coreruleset · EsadCetiner · Feb 25, 2025 · Feb 20, 2025 · Feb 24, 2025 · Feb 24, 2025
diff --git a/regex-assembly/933160.ra b/regex-assembly/933160.ra
@@ -28,6 +28,7 @@ eval
 exec
 file
 filegroup
+fopen
 glob
 imagegif
 imagejpeg

diff --git a/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf b/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
@@ -362,7 +362,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F
 # (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
 #   crs-toolchain regex update 933160
 #
-SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b\(?[\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:\*.*\*/|/.*)|#.*|[\s\x0b\"])*[\"']*\)?[\s\x0b]*\([^\)]*\)" \
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b\(?[\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|f(?:ile(?:group)?|open)|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:\*.*\*/|/.*)|#.*|[\s\x0b\"])*[\"']*\)?[\s\x0b]*\([^\)]*\)" \
     "id:933160,\
     phase:2,\
     block,\

diff --git a/rules/php-function-names-933150.data b/rules/php-function-names-933150.data
@@ -41,7 +41,6 @@ fclose
 file_exists
 file_get_contents
 finfo_open
-fopen
 fputs
 fsockopen
 ftp_connect

diff --git a/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933150.yaml b/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933150.yaml
@@ -1,6 +1,6 @@
 ---
 meta:
-  author: "lifeforms, azurit"
+  author: "lifeforms, azurit, Esad Cetiner"
 rule_id: 933150
 tests:
   - test_id: 1
@@ -552,8 +552,7 @@ tests:
             expect_ids: [933150]
   - test_id: 33
     desc: |
-      PHP function call with multiple whitespaces.
-      payload: fopen  (blah)
+      False positive with filename matching `fopen`
     stages:
       - input:
           dest_addr: 127.0.0.1
@@ -563,8 +562,8 @@ tests:
             Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
           method: GET
           port: 80
-          uri: "/get?foo=fopen%20%20%28blah%29"
+          uri: "/get?foo=RootAndLeafOpenCamera.jpg"
           version: "HTTP/1.1"
         output:
           log:
-            expect_ids: [933150]
+            no_expect_ids: [933150]
diff --git a/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933160.yaml b/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933160.yaml
@@ -693,3 +693,38 @@ tests:
         output:
           log:
             expect_ids: [933160]
+  - test_id: 39
+    desc: |
+      PHP function call with multiple whitespaces.
+      payload: fopen  (blah)
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          method: GET
+          port: 80
+          uri: "/get?foo=fopen%20%20%28blah%29"
+          version: "HTTP/1.1"
+        output:
+          log:
+            expect_ids: [933160]
+  - test_id: 40
+    desc: |
+      False positive with filename matching `fopen`
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          method: GET
+          port: 80
+          uri: "/get?foo=RootAndLeafOpenCamera.jpg"
+          version: "HTTP/1.1"
+        output:
+          log:
+            no_expect_ids: [933160]
-Original file line number
+Diff line change
@@ Expand Up / @@ -28,6 +28,7 @@ eval @@
     exec
     file
     filegroup
+    fopen
     glob
     imagegif
     imagejpeg
@@ Expand Down @@