Agenda for Monthly Chat: March 2019 (2019-03-04)

[dune73]

This is the Agenda for the Monthly CRS Chat.

The chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, March 4, at 20:30 CET.

Items on the Agenda:

PRs

• adding rule for Drupal CVE-2019-6340 #1315 Adding rule for Drupal CVE-2019-6340
• Add NGINX Docker and Travis Testing support. #1113 Add NGINX Docker and Travis Testing support
• Update contributing v3.2 #1284 Update contributing v3.2
• XML Soap Encoding 920240 #1286 XML Soap Encoding 920240
• Update travis to support secrules parsing #1301 Update travis to support secrules parsing
• Also inspect the path for the script tag #1306 Also inspect the path for the script tag
• Rule to check if both C-L and T-E are present #1310 Rule to check if both C-L and T-E are present

Other items

• The list of issues is growing and growing ...
• Progress of the CRS testsuite vs. ModSec 3 on NGINX and Apache
• Status CRS community summit in Tel Aviv, end of May during AppSecGlobal Tel Aviv.
• Time to think about CRS 3.2
• Felipe Zipitria is about to add our logo to the OWASP Swag project: https://github.com/fzipi/owasp-swag/tree/add-coreruleset-logos/projects/coreruleset
• Did @theMiddleBlue get commit rights from TW by now? (@csanders-git)
• Status of the update of the CRS docker container(s) (@csanders-git / @franbuehler / @danehrlich1)
• Status of the geoip blogbpost (@emphazer)
• Include Joomla support?

Feel free to add items as you see fit either above, or below as comments.

If you are not yet on the OWASP Slack, here is your invite: https://join.slack.com/t/owasp/shared_invite/enQtNDI5MzgxMDQ2MTAwLTEyNzIzYWQ2NDZiMGIwNmJhYzYxZDJiNTM0ZmZiZmJlY2EwZmMwYjAyNmJjNzQxNzMyMWY4OTk3ZTQ0MzFhMDY

[theMiddleBlue]

suggested item: a rule (or some rules) to handle XXE?

[dune73]

Do you want to open an issue / feature request for that?

[theMiddleBlue]

Do you want to open an issue / feature request for that?

yes, I've a working PoC, I'll open it with a draft rule

[dune73]

Cool. Very welcome.