From 26d452e8a35cc5347d5016a506b01d4defc81927 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Fri, 2 Oct 2026 18:23:14 -0300 Subject: [PATCH] Exempt pass,nolog control rules from detection-rule metadata The rules/*.conf path instruction and the rule-metadata check told CodeRabbit that every rule needs logdata, severity, paranoia-level, attack-type and capec metadata. Initialization (901), 905, 949, 959, 980, 999 and the PL skipAfter guards carry none of these by design, which produced false findings on 901 initialization rules. Also fix the ID range list: 900xxx is crs-setup.conf, 901xxx is initialization (not IP reputation). Co-Authored-By: Claude Opus 5.5 (1M context) --- .coderabbit.yaml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 81e5fb9..52255a1 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -299,7 +299,7 @@ reviews: would. Flag ⚠️ WARNING: — on the affected line for: Rule ID range — the ID must fall in the family's range and be unused: - 900000-900999 initialization, 901000-901999 IP reputation, + 900000-900999 crs-setup.conf, 901000-901999 initialization, 905000-905999 common exceptions, 910000-919999 protocol enforcement, 920000-929999 protocol attacks, 930000-939999 LFI/RFI/RCE/PHP, 941000-941999 XSS, 942000-942999 SQLi, 943000-943999 session fixation, @@ -307,10 +307,16 @@ reviews: 10 in its family. Plugin rules must use the plugin's own reserved range, never a core range. - Missing or wrong metadata — every rule needs `id`, `phase`, `msg`, + Missing or wrong metadata — every detection rule (one that scores + anomaly points, in 911-944 or 950-956) needs `id`, `phase`, `msg`, `logdata`, `tag:'OWASP_CRS'`, a `paranoia-level/N` tag, the relevant attack-type and `capec/NNN` tags, `ver:'OWASP_CRS/4.x.x'` matching the - current version, and a `severity`. A `tag:` value that is not in + current version, and a `severity`. Control rules are exempt: the + `pass,nolog` rules in 901 (initialization), 905, 949, 959, 980 and 999, + and the `TX:DETECTION_PARANOIA_LEVEL "@lt N"` skipAfter guards at the + top of each detection file, carry only `id`, `phase`, `pass,nolog`, + `tag:'OWASP_CRS'` and `ver`. Do not ask for msg, logdata, severity, + paranoia-level, attack-type or capec metadata on them. A `tag:` value that is not in `util/APPROVED_TAGS` fails the crs-linter CI job — say so explicitly and tell the author to add it there in sorted position first. @@ -865,8 +871,12 @@ reviews: `lts/v*` branch, where it must carry the LTS version rather than main's. - Missing paranoia-level tag, or a tag inconsistent with the - `TX:DETECTION_PARANOIA_LEVEL` guard and the file section around it. + Missing paranoia-level tag on a detection rule, or a tag + inconsistent with the `TX:DETECTION_PARANOIA_LEVEL` guard and the + file section around it. `pass,nolog` control rules (901 + initialization, 905, 949, 959, 980, 999, and the PL skipAfter + guards) carry no paranoia-level, severity, logdata or capec + metadata by design — never flag them for it. Missing `capec/` tag on a new detection rule, missing `logdata`, a `msg` that does not name the attack class, or a `severity` that does