Custom Response Body Rule Not Blocking for Responses Larger Than 1KB

Describe the bug

The custom rule below is triggered correctly when the response body contains the word "jolly." However, if the response size exceeds 1KB, the rule no longer blocks the request, even though the rule is triggered.

Custom Rule:

SecRule RESPONSE_BODY "@rx (?i)(\n|\''|\:|\W*)jolly" \
    "id:102, \
    phase:4, \
    deny, \
    log, \
    t:none, \
    msg:'UNAUTHORIZED DATA ACCESS'"

This issue occurs despite the configurations set for response body access limits and processing, indicating that the rule might not be evaluated correctly for larger response sizes.

Logs and dumps

1. Debug Logs (Level 9):
   Modsecurity-Response-Debug.txt

2. Audit Logs:
   modsec_audit_waf.theviscousweb.com.txt

3. Error Logs:
   [Attach relevant error logs]

4. Core Dump (if applicable):
   [Attach core dump if there was a crash]

To Reproduce

1. Curl Request:

   curl -X GET "https://your-server-endpoint" -H "Content-Type: application/json"
   

2. Ensure that the response body contains:

   ...some data...\n jolly
   

3. Ensure the response body size is greater than 1KB.

4. Verify that the request goes through when it should be denied based on the rule.

Expected behavior

The custom rule should deny the request and log the corresponding message whenever the word "jolly" appears in the response body, regardless of the response size.

Server (please complete the following information):

• ModSecurity version (and connector):
  ModSecurity v3.0.7 with nginx-connector v1.0.1

• WebServer:
  nginx-1.24.0

• OS (and distro):
  Linux, Ubuntu 24

Rule Set (please complete the following information):

• Running any public or commercial rule set?
  OWASP CRS

• Version number:
  4.7.0-nginx-202410030910 (OWASP CRS Docker image)

Start by reproducing the supplied curl case with ModSecurity v3.0.7, the nginx connector, and the OWASP CRS Docker image, using the custom RESPONSE_BODY rule and the attached debug and audit logs. Trace how response-body access limits handle bodies over 1KB and verify that a matching “jolly” response is denied regardless of size.