Crate waf_crs_curated 

Curated OWASP CRS / ModSecurity rule content for Light WAF.

The core ships the SecRule parser and engine (waf_detection::crs); this crate ships only content: high-confidence CVE, application and evasion signatures that add to the core’s native detection modules and contribute to the same cumulative anomaly score. It never re-implements the baseline (SQLi/XSS/traversal/RCE/LFI-RFI stay in the core).

• The .conf files are embedded at compile time. Build a module from curated_source with waf_detection::crs::CrsModule::from_source and inject it with Proxy::builder(&cfg).add_module(..) (or a module_factory).
• Only constructs supported by the core engine are used. A test loads the content through that engine and asserts that exactly EXPECTED_LOADED rules load with zero skipped, so a rule the engine could not run fails the build instead of silently shrinking coverage.
• Rule ids live in the reserved 9000000+ range.

Constants

EXPECTED_LOADED

How many rules the curated content is expected to load under the OPEN CRS engine’s supported subset. The compat gate asserts the engine’s loaded_count() equals this exactly: any edit that introduces an unsupported construct (which is skipped, not loaded) then fails the test rather than silently reducing coverage — the lesson of the B2 setvar-scoring bug.

Functions

curated_source

The full curated ruleset as one seclang source: the embedded .conf files concatenated in include order, ready for waf_detection::crs::CrsModule::from_source.