Skip to content

fix: accept SSN area numbers up to 899 in @verifySSN (2.x) - #3672

Open
fzipi wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
fzipi:v2/issue-2970-verifyssn-area
Open

fzipi wants to merge 1 commit into
owasp-modsecurity:v2/masterfrom
fzipi:v2/issue-2970-verifyssn-area

Conversation

@fzipi

@fzipi fzipi commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator

What

@verifySSN (apache2/re_operators.c) now rejects an area number only when it is 000, 666 or 900 to 999. The previous check rejected everything from 740 up. Same change as #3669 for 3.x.

Why

Since the Social Security Administration randomised assignment in June 2011, every area number except 000, 666 and 900-999 is issued, so numbers with areas 740 to 899 are real SSNs that the operator never flagged.

Tests

New tests/regression/misc/50-verifyssn.t (auto-discovered): areas 574 (matches), 800 (matches), 900 (no match), 666 (no match).

Verified in a Debian bookworm container (apache2 2.4): on untouched v2/master the area 800 case fails (200 instead of 403); on this branch all 4 pass. Unlike 3.x, 2.x does not consume the shared secrules-language-tests suite, so there is no submodule dependency here.

References

Fixes #2970 (2.x)
Related to #3669

🤖 Generated with Claude Code

The operator rejected any area number of 740 or above. Since the Social
Security Administration randomised assignment in June 2011 every area
number except 000, 666 and 900-999 is in use, so valid numbers in the
740-899 range were never detected.

The check is now area == 0, area == 666 or area >= 900. Same change as
the 3.x one in owasp-modsecurity#3669.

Fixes owasp-modsecurity#2970

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0181jBv5JdNQviwDzfnkf1Gy
@coderabbitai

coderabbitai Bot commented Oct 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 644b6ddb-4dc9-4897-b0f6-4b3ae4f30882

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant