Skip to content

WAF: Add DropRequest helper to block request in hooks#4016

Merged
blotus merged 11 commits intomasterfrom
drop-request-helper
Nov 26, 2025
Merged

WAF: Add DropRequest helper to block request in hooks#4016
blotus merged 11 commits intomasterfrom
drop-request-helper

Conversation

@blotus
Copy link
Member

@blotus blotus commented Oct 30, 2025

Allow to manually block requests from a pre_eval hook.

This allows for example to easily implement geoblocking by reusing existing crowdsec helpers:

 - filter: IsInBand == true && GeoIPEnrich(req.RemoteAddr)?.Country.IsoCode not in ["FR", "US"]
   apply:
     - SetReturnCode(400)
     - DropRequest("Forbidden Country")

@github-actions
Copy link

github-actions bot commented Oct 30, 2025

@blotus: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

  • /kind feature
  • /kind enhancement
  • /kind refactoring
  • /kind fix
  • /kind chore
  • /kind dependencies
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

@github-actions
Copy link

github-actions bot commented Oct 30, 2025

@blotus: There are no area labels on this PR. You can add as many areas as you see fit.

  • /area agent
  • /area local-api
  • /area cscli
  • /area appsec
  • /area security
  • /area configuration
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

@blotus
Copy link
Member Author

blotus commented Oct 30, 2025

/kind feature
/area appsec

@codecov
Copy link

codecov bot commented Oct 30, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 76.84887% with 72 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.89%. Comparing base (2398e7b) to head (9ce70b5).
⚠️ Report is 5 commits behind head on master.

Files with missing lines Patch % Lines
pkg/acquisition/modules/appsec/utils.go 78.45% 29 Missing and 10 partials ⚠️
pkg/acquisition/modules/appsec/appsec_runner.go 68.18% 12 Missing and 9 partials ⚠️
pkg/appsec/appsec.go 80.00% 7 Missing and 3 partials ⚠️
pkg/appsec/tx.go 60.00% 1 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #4016      +/-   ##
==========================================
+ Coverage   62.76%   62.89%   +0.13%     
==========================================
  Files         459      459              
  Lines       33067    33254     +187     
==========================================
+ Hits        20753    20914     +161     
- Misses      10195    10211      +16     
- Partials     2119     2129      +10
Flag Coverage Δ
bats 46.28% <41.47%> (-0.10%) ⬇️
unit-linux 35.74% <74.91%> (+0.27%) ⬆️
unit-windows 25.00% <58.19%> (+0.18%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@blotus blotus added this to the 1.7.4 milestone Nov 7, 2025
buixor
buixor reviewed Nov 21, 2025
View reviewed changes
@blotus blotus marked this pull request as ready for review November 26, 2025 12:43
@blotus blotus merged commit e886da9 into master Nov 26, 2025
16 checks passed
@blotus blotus deleted the drop-request-helper branch November 26, 2025 21:40
@FabseGP FabseGP mentioned this pull request Dec 13, 2025
Open
@blotus blotus mentioned this pull request Jan 27, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@buixor buixor buixor left review comments

@mmetc mmetc mmetc approved these changes

Assignees

No one assigned

Labels

area/appsec kind/feature

Projects

None yet

Milestone

1.7.4

Development

Successfully merging this pull request may close these issues.

3 participants

@blotus @buixor @mmetc