[RuleSet-injection]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [RuleSet-injection] of settings/requestclassifier.ini.
File
settings/requestclassifier.ini; override it in settings/override/requestclassifier.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Class | (empty) | Matched against the query and the path, decoded once; a posted body is never looked at. Rules: sql-union, sql-tautology (' or '1'='1), sql-boolean (or 1=1--), sql-time (sleep(, benchmark(), sql-schema (information_schema), sql-stacked (;drop table), sql-function, cmd-file (/etc/passwd), cmd-chain (;id, |cat, $(...), backticks), jndi, ssti ({{7*7}}, ${7*7}, #{...}, <%= %>), xss-script (<script, %3Cscript), xss-event (onerror=, <svg/on...), xss-url (javascript:), php-code. A search for "union station", O'Reilly, "select or drop" or <b> is no injection. |
| Patterns[] | (empty array) | |
| Disabled[] | (empty array) |
See also
Generated example: requestclassifier.ini [RuleSet-injection]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/requestclassifier.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment