From 3f41be8c34cc7fd5ecae100409755ba3ebce4681 Mon Sep 17 00:00:00 2001 From: Andre Date: Fri, 30 Oct 2026 21:55:48 +0000 Subject: [PATCH] 920120 is a negated rule and must say so MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ModSecurity defines 920120 with !@rx: its pattern describes a filename made only of SAFE characters, and the rule fires when the filename does NOT match. A quote, an apostrophe, a semicolon, an equals sign or a backslash in a filename is an attempt to break out of the Content-Disposition header, and that is what the rule exists to catch. This format had no way to express a negation, so the rule was imported as a plain pattern and means the exact opposite: it matched every legitimate upload and missed every dangerous filename. It did no harm only because the engine carried a built-in rule under the same ID — a different rule entirely, matching content-type.*boundary.* on every ordinary multipart upload — which took precedence. The engine gained a `negate` field (3.0.61); this declares it. Both are needed: the flag alone with no engine support does nothing, and engine support with no flag leaves the rule inverted. build_datetime bumped, because an agent skips a feed whose stamp has not moved without reading it. --- rulesets.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rulesets.json b/rulesets.json index cd521c3..a408eab 100644 --- a/rulesets.json +++ b/rulesets.json @@ -1,5 +1,5 @@ { - "build_datetime": "2026-10-30T17:50:13Z", + "build_datetime": "2026-10-30T21:47:18Z", "owasp_top_10": { "version": "2025", "url": "https://owasp.org/Top10/2025/", @@ -154,7 +154,8 @@ "OWASP_CRS/PROTOCOL-ENFORCEMENT", "capec/1000/210/272" ], - "paranoia_level": 1 + "paranoia_level": 1, + "negate": true }, { "id": "920260",