Excluding headers that contain a substring

Anant Mudambi via mod-security-users <[email protected]> Sat, 14 Dec 2024 19:05:08 -0800
Newsgroups gmane.comp.apache.mod-security.user
Message-ID <CALPdRR5W+ha6P=A1Ogz-a2BBncs6wXCEEz97DiWZd60rmcTT1A@mail.gmail.com>
--===============8602629560799784498==
Content-Type: multipart/alternative; boundary="0000000000007e4e3f06294655c9"

--0000000000007e4e3f06294655c9
Content-Type: text/plain; charset="UTF-8"

Hello,
Is it possible to write a rule exclusion that finds all headers that have a
certain string in them and exclude only those headers in subsequent rule?
Would something like this work?

SecRule REQUEST_HEADERS "@contains select" "...,
ctl:ruleRemoveTargetById=942032;%{MATCHED_VARS_NAMES}"

Thanks,
Anant

--0000000000007e4e3f06294655c9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,<div>Is it possible to write a rule exclusion that f=
inds all headers that have a certain string in them and exclude only those =
headers in subsequent rule? Would something like this work?</div><div><br><=
/div><div>SecRule REQUEST_HEADERS &quot;@contains select&quot; &quot;..., c=
tl:ruleRemoveTargetById=3D942032;%{MATCHED_VARS_NAMES}&quot;</div><div><br>=
</div><div>Thanks,</div><div>Anant</div></div>

--0000000000007e4e3f06294655c9--


--===============8602629560799784498==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============8602629560799784498==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

--===============8602629560799784498==--