fix: remove non-unix commands from unix rce rules (932230 PL-1, 932235 PL-1, 932250 PL-1, 932260 PL-1, 932220 PL-2, 932236 PL-2, 932239 PL-2, 932237 PL-3) by EsadCetiner · Pull Request #4247 · coreruleset/coreruleset

EsadCetiner · 2025-08-22T09:26:00Z

The Unix RCE rules uses unix-shell.data as a source of truth as to what commands it should be blocking, some entries in that list are not commands (some are /dev/ or /proc/ files) and are as a result being treated as a unix command as can be seen in issues like #4110.

This PR modifies the scripts used to generate unix-shell-upto3.ra and unix-shell-4andup.ra to exclude these entries so non-unix commands are not blocked along with the risk of false positives.

closes: coreruleset/phpmyadmin-rule-exclusions-plugin#31

…5 PL-1, 932250 PL-1, 932260 PL-1, 932220 PL-2, 932236 PL-2, 932239 PL-2, 932237 PL-3)

github-actions · 2025-08-22T09:26:35Z

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

for more information, see https://pre-commit.ci

fzipi · 2025-08-31T18:15:16Z

I see what you did. Makes sense. Now, these are mentions to files instead of commands, are they in another list or do we lose them?

EsadCetiner · 2025-08-31T20:09:19Z

@fzipi Yes they still exist in unix-shell.data, that's where these entries came from. This PR just prevents those entries from being added to unix-shell-.*

for more information, see https://pre-commit.ci

azurit · 2026-01-25T08:48:47Z

@EsadCetiner Can you please explain more what this PR does?

You are talking only about modifying two scripts, which now excludes keywords ^(dev|proc|etc|#|$|\$) but, in fact, lots of other (not matching that regex) keywords are removed from various lists. Or am i missing something?

EsadCetiner · 2026-01-25T09:12:48Z

@azurit

You are talking only about modifying two scripts, which now excludes keywords ^(dev|proc|etc|#|$|$) but, in fact, lots of other (not matching that regex) keywords are removed from various lists. Or am i missing something?

The script uses unix-shell.data as a source of truth for what commands to block, the issue is that some entries such as /proc/self , and /dev/null are being interpreted as unix commands which are then added as self and null to unix-shell-*.ra. This has resulted in false positives such as with coreruleset/phpmyadmin-rule-exclusions-plugin#31 and #4110. This PR removes those non-unix commands and modifies the scripts to exclude those entries to prevent them from being added back again in the future.

azurit · 2026-01-25T09:32:42Z

@azurit

You are talking only about modifying two scripts, which now excludes keywords ^(dev|proc|etc|#|$|$) but, in fact, lots of other (not matching that regex) keywords are removed from various lists. Or am i missing something?

The script uses unix-shell.data as a source of truth for what commands to block, the issue is that some entries such as /proc/self , and /dev/null are being interpreted as unix commands which are then added as self and null to unix-shell-*.ra. This has resulted in false positives such as with coreruleset/phpmyadmin-rule-exclusions-plugin#31 and #4110. This PR removes those non-unix commands and modifies the scripts to exclude those entries to prevent them from being added back again in the future.

@EsadCetiner Ok, got it, thanks.

azurit · 2026-01-25T09:33:32Z

Wouldn't it be safer to use proc/|dev/|etc/ ?

Copilot

Pull request overview

This PR refines the Unix RCE detection rules to stop treating non-command entries (notably /dev, /etc, /proc paths and similar) from unix-shell.data as shell commands, thereby reducing false positives such as the | SELF case reported in #4110 and in the linked phpMyAdmin plugin issue.

Changes:

Updated the Unix shell regex assembly inputs (unix-shell-upto3.ra, unix-shell-4andup.ra) to exclude non-command entries from rules/unix-shell.data and rules/unix-shell-builtins.data, and refreshed the generated command lists accordingly.
Regenerated the large assembled regexes in REQUEST-932-APPLICATION-ATTACK-RCE.conf for several RCE rules (932230, 932235, 932250, 932260, 932220, 932236, 932239, 932237) to align with the cleaned command lists.
Tightened regression tests for rule 932235 by adding a new FP test for the null token and simplifying the PL1/PL2 false-positive exclusion lists that are now redundant with the cleaned sources.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/regression/tests/REQUEST-932-APPLICATION-ATTACK-RCE/932235.yaml	Adds a regression test ensuring `time null space` is no longer flagged by rule 932235, covering the `null`-token change in the command lists.
rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf	Regenerates several RCE detection regexes so they no longer include non-command entries derived from `/dev`, `/etc`, `/proc`, and similar sources.
regex-assembly/include/unix-shell-upto3.ra	Adjusts the regeneration script to pre-filter non-command entries and updates the short-command list to drop items such as `fd@`, `tcp@`, and `udp@`.
regex-assembly/include/unix-shell-4andup.ra	Modifies the regeneration script to filter out non-command paths before assembling long-command patterns, updates the English-word suffixing step, and removes non-command tokens like `group`, `null`, `shadow`, `zero`, etc.
regex-assembly/exclude/unix-shell-fps-pl2.ra	Cleans up PL2 false-positive exclusions (e.g., removing `null` variants) that are now handled at the source list level.
regex-assembly/exclude/unix-shell-fps-pl1.ra	Simplifies PL1 FP exclusions by dropping entries (`group`, `null`, `shadow`, `shells`, `tcp`, `zero`, etc.) that no longer appear in the assembled command lists.
regex-assembly/exclude/unix-shell-fps-pl1-curated.ra	Removes now-redundant curated FP exclusions for `group` that are covered by the updated source filtering.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

fzipi · 2026-01-26T01:54:18Z

@azurit You got this one? Can I count on you for pushing it to the finish line?

azurit · 2026-01-26T07:29:35Z

@fzipi Sure thing.

azurit · 2026-01-26T07:43:53Z

@EsadCetiner There are still some invalid commands in the lists, at least:
GET
POST
HEAD

They were added in #3735 and maybe they can be completely removed.

EsadCetiner · 2026-01-26T07:51:27Z

@azurit No those entries were not added in that PR, and no they are not invalid commands.
See:

coreruleset/rules/unix-shell.data

Line 227 in 3f83126

bin/GET

$ which head --help
Usage: head [OPTION]... [FILE]...
Print the first 10 lines of each FILE to standard output.
With more than one FILE, precede each with a header giving the file name.

azurit · 2026-01-26T08:11:04Z

Wouldn't it be safer to use proc/|dev/|etc/ ?

What about this?

EsadCetiner · 2026-01-26T08:40:13Z

@azurit Sorry, I missed that. It's fixed now.

azurit · 2026-01-26T08:44:19Z

@EsadCetiner Good work, thank you!

EsadCetiner added 2 commits August 22, 2025 19:11

fix: remove non-unix commands from unix rce rules (932230 PL-1, 93223…

b8da289

…5 PL-1, 932250 PL-1, 932260 PL-1, 932220 PL-2, 932236 PL-2, 932239 PL-2, 932237 PL-3)

Merge branch 'coreruleset:main' into fix-exclude-non-unix-commands

3898fa9

EsadCetiner added the release:fix label Aug 22, 2025

EsadCetiner mentioned this pull request Aug 23, 2025

SQL query with "NULL" matches REQUEST-932-APPLICATION-ATTACK-RCE coreruleset/phpmyadmin-rule-exclusions-plugin#31

Closed

EsadCetiner and others added 2 commits August 31, 2025 21:18

Merge branch 'main' into fix-exclude-non-unix-commands

da2911a

chore(formatting): auto fixes from pre-commit hooks

97b52af

for more information, see https://pre-commit.ci

fzipi mentioned this pull request Sep 1, 2025

Monthly Chat Agenda September (2025-09-01) #4252

Closed

github-actions Bot added the Stale label Oct 1, 2025

EsadCetiner removed the Stale label Oct 5, 2025

fzipi mentioned this pull request Oct 6, 2025

Monthly Chat Agenda October (2025-10-06) #4281

Closed

Merge branch 'coreruleset:main' into fix-exclude-non-unix-commands

bcb05df

theseion mentioned this pull request Nov 3, 2025

Monthly Chat Agenda November (2025-11-03) #4317

Closed

github-actions Bot added the Stale label Dec 4, 2025

EsadCetiner removed the Stale label Dec 16, 2025

Merge branch 'coreruleset:main' into fix-exclude-non-unix-commands

b17a9c9

theseion mentioned this pull request Jan 5, 2026

Monthly Chat Agenda January 2026 (2026-01-05) #4392

Closed

EsadCetiner and others added 2 commits January 25, 2026 12:56

Merge branch 'main' into fix-exclude-non-unix-commands

2e393f7

chore(formatting): auto fixes from pre-commit hooks

b594f1f

for more information, see https://pre-commit.ci

azurit reviewed Jan 25, 2026

View reviewed changes

Comment thread regex-assembly/include/unix-shell-4andup.ra Outdated

azurit reviewed Jan 25, 2026

View reviewed changes

Comment thread regex-assembly/include/unix-shell-upto3.ra Outdated

Merge branch 'main' into fix-exclude-non-unix-commands

92e5512

fzipi requested a review from Copilot January 25, 2026 12:59

Copilot started reviewing on behalf of fzipi January 25, 2026 12:59 View session

Copilot AI reviewed Jan 25, 2026

View reviewed changes

Comment thread regex-assembly/include/unix-shell-4andup.ra Outdated

EsadCetiner added 2 commits January 26, 2026 10:19

Merge branch 'coreruleset:main' into fix-exclude-non-unix-commands

0bfa751

apply code review suggestions

466a98b

Merge branch 'main' into fix-exclude-non-unix-commands

d73a986

apply code review suggestions

51e6d90

azurit approved these changes Jan 26, 2026

View reviewed changes

EsadCetiner added this pull request to the merge queue Jan 26, 2026

Merged via the queue into coreruleset:main with commit 0d2f083 Jan 26, 2026
9 of 10 checks passed

EsadCetiner deleted the fix-exclude-non-unix-commands branch January 26, 2026 10:38

theseion mentioned this pull request Feb 2, 2026

Monthly Chat Agenda February 2026 (2026-02-02) #4438

Closed

Uh oh!

Conversation

EsadCetiner commented Aug 22, 2025

Uh oh!

github-actions Bot commented Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fzipi commented Aug 31, 2025

Uh oh!

EsadCetiner commented Aug 31, 2025

Uh oh!

azurit commented Jan 25, 2026

Uh oh!

EsadCetiner commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

azurit commented Jan 25, 2026

Uh oh!

azurit commented Jan 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

fzipi commented Jan 26, 2026

Uh oh!

azurit commented Jan 26, 2026

Uh oh!

azurit commented Jan 26, 2026

Uh oh!

EsadCetiner commented Jan 26, 2026

Uh oh!

azurit commented Jan 26, 2026

Uh oh!

EsadCetiner commented Jan 26, 2026

Uh oh!

azurit commented Jan 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Aug 22, 2025 •

edited

Loading

EsadCetiner commented Jan 25, 2026 •

edited

Loading