client9 / client9/libinjection

Libinjection - XSS Detection Rule 94110 false/positive

Open
#155 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
1k
Forks
282
PR merge metrics
No merged PRs in 30d

Description

**Description**
If you use the following Json in the playload, the rule 94110 is triggered. The problem is the string "filter={AnyChar}"
"query":"filter=in(labels.name,"test")"

**Error message:**

"message":"XSS Attack Detected via libinjection","action":"Matched","site":"Global","details":{"message":"Warning. detected XSS using libinjection. ","data":"Matched Data: XSS data found within ARGS:query: filter=in(labels.name,\\x22test\\x22)"

From my point of view, the rule should not be triggered by this payload

Here is the orginal issue: https://github.com/coreruleset/coreruleset/issues/2041#issuecomment-804098811

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.