4 ms·
Can someone with mod_security test a regex I wrote that should mitigate this? /\(.?\)\s\{.?\}\s\;/ from testing seems to catch any variants that I can think of
by Sanddancer 12y ago
Can someone with mod_security test a regex I wrote that should mitigate this? /\(.?\)\s\{.?\}\s\;/ from testing seems to catch any variants that I can think of that can trigger this bug, but I don't have a machine easily available to me at the moment to test with, unfortunately.
- fragmede 12y agoRedhat has some here: https://access.redhat.com/articles/1200223 https://access.redhat.com/articles/1200223
- Sanddancer 12y agoThose regexes seem a bit too fragile for my liking. Adding an extra space between the paren and the bracket breaks it, naming the function breaks it, etc. Plus it has a bigger chance of triggering false positives. It's an okay emergency fix, but I'm positive one can do better.
- jimrandomh 12y agoYour regex was damaged by HN's comment formatting. To get it to post correctly, put it on a line with four leading spaces.
- Sanddancer 12y agoRepost, because HN "formatted" it for me /\((.*)?\)\s*\{(.*)?\}\s*\;/ I have qualms against redhat's fix, because it seems like it would create too many false positives, and additionally looks way too easy to work around just by adding spaces, etc.