coreruleset · EsadCetiner · Mar 26, 2025 · Mar 23, 2025 · Mar 23, 2025 · Mar 23, 2025
diff --git a/rules/lfi-os-files.data b/rules/lfi-os-files.data
@@ -31,18 +31,26 @@
 .cshrc
 .cups/
 .dbus/
-.docker
+.docker/
 .drush/
 # .env
+.envrc
 .eslintignore
 .fbcindex
 .forward
 .gem/
+.git/
 .gitattributes
 .gitconfig
-.gnonme/
+.gitignore
+.gnome/
+.gnome2/
+.gnomerc/
 .gnupg/
+.google_authenticator
 .gsutil/
+.hg/
+.hgignore
 .hplip/hplip.conf
 .htaccess
 .htdigest
@@ -64,6 +72,7 @@
 .netrc
 .node_repl_history
 .npm/
+.npmrc
 .nsconfig
 .nsr
 .nvm/
@@ -82,22 +91,31 @@
 .rediscli_history
 .rhistory
 .rhosts
+.selected_editor
 .sh_history
 .sqlite_history
+.snap/
 .ssh/
 .subversion/
+.svn/
+.svnignore
 .tconn/
 .tcshrc
+.tmux.conf
 .thunderbird/
 .tor/
+.vagrant.d/
 .vidalia/
 .vim/
 .viminfo
 .vimrc
+.vscode
 .vmware/
 .www_acl
 .wwwacl
 .xauthority
+.yarnrc
+.zshenv
 .zhistory
 .zsh_history
 .zshrc

diff --git a/rules/restricted-files.data b/rules/restricted-files.data
@@ -5,45 +5,66 @@
 .htpasswd
 # home level dotfiles (keep in sync with lfi-os-files.data).
 # Also include commented values (e.g., `# .env`), but not comments.
-# grep -E '^(?:#\s*)?\.[^\s]+$' lfi-os-files.data | sed 's/^#\s*//'
+# grep -E "^(#\s*)?\.\S+
8000
$" lfi-os-files.data | sed 's/^#\s*//'
 .addressbook
+.anydesk/
 .aptitude/config
+.atom/
 .aws/
 .azure/
 .bash_
 .bashrc
+.boto
 .cache/notify-osd.log
 .config/
 .cshrc
-.docker
+.cups/
+.dbus/
+.docker/
 .drush/
 .env
+.envrc
 .eslintignore
 .fbcindex
 .forward
+.gem/
+.git/
 .gitattributes
 .gitconfig
+.gitignore
+.gnome/
+.gnome2/
+.gnomerc/
 .gnupg/
 .google_authenticator
+.gsutil/
+.hg/
+.hgignore
 .hplip/hplip.conf
 .htaccess
 .htdigest
 .htpasswd
+.java/
 .ksh_history
+.kube/
 .lesshst
 .lftp/
 .lhistory
 .lighttpdpassword
 .lldb-history
 .local/share/mc/
 .lynx_cookies
+.minikube/
 .my.cnf
 .mysql_history
 .nano_history
+.netrc
 .node_repl_history
+.npm/
 .npmrc
 .nsconfig
 .nsr
+.nvm/
 .oh-my-
 .password-store
 .pearrc
@@ -65,30 +86,29 @@
 .snap/
 .ssh/
 .subversion/
+.svn/
+.svnignore
 .tconn/
 .tcshrc
 .tmux.conf
+.thunderbird/
 .tor/
 .vagrant.d/
 .vidalia/
 .vim/
 .viminfo
 .vimrc
 .vscode
+.vmware/
 .www_acl
 .wwwacl
-.Xauthority
+.xauthority
 .yarnrc
+.zshenv
 .zhistory
 .zsh_history
-.zshenv
 .zshrc
-# Version control
-/.git/
-/.gitignore
-/.hg/
-/.hgignore
-/.svn/
+
 # October CMS credentials file
 /auth.json
 # Wordpress

diff --git a/tests/regression/tests/REQUEST-930-APPLICATION-ATTACK-LFI/930120.yaml b/tests/regression/tests/REQUEST-930-APPLICATION-ATTACK-LFI/930120.yaml
@@ -1,6 +1,6 @@
 ---
 meta:
-  author: "csanders-git, azurit"
+  author: "csanders-git, azurit, Esad Cetiner"
 rule_id: 930120
 tests:
   - test_id: 1
@@ -200,3 +200,39 @@ tests:
         output:
           log:
             no_expect_ids: [930120]
+  - test_id: 12
+    desc: |
+      False positive test.
+      Don't match .dockery in email address (matching .docker)
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          method: "GET"
+          port: 80
+          headers:
+            User-Agent: "OWASP CRS test agent"
+            Host: "localhost"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          uri: "/get?code=firstname.dockery@host.tld"
+          version: "HTTP/1.1"
+        output:
+          log:
+            no_expect_ids: [930120]
+  - test_id: 13
+    desc: |
+      True positive test.
+      Accessing hidden folder .docker
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          method: "GET"
+          port: 80
+          headers:
+            User-Agent: "OWASP CRS test agent"
+            Host: "localhost"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          uri: "/get?code=/path/to/.docker/secrets"
+          version: "HTTP/1.1"
+        output:
+          log:
+            expect_ids: [930120]