chore: adds CRS to http-server example

[M4tteoP]

It simplifies doing quick tests locally with the whole CRS.

Summary by CodeRabbit

• New Features

  • The HTTP server example now uses an embedded default WAF setup with CRS support and custom rules.
  • Example documentation was updated with clearer run commands and request samples.

• Bug Fixes

  • Expanded example coverage for blocked requests, including path traversal, SQLi, and custom rule matches.
  • Improved WAF configuration handling for custom directives and response customization.

• Tests

  • Updated example tests to validate the new blocked-request scenarios and concurrent behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: eab776de-302b-4cc0-ab09-b1c37a43ac57

📥 Commits

Reviewing files that changed from the base of the PR and between 0ab7cb5 and 39d71b3.

⛔ Files ignored due to path filters (3)

• examples/http-server/go.sum is excluded by !**/*.sum
• go.sum is excluded by !**/*.sum
• testing/coreruleset/go.sum is excluded by !**/*.sum

📒 Files selected for processing (7)

• examples/http-server/README.md
• examples/http-server/default.conf
• examples/http-server/go.mod
• examples/http-server/main.go
• examples/http-server/main_test.go
• go.mod
• testing/coreruleset/go.mod

---

📝 Walkthrough

Walkthrough

This PR integrates the embedded OWASP CRS (coraza-coreruleset) into the http-server example by configuring a merged RootFS (embedded CRS + OS filesystem), updates default.conf with audit logging and default actions, renumbers custom rules, revises README docs and tests, and bumps dependencies in multiple go.mod files.

Changes

CRS-enabled HTTP server example

Layer / File(s)	Summary
Merged RootFS WAF configuration examples/http-server/main.go	Imports mergefs utilities and configures the WAF with WithRootFS(mergefs.Merge(coreruleset.FS, mergefsio.OSFS)) while retaining DIRECTIVES_FILE override support.
default.conf CRS and audit logging setup examples/http-server/default.conf	Adds recommended Coraza includes, JSON audit logging to stdout, SecDefaultAction phases 3–5, explicit SecRuleEngine On, SecRequestBodyAccess On, and renumbers custom rule ids (1→100, 100→101).
Test cases for CRS and custom rules examples/http-server/main_test.go	Replaces prior test cases with CRS path traversal, CRS SQLi, and custom id/body rule cases expecting 403; switches concurrency loop to for range 10.
README documentation updates examples/http-server/README.md	Documents default CRS instrumentation, updated run commands (GOWORK=off go run .), new curl examples against /, DIRECTIVES_FILE/RESPONSE_BODY/RESPONSE_HEADERS configuration, and reworded WAF customization guidance.
Dependency updates across go.mod files examples/http-server/go.mod, go.mod, testing/coreruleset/go.mod	Adds coraza-coreruleset/v4, bumps coraza/v3, and updates various indirect dependency versions (tidwall/*, golang.org/x/*, magefile/mage, etc.).

Estimated code review effort: 2 (Simple) | ~15 minutes

Suggested reviewers: fzipi

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding CRS support to the http-server example.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.09%. Comparing base (43bd073) to head (e90436a).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1632      +/-   ##
==========================================
- Coverage   87.66%   86.09%   -1.57%     
==========================================
  Files         178      177       -1     
  Lines        9134     9128       -6     
==========================================
- Hits         8007     7859     -148     
- Misses        858      996     +138     
- Partials      269      273       +4     

Flag	Coverage Δ
coraza.no_memoize	85.66% <100.00%> (-2.09%)	⬇️
coraza.rule.case_sensitive_args_keys	85.68% <100.00%> (-1.95%)	⬇️
coraza.rule.mandatory_rule_id_check	85.70% <100.00%> (-1.95%)	⬇️
coraza.rule.multiphase_evaluation	?
coraza.rule.no_regex_multiline	85.67% <100.00%> (-1.95%)	⬇️
coraza.rule.rx_prefilter	85.88% <100.00%> (-1.79%)	⬇️
default	86.09% <100.00%> (-1.57%)	⬇️
examples+	16.28% <ø> (ø)
examples+coraza.no_memoize	85.61% <100.00%> (+<0.01%)	⬆️
examples+coraza.rule.case_sensitive_args_keys	85.59% <100.00%> (+<0.01%)	⬆️
examples+coraza.rule.mandatory_rule_id_check	85.70% <100.00%> (+<0.01%)	⬆️
examples+coraza.rule.multiphase_evaluation	?
examples+coraza.rule.no_regex_multiline	85.52% <100.00%> (+<0.01%)	⬆️
examples+coraza.rule.rx_prefilter	85.88% <100.00%> (+<0.01%)	⬆️
examples+no_fs_access	84.94% <100.00%> (+<0.01%)	⬆️
ftw	86.09% <100.00%> (-1.57%)	⬇️
no_fs_access	84.94% <100.00%> (-2.06%)	⬇️
tinygo	86.09% <100.00%> (-1.57%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[M4tteoP]

Great. This PR surfaced a potential race condition when using multiphase evaluation.
So the shape of the proper fix follows directly: either move the computation to parse time (a finalization pass over the rule group once all chain children are attached — no evaluation-time writes at all), or keep it lazy but make every access atomic. The parse-time pass is the cleaner one and also fixes the "recomputes forever" inefficiency, since parse time can record "computed, result is Unknown" definitively.

It will need some care. Moving to draft for now.