Writing application specfic rules for WAF?

Question

I was reading an article on "Protocol-Level Evasion of Web Application Firewalls" and the article insist on writing application specific rules in this manner:

<Location /index.php>
SecDefaultAction phase:2,t:none,log,deny
# Validate parameter names
SecRule ARGS_NAMES "!^(articleid)$" \
"msg:'Unknown parameter: %{MATCHED_VAR_NAME}'"
# Expecting articleid only once
SecRule &ARGS:articleid "!@eq 1" \
"msg:'Parameter articleid seen more than once'"
# Validate parameter articleid
SecRule ARGS:articleid "!^[0-9]{1,10}$" \
"msg:'Invalid parameter articleid'"
</Location>

The idea is to enumerate all the parameters against the web resource and filter them as shown in the rules above. My question is what other sort of application specific tuning is further required for WAF rules.

Answer 1

I'm not sure that you understood the article. The article insists on writing rules according to the following rubric:

1. Enumerate all parameters.
2. For each parameter, determine how many times it can appear in the request.
3. For each parameter, confirm that the value conforms to the desired format.
4. Reject requests that contain unknown parameters.
5. Reject requests that use invalid encoding.

These are the very basic guidelines for writing any WAF rulesets i.e. filter out what does not fit the quantity, content, or encoding of the expected data.

The details of what that should look like for any specific application is entirely up to the application itself. Look at the code or ask the developer of the application what the expected and valid parameters are.

Once you have done that, you need to update the rules if the application is updated, and you need to constantly monitor and tune the WAF according to what is sent to the application.