8000 fix(932200): detect windows style filepaths by s0md3v · Pull Request #2595 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix(932200): detect windows style filepaths #2595

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 4 commits into from
Closed

fix(932200): detect windows style filepaths #2595

wants to merge 4 commits into from

Conversation

s0md3v
Copy link
Contributor
@s0md3v s0md3v commented May 19, 2022

Issue: U8Z0MSCP

Description: The affected rule only works on *nix style filepaths.

Fix: Detect windows style filepaths by considering \ as valid filepath delimiter like /.

@s0md3v s0md3v changed the title fix(932200): fix windows style filepaths fix(932200): detect windows style filepaths May 19, 2022
@RedXanadu RedXanadu added the ⭐ bug bounty Comes from our Bug Bounty program label May 19, 2022
@dune73
Copy link
Member
dune73 commented May 20, 2022 •
edited by lifeforms
Loading

CRS Bug Bounty PR assessment

  • Rules affected (list rules): 932200
  • Paranoia Level addressed (1, 2, 3, 4, full or explain): 2
  • FTW passes (yes or no) : No
  • Rule(s) picked for solution (correct or not-correct or explain) : correct
  • Risk for false positives (irrelevant, adequate, substantial or explain) : probably adequate
  • Regular expression quality (inspirational, decent base, needs work, adequate or explain) : needs work
  • Documentation (needs work, adequate or explain) : N/A
  • Tests (none or some or adequate) : some, but could be more
     
  • Verdict (Unusable, inspirational, usable, almost perfect or perfect) : usable

This is not meant to be final. As a CRS dev, feel free to comment below and edit this form directly. As committer or observer, feel free to comment below with feedback and we will think about updating the assessment accordingly.

@RedXanadu
Copy link
Member

@s0md3v Your new test doesn't seem to be working at the moment.

@lifeforms
Copy link
Member
lifeforms commented May 22, 2022 •
edited
Loading

We have a rule for backslash notation in the contribution guidelines: \\should be written as \x5c
Please if possible could you put it after the / also for improved clarity.

We need also a test for the backslash, some more tests could really help.

@fzipi
Copy link
Member
fzipi commented May 22, 2022

Can you also be sure that your PR doesn't change permissions on files? I see a change from 644 to 755 (probably because of WSL?).

@lifeforms
Copy link
Member
lifeforms commented Jun 4, 2022 •
edited
Loading

Oops. Seems that the test is failing:

test_crs[932200.yaml -- 932200-14]
assert False

Is the test wrong or does the rule have a problem? Could you have a look at that @s0md3v ?

@fzipi fzipi mentioned this pull request Jun 5, 2022
Closed
@dune73 dune73 mentioned this pull request Jul 4, 2022
Closed
@fzipi
Copy link
Member
fzipi commented Jul 16, 2022

I'm struggling to make the test match. Will enter debug mode.

@fzipi fzipi mentioned this pull request Aug 1, 2022
Closed
@RedXanadu
Copy link
Member
RedXanadu commented Aug 4, 2022 •
edited
Loading

I believe the proposal here changes the existing regular expression in ways that fundamentally change its meaning. I think this needs a closer inspection.

I also have been unable to trigger the exploit described (tested briefly on a Windows 10 box: exploit doesn't work in cmd or PowerShell, but I'm a Windows n00b so I might be missing something.)

@RedXanadu RedXanadu self-assigned this Aug 4, 2022
@lifeforms
Copy link
Member

This issue may be harder than it looks (or maybe not). I am confused because as far as I know, we should have detected this technique also in earlier releases. So I think we may have to fix an existin rule as well, and that rule is really complex. I will close this for now, and use it as a reference.

@lifeforms lifeforms closed this Aug 15, 2022
@lifeforms lifeforms mentioned this pull request Aug 15, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@RedXanadu RedXanadu

Labels
⭐ bug bounty Comes from our Bug Bounty program
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@s0md3v @dune73 @RedXanadu @lifeforms @fzipi
0