Skip to content

Conversation

@theseion
Copy link
Contributor

During the refactoring of the RCE rules and the "upto3" and "4andup" data files, rules 932220 and 932250 were changed to accidentally include data files without cmdline suffixes, even thoug both rules use the cmdline processor. This commit fixes both rules, making them process the cmdline suffixes as originally intended.

@theseion theseion requested review from EsadCetiner and fzipi August 10, 2025 14:35
@github-actions
Copy link
Contributor

github-actions bot commented Aug 10, 2025

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

Copy link
Member

@EsadCetiner EsadCetiner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've just tested this locally and everything works as expected.

During the refactoring of the RCE rules and the "upto3" and "4andup"
data files, rules 932220 and 932250 were changed to accidentally include
data files without cmdline suffixes, even though both rules use the
cmdline processor. This commit fixes both rules, making them process the
cmdline suffixes as originally intended.
@theseion theseion added this pull request to the merge queue Aug 20, 2025
Merged via the queue into coreruleset:main with commit 59ed32c Aug 20, 2025
7 checks passed
@theseion theseion deleted the fix-932220-932250 branch August 20, 2025 06:09
@S0obi
Copy link
Contributor

S0obi commented Aug 20, 2025

@theseion is this PR linked to issue #4241 ?

@EsadCetiner
Copy link
Member

@S0obi No, this fixes a bug where some suffixes aren't being applied correctly resulting in false negatives. I'll reference the PR in the issue when I have a fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants