coreruleset · theseion · Jun 24, 2025 · May 4, 2025 · May 4, 2025 · Jun 3, 2025
diff --git a/regex-assembly/952110.ra b/regex-assembly/952110.ra
@@ -0,0 +1,12 @@
+##! Please refer to the documentation at
+##! https://coreruleset.org/docs/development/regex_assembly/.
+
+##!+ i
+
+java[a-z\.]+Exception
+java[a-z\.]+Error
+org\.[a-z\.]+Exception
+com\.[a-z\.]+Exception
+##! Java stack strace errors
+Exception in thread "[^"]*"
+at\s+(?:java|javax|jakarta|org|com)
diff --git a/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf b/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf
@@ -34,7 +34,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:952012,phase:4,pass,nolog,tag:'O
 #
 # Ref: https://github.com/andresriancho/w3af/blob/master/w3af/plugins/grep/error_pages.py
 #
-SecRule RESPONSE_BODY "@pmFromFile java-errors.data" \
+SecRule RESPONSE_BODY "@rx (?i)java[\.a-z]+E(?:xception|rror)|(?:org|com)\.[\.a-z]+Exception|Exception in thread \"[^\"]*\"|at[\s\x0b]+(?:ja(?:vax?|karta)|org|com)" \
     "id:952110,\
     phase:4,\
     block,\

diff --git a/rules/java-errors.data b/rules/java-errors.data
diff --git a/tests/regression/tests/RESPONSE-952-DATA-LEAKAGES-JAVA/952110.yaml b/tests/regression/tests/RESPONSE-952-DATA-LEAKAGES-JAVA/952110.yaml
@@ -0,0 +1,194 @@
+---
+meta:
+  author: "Xhoenix"
+rule_id: 952110
+tests:
+  - test_id: 1
+    desc: "javax.servlet.ServletException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "javax.servlet.ServletException: Error occurred during request processing"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 2
+    desc: "org.springframework.web.client.HttpClientErrorException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "org.springframework.web.client.HttpClientErrorException: 400 Bad Request"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 3
+    desc: "org.hibernate.exception.ConstraintViolationException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "org.hibernate.exception.ConstraintViolationException: could not execute statement"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 4
+    desc: "java.net.SocketTimeoutException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "java.net.SocketTimeoutException: Read timed out"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 5
+    desc: "org.springframework.security.access.AccessDeniedException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "org.springframework.security.access.AccessDeniedException: Access is denied"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 6
+    desc: "java.lang.NullPointerException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "java.lang.NullPointerException"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 7
+    desc: "com.fasterxml.jackson.databind.JsonMappingException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "com.fasterxml.jackson.databind.JsonMappingException: Unexpected character ('}' (code 125)): was expecting double-quote to start field name"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 8
+    desc: "org.apache.jasper.JasperException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "org.apache.jasper.JasperException: Unable to compile class for JSP"}
+        output:
+          log:
+            expect_ids: [952110]
+  - test_id: 9
+    desc: "org.apache.catalina.LifecycleException"
+    stages:
+      - input:
+          dest_addr: "127.0.0.1"
+          port: 80
+          headers:
+            Host: "localhost"
+            User-Agent: "OWASP CRS test agent"
+            Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
+            Accept-Encoding: "gzip,deflate"
+            Accept-Language: "en-us,en;q=0.5"
+            Content-Type: "application/json"
+          method: "POST"
+          version: "HTTP/1.1"
+          uri: "/reflect"
+          data: |-
+            {"body": "org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina]]"}
+        output:
+          log:
+            expect_ids: [952110]