feat: Split Node-Validator keywords functionally #2637
Conversation
|
Rebased on top of current dev branch (commit 7d591de) to resolve merge conflict. |
|
Now that the comment detection has been moved out of rule 941180 and into rule 941181, I think what is required here is to move the comment-related tests out of (There are two that I can see: 941180-4 and 9421180-5, although only 9421180-5 (the test title needs correcting) is failing.) |
This improvement adds further consistency to coreruleset#2088 The PL1 rule (`941180`) of Node-Validator keywords contains both evident attack fragments, i.e. `document.cookie`, as well as comment payloads, i.e. `<!--`. This change moves all comment payloads to the PL2 rule (`941181`) that already contains the comment closing tag `-->`. This makes the PL1 rule in line with the goal of PL1, and makes the already existing PL2 rule consistent with the goal of having `comment` payloads.
Moves comment related tests from 941180 to 941181
|
@RedXanadu You seem to be the last person who looked into this. Would you be willing to take over and shepherd this into a state that can be merged? |
|
@dune73 This can wait until post-v4, right? If so, then yes, I can take another look. |
|
OK, then let's add the post-4.0 tag and leave it as is for the time being. |
|
Cool, thanks. I'll re-base it and take another look when I can. |
|
Ready to reactivate this @RedXanadu? |
|
I don't remember what this was about 😅 But yes, I can take a look. |
|
Thank you @RedXanadu. |
|
@dune73 @RedXanadu We've been adding this one since September 2023 to the agenda. And it is originally from 2022. Are we thinking on merging, or we just close? |
|
No movement on my part; still on my todo list. |
This improvement adds further consistency to #2088
The PL1 rule (
941180) of Node-Validator keywords contains both evident attack fragments, i.e.document.cookie, as well as comment payloads, i.e.<!--.This change moves all comment payloads to the PL2 rule (
941181) that already contains the comment closing tag-->.This makes the PL1 rule in line with the goal of PL1, and makes the already existing PL2 rule consistent with the goal of having
commentpayloads.