corazawaf / coraza.io Goto Github PK

Summary

Currently seclang docs are manually maintained, which is a burden in maintenance and also gets outdated easily. We should generate this data from the code (like others do from protos) which would require to write a transpiler but will save a lot of work and will solve the outdated problem e.g. SecRequestBodyLimitAction isn't documented.

Unlike ModSecurity, REQUEST_XML is an alias for XML, as we also support RESPONSE_XML. That’s because of response body processing. Coraza only supports two XPATH expressions, //@* and /* which are hardcoded. That’s because of the lack of libxml2 support.

https://coraza.io/docs/seclang/variables/#xml

Currently the documentation upgrade process is:

go get -u github.com/corazawaf/coraza/v3@<coraza-commit-or-tag>
go mod tidy
go run mage.go generate
git add -u
git commit -m <message>

and create a PR.

We should have a github action to do that so we can trigger it on demand using this

Description

Describe the issue that you're seeing.

https://coraza.io/docs/seclang/execution-flow/#phases

image description is incorrect

Steps to reproduce

Clear steps describing how to reproduce the issue. Please please please link to a demo project if possible, this makes your issue much easier to diagnose (seriously).

Expected result

Add Response Headers

Actual result

Add Request Headers

Environment

https://coraza.io/docs/seclang/execution-flow/#phases

It is referenced in https://coraza.io/docs/seclang/directives/#secresponsebodyaccess but not documented.

Remember documentation should be added in https://github.com/corazawaf/coraza/blob/main/internal/seclang/directives.go and regenerated here.

Description

Homepage's link to OWASP CRS is broken.

Steps to reproduce

Go to the homepage and hover the link.

Expected result

It should say https://coraza.io/docs/tutorials/coreruleset/

Actual result

It says https://coraza.io/#

Description

actions.md should be generated in the same way we do in directives.md. For that we need a generation tool that creates the actions.md based on the godoc from functions, for example https://github.com/corazawaf/coraza/blob/main/internal/actions/allow.go#L39.

Summary

Coraza will use the first disruptive action based on syntactic order only.

This needs to be documented properly.

Basic example

Include a basic example or links here.

Motivation

Why are we doing this? What use cases does it support? What is the expected outcome?