Skip to content

feat: add Metadata analysis to rules and lazy parse #1363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: main
Choose a base branch
from

Conversation

soujanyanmbri
Copy link
Contributor

@soujanyanmbri soujanyanmbri commented May 23, 2025

Thank you for contributing to Coraza WAF, your effort is greatly appreciated
Before submitting check if what you want to add to coraza list meets quality standards before sending pull request. Thanks!

Make sure that you've checked the boxes below before you submit PR:

I’ve opened this PR after completing the implementation and cleaning up the code, following discussions with @piyushroshan and @jptosso

Summary:
Predictive variable matching is designed to filter data types in rules, which allows us only to run the rule if the content is relevant. This improves performance

There are negative and positive filters
List of filters:

  1. alphanumeric
  2. uri
  3. domain
  4. numeric
  5. boolean
  6. unicode

Steps to build this:

  • Extend collection fields to support metadata
  • Add tag support at bootstrap to this metadata and validate it
  • Match this at transaction level
  • Support transformations and multimatch

Thanks for your contribution ❤️

Copy link

codecov bot commented May 23, 2025

Codecov Report

Attention: Patch coverage is 90.30303% with 16 lines in your changes missing coverage. Please review.

Project coverage is 84.54%. Comparing base (04c2209) to head (0db8ca0).

Files with missing lines Patch % Lines
internal/actions/tag.go 40.00% 4 Missing and 2 partials ⚠️
experimental/types/value_metadata.go 96.47% 2 Missing and 1 partial ⚠️
internal/corazawaf/rule.go 88.00% 2 Missing and 1 partial ⚠️
internal/corazawaf/transaction.go 70.00% 3 Missing ⚠️
internal/corazarules/rule_match.go 92.30% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1363      +/-   ##
==========================================
+ Coverage   84.37%   84.54%   +0.16%     
==========================================
  Files         170      165       -5     
  Lines        9933    10035     +102     
==========================================
+ Hits         8381     8484     +103     
+ Misses       1308     1305       -3     
- Partials      244      246       +2     
Flag Coverage Δ
coraza.rule.case_sensitive_args_keys 84.44% <90.30%> (+0.10%) ⬆️
coraza.rule.multiphase_evaluation 83.95% <90.30%> (-0.08%) ⬇️
coraza.rule.no_regex_multiline 84.44% <90.30%> (+0.12%) ⬆️
default 84.54% <90.30%> (+0.16%) ⬆️
examples+ 16.15% <9.09%> (?)
examples+coraza.rule.case_sensitive_args_keys 81.85% <76.96%> (-2.49%) ⬇️
examples+coraza.rule.multiphase_evaluation ?
examples+coraza.rule.no_regex_multiline ?
examples+memoize_builders ?
ftw 82.04% <76.96%> (-2.34%) ⬇️
memoize_builders 84.54% <90.30%> (+0.06%) ⬆️
no_fs_access 81.85% <76.96%> (-2.03%) ⬇️
tinygo 16.15% <9.09%> (-68.20%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@soujanyanmbri soujanyanmbri marked this pull request as ready for review May 23, 2025 13:52
@soujanyanmbri soujanyanmbri requested a review from a team as a code owner May 23, 2025 13:52
@fzipi fzipi changed the title Add Metadata analysis to rules and lazy parse. feat: add Metadata analysis to rules and lazy parse Jun 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants