From 2edc819453657ea0fd369ff3a4d102dfe7314951 Mon Sep 17 00:00:00 2001
From: Ervin Hegedus <airween@gmail.com>
Date: Mon, 2 Nov 2026 15:05:11 +0100
Subject: [PATCH] Document Lua transformation list fixes in
 m.getvar()/m.getvars()

Up to libModSecurity 3.0.17, m.getvars() ignores its transformation
parameter, so the m.getvars() example in SecRuleScript doesn't work
as written (owasp-modsecurity/ModSecurity#3737).

Add a note to the Lua section of SecRuleScript that says so and gives
the workaround, and that lists the other differences in how 3.0.17
and 2.9.15 and earlier handle the list of transformation names: a
long list can crash the process, a table entry fails the script and a
number entry is taken as a name, and, in libModSecurity, "none" doesn't
start the list over and a name with a colon aborts the process.

Refs owasp-modsecurity/ModSecurity#3737
---
 .../3-2-configuration-directives.md                  | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/content/3-reference-manual/3-2-configuration-directives.md b/content/3-reference-manual/3-2-configuration-directives.md
index 9b0808a..3ca5229 100644
--- a/content/3-reference-manual/3-2-configuration-directives.md
+++ b/content/3-reference-manual/3-2-configuration-directives.md
@@ -1188,6 +1188,18 @@ libModSecurity (aka v3) is compatible with Lua 5.2+.
 
 {{% /notice %}}
 
+{{% notice note %}}
+
+In libModSecurity 3.0.17 and earlier, m.getvars() ignores its second parameter and returns the values without any transformation, so the m.getvars() example above doesn't find `<script` in `&LT;SCRIPT` ([#3737](https://github.com/owasp-modsecurity/ModSecurity/issues/3737)). In these versions, transform the values in the script, or call m.getvar() with the transformations for each variable you need. m.getvar() applies its transformations in every version.
+
+These versions, and ModSecurity 2.9.15 and earlier, also handle the list of transformation names differently from later versions:
+
+- A list with more than 20 names can write past the Lua stack and crash the process (in ModSecurity v2, the Apache child process).
+- An entry that is neither a string nor a number, such as a table, makes the script fail with a "bad argument" error, and a number is taken as a transformation name. Later versions skip both and write a debug log message.
+- In libModSecurity, "none" doesn't cancel the transformations before it in the list, and a name that contains a colon, such as "lowercase:", aborts the process. In later versions, "none" starts the list over, as it always has in ModSecurity v2, and a name with a colon is rejected as an invalid transformation function.
+
+{{% /notice %}}
+
 ## SecRuleUpdateActionById
 
 Updates the action list of the specified rule.