I have just released an updated version of ModSecurity for Java. This version implements the core functionality (request and response interception), and it contains a complete implementation of the portable web application firewall rule format. As I was uploading the archive I realized that, although I've been (slowly) working on it for more than a year now, this project had no home page. And so I made WAS Protect (follow the link for the latest specification) the fifth project hosted on www.modsecurity.org.
I expect I will need two more versions before a production-ready release. ModSecurity for Java is important for two reasons. First, the functionality it implements is effectively that of ModSecurity 2.0 format. Therefore the Java version will be slightly more advanced than the Apache version. Single-process multi-threaded operation of Java web servers will allow me to experiment with new features, especially the stateful operation. This is something I wanted to do for a long time. After I get these features right they will be ported to the Apache version.
The second reason ModSecurity for Java is important is the fact it implements the portable web application firewall rule format. I do believe that a portable format has a potential to move web application firewalls to a new level of usefulness. But the hard part will be convincing the vendors to implement the format. Technically, it's not a problem. The format is in XML and it's very simple. It's not clear what will happen to this work though. As I already mentioned, it's part of a larger undertaking done under the label of OASIS Web Application Security Technical Committee. After a year of no or very little activity, the committee is starting to show signs of activity again. This is mostly due to the entusiasm of Peter Michalek, the new Chair. Still, I am not convinced we have enough man power to handle the work load efficiently. Anyway, I've done my part I'll now see if I can help with something else (time permitting, of course).
