fix(scanner): avoid SVG/XML false positives; add allowlist and .gitignore

Browse Source

Relax payload scanner for XML/SVG by passing content-type into checks
Skip JS-style eval() detection when content-type is XML/SVG
Pass request Content-Type through sniff_file_for_php_payload() and raw-body checks
Add common XML/SVG content-types to allowlist.json
Add repository .gitignore (ignore logs, quarantine/, state/, env, vendor, IDE files)

...

This commit is contained in:

Gregor Klevže

2026-02-07 15:11:15 +01:00

commit 037b176892

5 changed files with 1585 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

1000

upload-logger.php Normal file

File diff suppressed because it is too large Load Diff