{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/571","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/571/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/571/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/571/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/571","id":174958589,"number":571,"title":"941120 (XSS Filter) REQUEST_COOKIES:  FP suspicion and question","user":{"login":"jschleus","id":20492485,"avatar_url":"https://avatars.githubusercontent.com/u/20492485?v=3","gravatar_id":"","url":"https://api.github.com/users/jschleus","html_url":"https://github.com/jschleus","followers_url":"https://api.github.com/users/jschleus/followers","following_url":"https://api.github.com/users/jschleus/following{/other_user}","gists_url":"https://api.github.com/users/jschleus/gists{/gist_id}","starred_url":"https://api.github.com/users/jschleus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschleus/subscriptions","organizations_url":"https://api.github.com/users/jschleus/orgs","repos_url":"https://api.github.com/users/jschleus/repos","events_url":"https://api.github.com/users/jschleus/events{/privacy}","received_events_url":"https://api.github.com/users/jschleus/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-09-04T17:02:36Z","updated_at":"2016-09-11T19:52:09Z","closed_at":"2016-09-11T19:29:13Z","body":"Not important but ... I found that the following  part of a Request Cookie\r\n\r\n     PSN: VVQ Dk8OmLOX1ONZPdsLBw==\r\n\r\n matches rule 941120 (CRS3 RC2) with\r\n\r\n     Matched Data: 1ONZPdsLBw=\r\n\r\nOk, that may be not the kind of string that the rule was built for so it may be a kind of FP but on the other side the requesting IP sent only that single request that seems not to be a really \"wanted\" (good) one so it seems something like a \"true\" FP or a \"false\" TP.\r\n\r\nBy the way the total Cookie string has a length of 7770  bytes (!) what brings me to the question if it would be meaningful to build a rule that checks (optionally) the length of the variable REQUEST_COOKIES against a given limit, especially for servers with short  cookie strings or even without any cookie usage."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/246200539","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/571#issuecomment-246200539","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/571","id":246200539,"user":{"login":"jschleus","id":20492485,"avatar_url":"https://avatars.githubusercontent.com/u/20492485?v=3","gravatar_id":"","url":"https://api.github.com/users/jschleus","html_url":"https://github.com/jschleus","followers_url":"https://api.github.com/users/jschleus/followers","following_url":"https://api.github.com/users/jschleus/following{/other_user}","gists_url":"https://api.github.com/users/jschleus/gists{/gist_id}","starred_url":"https://api.github.com/users/jschleus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschleus/subscriptions","organizations_url":"https://api.github.com/users/jschleus/orgs","repos_url":"https://api.github.com/users/jschleus/repos","events_url":"https://api.github.com/users/jschleus/events{/privacy}","received_events_url":"https://api.github.com/users/jschleus/received_events","type":"User","site_admin":false},"created_at":"2016-09-11T19:52:09Z","updated_at":"2016-09-11T19:52:09Z","body":"Ok, but that cookies I would expect smaller than for e.g. the (arbitrary) 300 bytes limit. The longer ones seems sometimes like a collection of all cookies the browser  (of an  infected host?) has gathered.\r\nBut I am not an expert on this area.\r\n "}}
{"actor":{"display_login":"jschleus"}}