Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am looking at a Java web application that compares all incoming request params and cookies against the following regex. If it matches, it is considered "an attack" and refuses the request. I'm guessing it's trying to prevent SQL injection / class loading or something, but I'm not sure. Can anyone help?
(.*\.|^|.*|\[('|"))(c|C)lass(\.|('|")]|\[).*
I'll take a guess... parsing the regular expression, it appears to be matching:
. OR ^ OR anything OR [class (case insensitive for the c only). OR quote (single or double)] OR [I'm not 100% sure on this. Sometimes the precedence rules are tricky, and I can't easily test this in java to see exactly how it behaves.
In general though, I find that breaking out the regular expression doesn't shed a lot of light! Certainly, it's not a very helpful rule. It seems to mainly be focused on finding instances of class, but it only does a case insensitive search on the c, so you could easily bypass this rule with clAss.
Given the search for class and quotes, I would guess that this is aiming to find an XSS payload (perhaps someone tried to inject something into the class parameter on a tag). However, it's hard to say for sure. Given that this appears to be a very poorly executed WAF rule anyway (for instance not properly checking in a case-insensitive way, and a few other minor details), I doubt the person who wrote this rule really knew what they were doing, which might make devising their intent much trickier.
^as a beginning character (which it normally is), but I wonder if that is the case given its location in the regular expression. Is it possible it is trying to match a literal^but that escaping it isn't necessary because of it is sandwiched between alternators? This would be similar to how]only needs to be escaped if it shows up inside a character set...