misc fixes / update

http/exposures/logs/roundcube-log-disclosure.yaml

@@ -2,7 +2,7 @@ id: roundcube-log-disclosure
 
 info:
   name: Roundcube Log Disclosure
-  author: dhiyaneshDk
+  author: dhiyaneshDk,kazet
   severity: medium
   reference:
     - https://github.com/detectify/ugly-duckling/blob/master/modules/crowdsourced/roundcube-log-disclosure.json
@@ -13,22 +13,28 @@ info:
 http:
   - method: GET
     path:
-      - "{{BaseURL}}/roundcube/logs/sendmail"
-      - "{{BaseURL}}/roundcube/logs/errors.log"
-      - "{{BaseURL}}/roundcube/logs/errors"
-      - "{{BaseURL}}/webmail/logs/sendmail"
-      - "{{BaseURL}}/webmail/logs/errors.log"
-      - "{{BaseURL}}/webmail/logs/errors"
-      - "{{BaseURL}}/mail/logs/sendmail"
-      - "{{BaseURL}}/mail/logs/errors.log"
-      - "{{BaseURL}}/mail/logs/errors"
-      - "{{BaseURL}}/logs/sendmail"
-      - "{{BaseURL}}/logs/errors.log"
-      - "{{BaseURL}}/logs/errors"
+      - "{{BaseURL}}/{{roundcube_path}}"
 
+    payloads:
+      roundcube_path:
+        - roundcube/logs/sendmail
+        - roundcube/logs/errors.log
+        - roundcube/logs/errors
+        - webmail/logs/sendmail
+        - webmail/logs/errors.log
+        - webmail/logs/errors
+        - mail/logs/sendmail
+        - mail/logs/errors.log
+        - mail/logs/errors
+        - logs/sendmail
+        - logs/errors.log
+        - logs/errors
+
+    max-size: 1000
     matchers-condition: and
     matchers:
       - type: word
+        part: body
         words:
           - "IMAP Error:"
           - "Message for"
@@ -37,8 +43,12 @@ http:
           - "PHP Error:"
           - "PHP Warning:"
         condition: or
-        part: body
 
       - type: status
         status:
           - 200
+
+    extractors:
+      - type: dsl
+        dsl:
+          - content_length