coreruleset · EsadCetiner · Oct 2, 2024 · Oct 3, 2024 · Oct 7, 2024 · Oct 26, 2024
diff --git a/regex-assembly/933160.ra b/regex-assembly/933160.ra
@@ -40,6 +40,7 @@ md5
 opendir
 passthru
 popen
+printf
 readfile
 tmpfile
 unpack

diff --git a/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf b/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
@@ -274,27 +274,27 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
 # The list of PHP functions is divided into four groups of varying attack/false positive risk.
 # Four separate rules are used to detect these groups of functions:
 #
-# - Rule 933150: ~40 words highly common to PHP injection payloads and extremely rare in
+# - Rule 933150: ~242 words highly common to PHP injection payloads and extremely rare in
 #		natural language or other contexts.
 #		Examples: 'base64_decode', 'file_get_contents'.
 #		These words are detected as a match directly using @pmFromFile.
 #		Function names are defined in php-function-names-933150.data
 #
-# - Rule 933160: ~220 words which are common in PHP code, but have a higher chance to cause
+# - Rule 933160: ~31 words which are common in PHP code, but have a higher chance to cause
 #		false positives in natural language or other contexts.
 #		Examples: 'chr', 'eval'.
 #		To mitigate false positives, a regexp looks for PHP function syntax, e.g. 'eval()'.
 #		Regexp is generated from function names in /regexp-assemble/data/933160.ra
 #
-# - Rule 933151: ~1300 words of lesser importance. This includes most PHP functions and keywords.
+# - Rule 933151: ~2200 words of lesser importance. This includes most PHP functions and keywords.
 #		Examples: 'addslashes', 'array_diff'.
 #		For performance reasons, the @pmFromFile operator is used, and many functions from lesser
 #		used PHP extensions are removed.
 #		To mitigate false positives, we only match when the '(' character is also found.
 #		This rule only runs in paranoia level 2 or higher.
 #		Function names are defined in php-function-names-933151.data
 #
-# - Rule 933161: ~200 words with short or trivial names, possibly leading to false positives.
+# - Rule 933161: ~95 words with short or trivial names, possibly leading to false positives.
 #		Examples: 'abs', 'cos'.
 #		To mitigate false positives, a regexp matches on function syntax, e.g. 'abs()'.
 #		This rule only runs in paranoia level 3 or higher.
@@ -362,7 +362,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F
 # (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
 #   crs-toolchain regex update 933160
 #
-SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b\(?[\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|f(?:ile(?:group)?|open)|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:\*.*\*/|/.*)|#.*|[\s\x0b\"])*[\"']*\)?[\s\x0b]*\([^\)]*\)" \
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b\(?[\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|f(?:ile(?:group)?|open)|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|r(?:intf|ev))|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:\*.*\*/|/.*)|#.*|[\s\x0b\"])*[\"']*\)?[\s\x0b]*\([^\)]*\)" \
     "id:933160,\
     phase:2,\
     block,\

diff --git a/rules/php-function-names-933150.data b/rules/php-function-names-933150.data
@@ -170,7 +170,6 @@ preg_replace_callback
 preg_replace_callback_array
 preg_split
 print_r
-printf
 proc_close
 proc_get_status
 proc_nice

diff --git a/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933150.yaml b/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933150.yaml
@@ -567,3 +567,35 @@ tests:
         output:
           log:
             no_expect_ids: [933150]
+  - test_id: 34
+    desc: False positive with SprintForTheCause matching printf
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          method: POST
+          port: 80
+          uri: "/post/?test=SprintForTheCause"
+          version: "HTTP/1.1"
+        output:
+          log:
+            no_expect_ids: [933150]
+  - test_id: 35
+    desc: Don't block printf function (Handled by 933160)
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          method: POST
+          port: 80
+          uri: "/post/?test=printf(foo)"
+          version: "HTTP/1.1"
+        output:
+          log:
+            no_expect_ids: [933150]
diff --git a/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933160.yaml b/tests/regression/tests/REQUEST-933-APPLICATION-ATTACK-PHP/933160.yaml
@@ -1,6 +1,6 @@
 ---
 meta:
-  author: "lifeforms, Franziska Bühler, Max Leske, azurit"
+  author: "lifeforms, Franziska Bühler, Max Leske, azurit, Esad Cetiner"
 rule_id: 933160
 tests:
   - test_id: 1
@@ -728,3 +728,35 @@ tests:
         output:
           log:
             no_expect_ids: [933160]
+  - test_id: 41
+    desc: False positive with SprintForTheCause matching printf
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          method: POST
+          port: 80
+          uri: "/post/?test=SprintForTheCause"
+          version: "HTTP/1.1"
+        output:
+          log:
+            no_expect_ids: [933160]
+  - test_id: 42
+    desc: Block Printf PHP function
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          method: POST
+          port: 80
+          uri: "/post/?test=printf(foo)"
+          version: "HTTP/1.1"
+        output:
+          log:
+            expect_ids: [933160]
-Original file line number
+Diff line change
@@ Expand Up / @@ -40,6 +40,7 @@ md5 @@
     opendir
     passthru
     popen
+    printf
     readfile
     tmpfile
     unpack
@@ Expand Down @@