SecRuleUpdateActionById directive with a range

[oceanmancuonh]

How to use SecRuleUpdateActionById directive to change action of multi rule id ? When i use SecRuleUpdateActionById 70050015 "pass" -> It's work

But SecRuleUpdateActionById 70050014-70050016 "pass" -> Not work

[airween]

Hi @oceanmancuonh,

do you think that would be the expected behavior?

libmodsecurity3's reference shows it does not support at all:

https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x)#secruleupdatetargetbyid

and mod_security2's reference that engine supports only the id[:offset] syntax:

https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#secruleupdateactionbyid

[oceanmancuonh]

that means if i want to change a series of action rules then i have to declare each rule id one by one if using this directive. there is no way to select multi rule id like regex, wildcard, ...

[airween]

that means if i want to change a series of action rules then i have to declare each rule id one by one if using this directive. there is no way to select multi rule id like regex, wildcard, ...

Yes, exactly.

You haven't mentioned which rule set you use, but if it's CRS, you can use SecRuleUpdateTargetByTag - docs is here. Probably it's more efficient.