I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any CRS rule work unproperly? really appreciated for the answer .
CRS co-lead here. First, I would recommend to use the newest release of CRS 3.2.2: https://coreruleset.org/installation/ Usually you can just delete your old coreruleset files (maybe keeping your crs-setup.conf) and unzip the new ones over your old copy.
You can definitely limit the file size that's inspected. This will protect against DoS by sending huge requests. In mod_security2.conf, you have the variables:
SecRequestBodyLimit 104857603 SecRequestBodyNoFilesLimit 104857603 SecRequestBodyLimitAction Reject
The first ones limit the requests to a little more than 100MB (Internet Explorer uses a few more bytes). This should be enough for most applications, but if your app requires bigger requests you can increase this value.
The last line will tell the firewall what to do with larger requests: do you want to block all larger requests? If you use
Reject, it will keep your security high, but large requests will be rejected. This may not be acceptable for you. If you use
ProcessPartial, only the first 100MB will be scanned so you still have some protection but not completely.