FPs with rule 953120 for gzip data
See original GitHub issueDescription
I’m experiencing lots of FPs with rule 953120
for Content-encoding: gzip
data. In all cases i analyzed, FPs were caused by these strings in gzip data:
<?\t
<?\r
I suggest following solutions:
- Ceating sibling rule in PL2 for pattern
<\?\s+
. - Chaining rule which checks that
Content-encoding != gzip
. (Can we really trust it?) - Chaining rule which checks for gzip magic number in
RESPONSE_BODY
. (What about other encodings, for example Brotli?)
I’m voting for (1). I can send a PR for any.
Issue Analytics
- State:
- Created a year ago
- Reactions:1
- Comments:7 (7 by maintainers)
Top Results From Across the Web
Rule 933100 FP on "<?xml" body · Issue #654 - GitHub
I've noticed this if the client did not send the proper XML Content-Type. Do you have control over the client code making the...
Read more >How To Optimize Your Site With GZIP Compression
Apache mod_deflate has some rules to avoid compression for older browsers. Already-compressed content: Most images, music and videos are already compressed. Don ...
Read more >GNU Gzip: General file (de)compression
GNU Gzip: General file (de)compression. This manual is for GNU Gzip (version 1.12, 2 April 2022), and documents commands for compressing and decompressing...
Read more >Configure the Minimize payload rule - Akamai TechDocs
Use the behaviors in this sub-rule to reduce the size of delivered content and decrease the number of bytes sent by your <<PRODUCT_NAME>>...
Read more >gzip — Support for gzip files — Python 3.11.1 documentation
Source code: Lib/gzip.py This module provides a simple interface to compress and decompress files just like the GNU programs gzip and gunzip would....
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Yes i meant it just like you wrote it.
@dune73 I have more info here: Solution number 3 is back in the game as I enabled brotli instead of gzip to see what happens and FPs are gone. I was testing it for about a month and there was no single FP similar to one above. Problematic data may be somehow related/tied to how gzip works.