Skip to content

feat: Expanded os files list#4536

Merged
EsadCetiner merged 100 commits into
coreruleset:mainfrom
HackingRepo:patch-7
Mar 29, 2026
Merged

feat: Expanded os files list#4536
EsadCetiner merged 100 commits into
coreruleset:mainfrom
HackingRepo:patch-7

Conversation

@HackingRepo
Copy link
Copy Markdown
Contributor

@HackingRepo HackingRepo commented Mar 8, 2026

Proposed changes

Expanded os files list to cover all critical and app files that are not previously blocked, And importantly critical change here added the mysql login file and linode cli dir and oracle cloud cli dir those contain extremly senstive content.

PR Checklist

  • [ x ] I have read the CONTRIBUTING doc
  • [ x ] I have added positive tests proving my fix/feature works as intended.
  • [ x ] I have added negative tests that prove my fix/feature considers common cases that might end in false positives

For the reviewer

  • Positive and negative tests were added
  • Tests cover the intended fix/feature properly
  • No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
  • In case a regular expression was changed, there is no ReDOS
  • Documentation is clear for the rule/change

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 8, 2026 •
edited
Loading

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

EsadCetiner
EsadCetiner reviewed Mar 9, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@EsadCetiner EsadCetiner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just going through the list, I can clearly see multiple files that are not relevant to web applications. Who installs Steam, a game launcher on a server? Most of these entries here are not relevant to web apps. You also need to sync the changes here to restricted-files.data and restricted-upload.data

@HackingRepo HackingRepo requested a review from EsadCetiner March 9, 2026 09:16
EsadCetiner
EsadCetiner reviewed Mar 12, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@EsadCetiner EsadCetiner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still seeing a ton of issues with this PR, can you please go through this and look for duplicate entries and remove anything that's not relevant for a server?

Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
HackingRepo and others added 11 commits March 12, 2026 00:50
@HackingRepo @EsadCetiner
Remove android studio and arduino
5420646 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo @EsadCetiner
Remove Next DNS config file
c49da09 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo @EsadCetiner
Remove Minitool Partition Wizard
ed43aca 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo @EsadCetiner
Add / to chocolatey
9b24748 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo
Remove comments from linode and oci
acd9145
@HackingRepo
Update lfi-os-files.data
3fa181a
@HackingRepo
Update lfi-os-files.data
3b56e0c
@HackingRepo @EsadCetiner
Remove .gitignore_global from the list because it already exist
d37e2ca 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo
Update lfi-os-files.data
63b6c78
@HackingRepo @EsadCetiner
Use lowercase cargo.toml
73cd547 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo @EsadCetiner
Remove mutt
42e7450 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo HackingRepo requested a review from EsadCetiner March 12, 2026 20:22
EsadCetiner
EsadCetiner requested changes Mar 21, 2026
View reviewed changes
Comment thread rules/lfi-os-files.data Outdated
Comment on lines +1068 to +1071
# Flatpak dir
.var/
# LibreWolf config dir
.librewolf
Copy link
Copy Markdown
Member

@EsadCetiner EsadCetiner Mar 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again, this is not relevant for a server. Think of the actual impact of accessing such a file and whether this is actually something you'd see in the wild. All your doing is increasing the risk of false positives without improving security.

Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
Comment thread rules/lfi-os-files.data Outdated
HackingRepo and others added 3 commits March 22, 2026 02:18
@HackingRepo @EsadCetiner
Removing the word 'file' from the sentence of Microsoft EditorConfig
ff859a9 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo @EsadCetiner
Removing the word 'dir' from the sentence of Usermin
a0e88c1 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo @EsadCetiner
Removing the word 'dir' from the sentence of GetMail
740be43 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo HackingRepo requested a review from EsadCetiner March 24, 2026 10:38
@HackingRepo
Copy link
Copy Markdown
Contributor Author

HackingRepo commented Mar 24, 2026

I fixed those, I will no longer add anything

EsadCetiner
EsadCetiner requested changes Mar 25, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@EsadCetiner EsadCetiner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks good, there's just one duplicate entry.

This won't make it into the LTS due to the amount of new entries being added which further heightens the risk of false positives.

Comment thread rules/restricted-upload.data Outdated
@HackingRepo @EsadCetiner
Remove duplicates
1779ef7 
Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
@HackingRepo HackingRepo requested a review from EsadCetiner March 25, 2026 17:48
@HackingRepo
Copy link
Copy Markdown
Contributor Author

HackingRepo commented Mar 25, 2026

Ok @EsadCetiner, I agree but we can add it to LTS, But only if you tested is any FPs

@fzipi
Copy link
Copy Markdown
Member

fzipi commented Mar 25, 2026

I'm afraid I'll agree this massive list change won't make it to LTS. Too risky. But we can merge next week for the latest and greatest version! 💪

@HackingRepo
Copy link
Copy Markdown
Contributor Author

HackingRepo commented Mar 25, 2026 •
edited
Loading

yes @fzipi, I agree with you

@fzipi fzipi added ⚠️ do not merge Additional work or discussion is needed despite passing tests and removed ⚠️ do not merge Additional work or discussion is needed despite passing tests labels Mar 26, 2026
@EsadCetiner EsadCetiner added this pull request to the merge queue Mar 29, 2026
Merged via the queue into coreruleset:main with commit 7f6fb7d Mar 29, 2026
8 checks passed
@HackingRepo HackingRepo deleted the patch-7 branch March 29, 2026 08:00
@fzipi fzipi mentioned this pull request Apr 6, 2026
Closed
@EsadCetiner EsadCetiner mentioned this pull request Apr 7, 2026
Merged
11 tasks
@HackingRepo HackingRepo mentioned this pull request Apr 20, 2026
Merged
@HackingRepo
Copy link
Copy Markdown
Contributor Author

HackingRepo commented May 1, 2026 •
edited
Loading

but wait, there a some very important entries that need backported like linode and mysql creds to LTS is the one, we need to backport, @EsadCetiner, other stuff not, because creds is the dangerous information, the attacker should not get for anything, only dirs contain creds will be backported to LTS else not, Because getting linode creds, linode a widely used cloud provider, the linode cli contain authentication details, if an attacker gain an access to them, that is a total control of linode.

@fzipi fzipi added the release:new-detection In this PR we introduce a new detection label May 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@EsadCetiner EsadCetiner EsadCetiner approved these changes

Assignees

No one assigned

Labels

release:new-detection In this PR we introduce a new detection

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@HackingRepo @fzipi @EsadCetiner