Document WAF CrossSiteScripting_BODY false-positive on webhook bodies (ABCA-858)

isadeks · isadeks · commit 3e73d5a419c2 · 2026-07-23T22:52:14.000+01:00
The CRS CrossSiteScripting_BODY rule blocks any Linear/Jira webhook whose issue
body contains HTML markup (&lt;head&gt;, &lt;meta&gt;, &lt;div&gt;) at the WAF edge with a 403
before the Lambda runs — the task silently never starts and the sender sees an
opaque 403. Live-caught on ABCA-858 (confirmed via API-GW WafFilteredException +
WAF sampled request RuleNameWithinRuleGroup=CrossSiteScripting_BODY).

Leaving XSS protection ON for now (real defense-in-depth) rather than weakening
WAF; documenting the known false-positive inline and tracking a deliberate fix
(considered per-route exclusion + operator alarm) as a backlog item. Comment
only — no behavior change.
diff --git a/cdk/src/constructs/task-api.ts b/cdk/src/constructs/task-api.ts
@@ -297,6 +297,15 @@ export class TaskApi extends Construct {
           // attachments up to 3 MB, presigned upload metadata). Excludes
           // SizeRestrictions_BODY only; all other CRS rules apply. Payload
           // size is bounded by API GW (10 MB) and validateAttachments().
+          //
+          // NOTE (ABCA-858, backlog): CrossSiteScripting_BODY here BLOCKS a
+          // Linear/Jira webhook whose issue body contains HTML markup
+          // (``<head>``, ``<meta>``, ``<div>``) at the WAF edge with a 403
+          // before the Lambda runs — the task silently never starts and the
+          // sender gets an opaque 403. XSS protection is intentionally kept ON
+          // for now (a real defense-in-depth layer); the false-positive is
+          // tracked as a backlog item to fix deliberately (e.g. a considered
+          // per-route exclusion + operator alarm) rather than weaken WAF here.
           name: 'AWSManagedRulesCommonRuleSet-TaskPaths',
           priority: 1,
           overrideAction: { none: {} },
