Skip to content

fix(942200): FP against comma and single quote in French addresses#4476

Merged
fzipi merged 3 commits into
coreruleset:mainfrom
theseion:4236-fix-fp-in-942200
Feb 28, 2026
Merged

fix(942200): FP against comma and single quote in French addresses#4476
fzipi merged 3 commits into
coreruleset:mainfrom
theseion:4236-fix-fp-in-942200

Conversation

@theseion
Copy link
Copy Markdown
Contributor

@theseion theseion commented Feb 22, 2026

  • Fixes FPs against French addresses, such as 999, rue d'Arlon
  • Additional tests and enhanced regex

Fixes #4236

@theseion theseion requested a review from a team February 22, 2026 19:18
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 22, 2026

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

- Fixes FPs against French addresses, such as `999, rue d'Arlon`
- Additional tests and enhanced regex

Fixes coreruleset#3838
Replaces coreruleset#4236
@theseion theseion force-pushed the 4236-fix-fp-in-942200 branch from bfd876d to 2e9569c Compare February 22, 2026 19:20
Comment thread regex-assembly/942200.ra Outdated
@fzipi fzipi added this pull request to the merge queue Feb 28, 2026
Merged via the queue into coreruleset:main with commit 6f855a4 Feb 28, 2026
8 checks passed
@mhoran
Copy link
Copy Markdown

mhoran commented Mar 2, 2026

After upgrading to v4.24.0 I saw that Googlebot was being blocked by modsecurity. I believe this change is to blame, as downgrading to v4.23.0 resolves. Googlebot has the following User-Agent which is being blocked by rule 942200:

Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.7559.132 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

@EsadCetiner
Copy link
Copy Markdown
Member

@mhoran Can you open an issue with your ModSecurity logs?

theseion added a commit to theseion/coreruleset that referenced this pull request Mar 8, 2026
github-merge-queue Bot pushed a commit that referenced this pull request Mar 9, 2026
* fix(942200): prevent matches against user agent strings

Make matching of parenthesis more restrictive

Refs #4476
Fixes #4502
Closes #4525

* Apply suggestions from code review

* Apply suggestion from @fzipi

---------

Co-authored-by: Felipe Zipitría <3012076+fzipi@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants