Fix. FW. Improve statement on WAF module to prevent false positive.

[svfcode]

task https://app.doboard.com/1/task/54874#comment_351988

[Copilot]

Pull request overview

This PR introduces PHPUnit coverage around WAF::hasSignature() to ensure “catch-all” body signatures (e.g., #.*#) don’t trigger unless constrained by headers/URL, helping reduce WAF false positives.

Changes:

• Added a new test suite validating that unconstrained catch-all body regex signatures do not match.
• Added positive/negative tests for header-constrained catch-all signatures.
• Added tests ensuring non-catch-all signatures (narrow regex / literal strings) still match as expected.

Suppressed comments (1)

tests/lib/CleantalkSP/SpbctWP/Firewall/WAFHasSignatureTest.php:61

• These new tests assert that a catch-all body regexp like #.*# must not match when waf_headers/waf_url are empty. However, the current implementation of WAF::hasSignature() returns true as soon as the body matches and whatToCheckAdditionally(...) returns 'nothing' (see lib/CleantalkSP/SpbctWP/Firewall/WAF.php:422-425). As-is, this test will fail unless the corresponding production logic change is included in this PR.

    public function testCatchAllWithoutHeadersDoesNotMatch()
    {
        $signature = array(
            'body'        => '#.*#',
            'waf_headers' => null,
            'waf_url'     => null,
        );

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.