Christian Folini

icon indicating a website link https://www.christian-folini.ch

icon company https://www.netnea.com icon location Berne, Switzerland icon location Webserver Fortification Engineer and Advisor in the Art of Defense. OWASP ModSecurity Core Rule Set Co-Lead.

Results 509 comments of Christian Folini

fix: prevent FPs against URL fragments in Referer header

But that means this PL2 FP will persist? Or do you want the PR for #3498 to do a new rule and remove this FP at the same time?

fix: prevent FPs against URL fragments in Referer header

So we can finish and merge this PR?

fix: prevent FPs against URL fragments in Referer header

That's priced in, yes. Thanks for the PR.

False positive with rule 942440 and Punycode domain name conversion (IDNA encoding)

Removing the stale issue. This is something that warrants a fix. Feel free to add the v4 lable anyone.

Fix regex patterns that look for multi-byte characters

Thank you for investigating. I am not nearly enough in the code and in this feature to know or remember.

Fix regex patterns that look for multi-byte characters

We sorted this out at the CRS meeting and opted to implement the above. https://github.com/coreruleset/coreruleset/issues/3466#issuecomment-1881762255 @theseion will provide his perf numbers (no perf loss expected).

Unified format for tests matching log rule IDs

We're talking about `log_contains`, don't we? Consolidation for the win!

user cannot upload files

Closing this.

Bug on Regression Test 942210-31

What ModSec version?

Bug on Regression Test 942210-31

This is really strange.