Walter Hop comments

Results 65 comments of


                                            Walter Hop

Rework Pullrequest #122, avoid xss false positives starting with 'on.*'

As a CRS maintainer, I agree that a fix for this problem would be very interesting. Our users regularly turn up false positives due to generic `onfoo=` matching. Some examples:...

Rework Pullrequest #122, avoid xss false positives starting with 'on.*'

build passed 🎉

Some small or/xor/having negatives

@client9 Thanks a lot. They may be silly but I'm trying to get a feel for what types of things libinjection is aimed to detect.

libinjection bypasses

Nice work @attackercan! By the way did you look at my new regexps in CRS 3? ;) (scared now) I did a complete rewrite of the PHP/RCE rules and always...

Set default value of crs_validate_utf8_encoding TX variable

Great work 🥳

Magento ver. 2.4.3

Hi @LINUXpos , thanks for your issue. Unfortunately, we need a bit more information to help you fix it. Do you have access to the ModSecurity audit log? (usually in...

fix(rfi): additional protocols for RFI rule 931130

> I noticed that many SSRF/RFI rules are only evaluated against query parameters. Perhaps including XML, headers, and other common injection points is also a good idea? I agree. Our...

fix(rfi): additional protocols for RFI rule 931130

`ldaps` is also a protocol (secure LDAP), `ldapi` is also there. Could we try to come up with an exhaustive list of protocols? I think there were also a bunch...

feat(rce): additional signatures for NodeJS RCE (934100)

I think `this['constructor']` will also work, or not? Should the regexp be updated to catch this as well?

feat(rce): additional signatures for NodeJS RCE (934100)

I don't think the base64Decode is a must, and I have no problems if you remove it. I remember adding it defensively, because I've seen a lot of PHP code...