From d1bdd7b4236172c9351745cd1921834014c01459 Mon Sep 17 00:00:00 2001 From: mhx Date: Sat, 30 May 2026 18:18:19 +0200 Subject: [PATCH] :bug: tests: appsec scenario uses OWASP CRS inband collection appsec-virtual-patching only ships CVE-specific rules, not generic SQLi. Switch to crowdsecurity/appsec-crs-inband (the blocking OWASP Core Rule Set) and use a SQLi probe that CRS paranoia level 1 matches (rule 942100/942130). --- tests/e2e/scenarios/appsec/acquis.yaml | 2 +- tests/e2e/scenarios/appsec/docker-compose.yml | 2 +- tests/e2e/scenarios/appsec/run.sh | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/e2e/scenarios/appsec/acquis.yaml b/tests/e2e/scenarios/appsec/acquis.yaml index cfc4d36..97d9bc5 100644 --- a/tests/e2e/scenarios/appsec/acquis.yaml +++ b/tests/e2e/scenarios/appsec/acquis.yaml @@ -1,5 +1,5 @@ listen_addr: 0.0.0.0:7422 -appsec_config: crowdsecurity/virtual-patching +appsec_config: crowdsecurity/crs-inband name: e2eAppSec source: appsec labels: diff --git a/tests/e2e/scenarios/appsec/docker-compose.yml b/tests/e2e/scenarios/appsec/docker-compose.yml index 5cc0667..b3d2a87 100644 --- a/tests/e2e/scenarios/appsec/docker-compose.yml +++ b/tests/e2e/scenarios/appsec/docker-compose.yml @@ -41,7 +41,7 @@ services: image: crowdsecurity/crowdsec:v1.7.8 container_name: crowdsec environment: - COLLECTIONS: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules" + COLLECTIONS: "crowdsecurity/appsec-crs-inband" BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5 CUSTOM_HOSTNAME: crowdsec CROWDSEC_BYPASS_DB_VOLUME_CHECK: "true" diff --git a/tests/e2e/scenarios/appsec/run.sh b/tests/e2e/scenarios/appsec/run.sh index ab0172e..c0c6b80 100755 --- a/tests/e2e/scenarios/appsec/run.sh +++ b/tests/e2e/scenarios/appsec/run.sh @@ -33,8 +33,8 @@ wait_for_status http://localhost:8000/foo 200 30 echo "[$SCENARIO] benign request must pass" assert_status http://localhost:8000/foo 200 -echo "[$SCENARIO] SQL-injection-like query string must be blocked by AppSec virtual patching" -# CRS-style SQLi probe — caught by crowdsecurity/appsec-generic-rules. -assert_status "http://localhost:8000/foo?id=1%27%20UNION%20SELECT%201%2C2%2C3--" 403 +echo "[$SCENARIO] SQL-injection-like query string must be blocked by OWASP CRS (inband)" +# Classic SQLi probe: ?id=1' OR '1'='1 — caught by CRS rule 942100/942130 (paranoia 1). +assert_status "http://localhost:8000/foo?id=1%27%20OR%20%271%27%3D%271" 403 echo "[$SCENARIO] OK"