owasp-modsecurity / owasp-modsecurity/ModSecurity

Remove possiblity to disable early-blocking processing

Open
#3,362 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

The compile-time option --disable-request-early in ModSecurity 2.x can lead to incorrect request processing with Core Rule Set (CRS) 4.0 and higher (as highlighted here).

Given that CRS 4.0+ relies on functionalities tied to early request processing, disabling it at build time effectively renders these newer CRS versions incompatible and can leave systems non-functional or even vulnerable. To ensure proper functionality and security when using modern CRS versions, I strongly recommend removing the --disable-request-early compile option from ModSecurity 2.x.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the build configuration and option handling for --disable-request-early; the issue names no specific files or tests. Check how the option affects early request processing and confirm that supported builds no longer expose a way to disable it. Validate with the existing build or test suite and CRS 4.0+ compatibility where available.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
build-system, security
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.