[ ijbswa-Actionsfile feedback-3168443 ] Another definite web bug

Actionsfile feedback item #3168443, was opened at 2011-01-30 17:00
Message generated for change (Comment added) made by fabiankeil
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=3168443&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: current actionsfile
>Status: Closed
>Resolution: Accepted
Priority: 1
Private: No
Submitted By: Adam Piggott (proactivesvcs)
>Assigned to: Fabian Keil (fabiankeil)
Summary: Another definite web bug

Initial Comment:
Ref default.action:
/cm\?[tc]

I thought it might be helpful to clarify this one too, and provide an example URL as the rule is a bit obscure-looking otherwise. That being said, I would expect to only see this pattern on coremetrics.com/net/eu so it might be worth considering retiring it, unless it's been seen on other domains, as coremetrics are already blocked at the domain level.

Example URL:
http://data.coremetrics.com/cm?ci=90121638&st=1296435164623&vn1=4.3.1&ec=UTF-8&vn2=e4.0&pi=PRODUCT%3A%20Asus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White%20%2812068815%29&ul=http%3A//www.play.com/PC/PCs/-/653/860/-/12068815/Asus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White/Product.html&tid=5&pr=12068815&pm=Asus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White&cg=/PC/PCs/&pc=Y&rnd=1296436726754&cvdone=p&cmig=y
Which was fetched from:
http://www.play.com/PC/PCs/-/653/860/-/12068815/Asus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White/Product.html

----------------------------------------------------------------------

>Comment By: Fabian Keil (fabiankeil)
Date: 2012-12-12 06:16

Message:
Thanks for the report.

Pattern updated and tests added in CVS.

----------------------------------------------------------------------

Comment By: Adam Piggott (proactivesvcs)
Date: 2011-01-30 17:09

Message:
OK the rule definitely shouldn't be retired, as coremetrics use it on their
customer's sub-domains[1]. Could be amended to:
/(eluminate|cm)\?[tc]i=\d+&st=\d+&
...to match both of these examples and help reduce false positives (not
that I've come across any) with the extra parameters.
http://sd.play.com/eluminate?ci=90121638&st=1296424516858&vn1=4.3.1&ec=UTF-8&vn2=e4.0&pi=PRODUCT%3A%20Asus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White%20%2812068815%29&rf=http%3A//www.google.co.uk/url%3Fsa%3Dt%26source%3Dweb%26cd%3D4%26ved%3D0CD8QFjAD%26url%3Dhttp%253A%252F%252Fwww.play.com%252FPC%252FPCs%252F-%252F653%252F860%252F-%252F12068815%252FAsus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White%252FProduct.html%26rct%3Dj%26q%3Dlcd%2520monitor%2520webcam%26ei%3DN95FTbq0K8OmhAfH_qziAQ%26usg%3DAFQjCNGt7KubX9LB8oNgNkiFyfA55jf8pg%26cad%3Drja&ul=http%3A//www.play.com/PC/PCs/-/653/860/-/12068815/Asus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White/Product.html&tid=5&pr=12068815&pm=Asus-VK192S-19-Widescreen-LCD-Monitor-With-Webcam-White&cg=/PC/PCs/&pc=Y&rnd=1296430566530

[1] sd.play.com resolves to 204.77.30.34, which is in coremetrics' IP
space.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=460288&aid=3168443&group_id=11118

------------------------------------------------------------------------------
LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
Remotely access PCs and mobile devices and provide instant support
Improve your efficiency, and focus on delivering more value-add services
Discover what IT Professionals Know. Rescue delivers
http://p.sf.net/sfu/logmein_12329d2d