8000 Move 941310 from PL1 to PL2 by franbuehler · Pull Request #2014 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Move 941310 from PL1 to PL2 #2014

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 2 commits into from
Closed

Move 941310 from PL1 to PL2 #2014

wants to merge 2 commits into from

Conversation

franbuehler
Copy link
Contributor

This PR is a proposal for issue #1942. We can discuss there if this is the correct solution.
This PR moves rule 941310 from PL1 to PL2, because it has a lot of false positives with Russian letters and German Umlaute.

@franbuehler franbuehler linked an issue Feb 18, 2021 that may be closed by this pull request
Rule 941310: false positive for Russian letters "м" and "о" #1942
Closed
@dune73 dune73 mentioned this pull request Mar 1, 2021
Closed
@franbuehler franbuehler self-assigned this Mar 1, 2021
@franbuehler
Copy link
Contributor Author

Meeting decision March: #2008 (comment):
@airween volunteers to review this PR after @franbuehler provided a curl example.

@dune73 dune73 mentioned this pull request Apr 2, 2021
Closed
@dune73
Copy link
Member
dune73 commented Apr 2, 2021

@franbuehler did you send the curl example to @airween directly or did this get lost?

@franbuehler
Copy link
Contributor Author

@dune73, I was not able to find a curl example. I tried to reproduce it in the browser with the application where I found the false positives in the log. I also tried with Max explanation but it does not work for me. My environment seems to encode the correct way.
See the linked issue.

@dune73
Copy link
Member
dune73 commented Apr 2, 2021

Thank you. I propose we leave this PR open for a bit longer until your discussion with @thesion is over in issue #1942.

@dune73 dune73 marked this pull request as draft April 2, 2021 17:04
@dune73 dune73 mentioned this pull request May 3, 2021
Closed
@franbuehler franbuehler marked this pull request as ready for review May 3, 2021 20:03
@dune73 dune73 mentioned this pull request Jun 3, 2021
Closed
@dune73
Copy link
Member
dune73 commented Jun 6, 2021

Time to put this back on the table?

@franbuehler
Copy link
Contributor Author

Meeting decision June (#2074 (comment)):
@franbuehler and @theseion will discuss on their call if this PR should still be merged

@dune73 dune73 mentioned this pull request Jul 2, 2021
Closed
@franbuehler
Copy link
Contributor Author
franbuehler commented Jul 5, 2021 •
edited
Loading

I would close this PR here for 2 reasons:

  1. We have the new chained rule from PR Use chained end tag detection for rule 941310 #2107 at PL1 (PL1 is my proposal), which also has a good coverage of the attack.
  2. The vulnerability is rare because it only appears on an incorrectly configured Tomcat. I would not risk a possible FP at PL2 for this rare vulnerability.

As always: other opinions welcome.

@franbuehler
Copy link
Contributor Author
franbuehler commented Jul 5, 2021 •
edited
Loading

We agree on closing this PR here. PR #2107 solves the problem.
Monthly chat meeting July:
#2141 (comment)

@franbuehler franbuehler closed this Jul 5, 2021
@franbuehler franbuehler deleted the fix-fp-941310 branch July 31, 2023 13:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@franbuehler franbuehler

Labels
👀 Needs action
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Rule 941310: false positive for Russian letters "м" and "о"
2 participants
@franbuehler @dune73
0