more strict matchers

cves/2020/CVE-2020-12116.yaml

@@ -32,8 +32,10 @@ requests:
         regex:
           - "(?m)/cachestart/.*/jquery/"
 
+    req-condition: true
     matchers:
-      - type: word
+      - type: dsl
-        words:
+        dsl:
-          - "BEGIN RSA PRIVATE KEY"
+          - 'contains(body_2, "BEGIN RSA PRIVATE KEY")'
-        part: body
+          - 'status_code_2 == 200'
+        condition: and

exposures/configs/server-private-keys.yaml

@@ -45,3 +45,9 @@ requests:
       - type: status
         status:
           - 200
+
+      - type: dsl
+        dsl:
+          - '!contains(body_2, "<html")'
+          - '!contains(body_2, "<HTML")'
+        condition: and