fix: support for crs 3.3.x

Author: EsadCetiner

plugins/referer-hardening-before.conf

@@ -64,6 +64,7 @@ SecRule REQUEST_HEADERS:Referer "!@rx (?i)^(?:[a-z][a-z0-9+-.]*://|/|about:blank
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 # Fragment component check.
@@ -83,6 +84,7 @@ SecRule REQUEST_HEADERS:Referer "@contains #" \
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 # Userinfo component check.
@@ -102,6 +104,7 @@ SecRule REQUEST_HEADERS:Referer "@rx (?i)^[a-z][a-z0-9+-.]*://[^/]*@" \
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 # Parse URL components (only for non-empty, non-relative referers).
@@ -141,6 +144,7 @@ SecRule REQUEST_HEADERS:Referer "@rx (?i)^data:" \
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 SecRule TX:referer-hardening-plugin_domain_name "@gt 253" \
@@ -160,6 +164,7 @@ SecRule TX:referer-hardening-plugin_domain_name "@gt 253" \
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 SecRule TX:referer-hardening-plugin_domain_name "!@rx (?i)^[a-z0-9\-.]+$" \
@@ -179,6 +184,7 @@ SecRule TX:referer-hardening-plugin_domain_name "!@rx (?i)^[a-z0-9\-.]+$" \
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 SecRule TX:referer-hardening-plugin_port "!@rx ^$" \
@@ -200,6 +206,7 @@ SecRule TX:referer-hardening-plugin_port "!@rx ^$" \
     chain"
     SecRule TX:referer-hardening-plugin_port "!@rx ^[0-9]+$" \
         "setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+        setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
         setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 SecRule TX:referer-hardening-plugin_port "@gt 65535" \
@@ -219,6 +226,7 @@ SecRule TX:referer-hardening-plugin_port "@gt 65535" \
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
 SecMarker "END-REFERER-HARDENING-PLUGIN-PL1"
@@ -249,7 +257,8 @@ SecRule REQUEST_HEADERS:Referer "@rx ^$" \
     ver:'referer-hardening-plugin/1.0.0',\
     severity:'CRITICAL',\
     setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
-    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
+    setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"