Repository navigation
ctl:ruleRemoveTargetById does not support the regex form ARGS:/.../ (SecRuleUpdateTargetById does) #717
Description
ctl:ruleRemoveTargetById=123;ARGS:/^id_/" should be resolved to every ARGS item that starts by id_. As listed on manual: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#args
Apparently such thing does not happens when ARGS is used with "ctl:ruleRemoveTargetById"
Reacted by welljsjs, chadoc, andreika47, TW - Vincent and Nicholas Roth
Activity
odesk2dot2by commentedon Jul 14, 2015
Very interesting, did you solved problems? I am also in such situation. It is not logical. Why this don't work?
fzipi commentedon Nov 8, 2016
I can confirm this for other variables, e.g. REQUEST_COOKIES.
davidjrh commentedon Aug 22, 2017
Having the same issue here.
welljsjs commentedon Sep 27, 2020
Facing the same issue - is there any update on this, did this ever receive some more attention?
kwaazaar commentedon Nov 9, 2020
Not a regex, but I have this line:
But the request is blocked with the message:
Isn't this the simplest of all rule updates? Am I misunderstanding how this is supposed to work?
martinhsv commentedon Nov 9, 2020
Hi @kwaazaar ,
It sounds like your use case is a duplicate of
#2251
That bug was fixed early in 2020 (but after v3.0.4).
If you do not wish to update to more recent code at this time, the workaround is to use the regex equivalent:
SecRuleUpdateTargetById "!ARGS:/Password/"
fzipi commentedon Oct 12, 2026
Revisiting this one. Still valid in v3.
ctl:ruleRemoveTargetByIdcompares the removed target against the variable's full name with a case-insensitive exact string match (src/rule_with_operator.cc, them_ruleRemoveTargetByIdlookups), soARGS:/^id_/never matches anything. The config-timeSecRuleUpdateTargetByIdgoes through the variable parser and does support the regex form, which is why the workaround in the thread works.Proposal: parse the
ctl:ruleRemoveTargetByIdtarget with the same variable parser so the two directives agree.[-]Support regular expression in ARGS selection while using ctl:ruleRemoveTargetById[/-][+]ctl:ruleRemoveTargetById does not support the regex form ARGS:/.../ (SecRuleUpdateTargetById does)[/+]fzipi commentedon Oct 12, 2026
Duplicate of #911, which has the more recent discussion and a concrete proposal. Suggest closing this one in favour of #911.
fzipi commentedon Oct 12, 2026
Follow-up: open PR #3526 implements regex targets for
ctl:ruleRemoveTargetByIdandctl:ruleRemoveTargetByTagin 3.x.