📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

Good PR

@zoutjebot Thanks for the PR.

Questions:

• what is the difference between this rule and 934180?
• can you provide the .ra file?
• do not use "5" (e.g. 934175) for the rule, use IDs that are multiple of 10

ping @zoutjebot

Thanks for the review, Felipe. Addressing each point:

Difference between this rule and 934180:

934180 (PL2) matches {%...%} and <%...%> broadly — any content inside the delimiters triggers it. It does not cover {{...}} (that is partially in 941380 as XSS, not SSTI-specific) or #{...} (Expression Language).

This rule targets a narrower, higher-confidence pattern: it matches {{...}}, #{...}, and <%...%> but only when they contain code execution indicators — arithmetic (*), dunder access (__), or function call syntax (()). That strictness is what makes it viable at PL1 without introducing false positives from legitimate template usage like {{username}} or <%=title%>.

In short: 934180 catches broad template syntax at PL2, this rule catches template syntax with execution intent at PL1.

.ra file: Added in the latest push (regex-assembly/934175.ra), with .conf regenerated via crs-toolchain.

Rule ID: Will renumber to a multiple of 10. However, all PL1 slots from 934100 through 934170 are currently taken and 934180+ is PL2. Where would you like this placed?

Thanks. It doesn't matter as rules aren't constrained to have an id smaller that the ones in PL2. So the next one free in the 934 is good.

@zoutjebot Use 934200.

Done. Renumbered to 934200 — .ra file, .conf, and tests all updated. Rebased on latest main.

@zoutjebot, rename the title from feat(934175): detect Server-Side Template Injection (SSTI) attacks to feat(934200): detect Server-Side Template Injection (SSTI) attacks

Updated the PR title. Thanks.

already

relunsec@relunsec:~$ curl https://sandbox.coreruleset.org/?q=%7B%7B7*7%7D%7D -H "X-Format-Output: txt-matched-rules" -H "x-crs-paranoia-level: 2"
941380 PL2 AngularJS client side template injection detected
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=0-5-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=5, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=5)
relunsec@relunsec:~$ 

and

relunsec@relunsec:~$ curl https://sandbox.coreruleset.org/?q=%7B%7B\'\'.__class__%7D%7D -H "X-Format-Output: txt-matched-rules" -H "x-crs-paranoia-level: 2"
941380 PL2 AngularJS client side template injection detected
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=0-5-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=5, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=5)
relunsec@relunsec:~$ 

detected