Rule 941130: False positive

[Taiki-San]

Type of Issue

False positive.

Description

The rule incorrectly (I think) match patterns finishing with base64.
Specifically, because of the starting [\s\S], patterns like blablabase64 will match.

I suspect the reason is that the regex tries to do too many things.
Specifically, trying to touch the starting condition to simply be [\s] break the match of patterns like <!ENTITY % cgger SYSTEM.
Not sure what a fix would be besides moving [\s\S] inside the OR condition of each pattern.

Confirmation

[X] I have removed any personal data (email addresses, IP addresses,
passwords, domain names) from any logs posted.

[github-actions]

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

[Taiki-San]

The issue still exists, not sure tagging it as stale and closing it is the right way forward :)

[dune73]

Correct.

Yes so far nobody seemed to care enough to actually get going on this. I have added it to the next meeting. Chances are we will find a volunteer that way.

#1683

[Taiki-San]

Thanks! I'm hoping to get a bit of time to focus on them in the coming weeks/months otherwise.

[dune73]

We took this to our CRS Meetup in Bern and wrote a fix together: #1701

Removing it from the meeting agenda.