deps: bump zentinel-modsec to 0.2.0 - #5
Merged
Conversation
0.2.0 changes chain evaluation: a chain's actions now fire only when every link matches, and continuation rules inherit the starter's phase. That alters which requests are blocked, which is why the engine went to a minor version rather than a patch -- the upgrade should be deliberate. Adds tests/engine_behaviour.rs covering what operators actually depend on: complete chains block, partial chains do not, SQLi is detected, clean traffic passes, and anomaly scoring reaches its threshold. The agent's existing tests cover configuration and protocol, not blocking decisions, so an engine bump could previously change security behaviour with nothing here to catch it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes the CRS compatibility work and the chain-semantics fix released today in zentinel-modsec v0.2.0.
Why this needed a deliberate bump
The engine went to a minor version specifically so this would not happen automatically. This crate pinned
"0.1.4"— a caret requirement — so a 0.1.5 would have been picked up on the next build.zentinel-modsec#18 changes which requests get blocked, in both directions:
phase:1chains that could never complete now canFor a WAF agent that is a security-behaviour change, not a routine dependency bump.
What this gains
SecRuleUpdateTargetById— the standard CRS exclusion workflow, so false positives can be tuned away per-target instead of by disabling whole rulesMULTIPART_PART_HEADERSactually populated, so CRS's multipart rules evaluate rather than silently matching nothingVerification
Added
tests/engine_behaviour.rs, because the existing suite covers this crate's configuration and protocol surface but not blocking decisions — an engine bump could previously change security behaviour with nothing here to catch it. The new tests assert that complete chains block, partial chains do not, SQLi is detected, clean traffic passes, and anomaly scoring reaches its threshold.All green on 0.2.0: 17 tests, clippy clean,
cargo fmt --checkclean.Operators upgrading should re-test their ruleset against representative traffic, per the release notes.