Re: Excluding headers that contain a substring

Nick Gearls <[email protected]> Thu, 19 Dec 2024 09:51:13 +0100
Newsgroups	gmane.comp.apache.mod-security.user
Message-ID	<[email protected]>
--===============5695962654001787449==
Content-Language: en-US, fr
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    Hello,<br>
    <br>
    The proper way would something like<br>
    <blockquote>SecRule REQUEST_HEADERS "@contains select" "...,chain"<br>
       SecRule MATCHED_VARS_NAMES @unconditionalMatch
      "ctl:ruleRemoveTargetById=942032;%{MATCHED_VAR}"<br>
    </blockquote>
    Unfortunately, ruleRemoveTargetById doesn't support macro expansion.<br>
    No solution for the moment I'm afraid.<br>
    <br>
    <div class="moz-cite-prefix">On 15/12/2024 04:05, Anant Mudambi via
      mod-security-users wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CALPdRR5W+ha6P=A1Ogz-a2BBncs6wXCEEz97DiWZd60rmcTT1A@mail.gmail.com">
      <div dir="ltr">Hello,
        <div>Is it possible to write a rule exclusion that finds all
          headers that have a certain string in them and exclude only
          those headers in subsequent rule? Would something like this
          work?</div>
        <div><br>
        </div>
        <div>SecRule REQUEST_HEADERS "@contains select" "...,
          ctl:ruleRemoveTargetById=942032;%{MATCHED_VARS_NAMES}"</div>
        <div><br>
        </div>
        <div>Thanks,</div>
        <div>Anant</div>
      </div>
    </blockquote>
  </body>
</html>


--===============5695962654001787449==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============5695962654001787449==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

--===============5695962654001787449==--