Christian Folini

icon indicating a website link https://www.christian-folini.ch

icon company https://www.netnea.com icon location Berne, Switzerland icon location Webserver Fortification Engineer and Advisor in the Art of Defense. OWASP ModSecurity Core Rule Set Co-Lead.

Results 509 comments of Christian Folini

FP on 932150 (PL1) with payload "ping" and "time"

But this is 932150. A rule with dozens and dozens of commands. How would you want to pull this off for ping alone?

FP on 932150 (PL1) with payload "ping" and "time"

What @lifeforms describes is also the resolution of our monthly issue chat. https://github.com/coreruleset/coreruleset/issues/2401#issuecomment-1061076993 Adding the "good first issue" label.

Take a closer look at https://github.com/mandiant/heyserial

Also: https://twitter.com/ramen0x3f/status/1470952808434343944

Take a closer look at https://github.com/mandiant/heyserial

I doubt anybody has the time for a through inspection, so I guess we can let it be closed.

HTTP PUT being blocked in WordPress is a false positive

We'd still be interested to get your logs @firasd.

HTTP PUT being blocked in WordPress is a false positive

So what do we do here. Add all this to the WP RE package?

HTTP PUT being blocked in WordPress is a false positive

I think the expansion makes sense, but I am not sure it's a good task for the retreat. It's something that does not need a focused group of developers (unless...

HTTP PUT being blocked in WordPress is a false positive

Issue covered in the [September issue chat](https://github.com/coreruleset/coreruleset/issues/2185#issuecomment-913804183). @lifeforms will do a PR to address the PUT problem. The expansion idea comes afterwards.

HTTP PUT being blocked in WordPress is a false positive

The amount of @lifeforms assigned issues is staggering. We need to free you!

HTTP PUT being blocked in WordPress is a false positive

Sorry for not getting to work on this. The team is currently swamped (see https://coreruleset.org/20220711/update-on-crs-4-0-release-delay/). We're happy to accept pull requests for this though.