Karel

Hey! Just wanted to point out that look arounds are not allowed in the CRS codebase due to performance and compatibility reasons: https://github.com/coreruleset/coreruleset/blob/v4.0/dev/CONTRIBUTING.md#:~:text=To%20ensure%20compatibility%20with

I noticed that many SSRF/RFI rules are only evaluated against query parameters. Perhaps including XML, headers, and other common injection points is also a good idea?

I've just pushed another fix for a bypass submitted by @hussein98d in `YJGXRICC`

Sorry for the wait! I should be able to get the necessary work done before the weekend is over. Is the include directive global? Can I reference it in other...

Awesome @fzipi, I'll get on that as soon as I can.

Hi @lifeforms, I'd love some feedback on your feedback (ha!). I was never forwarded any `process.config` or `process.mainModule` bypasses by @hussein98d. Also, I noticed some room for improvement in this...

@dune73, I've noticed that the tests indeed fail. @fzipi and I have been looking into it but are so far unable to track down the root cause. I'll definitely get...

@dune73, thank you. @fzipi told me that he managed to track down the test issue to the transformations. After the other issue is resolved, I'll be sure to add the...

@lifeforms, correct. It would require a similar approach to the two additional regular expressions I've already added. Perhaps I'm wrong, but I feel like there's a way to use `regexp-assemble`...

This is true. The base64Decode transformation appears to cause the issue. Applying it last would technically solve the problem, but isn't ideal since it wouldn't be able to detect cases...