rules for prevent download of install or configuration file like composer.lock g

markham89 · February 1, 2017, 7:09pm

Hi,

i want make a rules to prevent download of installation or configuration files like composer.lock, .git files…

original owasp rules set has a file for that :

SpiderLabs/owasp-modsecurity-crs/blob/v3.0/master/rules/restricted-files.data

# Apache
# (no slash; also guards against old.htaccess, old.htpasswd, etc.)
.htaccess
.htdigest
.htpasswd
# Version control
/.git/
/.gitignore
/.hg/
/.hgignore
/.svn/
# Wordpress
wp-config.php
wp-config.bak
wp-config.old
wp-config.temp
wp-config.tmp
wp-config.txt
# Symfony
/config/config.yml

This file has been truncated. show original

How can i do that with cwaf ?

thx

akabakov · February 2, 2017, 11:04am

Please, use Userdata - Blocked Extensions in plug-in.
From command line this file is also accessable /path_to_cwaf/cwaf/rules/userdata_bl_extensions