fix: reduce false positives from CVE-derived payload research#4573
Closed
zoutjebot wants to merge 1 commit into
Closed
fix: reduce false positives from CVE-derived payload research#4573zoutjebot wants to merge 1 commit into
zoutjebot wants to merge 1 commit into
Conversation
False positive reductions:
- fix(942550): narrow JSON-SQL first branch to single-quote/backtick only
- fix(942290): add word boundary after MongoDB operator names
- fix(930120): require path separator before .profile
- fix(932370): remove 'url' from Windows command list (GraphQL/JSON FPs)
- fix(933150): remove is_int from high-risk PHP function list (cookie FPs)
- fix(943110): remove generic session_id/session-id from PL1 session fixation
- fix(932260): add trailing delimiter to base64/lastlog/lastlogin commands
- fix(932340): remove single-char 'w' from no-arguments list, remove '{' trigger
- fix(932270): require start-of-string/whitespace before tilde expansion
- fix(932330): require non-alphanumeric before shell history !- pattern
- fix(920420): stop content-type extraction at comma (multi-value headers)
All regex changes ported to .ra files and regenerated via crs-toolchain.
Regression tests updated for changed rule behaviors.
Methodology: https://wafplanet.com/blog/autoresearch-crs-regex/
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
📊 Quantitative test results for language: |
Contributor
|
ok, good @zoutjebot |
Member
|
@zoutjebot Same here. Sorry, but smaller PRs will make easier review and approval. Can you create an issue and do one PR per line in your table? Thanks! |
Contributor
|
@zoutjebot, it still the same issue, Every fix must have it own pr, the fixes must be organized and clean, You need to split every change to a pr, But warning!! do'nt submit all 11 prs in the same day, Because it looks like spam |
Contributor
Author
|
Superseded by individual PRs per maintainer feedback. See #4584 for tracking. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split from #4565 per @EsadCetiner's review request. This PR contains only false positive reductions.
Changes
\bword boundary after MongoDB operator names.profile.profileas substring in URLs like/user.profileimageurlfrom Windows command listis_intfrom high-risk PHP function listis_intwere triggering false positivessession_id/session-idfrom PL1 session fixationbase64/lastlog/lastlogincommandsbase64encoded,lastlogon)wfrom no-arguments list; remove{triggerwtriggers on any URL containing 'w';{triggers on JSONparam=abc~def!-pattern!-inside wordsMethodology
Automated CVE-derived payload testing: https://wafplanet.com/blog/autoresearch-crs-regex/
Test results
.rafiles and regenerated viacrs-toolchainsession-idpattern