# Profil ModSecurity OWASP pour Octave (BO/FO)
# Base: OWASP Core Rule Set (CRS) + règles locales ciblées.

SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off

# Journaliser seulement les transactions pertinentes.
SecAuditEngine RelevantOnly
SecAuditLogParts ABIJDEFHZ
SecAuditLog /var/log/nginx/modsec_audit.log

# Charger OWASP CRS (paths standards Debian/Ubuntu).
Include /etc/modsecurity/crs/crs-setup.conf
Include /usr/share/modsecurity-crs/rules/*.conf

# Méthodes HTTP dangereuses rarement utiles en production.
SecRule REQUEST_METHOD "@rx ^(?:TRACE|TRACK)$" \
    "id:110001,phase:1,deny,log,status:403,msg:'HTTP method not allowed'"

# Blocage XSS basique (libinjection).
SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS|REQUEST_URI "@detectXSS" \
    "id:110002,phase:2,deny,log,status:403,msg:'XSS pattern detected'"

# Blocage SQLi basique (libinjection).
SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS|REQUEST_URI "@detectSQLi" \
    "id:110003,phase:2,deny,log,status:403,msg:'SQLi pattern detected'"

# Tentatives simples de path traversal.
SecRule REQUEST_URI|ARGS "@rx (?:\.\./|%2e%2e%2f|%2e%2e/)" \
    "id:110004,phase:2,deny,log,status:403,msg:'Path traversal pattern detected',t:none,t:urlDecodeUni"
