Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend ID Regex to support escaped quotes #410

Merged
merged 2 commits into from
Dec 10, 2024
Merged

Extend ID Regex to support escaped quotes #410

merged 2 commits into from
Dec 10, 2024

Conversation

M4tteoP
Copy link
Member

@M4tteoP M4tteoP commented Dec 6, 2024

Address coreruleset/coreruleset#3239.
This PR proposes to extend the regex looking for IDs to support also IDs coming with escaped quotes.
JSON log lines such as the following one are not supported:

{"time":"2024-12-06T11:13:12.250069+01:00","level":"ERROR","msg":"[client \"127.0.0.1\"] Coraza: Warning. Request content type charset is not allowed by policy [file \"@owasp_crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf\"] [line \"2753\"] [id \"920480\"] [rev \"\"] [msg \"Request content type charset is not allowed by policy\"] [data \"|garbage|\"] [severity \"critical\"] [ver \"OWASP_CRS/4.7.0\"] [maturity \"0\"] [accuracy \"0\"] [tag \"application-multi\"] [tag \"language-multi\"] [tag \"platform-multi\"] [tag \"attack-protocol\"] [tag \"paranoia-level/1\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/255/153\"] [tag \"PCI/12.1\"] [hostname \"127.0.0.1\"] [uri \"/\"] [unique_id \"UGAYIvYnOAtQVNqhxNg\"]","severity":"critical"}

As described in the original issue, the problem is [id \"920480\"], but now as mentioned in coreruleset/coreruleset#3239 (comment), we can just extend the regex to make it flexible enough to support also this case.

@M4tteoP M4tteoP marked this pull request as ready for review December 6, 2024 17:05
Copy link
Collaborator

@theseion theseion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please rebase.

waflog/read.go Show resolved Hide resolved
@theseion theseion merged commit 603891e into main Dec 10, 2024
4 checks passed
@theseion theseion deleted the extend_regex branch December 10, 2024 06:25
@theseion
Copy link
Collaborator

Perfect, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants