Repository navigation
Conversation
The operator rejected any area number of 740 or above. Since the Social Security Administration randomised assignment in June 2011 every area number except 000, 666 and 900-999 is in use, so valid numbers in the 740-899 range were never detected. The check is now area == 0, area == 666 or area >= 900. Same change as the 3.x one in owasp-modsecurity#3669. Fixes owasp-modsecurity#2970 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0181jBv5JdNQviwDzfnkf1Gy
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|




What
@verifySSN(apache2/re_operators.c) now rejects an area number only when it is000,666or900to999. The previous check rejected everything from740up. Same change as #3669 for 3.x.Why
Since the Social Security Administration randomised assignment in June 2011, every area number except 000, 666 and 900-999 is issued, so numbers with areas 740 to 899 are real SSNs that the operator never flagged.
Tests
New
tests/regression/misc/50-verifyssn.t(auto-discovered): areas 574 (matches), 800 (matches), 900 (no match), 666 (no match).Verified in a Debian bookworm container (apache2 2.4): on untouched
v2/masterthe area 800 case fails (200 instead of 403); on this branch all 4 pass. Unlike 3.x, 2.x does not consume the sharedsecrules-language-testssuite, so there is no submodule dependency here.References
Fixes #2970 (2.x)
Related to #3669
🤖 Generated with Claude Code