Repository navigation
ctl:ruleRemoveTargetByTag does not support regex in ModSecurity v3.x #2432
Description
Issue #588 was raised against ModSecurity v2.9.x. In those versions ctl:ruleRemoveTargetByTag does support regular expressions, but the raised issue noted that some regex metacharacters cause difficulties.
This new issue is being created to separately track the different state of affairs in v3.x.
In particular, ctl:ruleRemoveTargetByTag works correctly when specifying regular text. It does not, however, have any support at all for regex.
This appears to have been intentional in the initial implementation of the v3.x code, so any regex functionality implemented for ctl:ruleRemoveTargetByTag now may be considered an enhancement rather a bug fix.
It's unclear how widely useful regular expressions are for this particular ctl action, but this issue at least allows the matter to be considered for 3.1 (or later) implementation.
Activity
theMiddleBlue commentedon Aug 9, 2023
Rule exclusion on API that usually has JSON body it's a pain on v3 without this feature.
A nested JSON body is hard to exclude. Something like:
{ "foo": [ {"bar": "1"}, {"bar": "1 or 1=1--"} ... ] }It makes a lot of users remove the whole ruleset or turn off the request body access instead of removing a long, long list of:
ARGS:json.foo.array_0.bar
ARGS:json.foo.array_1.bar
etc...
fardarter commentedon Mar 1, 2024
I would also like this feature
fzipi commentedon Oct 12, 2026
Revisiting this one. Same mechanism as #911: in 3.x the
ctl:ruleRemoveTargetByTagtarget is compared with the variable's full name by exact string equality (src/rule_with_operator.cc, them_ruleRemoveTargetByTaglookups), soARGS:/^json\.foo\./can never match. The fix proposed on #911, parsing the ctl target with the same variable parserSecRuleUpdateTargetByIduses, coversByIdandByTagat once.Suggest tracking both under #911 and closing this one as a duplicate once that lands.
fzipi commentedon Oct 12, 2026
Follow-up: open PR #3526 implements regex targets for
ctl:ruleRemoveTargetByIdandctl:ruleRemoveTargetByTagin 3.x.