feat: target Unix commands in Referer header explicitly #3300
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
New rules 932205, 932206 to handle the Referer header explicitly. The regular expression in 932200 leads to false positives against URLs with query strings (due to the `?`). 932205 uses an additional prefix in the regular expression that matches the first `?` so that the following expressions will only match question marks that are part of the payload. 932206 uses an additional prefix to match only when the Referer value is not a URL (which is illegal). 932206 is thus equivalent to 932200 but is required to distinguish the case where the Referer header does actually contain a URL. Fixes coreruleset#3180
Xhoenix
reviewed
Sep 10, 2023
Xhoenix
reviewed
Sep 10, 2023
Xhoenix
reviewed
Sep 10, 2023
Xhoenix
approved these changes
Sep 10, 2023
|
Thanks for the reviews and the PR @theseion. Merging now. |
theseion
added a commit
to theseion/coreruleset
that referenced
this pull request
Sep 17, 2023
In coreruleset#3300 a false positive in 932200 was fixed and tests were written to ensure that the FP was fixed but the tests target 932205 and 932206. This commit adds the same FP tests to 932200, the rule that originally exhibited the FPs.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New rules 932205, 932206 to handle the Referer header explicitly.
The regular expression in 932200 leads to false positives against URLs
with query strings (due to the
?). 932205 uses an additional prefix inthe regular expression that matches the first
?so that the followingexpressions will only match question marks that are part of the payload.
932206 uses an additional prefix to match only when the Referer value is
not a URL (which is illegal). 932206 is thus equivalent to 932200 but is
required to distinguish the case where the Referer header does actually
contain a URL.
Fixes #3180.