Felipe Zipitría comments

Results 581 comments of


                                            Felipe Zipitría

Unable to test coreruleset/nextcloud-rule-exclusions-plugin in ingress-nginx

CC: @EsadCetiner

feat: Block AI scraping bots

Thanks for your contribution @highpingblorg! Writing tests is easy. Maybe taking a quick look at our https://github.com/coreruleset/coreruleset/blob/main/CONTRIBUTING.md, will give you more insights. Here is the Tl; DR version https://github.com/coreruleset/coreruleset/blob/main/CONTRIBUTING.md#writing-tests. See...

Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash)

Good question. We need to review this...

Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash)

Added some tests in go-ftw, and looks like [it is doing the encoding](https://github.com/corazawaf/coraza/issues/1193#issuecomment-2492561551)...

fix: prevent invalid commands matches on 5 characters or less (932230 PL-1, 932235 PL-1, 932236 PL-2, 932237 PL-3, 932239 PL-2, 932250 PL-1, 932260 PL-1)

> Since this is a big change, I likely may have missed some commands that were intended to be matched (For example, ip matching iptables and ip6tables) but were shortened...

fix: prevent invalid commands matches on 5 characters or less (932230 PL-1, 932235 PL-1, 932236 PL-2, 932237 PL-3, 932239 PL-2, 932250 PL-1, 932260 PL-1)

> (?:[\s&|)]|$) Maybe using a word boundary instead? Like `(?:[\s&|)])?\b`.

Felipe Zipitría

Unable to test coreruleset/nextcloud-rule-exclusions-plugin in ingress-nginx

feat: Block AI scraping bots

Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash)

Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash)

fix: prevent invalid commands matches on 5 characters or less (932230 PL-1, 932235 PL-1, 932236 PL-2, 932237 PL-3, 932239 PL-2, 932250 PL-1, 932260 PL-1)

fix: prevent invalid commands matches on 5 characters or less (932230 PL-1, 932235 PL-1, 932236 PL-2, 932237 PL-3, 932239 PL-2, 932250 PL-1, 932260 PL-1)

Clarify CRS 3 maintenance plans

feat: detect generic config filenames

feat: detect generic config filenames

fix(933150): moving printf to 933160 for additional php syntax check (933150 PL-1, 933160 PL-1)