From 048c3720661df00b376f6aa17fce28226d02e17e Mon Sep 17 00:00:00 2001 From: azurit Date: Sun, 4 Oct 2026 10:28:18 +0200 Subject: [PATCH 1/6] Update wordpress-rule-exclusions-before.conf --- plugins/wordpress-rule-exclusions-before.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/wordpress-rule-exclusions-before.conf b/plugins/wordpress-rule-exclusions-before.conf index 6c0a499..073645b 100644 --- a/plugins/wordpress-rule-exclusions-before.conf +++ b/plugins/wordpress-rule-exclusions-before.conf @@ -46,6 +46,7 @@ SecRule REQUEST_FILENAME "@rx /wp-(?:login|admin/admin-ajax)\.php$" \ nolog,\ ctl:ruleRemoveTargetById=920230;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=920273;ARGS:redirect_to,\ + ctl:ruleRemoveTargetById=932235;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=931130;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=942430;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=942431;ARGS:redirect_to,\ From 6fe60a3fecec645f3f8b185a97a23f760f9e9413 Mon Sep 17 00:00:00 2001 From: azurit Date: Sun, 4 Oct 2026 10:32:08 +0200 Subject: [PATCH 2/6] Update 9507100.yaml --- .../9507100.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml index 1e60636..45d17a1 100644 --- a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml +++ b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml @@ -97,3 +97,19 @@ tests: output: log: expect_ids: [932160] + - test_id: 4 + desc: False positive with '=post&' + stages: + - input: + dest_addr: 127.0.0.1 + headers: + Host: localhost + User-Agent: OWASP CRS test agent + Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 + port: 80 + method: GET + version: "HTTP/1.1" + uri: /get/wp-login.php?redirect_to=https%3A%2F%example.com%2Fwp-admin%2Fedit.php%3Fs%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D1%26post_format%26seo-filter%26filter_action%3DFiltrova%25C5%25A5%26paged%3D1%26action2%3D-1 + output: + log: + no_expect_ids: [932235] From 25828bc20b745d6ec938920d6fe3e8a4aa049b8e Mon Sep 17 00:00:00 2001 From: azurit Date: Sun, 4 Oct 2026 11:05:21 +0200 Subject: [PATCH 3/6] Update wordpress-rule-exclusions-before.conf --- plugins/wordpress-rule-exclusions-before.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plugins/wordpress-rule-exclusions-before.conf b/plugins/wordpress-rule-exclusions-before.conf index 073645b..bb2881d 100644 --- a/plugins/wordpress-rule-exclusions-before.conf +++ b/plugins/wordpress-rule-exclusions-before.conf @@ -47,7 +47,9 @@ SecRule REQUEST_FILENAME "@rx /wp-(?:login|admin/admin-ajax)\.php$" \ ctl:ruleRemoveTargetById=920230;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=920273;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=932235;ARGS:redirect_to,\ + ctl:ruleRemoveTargetById=932236;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=931130;ARGS:redirect_to,\ + ctl:ruleRemoveTargetById=942120;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=942430;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=942431;ARGS:redirect_to,\ ctl:ruleRemoveTargetById=942432;ARGS:redirect_to,\ From 156cea36c048c7fc02640424add761ad980780de Mon Sep 17 00:00:00 2001 From: azurit Date: Sun, 4 Oct 2026 11:06:57 +0200 Subject: [PATCH 4/6] Update no_expect_ids format in YAML test --- .../regression/wordpress-rule-exclusions-plugin/9507100.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml index 45d17a1..7812598 100644 --- a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml +++ b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml @@ -112,4 +112,7 @@ tests: uri: /get/wp-login.php?redirect_to=https%3A%2F%example.com%2Fwp-admin%2Fedit.php%3Fs%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D1%26post_format%26seo-filter%26filter_action%3DFiltrova%25C5%25A5%26paged%3D1%26action2%3D-1 output: log: - no_expect_ids: [932235] + no_expect_ids: + - 932235 + - 932236 + - 942120 From a9a34669c160bff75098252e4e2414de89a46073 Mon Sep 17 00:00:00 2001 From: azurit Date: Sun, 4 Oct 2026 15:49:46 +0200 Subject: [PATCH 5/6] Update 9507100.yaml --- tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml index 7812598..099745c 100644 --- a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml +++ b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml @@ -109,7 +109,7 @@ tests: port: 80 method: GET version: "HTTP/1.1" - uri: /get/wp-login.php?redirect_to=https%3A%2F%example.com%2Fwp-admin%2Fedit.php%3Fs%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D1%26post_format%26seo-filter%26filter_action%3DFiltrova%25C5%25A5%26paged%3D1%26action2%3D-1 + uri: /get/wp-login.php?redirect_to=https%3A%2F%2Fexample.com%2Fwp-admin%2Fedit.php%3Fs%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D1%26post_format%26seo-filter%26filter_action%3DFiltrova%25C5%25A5%26paged%3D1%26action2%3D-1 output: log: no_expect_ids: From 593f4313246272ee2fc72cbece889c42baaf47cd Mon Sep 17 00:00:00 2001 From: azurit Date: Sun, 4 Oct 2026 16:35:42 +0200 Subject: [PATCH 6/6] Update 9507100.yaml --- tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml index 099745c..f6bf4f8 100644 --- a/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml +++ b/tests/regression/wordpress-rule-exclusions-plugin/9507100.yaml @@ -109,7 +109,7 @@ tests: port: 80 method: GET version: "HTTP/1.1" - uri: /get/wp-login.php?redirect_to=https%3A%2F%2Fexample.com%2Fwp-admin%2Fedit.php%3Fs%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D1%26post_format%26seo-filter%26filter_action%3DFiltrova%25C5%25A5%26paged%3D1%26action2%3D-1 + uri: /get/wp-login.php?redirect_to=https%3A%2F%2Flocalhost%2Fwp-admin%2Fedit.php%3Fs%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D1%26post_format%26seo-filter%26filter_action%3DFiltrova%25C5%25A5%26paged%3D1%26action2%3D-1 output: log: no_expect_ids: