Search code examples
owaspmod-security

ModSecurity: Ignore Array ARGS

I want an exclusion rule for a request to be evaluated at runtime. The body of the request is an array. e.g

["somestring", "someRandomString",....]

This is the rule I have written:

SecRule REQUEST_URI "@beginsWith /my/url" \

              "phase:2,nolog,pass,id:10000,ctl:ruleRemoveTargetById=942100;ARGS"

However, the array ARGS are not excluded. I have not found anything about this in the online docs. Help would be appreciated.

Solution

  • Make sure this is defined before rule 942100.

    ctl actions must be specified before the rules they alter, unlike SecRuleUpdateTargetById which must be specified after, confusingly enough.