Skip to content

feat(942350): added replace keyword + c-type comment evasion#4373

Merged
Xhoenix merged 9 commits into
coreruleset:mainfrom
touchweb-vincent:patch-23
Jan 24, 2026
Merged

feat(942350): added replace keyword + c-type comment evasion#4373
Xhoenix merged 9 commits into
coreruleset:mainfrom
touchweb-vincent:patch-23

Conversation

@touchweb-vincent
Copy link
Copy Markdown
Contributor

@touchweb-vincent touchweb-vincent commented Dec 7, 2025

Hello,

I think this rule is missing support for the REPLACE statement : https://dev.mysql.com/doc/refman/8.4/en/replace.html

We currently have nothing that catches this payload at PL1 :

REPLACE test (id, name) VALUES (1, 'test');

curl -H "x-format-output: txt-matched-rules" -H "x-crs-paranoia-level:2" "http://sandbox.coreruleset.org/" -d 'test=REPLACE%20test%20%28id%2C%20name%29%20VALUES%20%281%2C%20%27test%27%29%3B%20'

Additionally, this rule is sensitive to C-style comment (like these ones) evasions, so I suggest tightening the rule to improve its coverage to catch this on PL1 :

curl -H "x-format-output: txt-matched-rules" -H "x-crs-paranoia-level:2" "http://sandbox.coreruleset.org/" -d 'test=;DROP%2F%2Atest%2A%2FTABLE+test%3B'

What do you think ?

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Dec 7, 2025

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

@Xhoenix Xhoenix added this pull request to the merge queue Jan 24, 2026
Merged via the queue into coreruleset:main with commit 23e99cb Jan 24, 2026
8 checks passed
@touchweb-vincent touchweb-vincent deleted the patch-23 branch January 24, 2026 12:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants