✏ EDIT: 932220.ra##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.

##! Word list for rule 932220 (RCE Unix command injection)
##!
##! This list comes from (and should be in sync) the `unix-shell.data` file.

##! Not all of the prefixes for the command words will be legal.
##! We've decided to use the same prefix as in 932100 and 932105 here,
##! because we don't know exactly what things are possible after a pipe and
##! we don't want to overcomplicate things by introducing another prefix variation.
##! Not all of the prefixes matched by the expression will actually be valid.

##!+ i

##!^ .\|

##!> assemble
  \s*
  ##!> include unix-shell-evasion-prefix

  ##!> cmdline unix
    ##!> include-except unix-shell-upto3 unix-shell-fps-pl2 -- @ "" ~ ""
  ##!<
##!<


 [✗] CANCEL

[~] Kerym Chaeceran