dune73

Overview of Team Approaches for E-Collecting Hackathon Oct 31 / Nov 1, 2025

• Updated: 2025-10-28 00:14:17
• URL to this file: https://gist.github.com/dune73/08cb549ea4c69e18a2d3dc32f1ab80c3
• Link to E-Collecting Hackathon Root on GitHub: https://github.com/swiss/e-collecting-hackathon
• Link to E-Collecting website at Federal Chancellery: German / French

1) Voll-medienbruchfreies E-Collecting: direkte Demokratie im digitalen Zeitalter

• Teamleads: Marco Loppacher/GitHub Account = LoppiNW1 (Team leader)

dune73

This overview has moved to https://gist.github.com/dune73/08cb549ea4c69e18a2d3dc32f1ab80c3#file-e-collecting-hackathon-overview-md

dune73

#!/bin/bash
#
# Wrapper script to run ftw in quantitative testing mode across many languages.
# First it executes ftw and saves the results in JSON format.
# Then it loops over the locally saved results.
#

# strict bash behavior: seehttp://redsymbol.net/articles/unofficial-bash-strict-mode/
#set -euo pipefail
IFS=$'\n\t'

dune73

# Towards a new OWASP CRS Release Policy

With the release of CRS 4.0.0 (2024-02-14), we have also started a line of
monthly releases. CRS 4.1.0 came out on March 21, so we're getting
into the habit. But there is a lot more to this than only a monthly
release and we have not explored these topics yet. This was also
highlighted in a public issue
(FIXME: Link https://github.com/coreruleset/coreruleset/issues/3624)
and a conversation in our Slack recently (OWASP Slack, channel #coreruleset).

dune73

ServerName        localhost
ServerAdmin       root@localhost
ServerRoot        /apache
User              www-data
Group             www-data
PidFile           logs/httpd.pid

ServerTokens      Prod
UseCanonicalName  On
TraceEnable       Off

dune73

#! /usr/bin/env python

import subprocess
import json
import datetime
import sys
import os

def get_issue(repository: str, number: int) -> dict:
	command = f"""gh issue view \

dune73

BEFORE CRS INCLUDE:

# Defense against CVE-2021-44228 
# See https://coreruleset.org/20211213/crs-and-log4j-log4shell-cve-2021-44228/

SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/|XML://@ "@rx (?:\${[^}]{0,4}\${|\${(?:jndi|ctx))" \
    "id:1005,\
    phase:2,\
    block,\
    t:none,t:urlDecodeUni,t:cmdline,\

dune73

diff --git a/src/operators/rx.cc b/src/operators/rx.cc
index 43f6444b..b4fc6ff4 100644
--- a/src/operators/rx.cc
+++ b/src/operators/rx.cc
@@ -1,6 +1,6 @@
 /*
  * ModSecurity, http://www.modsecurity.org/
- * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ * Copyright (c) 2015 - 2020 Trustwave Holdings, Inc. (http://www.trustwave.com/)
  *

dune73

xxx

dune73

Purpose
-------

This is a CRS side project with non-blocking rules in beta quality. The idea
is to allow people to use these rules in production and to provide
feedback so we can adjust them or include them at the right paranoia
level in the real releases.

Rules in Kindergarden are meant to do no harm, but they are still beta.