ModSecurity
ModSecurity copied to clipboard
Operator @rx has different flags in two engines
Describe the bug
It seems like the @rx operator has a different behavior in two engines (mod_security2 and libmodsecurity3)
mod_security2 has these PCRE flags:
libmodsecurity3 has these ones:
To Reproduce
https://github.com/coreruleset/coreruleset/issues/3277
We should discuss:
- do we want to resolve this issue?
- how?
I think this is a good idea, I mean add a build flag to libmodsecurity3 (mod_security2 is not affected) which changes the flag, and not in the next release but after that we make it mandatory (and we can add an optional build flag to keep the old (current) one).
PCRE2_DOTALL & PCRE2_DOLLAR_ENDONLY look the right way for me as we need to check multiline ARGS