Disable specific built-in firewall rules that are causing excessive blocking on an Azure Application Gateway.

azure-waf-rule-with-overrides.json

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "variables": {
        "publicSitePolicy": "my-wafpolicy-for-public-sites",
        "htmlOwaspRuleOverrides": [
            {
                "ruleGroupName": "REQUEST-932-APPLICATION-ATTACK-RCE",
                "rules": [
                    {
                        "ruleId": "932150",
                        "state": "Disabled"
                    }
                ]
            },
            {
                "ruleGroupName": "REQUEST-942-APPLICATION-ATTACK-SQLI",
                "rules": [
                    {
                        "ruleId": "942370",
                        "state": "Disabled"
                    },
                    {
                        "ruleId": "942210",
                        "state": "Disabled"
                    },
                    {
                        "ruleId": "942430",
                        "state": "Disabled"
                    },
                    {
                        "ruleId": "942440",
                        "state": "Disabled"
                    },
                    {
                        "ruleId": "942450",
                        "state": "Disabled"
                    }
                ]
            }
        ]
    },
    "resources": [
        {
            "apiVersion": "2019-09-01",
            "type": "Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies",
            "name": "[variables('publicSitePolicy')]",
            "location": "[resourceGroup().location]",
            "tags": {},
            "properties": {
                "customRules": [],
                "policySettings": {
                    "fileUploadLimitInMb": 20,
                    "maxRequestBodySizeInKb": 128,
                    "mode": "Prevention",
                    "requestBodyCheck": false,
                    "state": "Enabled"
                },
                "managedRules": {
                    "exclusions": [],
                    "managedRuleSets": [ 
                        {
                            "ruleSetType": "OWASP",
                            "ruleSetVersion": "3.1",
                            "ruleGroupOverrides": "[variables('htmlOwaspRuleOverrides')]"
                        } 
                    ]
                }
            }
        }
    ]
}