4 ms·

Don't forget about eating requests it thinks are SQLi. We had an English sentence in the POST body that we reduced the content of to '"a" or b in c' that cloud

Don't forget about eating requests it thinks are SQLi. We had an English sentence in the POST body that we reduced the content of to '"a" or b in c' that cloud-based was returning a 401 on. But '"a" or b' nor 'a or b in c' did. That was a fun time tracking down. Luckily the users that experiencing the issue were in house, so they actually reported the bug.

jgrahamc 10y ago
Did you report that to us?
- _asummers 10y ago
  We did not, we disabled protection til we found the offender then reenacted the ones that weren't it. It seemed very much a purposeful feature from the description of the setting.
  - jgrahamc 10y ago
    What you describe is a false positive. We would very much like to know about them.