Javascript "console.log()" and "console.dir()" not being detected

[dune73]

$ curl -H "x-format-output: txt-matched-rules" http://sandbox.coreruleset.org/ -d 'foo=console.log(msg)'
-- no output --

$ curl -H "x-format-output: txt-matched-rules" http://sandbox.coreruleset.org/ -d 'foo=console.dir(msg)'
-- no output --

[azurit]

Is it really possible to run a javascript like this? We have no rule which is catching javascript functions on it's own (except 941390 but it's very specific). The common usage of javascript is, for example, this:

$  curl -H "x-format-output: txt-matched-rules" http://sandbox.coreruleset.org/ -d 'foo=javascript:console.log(msg)'
941170 PL1 NoScript XSS InjectionChecker: Attribute Injection
941210 PL1 IE XSS Filters - Attack Detected
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 10)
980170 PL1 Anomaly Scores: (Inbound Scores: blocking=10, detection=10, per_pl=10-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=10, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=10)

[dune73]

This is taken from this thread: https://twitter.com/intigriti/status/1772929816360050857

The idea was to take these ideas and detect them even if they are naked.

If this is too cumbersome / too prone of FPs or would add too much overhead in the form of a new rule, we may one want to skip it.

But I think it could be worthwhile to plug these holes since they are used while trying out exploits.

[theseion]

I can't view the thread, only the original message, so it's possible I don't have the full picture.

Your requests look like the injection vulnerability would exist only because the application was badly designed. It's not a classical XSS injection IMO, since it wouldn't work with plain HTML. I don't think it makes sense for us to invest our energy here at the moment.

[dune73]

The thread is about ~ "How do you prove an XSS when script-alert is blocked by a WAF". So these are all ways to evade detection. You can say they do not work when naked, but I still think it warranted and if only as a 2nd net of safety since they indicate the desire to inject code.