caddy-waf/rules/data-validation.json

[
    {
        "id": "data-validation-int-overflow",
        "phase": 2,
        "pattern": "(?i)\\b(?:\\d{15,})\\b",
        "targets": ["ARGS", "BODY", "HEADERS"],
        "severity": "MEDIUM",
         "action": "log",
        "score": 4,
         "description":"Log large numbers (Potential Integer Overflow)."
    },
     {
       "id":"data-validation-invalid-email",
        "phase": 2,
       "pattern":"(?i)(?:[^@\\s]+@[^@\\s]+\\.[^@\\s]+){0,}",
        "targets":["ARGS", "BODY", "HEADERS"],
        "severity":"LOW",
        "action":"log",
        "score": 2,
        "description":"Log data that does not look like valid email address."
    },
    {
        "id":"data-validation-invalid-phone",
        "phase":2,
        "pattern":"(?i)(?:[^\\d\\+\\(\\)\\-\\s]){1,}",
        "targets": ["ARGS", "BODY", "HEADERS"],
        "severity":"LOW",
        "action":"log",
         "score": 2,
       "description":"Log data that contains invalid chars in phone numbers"
    },
   {
     "id":"data-validation-invalid-date",
     "phase": 2,
      "pattern":"(?i)(?:\\d{1,2}[\\/\\-]\\d{1,2}[\\/\\-]\\d{2,4}){0,}",
     "targets":["ARGS","BODY", "HEADERS"],
       "severity":"LOW",
       "action":"log",
      "score": 2,
      "description":"Log data that does not look like valid date"

  },
  {
        "id":"data-validation-long-string",
        "phase": 2,
        "pattern":"^.{5000,}$",
         "targets":["ARGS","BODY"],
         "severity":"LOW",
         "action":"log",
         "score": 2,
         "description":"Log very long strings (can indicate data injection)"
   }
]