$ show owasp-modsecurity/ModSecurity
ModSecurity v3 (libmodsecurity) is a C++17 Web Application Firewall (WAF) rule engine that parses SecLang configuration and rules, then evaluates them against HTTP transaction data. It is a library rather than a standalone server: connectors such as nginx or IIS feed requests through Transaction phase methods (processConnection, processURI, processRequestHeaders, processRequestBody, processResponseHeaders, processResponseBody, processLogging). The engine resolves ModSecurity variables (ARGS, REQUEST_HEADERS, FILES, TX, etc.), applies transformation pipelines (base64Decode, urlDecode, normalisePath, removeComments, htmlEntityDecode), evaluates operators (rx, pm, ipMatch, detectSQLi/detectXSS via libinjection, verifyCC, geoLookup), and executes actions (deny, allow, redirect, setvar, ctl:*). It supports multipart/JSON/XML/urlencoded request body parsing, audit logging through serial/parallel/HTTPS writers, and persistent collections on LMDB or in-memory backends. The code is organized around plugin-style base classes and factory instantiation for actions, operators, transformations, and variables, with a Bison/Flex generated parser for the SecLang grammar. Although the repository contains a rich JSON-based regression-test corpus, its character is overwhelmingly an application/library, not a data-research project. Architecture is modular but carries legacy baggage: autotools build system, extensive #ifdef feature gates (CURL, LMDB, Lua, libxml2, GeoIP/MaxMind, ssdeep, PCRE/PCRE2), manual memory management, and some stubbed operators. Duplicated CI workflows and long-standing TODOs indicate medium technical drift, but the project remains actively maintained and is a solid, widely deployed security library with several genuinely reusable low-level components.
The LLM identified 4 files worth highlighting for reuse:
Self-contained radix tree implementation for fast IPv4/IPv6 CIDR matching. It powers IP-match operators and can be lifted into any project needing efficient IP prefix lookups without ModSecurity dependencies.
Base class and factory for a chainable string-transformation pipeline. Each transformation such as urlDecode, htmlEntityDecode, or removeComments is a small class implementing evaluate(string); the pattern makes it easy to add new transformations without altering the rule engine.
Cross-version PCRE/PCRE2 wrapper exposing a clean Regex interface for matching and captures. It isolates the regex ecosystem from the rest of the WAF engine and can be reused in any C++ project requiring PCRE2 with legacy fallback.
Pluggable persistent collection backend using LMDB for stateful WAF collections such as IP, session, and global data, with expiration and thread-safe access. It demonstrates a clean storage-backend abstraction adaptable to other key-value persistence needs.