Skip to content

Target transformed even when ignored via ctl: action #2932

Open
@marcstern

Description

@marcstern

v2 master

When ignoring some targets, like a huge ARG, it's not matched but still transformed.
In some cases (several big ARGS), it can have dramatic impacts on performance.

Debug log showing the problem (ARGS:ParamToIgnore=a%2520b):

[9] fetch_target_exception: Found exception target list [ARGS:ParamToIgnore] for rule id 2000415
[9] fetch_target_exception: Target ARGS:ParamToIgnore will not be processed.
[4] Executing operator "rx" with param "a" against ARGS:ParamToIgnore skipped.
[9] T (0) urlDecode: "a b"
[9] T (0) htmlEntityDecode: "a b"
[9] T (0) jsDecode: "a b"
[9] T (0) compressWhitespace: "a b"
[9] T (0) lowercase: "a b"
[4] Rule returned 0.

Metadata

Metadata

Assignees

No one assigned

    Labels

    2.xRelated to ModSecurity version 2.xbugIt is a confirmed bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions