Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Very large amount of false positives with rule 932200

See original GitHub issue

Description

Rule 932200 is generating very high level of false positives on real world traffic.
Here are some of the examples I found after running it for a few hours:

https://website/bla/grille?jour= 4
<a href='https://newswebsite/article.html'>someone's name</a>
{"$productid":"4242"}

I have not dug enough to determine if this is a bug in the regex or just a FP prone strategy. Considering that it triggers a lot (on purpose?) on fairly common patterns, does it belong in PL1?

Confirmation

[X] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

Issue Analytics

State:
Created 3 years ago
Comments:8 (7 by maintainers)

Top GitHub Comments

2reactions

Taiki-Sancommented, Dec 16, 2020

Hey, my apologies for the delayed response. At the time of 1820, our runtime didn’t actually support MATCHED_VAR but combined with 1831, the issue can be closed on my end. I’ll run more tests in the future and depending of what they show, I’ll open a new, more specific issue 😃

0reactions

franbuehlercommented, Dec 16, 2020

Do you have any updates on this, @Taiki-San? In PR #1820 the rule has been fixed and additionally in PR #1831 the rule has been moved to PL2. We would like to hear your feedback so that we can properly close this issue.

Top Results From Across the Web

Potential for False Positive Results with Antigen Tests ... - FDA

Laboratories should expect some false positive results when screening large populations with a low prevalence of COVID-19 infection.

The impact of false positive COVID-19 results in an area of low ...

KEYWORDS: COVID-19, false positive results, high prevalence, low prevalence ... in a very low prevalence setting, the negative predictive value was 100% (no ......

What are False Positives? | Dow Jones Professional

A “false positive” is an error in reporting which incorrectly indicates a match. To follow “Know Your Customer” (KYC) regulations, firms must conduct ......

Intrusion Detection - OWASP Foundation

An IDS, on the other hand, will only notify on the false positive and will not ... false negatives), produce an extremely large...

False-Positive HIV Test Results | CDC

Generally, HIV tests have high specificity, meaning that there are few false-positive results and most uninfected.