Request","name":"Feature Request","color":"efb480"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-24T21:04:50Z","updated_at":"2016-09-24T21:04:50Z","closed_at":null,"body":"I've always wanted to offer some kind of super-paranoid \"read only mode\". Maybe this could be a future paranoia level 5?\r\n\r\nIn this mode, the CRS would:\r\n\r\n- disallow http methods that submit data such as POST, PUT, DELETE, etc.\r\n- disallow ARGS and ARGS_NAMES, so you can't submit query parameters\r\n- disallow request bodies\r\n- disallow any unusual characters in the URI, allowing only a short list like `a-z A-Z 0-9 . - _ /`\r\n- disallow any special characters in cookie names and values\r\n\r\nYou could basically put this up for read-only sites. It could approach the security profile of a static site generator, but you will still be able to use any CMS you like.\r\n\r\nYou could whitelist your office IPs for the content managers, and if you still need to expose some dynamic APIs, you could specifically exclude those by doing `ctl:removeRuleByTag:paranoia-level/5` on their URIs.\r\n\r\nI feel that this mode should take precedence over app exclusions. Otherwise, the app exclusions would create large (and publicly known) holes in this security profile. So, maybe this mode should be seen as something categorically different from the paranoia level system. At the other hand, this mode does feel like a natural progression after PL4, and I probably would also want to enable all the PL4 level strictness for URIs when using this mode (e.g. SQLi in URIs). and adding this mode into the PL system will allow a single knob to set all strictness properties of the CRS, which would allow for the easiest automation / deployment / GUIs."}}
{"actor":{"display_login":"lifeforms"}}