feat: enable crs_validate_utf8_encoding by default#4647
Merged
fzipi merged 2 commits intoJun 2, 2026
Conversation
UTF-8 encoding validation (rule 920250) was opt-in. Per the monthly chat decision in coreruleset#4646, enable it by default on main to gather user feedback, with possible backport to LTS later. - rule 901169: default tx.crs_validate_utf8_encoding to 1 instead of 0 - crs-setup.conf.example: document the check as enabled by default; the SecAction (900950) now disables it for sites using non-UTF-8 parameters - tests: drop VALIDATE_UTF8_ENCODING override so the regression suite exercises the new default Refs: coreruleset#4646
Contributor
|
📊 Quantitative test results for language: |
EsadCetiner
requested changes
Jun 2, 2026
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
EsadCetiner
approved these changes
Jun 2, 2026
Contributor
|
i agree with fzipi that needs be backported, why a request needs to be no UTF8 encoding, there a no legitimate reason to be |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
enables UTF-8 encoding validation (rule 920250) by default on
main.rules/REQUEST-901-INITIALIZATION.conf(901169): defaulttx.crs_validate_utf8_encodingto1instead of0crs-setup.conf.example: documents the check as enabled by default; theSecAction(900950) now serves as the opt-out (sets the variable to0) for sites that send request parameters in a non-UTF-8 encoding. wording also clarifies that only UTF-8 is validated (UTF-16 and other encodings are not checked by@validateUtf8Encoding)tests/docker-compose.yml: removes theVALIDATE_UTF8_ENCODING: 1override so the regression suite exercises the new default rather than forcing it ontests/.../920250.yaml: updates the now-outdated commentwhy
per the decision recorded in the monthly chat (#4646): we don't have data either way on the false-positive impact, so we enable it by default on
main, gather feedback from users, and decide on an LTS backport later.@validateUtf8Encodingruns againstREQUEST_FILENAME|ARGS|ARGS_NAMES. per the WHATWG URL standard and RFC 3986 convention, URLs and query strings are UTF-8 (non-ASCII is percent-encoded as UTF-8 bytes), so raw non-UTF-8 parameters are non-standard and the false-positive surface for legitimate traffic is small. sites that genuinely use a non-UTF-8 parameter encoding can opt out via 900950.verification: full regression suite run with the new default. all
920250tests pass driven solely by the default (env override removed). the only two failing tests (920360-1,920380-1) fail identically on the unmodified baseline and are unrelated to this change (they depend on arg-length/arg-count limits not applied by the test entrypoint).refs
ai disclosure
crs-setup.conf.examplecomment rewording, PR description drafting920250passes on the new default with theVALIDATE_UTF8_ENCODINGoverride removed; established a baseline by stashing the change and confirming the two unrelated failures (920360-1,920380-1) pre-exist; verified the operator only validates UTF-8 and confirmed the@validateUtf8Encodingtarget variables against the RFC 3986 / WHATWG URL conventions; checked there are no other references to the setting in docs/INSTALL/README