Support regular expression in ARGS selection while using ctl:ruleRemoveTargetById

[zimmerle]

ctl:ruleRemoveTargetById=123;ARGS:/^id_/" should be resolved to every ARGS item that starts by id_. As listed on manual: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#args

Apparently such thing does not happens when ARGS is used with "ctl:ruleRemoveTargetById"

[odesk2dot2by]

Very interesting, did you solved problems? I am also in such situation. It is not logical. Why this don't work?

[fzipi]

I can confirm this for other variables, e.g. REQUEST_COOKIES.

[davidjrh]

Having the same issue here.

[welljsjs]

Facing the same issue - is there any update on this, did this ever receive some more attention?

[kwaazaar]

Not a regex, but I have this line:

SecRuleUpdateTargetById 942100 !ARGS:Password

But the request is blocked with the message:

"Matched Data: novc found within ARGS:Password: Test123!@#"

Isn't this the simplest of all rule updates? Am I misunderstanding how this is supposed to work?

[martinhsv]

Hi @kwaazaar ,

It sounds like your use case is a duplicate of
#2251

That bug was fixed early in 2020 (but after v3.0.4).

If you do not wish to update to more recent code at this time, the workaround is to use the regex equivalent:
SecRuleUpdateTargetById "!ARGS:/Password/"