owasp-modsecurity-crs
owasp-modsecurity-crs copied to clipboard
Merge new stuff from restricted-files.data into lfi-os-files.data
#1292 brought us some new credentials/config file names for restricted-files.data.
All or most of these entries (depending a short review for FP) should also be added to lfi-os-files.data.
As discussed in #1292, what's the difference between those two data files?
restricted-files.datatriggers on file paths, example:http://localhost/.docker/xxxlfi-os-files.datatriggers when used in a parameter, example:http://localhost/script_with_lfi_vuln.php?file=.docker/xxx
So to prevent LFI on these files, we should copy as many as possible to both rules.
This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days
I'm reopening this. I really think we should do this.