Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Operator @rx has different flags in two engines #3295

Open
airween opened this issue Nov 7, 2024 · 2 comments
Open

Operator @rx has different flags in two engines #3295

airween opened this issue Nov 7, 2024 · 2 comments
Assignees
Labels
2.x Related to ModSecurity version 2.x

Comments

@airween
Copy link
Member

airween commented Nov 7, 2024

Describe the bug

It seems like the @rx operator has a different behavior in two engines (mod_security2 and libmodsecurity3)

mod_security2 has these PCRE flags:

PCRE2, PCRE

libmodsecurity3 has these ones:

PCRE2, PCRE

To Reproduce

coreruleset/coreruleset#3277

We should discuss:

  • do we want to resolve this issue?
  • how?
@airween airween added the 2.x Related to ModSecurity version 2.x label Nov 7, 2024
@airween airween changed the title Operator @rx has different flags in two wngines Operator @rx has different flags in two engines Nov 7, 2024
@airween
Copy link
Member Author

airween commented Nov 13, 2024

I think this is a good idea, I mean add a build flag to libmodsecurity3 (mod_security2 is not affected) which changes the flag, and not in the next release but after that we make it mandatory (and we can add an optional build flag to keep the old (current) one).

@marcstern
Copy link

PCRE2_DOTALL & PCRE2_DOLLAR_ENDONLY look the right way for me as we need to check multiline ARGS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2.x Related to ModSecurity version 2.x
Projects
None yet
Development

No branches or pull requests

2 participants