MIE. ".php.ns" bypasses ".php$" regexp but is
still parsed as PHP by Apache. (manipulates an equivalence property under
Apache)
Potential Mitigations
Phase
Description
Implementation
Regular expressions can become error prone when defining a complex
language even for those experienced in writing grammars. Determine if
several smaller regular expressions simplify one large regular
expression. Also, subject your regular expression to thorough testing
techniques such as equivalence partitioning, boundary value analysis,
and robustness. After testing and a reasonable confidence level is
achieved, a regular expression may not be foolproof. If an exploit is
allowed to slip through, then record the exploit and refactor your
regular expression.