Skip to content

fix(921180, 921210, 921220): should be block not pass#4294

Merged
EsadCetiner merged 6 commits into
coreruleset:mainfrom
touchweb-vincent:patch-14
Oct 18, 2025
Merged

fix(921180, 921210, 921220): should be block not pass#4294
EsadCetiner merged 6 commits into
coreruleset:mainfrom
touchweb-vincent:patch-14

Conversation

@touchweb-vincent
Copy link
Copy Markdown
Contributor

Hello

I guess it's a mistake, but maybe there is something i don't have in mind.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Oct 18, 2025

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

Copy link
Copy Markdown
Member

@EsadCetiner EsadCetiner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch, can you update 921180 disruptive action to block too?

@touchweb-vincent
Copy link
Copy Markdown
Contributor Author

Already done normally, did you see it ?

@EsadCetiner EsadCetiner changed the title fix(921210): should be block not pass fix(921180, 921210, 921220): should be block not pass Oct 18, 2025
@EsadCetiner EsadCetiner added this pull request to the merge queue Oct 18, 2025
Merged via the queue into coreruleset:main with commit 1fbd77e Oct 18, 2025
9 checks passed
@dune73
Copy link
Copy Markdown
Member

dune73 commented Oct 18, 2025

@EsadCetiner Do you see how this could have slipped our attention before? How come it passed the tests?

@touchweb-vincent touchweb-vincent deleted the patch-14 branch October 18, 2025 09:55
@EsadCetiner
Copy link
Copy Markdown
Member

@dune73 The rules are still adding points to the anomaly score which should be enough for 949110 to block the request, so it's more an stylistic issue than an actual functional issue if your not using the self-contained mode. I clearly remember these rules blocking request before, but I'll double check to be sure.

@EsadCetiner
Copy link
Copy Markdown
Member

@dune73

rules are still adding points to the anomaly score which should be enough for 949110 to block the request

I just tested on both Apache and NGINX and I can confirm this behavior, this is only problematic if your using the self-contained mode.

@dune73
Copy link
Copy Markdown
Member

dune73 commented Oct 18, 2025

Yes, you're right. It does not really matter in standard deployments, since block is pass. But we should still have tests catching this. @airween is this a case for a linter extension?

@airween
Copy link
Copy Markdown
Contributor

airween commented Oct 18, 2025

Yes, you're right. It does not really matter in standard deployments, since block is pass. But we should still have tests catching this. @airween is this a case for a linter extension?

Actually the linter does not have any feature that catches this typo/issue. We should add that one, if it's necessary. I would like to work on linter during the retreat (I added that to tasks), so we can add soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants