Skip to content

v3: "General failure, action: 0x..." prints a pointer instead of the action name #3708

Open

Description

@fzipi

Describe the bug

When SecRuleUpdateActionById is given an action that can't be updated (a configuration-time action such as chain, id, phase, rev, ver, maturity or accuracy), libModSecurity v3 prints a memory address instead of the action's name:

General failure, action: 0x932c545b8 has not expected to be used with UpdateActionByID.

This was reported before in #2625 and closed as completed in 2021, but the code that prints it hasn't changed.

To Reproduce

SecRule REQUEST_HEADERS:User-Agent "@rx ^curl" "id:10,phase:2,pass,log,chain"
    SecRule REQUEST_HEADERS:Accept "@rx \*/\*" "t:none"
SecRuleUpdateActionById 10 "pass,chain"

Seen with test/regression_tests on v3/master (84b5996).

Expected behavior

The message should name the action, e.g. General failure, action: chain has not expected to be used with UpdateActionByID.

Cause

Action::m_name is a std::shared_ptr<std::string>, so std::cout << a->m_name prints the pointer. Writing *a->m_name instead fixes it. The same mistake appears three times:

  • src/rules_exceptions.cc:40 (the "has not expected to be used with UpdateActionByID" message)
  • src/rules_exceptions.cc:51 ("has an unknown type")
  • src/rule_with_actions.cc:127 ("has an unknown type")

Related

All three messages are written straight to std::cout rather than returned through the existing error out-parameter. A connector therefore never sees them in its error log, and the configuration still loads with the action silently dropped. Fixing the pointer is the minimal change. Reporting the problem through error, as a warning or as a load failure, needs a decision, because it would change behavior for configurations shared with v2 that repeat chain in an update. v2 requires repeating chain there; see the "Updating chained rules" note in owasp-modsecurity/documentation#2.

Activity

  1. added
    bugIt is a confirmed bug
    3.xRelated to ModSecurity version 3.x
    on Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.xRelated to ModSecurity version 3.xbugIt is a confirmed bug

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions