owasp-modsecurity / owasp-modsecurity/ModSecurity
Escape double quotation mark character in non-regex operator
Open
Nobody has claimed this yet.
3.x
bug
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Currently, am using Nginx + ModSecurity v3.
I want to create a rule that filters double quotation mark characters using a non-regex operator.
Pattern: not "redirect" to
I write the rule below:
SecRule ARGS|REQUEST_BODY "@streq not \"redirect\" to" "id:1,deny,log,..."
But it not working as I hope
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the SecRule using the @streq operator under Nginx with ModSecurity v3, focusing on the escaped double quotation marks in the pattern. Trace how the rule parser handles the quoted expression and verify the behavior against the reported expected match for not "redirect" to.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100