📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

Hello,

I don’t understand why the conditional enabling of the XML/JSON processors isn’t in crs-setup.conf.example but instead here:
https://github.com/owasp-modsecurity/ModSecurity/blob/v3/master/modsecurity.conf-recommended

What you just reported is going to happen again.

In my opinion, we should add a comment above 900220 stating that it is forbidden to add items to this stack without simultaneously adding a corresponding declaration to one of the body processors.

I don’t understand why the conditional enabling of the XML/JSON processors isn’t in crs-setup.conf.example but instead here

For historical reasons and now we're stuck with modsecurity.conf-recommended. We've had issues with the interoperability before but we can't simply remove / change that file, since CRS is technically only one potential choice of rule set, so the defaults can't rely on the CRS configuration.

What you just reported is going to happen again.

Probably, but if I had done my job right, I would have read the existing comment and realised that I was making a mistake.

In my opinion, we should add a comment above 900220 stating that it is forbidden to add items to this stack without simultaneously adding a corresponding declaration to one of the body processors.

That comment exists in crs-setup.conf.example, where it belongs.

You’re right, there’s already a long explanation about this. https://github.com/coreruleset/coreruleset/blob/main/crs-setup.conf.example#L499C1-L506C64

# When additional JSON content types are legitimately used in a deployment,
# e.g. application/cloudevents+json, it is extremely important to ensure that a
# rule exists to enable the engine's JSON body processor for these additional
# JSON content types. Failure to do so can lead to a request body bypass. The
# default JSON rule in modsecurity.conf-recommended (200001) will only activate
# the JSON body processor for the specific content type application/json. The
# optional modsecurity.conf-recommended rule 200006 can be used to enable the
# JSON body processor for a wide variety of JSON content types.