Stuck on an issue?
Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.
And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.
Rewrite/rethink rule 942260 with re2 compatibility
See original GitHub issueMotivation
Rule 942260 is using ++ (possesive quantifier) and it is not supported.
[\"'`]\s*?[^?\w\s=.,;)(]++\s*?[(@\"'`]*?\s*?\w+\W+\w
We need to see if we can find a viable alternative or that can be dropped somehow.
Proposed solution
None yet.
Alternatives
- Just remove possessive quantifier. re2 matches should be guaranteed to run in time linear in the size of the input (but we are testing it).
Additional context
Possessive matching isn’t supported in re2 ((?>re) | possessive match of re (NOT SUPPORTED)).
Issue Analytics
- State:
- Created 2 years ago
- Comments:19 (19 by maintainers)
Top Results From Across the Web
Vulnerable regexp in rule 942260, 942490 (was: 942330) #1359
The issue is not directly exploitable on ModSecurity 2 thanks to PCRE match limit settings, that are very low by default. The rule...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
@fzipi you’re right. It’s not a good idea to do everything now. I’ve opened a separate issue for clean up rules 942180 and 942340.
Not strictly, but I though it would make sense to clean those up as well. Since I’m in the flow… 😉