Repository navigation
Conversation
Since owasp-modsecurity/ModSecurity#3709 (released in 2.9.16), v2 sets TX:MSC_PCRE_ERROR when an @rx pattern is invalid after macro expansion or a regex execution fails, and a negated !@rx no longer matches on a regex error. The MSC_PCRE_ERROR entry still called the flag v3-only. Update the variable entry, the reserved TX names list, the @rx notes and the explanation of rule 200005 in the recommended configuration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RiUJuqXNvvpytiGRiDFyTy
owasp-modsecurity/ModSecurity#3711 makes @rx and @rxglobal set TX:MSC_PCRE_ERROR next to the standalone variable, including on match limit errors, so rule 200005 sees every regex error. Replace the statement that v3 does not set the TX flag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RiUJuqXNvvpytiGRiDFyTy
fzipi
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
MSC_PCRE_ERROR: the entry said the flag was libModSecurity v3 only. Both engines now setTX:MSC_PCRE_ERROR, which rule 200005 (TX:/^MSC_/) catches. ModSecurity v2 sets it since 2.9.16 and libModSecurity v3 since 3.0.18. Earlier v3 releases set only the standalone variable.MSC_PCRE_ERRORentry next toMSC_PCRE_LIMITS_EXCEEDED.@rx: a new paragraph says that on a regex error neither@rxnor!@rxmatches, and that before 2.9.16 v2 matched the negated form. The v3 note mentions the TX flag.why
This is the docs follow-up promised in the reviews of owasp-modsecurity/ModSecurity#3709 (v2) and owasp-modsecurity/ModSecurity#3711 (v3), both for owasp-modsecurity/ModSecurity#3123.
notes
TX:MSC_PCRE_LIMITS_EXCEEDED. The docs describe that as it stands. If #3711 changes it before merging, I'll update this PR.@validateHash. I'll add it here or in a follow-up once it merges.🤖 Generated with Claude Code