[airween]

Proposed changes

Document the Lua transformation list fixes in owasp-modsecurity/ModSecurity#3738 (libModSecurity) and owasp-modsecurity/ModSecurity#3739 (ModSecurity v2), for owasp-modsecurity/ModSecurity#3737.

• Configuration directives, SecRuleScript: a new note at the end of the Lua section:
  • in libModSecurity 3.0.17 and earlier, m.getvars() ignores its transformations, so the m.getvars() example in the same section doesn't find <script in <SCRIPT; the workaround is to transform in the script or to use m.getvar();
  • in those versions and in ModSecurity 2.9.15 and earlier: a list with more than 20 names can crash the process; a table entry fails the script with "bad argument", and a number is taken as a name;
  • in libModSecurity only: "none" doesn't start the list over, and a name with a colon, such as "lowercase:", aborts the process.

Further comments

• Don't merge this before fix: Lua m.getvar()/m.getvars() transformation arguments ModSecurity#3738 and fix: pop each entry of a Lua transformation table (v2) ModSecurity#3739. The note describes the behavior before them as that of "3.0.17 and earlier" and "2.9.15 and earlier", and the fixed behavior as that of later versions. If either fix ships in a later release than the next one, the version needs to be updated before this is merged.
• The note goes after the existing Lua notes, not right after the m.getvars() example, so that it doesn't conflict with docs: RULE can't be read from Lua in libModSecurity v3 #6 and docs: document where Lua m.log() messages goes #7, which add notes in the same section.
• 20 is LUA_MINSTACK, the number of free stack slots a C function gets. The crash isn't certain just above it: in the regression tests, libModSecurity crashed with 100 entries and the ModSecurity v2 Apache child with 1000.

AI disclosure

Made with help of Claude Code, Opus 5.5

[fzipi]

Thanks @airween. I checked each statement against v3/master, v2/master and the two fix PRs, and the note matches. LGTM.

• m.getvars() ignores its transformations in v3. On v3/master, Lua::getvars() never reads argument 2, so the example above gets <SCRIPT untransformed. With #3738, lowercase then htmlEntityDecode gives <script, which is what the lua-tfn-getvars-table.lua case checks.
• Long lists. Neither engine pops the entry from lua_rawgeti() before the fixes. "More than 20 names can crash" is the right wording, since the crash in the tests came only at 100 (v3) and 1000 (v2).
• Tables and numbers. Before the fixes, luaL_checkstring() raises "bad argument" for a table and converts a number to a name. Both fixes check lua_type() != LUA_TSTRING and log at level 8, so "skip both and write a debug log message" holds in both engines.
• "none" and names with a colon (v3 only). v3/master continues on "none" instead of clearing the list. "t:lowercase:" makes Action::set_name_and_payload() call at(0) on an empty payload, which throws std::out_of_range. #3738 clears the list and logs "Invalid transformation function" for a name with :.

Approving on the same condition as the description: merge only after #3738 and #3739, and check that "3.0.17 and earlier" and "2.9.15 and earlier" still match the releases they land in.

[airween]

Thanks @fzipi. I'll merge it after #3738 and #3739, and check the version numbers then.