Detection engine:
- Normalize request data (body, cookies, form and JSON values, request headers)
before inspection instead of only the URL query string, so encoded variants
are evaluated consistently.
- Extend XSS / SQLi / command-injection inspection to request bodies and to
custom request headers; bodies and headers are scanned per value rather than
as one blob to keep false positives low.
- Add a configurable body inspection mode (body_detect_mode: observe/block/off,
default observe) so the new deep checks record rather than block until an
operator confirms them, plus body_detect_field_exclude to skip fields that
legitimately carry rich text.
- Keep false positives down on the new paths: skip structured values, require a
corroborating signal before flagging body/header XSS, and leave dual-use
keywords out of the fallback lists.
- Path traversal is now normalized and judged on whether it escapes the site
root instead of matching literally; this also clears a long-standing false
positive on legitimate in-site relative paths. Adds a sensitive-file list.
- Scanner detection now covers all request headers and known probe paths.
Plugins:
- Suspend plugin loading pending signing and admission work. The code path is
retained but gated off, and shipped disabled by default.
Validated against a local test corpus and a 33k real-traffic benchmark:
detection improved across every category while the real-traffic false-positive
count stayed flat.
samwaf