Hey @gantony, thanks for reporting this!
At first glance, it seems very reasonable and would help avoid the misconception that some rules are up and running when they’re not due to an incorrect path. At the very least, we should verify that the path exists. That said, the idea of expecting at least one rule also looks interesting, and right now I do not see why it could be useful to include a directive with no rules. Let’s wait for others to weigh in :)

Thanks for the feedback.

At the very least, we should verify that the path exists.

We could dig a hole for ourselves here too 😅. Maybe the path is valid but we typed coreruleset-default/*.comf instead of coreruleset-default/*.conf. Hence the suggestion to report an error when we include a directive with no rules.

A bit like a compile error for an unused variable in go 😄.

What middleware and what version are you using?

I am using the latest github.com/corazawaf/coraza/v3.

I guess an example would help describe the issue. This program:

package main

import (
	"fmt"
	"testing/fstest"

	"github.com/corazawaf/coraza/v3"
)

func main() {
	m := fstest.MapFS{
		"crs/sample.conf":     &fstest.MapFile{Data: []byte("SecRuleEngine DetectionOnly\n")},
		"valid.conf":          &fstest.MapFile{Data: []byte("Include crs/sample.conf\n")},
		"valid-glob.conf":     &fstest.MapFile{Data: []byte("Include crs/*.conf\n")},
		"invalid-error.conf":  &fstest.MapFile{Data: []byte("Include crs/demo.conf\n")},
		"invalid-silent.conf": &fstest.MapFile{Data: []byte("Include rules/*.conf\n")},
	}

	setupCoraza := func(config string) {
		_, err := coraza.NewWAF(coraza.NewWAFConfig().
			WithRootFS(m).
			WithDirectives(config))
		if err != nil {
			fmt.Println(err)
		}
	}

	// This works
	setupCoraza(`Include valid.conf`)

	// This works (glob)
	setupCoraza(`Include valid-glob.conf`)

	// This doesn't work, but we get the expected error
	setupCoraza(`Include invalid-error.conf`)

	// This doesn't work (no file imported), but it does so silently
	// Would like to add an error when an Include with a glob has no effect (import no files)
	setupCoraza(`Include invalid-silent.conf`)
}

provides the following output:

invalid WAF config from string: failed to parse string: failed to readfile: open crs/demo.conf: file does not exist

and I would propose to update Coraza to provide the following output:

invalid WAF config from string: failed to parse string: failed to readfile: open crs/demo.conf: file does not exist
invalid WAF config from string: failed to parse string: empty glob: rules/*.conf does not match any file

Of course, I'm open to suggestion for the exact wording around empty glob: rules/*.conf does not match any file. And also making that check opt-in only, although I would prefer it to be the default.

Enhancements

Do you intend to add a new feature or change an existing one?

• Suggest your change in the Discussion and start writing code.
• Do not open an issue on GitHub until you have collected positive feedback about the change. GitHub issues are primarily intended for bug reports and fixes.

Sorry, looks like I should have opened a discussion instead of opening an issue 😓.

The fix (if desirable) is very small so will open a PR for consideration.

As I ran into a similar issue:

Example: Include /etc/coraza-spoa/crs/v4.7.0/@owasp_crs/*.conf

If the coraza service-user has no read-permissions for the directory containing the config-files (@owasp_crs in this case) there is no error that would indicate a problem. This makes troubleshooting unnecessarily complicated.

Versions: coraza v3.2.2, coraza-spoa main

PR is merged, so I believe this issue can be closed.