patterns/THIRD_PARTY_NOTICES.md

Third-Party Notices

patterns does not author its detection rules from scratch. It fetches, parses, and converts rule and blocklist data published by third-party projects into the native configuration syntax of Nginx, Apache, Traefik, and HAProxy.

The original code of this project — the Python converters (owasp2json.py, json2nginx.py, json2apache.py, json2traefik.py, json2haproxy.py, badbots.py, import_*.py), the documentation, and the tests — is licensed under the MIT License (Copyright (c) Fabrizio Salmi).

The generated data is a different matter. The following artifacts are not original works of this project; they are generated / derived artifacts built from the upstream sources listed below, and they are redistributed under the upstream licenses, not under this project's MIT license:

• owasp_rules.json — intermediate JSON extracted from the OWASP Core Rule Set.
• waf_patterns/** — the per-platform WAF configurations converted from that JSON and from the bad-bot / referrer-spam blocklists.

Each source below states what it provides, its SPDX license identifier, and the attribution it requires. Where a project's license text is required to accompany redistribution, a copy is included in the LICENSES/ directory.

---

OWASP Core Rule Set (CRS)

• Upstream: https://github.com/coreruleset/coreruleset
• Provides: the WAF detection rules (SQLi, XSS, RCE, LFI, RFI, generic anomaly and protocol-violation patterns). owasp2json.py downloads the CRS .conf rule files, extracts the SecRule patterns, and writes them to owasp_rules.json; the json2*.py converters then transform that JSON into waf_patterns/nginx/, waf_patterns/apache/, waf_patterns/traefik/, and waf_patterns/haproxy/.
• SPDX license: Apache-2.0
• License copy: LICENSES/Apache-2.0.txt (included to satisfy Apache-2.0 §4(a): recipients of the redistributed material must receive a copy of the License).
• Attribution and required notices:
  • Copyright © the OWASP® CRS project and its contributors.
  • Modification / "state changes" notice (Apache-2.0 §4(b)): the files owasp_rules.json and everything under waf_patterns/** are derived and converted works. The original CRS SecRule directives have been parsed, filtered, reformatted, and translated into Nginx map/if directives, Apache ModSecurity SecRule sets, Traefik middleware TOML, and HAProxy ACL files. These outputs are not the unmodified OWASP Core Rule Set and are not endorsed by the OWASP CRS project. Every generated file additionally carries a provenance header (or, for owasp_rules.json, a top-level _provenance key) recording the CRS reference it was built from and pointing back to this file.
  • "OWASP" is a registered trademark of the OWASP Foundation. This project is not affiliated with or endorsed by the OWASP Foundation.

---

Crawler-Detect (JayBizzle)

• Upstream: https://github.com/JayBizzle/Crawler-Detect

• Provides: part of the bad-bot User-Agent list consumed by badbots.py (raw/Crawlers.txt), used to generate the bots.* files under waf_patterns/**.

• SPDX license: MIT

• Required copyright notice:

  MIT License
  
  Copyright (c) 2015-2020 Mark Beech
  
  Permission is hereby granted, free of charge, to any person obtaining a copy
  of this software and associated documentation files (the "Software"), to deal
  in the Software without restriction ... (full MIT terms as published upstream).
  

---

nginx-ultimate-bad-bot-blocker (mitchellkrogza)

• Upstream: https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker

• Provides: part of the bad-bot User-Agent list consumed by badbots.py (_generator_lists/bad-user-agents.list), used to generate the bots.* files under waf_patterns/**.

• SPDX license: MIT

• Required copyright notice:

  MIT License
  
  Copyright (c) 2017 Mitchell Krog - mitchellkrog@gmail.com
  
  Permission is hereby granted, free of charge, to any person obtaining a copy
  of this software and associated documentation files (the "Software"), to deal
  in the Software without restriction ... (full MIT terms as published upstream).
  

---

referrer-spam-blacklist (Matomo / piwik)

• Upstream: https://github.com/matomo-org/referrer-spam-blacklist (fetched by badbots.py via the legacy piwik/referrer-spam-blacklist path, spammers.txt).
• Provides: the referrer-spam domain list used as an additional signal when generating the bots.* files under waf_patterns/**.
• SPDX license: none — the project is released into the Public Domain ("Public Domain (no copyright)", per the upstream README/LICENSE).
• Attribution: none legally required. Credit is given here voluntarily.

---

Summary

Upstream source	Provides	SPDX	License copy
coreruleset/coreruleset	owasp_rules.json, waf_patterns/** rules	Apache-2.0	LICENSES/Apache-2.0.txt
JayBizzle/Crawler-Detect	bad-bot User-Agent list	MIT	notice above
mitchellkrogza/nginx-ultimate-bad-bot-blocker	bad-bot User-Agent list	MIT	notice above
matomo-org/referrer-spam-blacklist	referrer-spam domain list	Public Domain	—

If you redistribute the generated artifacts (for example the release archives nginx_waf.zip, apache_waf.zip, traefik_waf.zip, haproxy_waf.zip, or the files under waf_patterns/**), you must keep this notice and the accompanying LICENSES/ directory with them.