#
# -=[ Ruby source code leakage ]=-
#
# Detect some common Ruby keywords in output.
#
SecRule RESPONSE_BODY "@rx (?:\b(?:def|class|module|end|if|else|elsif|unless|while|until|for|do|begin|rescue|ensure|case|when|then|yield|return|super|self|nil|true|false|and|or|not|attr_accessor|attr_reader|attr_writer|alias|break|next|redo|retry|require|include|extend|private|protected|public|__FILE__|__LINE__|BEGIN|END)\b)" \
    "id:956120,\
    phase:4,\
    block,\
    capture,\
    t:none,\
    msg:'Ruby source code leakage',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
    tag:'application-multi',\
    tag:'language-ruby',\
    tag:'platform-multi',\
    tag:'attack-disclosure',\
    tag:'paranoia-level/1',\
    tag:'OWASP_CRS',\
    tag:'OWASP_CRS/DATA-LEAKAGES-RUBY',\
    tag:'capec/1000/118/116',\
    tag:'PCI/6.5.6',\
    ver:'OWASP_CRS/4.14.0-dev',\
    severity:'ERROR',\
    setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"