Added support for <? in Rule 933100

meetug · meetug · commit 7fdc4a69698b · 2019-11-12T14:37:36.000-08:00
diff --git a/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf b/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
@@ -43,7 +43,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:933012,phase:2,pass,nolog,skipAf
 # Therefore, that pattern is now checked by rule 933190 in paranoia levels
 # 3 or higher.
 #
-SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:<\?(?:[^x]|x[^m]|xm[^l]|xml[^\s]|xml$)|<\?php|\[(?:\/|\\\\)?php\])" \
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:<\?(?:[^x]|x[^m]|xm[^l]|xml[^\s]|xml$|$)|<\?php|\[(?:\/|\\\\)?php\])" \
     "id:933100,\
     phase:2,\
     block,\

Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:933012,phase:2,pass,nolog,skipAf`
`43`	`43`	`# Therefore, that pattern is now checked by rule 933190 in paranoia levels`
`44`	`44`	`# 3 or higher.`
`45`	`45`	`#`
`46`		`-SecRule REQUEST_COOKIES\|!REQUEST_COOKIES:/__utm/\|REQUEST_COOKIES_NAMES\|ARGS_NAMES\|ARGS\|XML:/* "@rx (?:<\?(?:[^x]\|x[^m]\|xm[^l]\|xml[^\s]\|xml$)\|<\?php\|\[(?:\/\|\\\\)?php\])" \`
	`46`	`+SecRule REQUEST_COOKIES\|!REQUEST_COOKIES:/__utm/\|REQUEST_COOKIES_NAMES\|ARGS_NAMES\|ARGS\|XML:/* "@rx (?:<\?(?:[^x]\|x[^m]\|xm[^l]\|xml[^\s]\|xml$\|$)\|<\?php\|\[(?:\/\|\\\\)?php\])" \`
`47`	`47`	`"id:933100,\`
`48`	`48`	`phase:2,\`
`49`	`49`	`block,\`