ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: opt / bitninja-waf3 / coreruleset / regex-assembly

# # # # # # # # # # # # # # # # # # # #
# configuration file for crs-toolchain
# # # # # # # # # # # # # # # # # # # #
patterns:
  # The Unix evasion patterns, were extended per decision in https://github.com/coreruleset/coreruleset/issues/2632.
  anti_evasion:
    # - [\x5c'\"\[)]: common evasion tokens and path expansion, e.g., `/bin/[c]''a""\t`
    # - (?:\|\||&&)\s*: hiding of empty variables through logial operators, e.g., `nc&&$u -p 777`
    # - \$[a-z0-9_@?!#{(*-]*: empty variable evasion, e.g., `n\$uc -p 777`
    # - [\x5c'\"\[)], \$[a-z0-9_@?!#{(*-]*: arithmetic expansion evasion, e.g., `c$((9))9`
    unix: |
      [\x5c'\"\[)]*(?:(?:(?:\|\||&&)\s*)?\$[a-z0-9_@?!#{(*-]*)?\x5c?
    windows: |
      [\"\^]*
  anti_evasion_suffix:
    # - <>: redirection, e.g., `cat<foo`
    # - ,: brace expansion, e.g., `""{nc,-p,777}`
    ## - &|: logical operators in headers, e.g., `a=nc&&$a -nlvp 555`
    unix: |
      [\s<>,&|)].*
    # "more foo", "more,foo", "more;foo", "more.com", "more/e",
    # "more<foo", "more>foo"
    windows: |
      [\s,;./<>].*
  # Same as above but does not allow any white space as the next token.
  # This is useful for words like `python3`, where `python@` would
  # create too many false positives because it would match `python `.
  anti_evasion_no_space_suffix:
    # This will match:
    #
    # python<<<foo
    # python2 foo
    #
    # It will _not_ match:
    # python foo
    unix: |
      (?:[<>,&|]|(?:[\w\d._-][\x5c'\"\[]*(?:(?:(?:\|\||&&)\s*)?\$[a-z0-9_@?!#{*-]*)?\x5c?)+[\s<>,&|]).*
    # This will match:
    #
    # python,foo
    # python2 foo
    #
    # It will _not_ match:
    # python foo
    windows: |
      (?:[,;./<>]|(?:[\w\d._-][\"\^]*)+[\s,;./<>]).*

[-] 920220-chain1.ra [edit]
[-] 942370.ra [edit]
[-] 922110-chain1.ra [edit]
[-] 932237.ra [edit]
[-] 942280.ra [edit]
[-] 942470.ra [edit]
[-] 932220.ra [edit]
[-] 933131.ra [edit]
[-] 942200.ra [edit]
[-] 932320.ra [edit]
[-] 942520.ra [edit]
[-] 942290.ra [edit]
[-] 932301.ra [edit]
[-] 932260.ra [edit]
[-] toolchain.yaml [edit]
[-] 931131.ra [edit]
[-] 942500.ra [edit]
[-] 920100.ra [edit]
[-] 941220.ra [edit]
[-] 942480.ra [edit]
[-] 921421.ra [edit]
[-] 932232.ra [edit]
[+] ..
[-] 932175.ra [edit]
[-] 934101.ra [edit]
[-] 942410.ra [edit]
[-] 932236.ra [edit]
[-] 920120.ra [edit]
[-] 933160.ra [edit]
[-] 920260.ra [edit]
[-] 920221.ra [edit]
[-] 942390.ra [edit]
[-] 941390.ra [edit]
[-] 942521.ra [edit]
[-] 934170.ra [edit]
[-] 932205-chain1.ra [edit]
[-] 942190.ra [edit]
[-] 942350.ra [edit]
[-] 942380.ra [edit]
[-] 932140.ra [edit]
[-] 944150.ra [edit]
[-] 951240.ra [edit]
[-] 942180.ra [edit]
[-] 932131.ra [edit]
[-] 932206.ra [edit]
[-] 932235.ra [edit]
[-] 944152.ra [edit]
[-] 932210.ra [edit]
[-] 942550.ra [edit]
[-] 933200.ra [edit]
[-] 920521.ra [edit]
[-] 942362.ra [edit]
[-] 951230.ra [edit]
[-] 932130.ra [edit]
[-] 932321.ra [edit]
[-] 933211.ra [edit]
[-] 932238.ra [edit]
[-] 932200.ra [edit]
[-] 932230.ra [edit]
[-] 934120.ra [edit]
[-] 932205.ra [edit]
[-] 932310.ra [edit]
[-] 933210.ra [edit]
[-] 932311.ra [edit]
[-] 934150.ra [edit]
[-] 942150.ra [edit]
[-] 944151.ra [edit]
[-] 941210.ra [edit]
[-] 942120.ra [edit]
[-] 942240.ra [edit]
[-] 941130.ra [edit]
[-] 942230.ra [edit]
[-] 932239.ra [edit]
[-] 934100.ra [edit]
[-] 942152.ra [edit]
[-] 933161.ra [edit]
[-] 934160.ra [edit]
[-] 942260.ra [edit]
[-] 942400.ra [edit]
[+] include
[-] 942330.ra [edit]
[-] 942140.ra [edit]
[-] 932380.ra [edit]
[-] 941160.ra [edit]
[-] 920600.ra [edit]
[-] 932231.ra [edit]
[-] 942321.ra [edit]
[-] 942360.ra [edit]
[-] 942131.ra [edit]
[-] 942320.ra [edit]
[-] 934140.ra [edit]
[+] exclude
[-] 931130.ra [edit]
[-] 942440.ra [edit]
[-] 942340.ra [edit]
[-] 942310.ra [edit]
[-] 932125.ra [edit]
[-] 932240.ra [edit]
[-] 921422.ra [edit]
[-] 942170.ra [edit]
[-] 932370.ra [edit]
[-] 942440-chain1.ra [edit]
[-] 930100.ra [edit]
[-] 942210.ra [edit]
[-] 942540.ra [edit]
[-] 932300.ra [edit]
[-] 942130.ra [edit]
[-] 942300.ra [edit]
[-] 932250.ra [edit]
[-] 942560.ra [edit]
[-] 942151.ra [edit]