Skip to content

feat(930130,930140): expand AI-based paths#4540

Merged
fzipi merged 2 commits into
coreruleset:mainfrom
Elnadrion:930130,930140
Mar 10, 2026
Merged

feat(930130,930140): expand AI-based paths#4540
fzipi merged 2 commits into
coreruleset:mainfrom
Elnadrion:930130,930140

Conversation

@Elnadrion
Copy link
Copy Markdown
Contributor

@Elnadrion Elnadrion commented Mar 10, 2026

Proposed changes

Hey :) Awesome idea in: #4519
I've expanded the list a bit in this PR

PR Checklist

  • I have read the CONTRIBUTING doc
  • I have added positive tests proving my fix/feature works as intended.
  • I have added negative tests that prove my fix/feature considers common cases that might end in false positives
  • In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
  • My test use the comment field to write the expected behavior
  • I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

  • Positive and negative tests were added
  • Tests cover the intended fix/feature properly
  • No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
  • In case a regular expression was changed, there is no ReDOS
  • Documentation is clear for the rule/change

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 10, 2026 •
edited
Loading

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

@Elnadrion Elnadrion changed the title feature(930130,930140): expand AI-based paths feat(930130,930140): expand AI-based paths Mar 10, 2026
@franbuehler
Copy link
Copy Markdown
Contributor

franbuehler commented Mar 10, 2026

Thank you very much for this extension @Elnadrion! In my opinion, it looks good. I'll approve the PR.

franbuehler
franbuehler previously approved these changes Mar 10, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@franbuehler franbuehler left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@fzipi fzipi enabled auto-merge March 10, 2026 18:09
@fzipi fzipi added this pull request to the merge queue Mar 10, 2026
Merged via the queue into coreruleset:main with commit 4000509 Mar 10, 2026
8 checks passed
@fzipi fzipi added the release:new-detection In this PR we introduce a new detection label Mar 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Xhoenix Xhoenix Xhoenix approved these changes

@franbuehler franbuehler franbuehler left review comments

Assignees

No one assigned

Labels

release:new-detection In this PR we introduce a new detection

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Elnadrion @franbuehler @Xhoenix @fzipi