Skip to content

refactor: drop older spelling variants#4386

Merged
azurit merged 1 commit into
coreruleset:mainfrom
fgsch:fgsch/push-mtlxvvoromur
Dec 25, 2025
Merged

refactor: drop older spelling variants#4386
azurit merged 1 commit into
coreruleset:mainfrom
fgsch:fgsch/push-mtlxvvoromur

Conversation

@fgsch
Copy link
Copy Markdown
Contributor

@fgsch fgsch commented Dec 21, 2025

Proposed changes

Drop older spelling variants for some transformations.
These were renamed in 2010 to their American spelling counterpart.

PR Checklist

  • I have read the CONTRIBUTING doc
  • I have added positive tests proving my fix/feature works as intended.
  • I have added negative tests that prove my fix/feature considers common cases that might end in false positives
  • In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
  • My test use the comment field to write the expected behavior
  • I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

  • Positive and negative tests were added
  • Tests cover the intended fix/feature properly
  • No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
  • In case a regular expression was changed, there is no ReDOS
  • Documentation is clear for the rule/change

These were renamed in 2010 to their American spelling counterpart.
@github-actions
Copy link
Copy Markdown
Contributor

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

Comment thread util/crs-rules-check/rules-check.py
@airween
Copy link
Copy Markdown
Contributor

airween commented Dec 21, 2025

Hi @fgsch 👋!

Thanks for this PR, I've added one comment to the rules-check script - I don't insist that suggestion, rather I'm curious your (and other devs') opinion.

@fgsch
Copy link
Copy Markdown
Contributor Author

fgsch commented Dec 22, 2025

Hi @fgsch 👋!

Thanks for this PR, I've added one comment to the rules-check script - I don't insist that suggestion, rather I'm curious your (and other devs') opinion.

👋 @airween.

Personally, given that these transformations were deprecated 15 years ago, and the fix is just one character away, I'd be more inclined to remove the old variants, but I'm not sure if the script is meant to be used outside this repository.

I'm equally happy to rework this PR to only update the rules and keep the Python script as is, thus allowing both forms.
The downside of keeping both is that someone could reintroduce the old variants at a later time, but I suppose the chances of this are low and will probably be caught during review.

@airween
Copy link
Copy Markdown
Contributor

airween commented Dec 22, 2025

Hi @fgsch,

Personally, given that these transformations were deprecated 15 years ago, and the fix is just one character away, I'd be more inclined to remove the old variants, but I'm not sure if the script is meant to be used outside this repository.

I'm equally happy to rework this PR to only update the rules and keep the Python script as is, thus allowing both forms. The downside of keeping both is that someone could reintroduce the old variants at a later time, but I suppose the chances of this are low and will probably be caught during review.

meanwhile I thought about the issue and I think in case of CRS we should completely disallow the old syntax in both cases. I think the PR is ready, you don't need to do anything else. I'm going to open the necessary issues and will send PR's to fix this in affected repositories.

And thank you again you brought up this topic.

@azurit azurit added this pull request to the merge queue Dec 25, 2025
Merged via the queue into coreruleset:main with commit 6cb3d16 Dec 25, 2025
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants