fix: rule 930110 is not supposed to match bare '..' without (back)slashes #4050
Conversation
|
📊 Quantitative test results for language: |
|
@theseion Can you please check what is going on? It should work, see (test 7 is on the last line): Maybe the backend is returning 400 Bad Request? |
|
I think you need to change the test to |
|
No, it is a negative test... |
|
There's an override for nginx in |
16f8b10 to
7e33353
Compare
|
I've added a change to your PR that fixes a race condition when waiting for the server to start. |
|
That is why i'm asking why exactly is it not passing as i cannot get this information by myself (i assume - i don't think i have access to it, correct me if i'm wrong). And that is why i was suggesting that backend (apache/nginx) is, maybe, returning code 400 (Bad Request) because this is what Apache and also nginx is returning when |
|
As I wrote, just update |
Cool, thanks, misunderstood you the first time. |
Feature was originally added in #2016 but was incorrectly implemented. Test, which was supposed to check for this, was not working because rule is targeting
REQUEST_URIfrom which is engine removing.and..in the path part of the URI (path is normalized).