Make multipart/mixed an OWASP-allowed content type

[HeikoTheissen]

OWASP maintains a set of core rules which, among others, contains a list of "allowed content types for requests"

https://github.com/coreruleset/coreruleset/blob/a2f477d9d3171ac23cde3a3fc719356bc3db55db/rules/REQUEST-901-INITIALIZATION.conf#L200

which is then used in another rule

https://github.com/coreruleset/coreruleset/blob/a2f477d9d3171ac23cde3a3fc719356bc3db55db/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf#L1013.

This list is not set in stone, for example, multipart/related was added as a result of coreruleset/coreruleset#1721.

To support OData multipart $batch requests, should the OData TC raise another issue to have multipart/mixed included?

[ralfhandl]

@HeikoTheissen to approach OWASP

[HeikoTheissen]

@HeikoTheissen to approach OWASP

@mikepizzo offered to ask a colleague at Microsoft, I'd like to await his response first so that I can better judge what impact the rule 901162 (which we want modified) actually has.

[HeikoTheissen]

OWASP closed the PR and, instead of allowing multipart/mixed, decided to disallow multipart/related (coreruleset/coreruleset#3905). Both content types cannot be parsed by the ModSecurity WAF engine.

[ralfhandl]

Should we then deprecate the multipart batch format and move it to a separate specification?

[HeikoTheissen]

owasp-modsecurity/ModSecurity#3296

[ralfhandl]

No further action needed at this point. Whoever puts a WAF in front of an OData API has to make sure that all requests they need processed are passed on.