Andre
843171b985
Rule 932180 "Restricted File Upload Attempt" targets filename, scores 10 and blocks. Its pattern carries CRS's OS-pseudo-file list with no path anchor, so bare words matched any uploaded filename: module modules meminfo mounts misc mdstat mtrr loadavg locks version uptime cmdline stat swaps slabinfo partitions pagetypeinfo So release-version-2.zip, company-misc-notes.pdf and meminfo.txt were refused as critical RCE attempts. Found because it blocked an image upload to our own wiki, which sits behind EdgeGuard: the response carried x-edgeguard-id, the console found the event by that id, and the match was `module-` in the filename. These names mean something as a PATH and nothing as a filename, so the branch now requires a leading slash. The dotfile branch keeps its own (?:\b|^) anchor and is untouched. Measured against the previous pattern over a corpus of 51 names: 16 ordinary filenames released, NOTHING newly blocked, and every true positive still caught — .htaccess, .env, .aws/credentials, wp-config.php, /proc/version, /proc/self/environ, ../../proc/modules, uploads/../../proc/kcore. build_datetime bumped. An agent skips a feed whose stamp has not changed without reading it, so a corrected pattern under the old stamp would reach nobody.