Re: Excluding headers that contain a substring

Hi Anant,

On Sat, Dec 14, 2024 at 07:05:08PM -0800, Anant Mudambi via mod-security-users wrote:
> Hello,
> Is it possible to write a rule exclusion that finds all headers that have a
> certain string in them and exclude only those headers in subsequent rule?
> Would something like this work?
> 
> SecRule REQUEST_HEADERS "@contains select" "...,
> ctl:ruleRemoveTargetById=942032;%{MATCHED_VARS_NAMES}"

Unfortunately not, it's not possible.

Even though Apache allows this syntax (a note: you forget to add
the target to your exclusion, I mean the correct form would be
"...;ctl:ruleRemoveTargetById=942032;REQUEST_HEADERS:%{MATCHED_VARS_NAMES}"),
but when it evaluates it gets "%{MATCHED_VARS_NAMES}" as header
name, not the substituted value.

In case of Nginx its parser does not allow this syntax.


Regards,


a.



_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/