Skip to content

fix(unix): exclude pg command from pl-1#4613

Merged
fzipi merged 1 commit into
coreruleset:mainfrom
EsadCetiner:fix-remove-pg-command
Apr 18, 2026
Merged

fix(unix): exclude pg command from pl-1#4613
fzipi merged 1 commit into
coreruleset:mainfrom
EsadCetiner:fix-remove-pg-command

Conversation

@EsadCetiner
Copy link
Copy Markdown
Member

Proposed changes

The pg command isn't installed by default on most Linux distros and is typically not installed afterwards by sysadmins. Fixes a false positive reported in CRS dev chat with the pg command.

PR Checklist

  • I have read the CONTRIBUTING doc
  • I have added positive tests proving my fix/feature works as intended.
  • I have added negative tests that prove my fix/feature considers common cases that might end in false positives
  • In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
  • My test use the comment field to write the expected behavior
  • I have added documentation for the rule or change (when appropriate)

Further comments

For the reviewer

  • Positive and negative tests were added
  • Tests cover the intended fix/feature properly
  • No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
  • In case a regular expression was changed, there is no ReDOS
  • Documentation is clear for the rule/change

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 15, 2026

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

@HackingRepo
Copy link
Copy Markdown
Contributor

HackingRepo commented Apr 15, 2026

do'nt confuse psql with pg @EsadCetiner, so psql must remain blocked

@EsadCetiner
Copy link
Copy Markdown
Member Author

@HackingRepo I'm not sure what your trying to say? I'm removing pg, not psql, what does that have to do with this PR?

@HackingRepo
Copy link
Copy Markdown
Contributor

HackingRepo commented Apr 15, 2026

I see pg is not installed even on Ubuntu, by default and even no APT package exists for it

relunsec@relunsec:~$ pg
pg: command not found
relunsec@relunsec:~$ 

So just we can move the command to PL3 better not just PL2

@HackingRepo
Copy link
Copy Markdown
Contributor

HackingRepo commented Apr 15, 2026

it even completly removed https://askubuntu.com/questions/1065434/usr-bin-pg-no-longer-present-in-18-04-util-linux-package, so that need to be on PL3 and PL4 only detected

@EsadCetiner
Copy link
Copy Markdown
Member Author

@HackingRepo

I see pg is not installed even on Ubuntu, by default and even no APT package exists for it

That's what I said in my PR description.

So just we can move the command to PL3 better not just PL2

There's no stricter sibling rule at PL-3, and I don't see a reason to even make a PL-3 rule.

@HackingRepo
Copy link
Copy Markdown
Contributor

HackingRepo commented Apr 15, 2026

No, at PL2 that still can cause FPs @EsadCetiner, it must be also excluded at PL1 and PL2 both not just PL1

@HackingRepo
Copy link
Copy Markdown
Contributor

simply add also it to unix-shell-fps-pl2.ra file not just unix-shell-fps-pl1.ra

@EsadCetiner
Copy link
Copy Markdown
Member Author

@HackingRepo

No, at PL2 that still can cause FPs, it must be also excluded at PL1 and PL2 both not just PL1

Ok, and? do you have anything to prove this is a big enough problem at PL-2? As far as I can tell this specific false positive doesn't look too common, and considering the fact pg is not very commonly installed it provides low value at level 1.

simply add also it to unix-shell-fps-pl2.ra file not just unix-shell-fps-pl1.ra

As I mentioned before, there is no stricter sibling rule at PL-3 which can detect pg.

@EsadCetiner EsadCetiner added the backport:lts-4.25 PR that must be backported to LTS release label Apr 16, 2026
@fzipi fzipi force-pushed the fix-remove-pg-command branch from 9e3ebe4 to a1a77e6 Compare April 18, 2026 13:09
@fzipi
Copy link
Copy Markdown
Member

fzipi commented Apr 18, 2026

I'll say let's first merge this one, and if @HackingRepo wants to run some tests to see the value of moving to major PLs we can reconsider.

@fzipi fzipi added this pull request to the merge queue Apr 18, 2026
Merged via the queue into coreruleset:main with commit 82195a4 Apr 18, 2026
9 of 10 checks passed
@EsadCetiner EsadCetiner deleted the fix-remove-pg-command branch April 18, 2026 16:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:lts-4.25 PR that must be backported to LTS release release:fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants