-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
None
-
None
-
None
Having a rule like this , the one that includes the AND will give false positives for an application that complies with first condition , doesnt with second BUT another of the analised applications complies with the second condition :
<rule id="springboot-00003"> <when> <or> <filecontent pattern="{*}APPAAA{*}" filename="{*}.txt"/> <filecontent pattern="{*}APPBBB{*}" filename="{*}.txt"/> </or> </when> <perform> <hint title="APPAAA OR APPBBB FOUND"> <message>APPAAA OR APPBBB FOUND</message> </hint> </perform> </rule> <rule id="springboot-00004"> <when> <and> <filecontent pattern="{*}APPAAA{*}" filename="{*}.txt"/> <filecontent pattern="{*}APPCCC{*}" filename="{*}.txt"/> </and> </when> <perform> <hint title="APPAAA AND APPCCC FOUND"> <message>APPAAA AND APPCCC FOUND</message> </hint> </perform> </rule>
Attached the 3 applications containing very simple text files and the result will be :
- appA has both incidents
- appB has none
- appC has both incidents
There are 3 rules using the wrong approach ( old ones )
- weblogic-catchall
- hibernate51-53
- Maven-artemis-jms-client
