feat: regex key support for ctl:ruleRemoveTargetById and ctl:ruleRemoveTargetByTag

CHANGES

@@ -1,3 +1,14 @@
+v3.0.18 - TBD
+---------------------
+
+  - [feat: Regex key support for ctl:ruleRemoveTargetById/ByTag (#3505):
+     slash-aware :/…/ tokenization ({m,n}); literals with '/' no longer
+     swallow trailing actions; VariableRegex synthetic fullName skipped for
+     regex exclusions. Public Transaction::m_ruleRemoveTargetBy{Id,Tag}
+     element types change to RuleRemoveTargetBy{Id,Tag}Entry; ByTag literal
+     full-name matching is now case-insensitive (same as ById).]
+    [PR #3526 - @etiennemunnich]
+
 v3.0.17 - 2026-Sep-29
 ---------------------
 

headers/modsecurity/rule_remove_target_entry.h

@@ -0,0 +1,66 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#ifndef HEADERS_MODSECURITY_RULE_REMOVE_TARGET_ENTRY_H_
+#define HEADERS_MODSECURITY_RULE_REMOVE_TARGET_ENTRY_H_
+
+#include <memory>
+#include <string>
+
+namespace modsecurity {
+
+namespace Utils {
+class Regex;
+}
+
+/**
+ * Shared target-matching logic for ctl:ruleRemoveTarget{ById,ByTag}.
+ * Supports literal target (e.g. ARGS:pwd) or regex (e.g. ARGS:/^json\.\d+\.JobDescription$/).
+ * Regex is compiled at config load time.
+ */
+struct RuleRemoveTargetSpec {
+    std::string literal;
+    std::shared_ptr<Utils::Regex> regex;
+
+    bool matchesKeyWithCollection(const std::string &key,
+                                  const std::string &keyWithCollection) const;
+    bool matchesFullName(const std::string &fullName) const;
+
+    /**
+     * Detect COLLECTION:/pattern/ in target, compile into *regex_out.
+     * action_name is used in error strings (e.g. "ruleRemoveTargetById").
+     * Returns false on unclosed/unsupported, empty, or invalid regex.
+     */
+    static bool detectAndCompileRegex(const std::string &target,
+                                      std::shared_ptr<Utils::Regex> *regex_out,
+                                      const char *action_name,
+                                      std::string *error);
+};
+
+
+struct RuleRemoveTargetByIdEntry {
+    int id{};
+    RuleRemoveTargetSpec target;
+};
+
+
+struct RuleRemoveTargetByTagEntry {
+    std::string tag;
+    RuleRemoveTargetSpec target;
+};
+
+}  // namespace modsecurity
+
+#endif  // HEADERS_MODSECURITY_RULE_REMOVE_TARGET_ENTRY_H_

headers/modsecurity/transaction.h

@@ -53,6 +53,9 @@ typedef struct Rules_t RulesSet;
 #include "modsecurity/variable_origin.h"
 #include "modsecurity/anchored_set_variable_translation_proxy.h"
 #include "modsecurity/audit_log.h"
+#ifdef __cplusplus
+#include "modsecurity/rule_remove_target_entry.h"
+#endif
 
 
 #ifndef NO_LOGS
@@ -532,12 +535,12 @@ class Transaction : public TransactionAnchoredVariables, public TransactionSecMa
     /**
      *
      */
-    std::list< std::pair<std::string, std::string> > m_ruleRemoveTargetByTag;
+    std::list<RuleRemoveTargetByTagEntry> m_ruleRemoveTargetByTag;
 
     /**
      *
      */
-    std::list< std::pair<int, std::string> > m_ruleRemoveTargetById;
+    std::list<RuleRemoveTargetByIdEntry> m_ruleRemoveTargetById;
 
     /**
      *

src/Makefile.am

@@ -47,6 +47,7 @@ pkginclude_HEADERS = \
 	../headers/modsecurity/rule_unconditional.h \
 	../headers/modsecurity/rule_with_actions.h \
 	../headers/modsecurity/rule_with_operator.h \
+	../headers/modsecurity/rule_remove_target_entry.h \
 	../headers/modsecurity/rules.h \
 	../headers/modsecurity/rule_message.h \
 	../headers/modsecurity/rules_set.h \
@@ -275,6 +276,7 @@ libmodsecurity_la_SOURCES = \
 	rule_unconditional.cc \
 	rule_with_actions.cc \
 	rule_with_operator.cc \
+	rule_remove_target_entry.cc \
 	rule_message.cc \
 	rule_script.cc \
 	unique_id.cc \

src/actions/ctl/rule_remove_target_by_id.cc

@@ -20,8 +20,11 @@
 #include <string>
 #include <vector>
 #include <utility>
+#include <memory>
 
 #include "modsecurity/transaction.h"
+#include "modsecurity/rule_remove_target_entry.h"
+#include "src/utils/regex.h"
 #include "src/utils/string.h"
 
 
@@ -54,12 +57,16 @@ bool RuleRemoveTargetById::init(std::string *error) {
 
     m_target = param[1];
 
-    return true;
+    return RuleRemoveTargetSpec::detectAndCompileRegex(
+        m_target, &m_regex, "ruleRemoveTargetById", error);
 }
 
 bool RuleRemoveTargetById::evaluate(RuleWithActions *rule, Transaction *transaction) {
-    transaction->m_ruleRemoveTargetById.push_back(
-        std::make_pair(m_id, m_target));
+    RuleRemoveTargetByIdEntry entry;
+    entry.id = m_id;
+    entry.target.literal = m_target;
+    entry.target.regex = m_regex;
+    transaction->m_ruleRemoveTargetById.push_back(std::move(entry));
     return true;
 }
 

src/actions/ctl/rule_remove_target_by_id.h

@@ -13,6 +13,7 @@
  *
  */
 
+#include <memory>
 #include <string>
 
 #include "modsecurity/actions/action.h"
@@ -23,7 +24,12 @@
 #define SRC_ACTIONS_CTL_RULE_REMOVE_TARGET_BY_ID_H_
 
 namespace modsecurity {
+
+namespace Utils {
+class Regex;
+}
+
 namespace actions {
 namespace ctl {
 
 
@@ -39,6 +45,7 @@
 
     int m_id;
     std::string m_target;
+    std::shared_ptr<Utils::Regex> m_regex;  // pre-compiled at config load
 };
 
 

src/actions/ctl/rule_remove_target_by_tag.cc

@@ -20,8 +20,11 @@
 #include <string>
 #include <vector>
 #include <utility>
+#include <memory>
 
 #include "modsecurity/transaction.h"
+#include "modsecurity/rule_remove_target_entry.h"
+#include "src/utils/regex.h"
 #include "src/utils/string.h"
 
 
@@ -47,12 +50,16 @@ bool RuleRemoveTargetByTag::init(std::string *error) {
     m_tag = param[0];
     m_target = param[1];
 
-    return true;
+    return RuleRemoveTargetSpec::detectAndCompileRegex(
+        m_target, &m_regex, "ruleRemoveTargetByTag", error);
 }
 
 bool RuleRemoveTargetByTag::evaluate(RuleWithActions *rule, Transaction *transaction) {
-    transaction->m_ruleRemoveTargetByTag.push_back(
-        std::make_pair(m_tag, m_target));
+    RuleRemoveTargetByTagEntry entry;
+    entry.tag = m_tag;
+    entry.target.literal = m_target;
+    entry.target.regex = m_regex;
+    transaction->m_ruleRemoveTargetByTag.push_back(std::move(entry));
     return true;
 }
 

src/actions/ctl/rule_remove_target_by_tag.h

@@ -13,6 +13,7 @@
  *
  */
 
+#include <memory>
 #include <string>
 
 #include "modsecurity/actions/action.h"
@@ -23,7 +24,12 @@
 #define SRC_ACTIONS_CTL_RULE_REMOVE_TARGET_BY_TAG_H_
 
 namespace modsecurity {
+
+namespace Utils {
+class Regex;
+}
+
 namespace actions {
 namespace ctl {
 
 
@@ -37,6 +43,7 @@
 
     std::string m_tag;
     std::string m_target;
+    std::shared_ptr<Utils::Regex> m_regex;
 };