Repository navigation
fix(detection): port the feedback-wave fixes to the JVM engine - #53
Merged
Merged
Conversation
A passive rate-limit hit logged as a penetration attempt with no reason. Without trigger info the line now reads Suspicious activity detected with the reason, matching the reference engine. Refs #52.
…quest scan Refs #52.
excluded_semantic_detection_headers (global) and detectionExclusion(semanticHeaders) (route) name headers whose values skip the semantic analyzer only. Regex scanning is unchanged and the default is empty. Refs #52.
A whole logged-in cookie header scored as one long semantic value and was flagged. Each pair now goes through the same header path and value budget. Refs #52.
detection_max_scan_seconds (default 10.0, range 0.1 to 60) bounds the regex scan time of one request across every field and pattern. It is measured as the thread CPU time of the scan worker, since wall time on a loaded host flags benign requests. Exhaustion records a weighted pattern_timeout threat named scan_time_budget_exhausted (fail-closed), and the trigger names it when it tips the score. Refs #52.
github-actions
Bot
added
documentation
…ivers The 100 percent line gate keys its documented exclusions by line number, so the lines this branch added shifted them. Refs #52.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I am porting the verified reference fixes from guard-core to the JVM engine.
[PASSIVE MODE] Suspicious activity detected from ... - Reason: ....enable_dynamic_rulesdocumentation lists exactly what a dynamic rule can change.excluded_semantic_detection_headers(global) anddetectionExclusion(semanticHeaders = ...)(route). Listed headers skip the semantic analyzer only, regex scanning is unchanged, default empty.name=valuepair at a time, each pair through the same header path and value budget.detection_max_scan_seconds(default 10.0, range 0.1 to 60): a per-request regex scan budget measured in thread CPU time inside the scan worker (not wall time, which flags benign requests on a loaded host). Exhaustion records a weightedpattern_timeoutthreat namedscan_time_budget_exhaustedand fails closed, and the trigger text names it when it tips the score.Each point has its own commit with its tests. The conformance corpus is untouched and
fullCorpusGatestays green.Closes #52