blog: crs migration part 5 by fzipi · Pull Request #505 · coreruleset/website

fzipi · 2026-04-22T13:56:58Z

Summary by CodeRabbit

Documentation
- Added Part 5 of the migration guide detailing rule-level changes from CRS 3.3 → CRS 4.25 LTS: new response-phase web-shell detections, HTTP/3 enabled by default and HTTP/0.9 effectively blocked, header restriction tiers, regex engine compatibility changes, and a three-step audit workflow to review and validate excluded rules before enabling blocking.

Covers new web shell detection rules, HTTP/3 support, HTTP/0.9 removal, restructured restricted headers (basic/extended), RE2/Hyperscan compatibility, and a 3-step methodology for auditing existing exclusions against the CRS 4 rule set. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Sets refLinksErrorLevel=WARNING so cross-post ref links don't break the build when sibling posts don't yet exist on the same branch. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The author is already shown from the front matter. Adds the related-pages shortcode to cross-link migration series posts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Web shell detection is in the 955xxx range (RESPONSE-955-WEB-SHELLS.conf), not 950xxx - Rewrite the HTTP/0.9 section: the protocol enforcement mechanism and the default allowed list are identical in CRS 3 and CRS 4, so no new rule blocks HTTP/0.9. The actual change is narrower — rule 921110 (response-splitting detection) dropped its HTTP/0.9 carve-out per PR #1966 - Complete the basic restricted headers list with proxy, lock-token, content-range, and if, matching the default tx.restricted_headers_basic

cloudflare-workers-and-pages · 2026-04-22T14:00:14Z

Deploying website with Cloudflare Pages

Latest commit:	`272ec15`
Status:	✅ Deploy successful!
Preview URL:	https://5fd2e179.website-1u6.pages.dev
Branch Preview URL:	https://blog-crs-migration-part-5.website-1u6.pages.dev

View logs

Copilot

Pull request overview

Adds the next entry in the CRS 3→4 migration blog series, along with its header image, and tweaks Hugo’s internal-ref error handling to accommodate missing references during publication staging.

Changes:

Add Part 5 post: “Rule Changes” (new content page + hero image).
Add Part 1 post: “Overview” (new content page).
Update Hugo config to downgrade missing ref/relref targets from errors to warnings.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`static/images/2026/04/pexels-egorkomarov-8824026.jpg`	Adds the hero image used by the new post.
`content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md`	New Part 5 article content and internal navigation refs.
`content/blog/2026-03-30-migrating-from-crs-3-to-crs-4-part-1-overview.md`	New Part 1 article content and internal navigation refs.
`config/_default/hugo.yaml`	Changes Hugo behavior for missing internal `ref` targets (ERROR → WARNING).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com>

Agent-Logs-Url: https://github.com/coreruleset/website/sessions/ae1b0ead-82ff-4306-8a5f-cc2dd65d4f94 Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

coderabbitai · 2026-04-26T15:57:30Z

📝 Walkthrough

Walkthrough

Documents rule-level changes when migrating from CRS 3.3 to CRS 4.25 LTS: new/removed/renumbered rules, response-phase web‑shell detections, default HTTP version adjustments, header restriction tiers, regex engine compatibility shifts, and an exclusion-auditing workflow.

Changes

Cohort / File(s)	Summary
CRS Migration Blog Post `content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md`	Adds a new migration article detailing rule-level differences between CRS 3.3 and 4.25 LTS: new response-phase web‑shell rule set (`RESPONSE-955-WEB-SHELLS.conf`), `HTTP/3`/`HTTP/3.0` added to allowed versions, tightened request-line validation blocking HTTP/0.9, header blocking split into basic vs extended tiers, shift from PCRE-only to RE2/Hyperscan-compatible regex patterns, and a three-step exclusion auditing process referencing `CHANGES.md`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 I hopped through lines of rules tonight,

Found web‑shell guards and headers tight,
HTTP versions set just right,
Regex tuned for faster flight,
Exclusions checked beneath moonlight 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'blog: crs migration part 5' directly and specifically describes the changeset, which adds the fifth article in a CRS migration series documenting rule-level changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch blog/crs-migration-part-5

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md (1)

31-31: Use version-pinned CHANGES.md links to prevent doc drift.

At Line 31, Line 61, and Line 110, linking to .../blob/main/CHANGES.md can silently change over time and make migration guidance inconsistent with the stated CRS baseline. Prefer linking to a release tag/commit-specific CHANGES.md.

Proposed doc-link hardening

-The authoritative source for all of these changes is the [CHANGES.md](https://github.com/coreruleset/coreruleset/blob/main/CHANGES.md) in the CRS 4.0 release.
+The authoritative source for all of these changes is the [CHANGES.md](https://github.com/coreruleset/coreruleset/blob/v4.0/CHANGES.md) in the CRS 4.0 release.

-See the "drop HTTP/0.9 support" change in [CHANGES.md](https://github.com/coreruleset/coreruleset/blob/main/CHANGES.md) (PR `#1966`).
+See the "drop HTTP/0.9 support" change in [CHANGES.md](https://github.com/coreruleset/coreruleset/blob/v4.0/CHANGES.md) (PR `#1966`).

-For each rule ID you found in Step 1, search for it in [CHANGES.md](https://github.com/coreruleset/coreruleset/blob/main/CHANGES.md).
+For each rule ID you found in Step 1, search for it in [CHANGES.md](https://github.com/coreruleset/coreruleset/blob/v4.0/CHANGES.md).

Also applies to: 61-61, 110-110

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md`
at line 31, Replace the unstable ".../blob/main/CHANGES.md" links found at the
referenced lines (31, 61, 110) with release-tagged or commit-specific URLs
(e.g., ".../blob/v4.0.0/CHANGES.md" or a commit SHA) so the CHANGES.md
referenced is pinned to the CRS 4.0 release; update each markdown link
occurrence of ".../blob/main/CHANGES.md" accordingly to a tag/commit-specific
path to prevent doc drift.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md`:
- Line 62: Fix the extra double-space typo in the user-facing sentence
describing CRS 4.25.1 and rule `920100`: locate the paragraph mentioning "CRS
4.25.1 (first quarterly LTS backport, scheduled) — request-line validation (rule
`920100`)" and change "requests  will trigger" to "requests will trigger"
(remove the extra space) so the sentence reads correctly.

---

Nitpick comments:
In
`@content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md`:
- Line 31: Replace the unstable ".../blob/main/CHANGES.md" links found at the
referenced lines (31, 61, 110) with release-tagged or commit-specific URLs
(e.g., ".../blob/v4.0.0/CHANGES.md" or a commit SHA) so the CHANGES.md
referenced is pinned to the CRS 4.0 release; update each markdown link
occurrence of ".../blob/main/CHANGES.md" accordingly to a tag/commit-specific
path to prevent doc drift.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 92d2cf07-8939-48a8-bb52-668366f978a5

📥 Commits

Reviewing files that changed from the base of the PR and between 7d41310 and bde003c.

⛔ Files ignored due to path filters (1)

static/images/2026/04/pexels-egorkomarov-8824026.jpg is excluded by !**/*.jpg

📒 Files selected for processing (1)

content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md

…ule-changes.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md`:
- Line 31: Update the CHANGES.md link so it points to a stable release tag or
LTS branch instead of main: replace the current
"[CHANGES.md](https://github.com/coreruleset/coreruleset/blob/main/CHANGES.md)"
URL with a versioned URL like
"https://github.com/coreruleset/coreruleset/blob/v4.25.0/CHANGES.md" or an LTS
branch URL like
"https://github.com/coreruleset/coreruleset/blob/lts/v4.25.x/CHANGES.md"; apply
the same change to the other occurrence mentioned (around line 110) so all
CHANGES.md references use a pinned tag or LTS branch.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 74cc7a98-0b94-4b10-8787-d5333930a948

📥 Commits

Reviewing files that changed from the base of the PR and between bde003c and 272ec15.

📒 Files selected for processing (1)

content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md

fzipi and others added 6 commits March 31, 2026 09:10

chore: demote broken ref links to warnings

78a4a15

Sets refLinksErrorLevel=WARNING so cross-post ref links don't break the build when sibling posts don't yet exist on the same branch. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: use proper figure shortcode caption and attr parameters

56a509e

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: replace author byline with related-pages shortcode

5759064

The author is already shown from the front matter. Adds the related-pages shortcode to cross-link migration series posts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: add What's Next section to part 1 linking to part 2

777bd4a

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fzipi requested review from Copilot and theseion April 22, 2026 13:56

Copilot started reviewing on behalf of fzipi April 22, 2026 13:57 View session

Merge branch 'main' into blog/crs-migration-part-5

9326b68

fzipi commented Apr 22, 2026

View reviewed changes

Comment thread content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md Outdated

Copilot AI reviewed Apr 22, 2026

View reviewed changes

Comment thread content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md

docs: update blogpost

436c4ac

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

theseion requested changes Apr 23, 2026

View reviewed changes

Apply suggestions from code review

b512934

Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com>

fzipi requested a review from theseion April 26, 2026 12:59

theseion requested changes Apr 26, 2026

View reviewed changes

Comment thread content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md Outdated

Copilot started work on behalf of fzipi April 26, 2026 15:56 View session

blog: add link to RFC 9110 in HTTP/0.9 section

bde003c

Agent-Logs-Url: https://github.com/coreruleset/website/sessions/ae1b0ead-82ff-4306-8a5f-cc2dd65d4f94 Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Copilot finished work on behalf of fzipi April 26, 2026 15:57

coderabbitai Bot reviewed Apr 26, 2026

View reviewed changes

Comment thread content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md Outdated

Update content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-r…

272ec15

…ule-changes.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

coderabbitai Bot reviewed Apr 26, 2026

View reviewed changes

Comment thread content/blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md

theseion approved these changes Apr 26, 2026

View reviewed changes

fzipi merged commit 1bbaae1 into main Apr 26, 2026
3 checks passed

fzipi deleted the blog/crs-migration-part-5 branch April 26, 2026 19:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

blog: crs migration part 5#505

blog: crs migration part 5#505
fzipi merged 11 commits intomainfrom
blog/crs-migration-part-5

fzipi commented Apr 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 26, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

fzipi commented Apr 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying website with Cloudflare Pages

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fzipi commented Apr 22, 2026 •

edited by coderabbitai Bot

Loading

cloudflare-workers-and-pages Bot commented Apr 22, 2026 •

edited

Loading

coderabbitai Bot commented Apr 26, 2026 •

edited

Loading