如何在Modsecurity规则中编辑正则表达式
我需要在以下规则中修改特定的正则表达式（ID： 932130 - 文件request-932-932-application-Attack-rce.conf），而无需更改原始文件：
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\$(?:\((?:\(.*\)|.*)\)|\{.*\})|[<>]\(.*\))" \
所以我需要排除重点从args变量，以至于正则 [＆lt;＆gt;]（。*）的最后一部分） 我尝试了secruleupdateTargetById 932130“！
我感谢您的帮助。
I need to modify specific regular expressions in the following rule(ID: 932130 - file REQUEST-932-APPLICATION-ATTACK-RCE.conf) without changing the original file:
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\$(?:\((?:\(.*\)|.*)\)|\{.*\})|[<>]\(.*\))" \
So the point is I need to exclude from the ARGS variable the last part of regex - [<>](.*))
I tried with SecRuleUpdateTargetById 932130 "!ARGS:/[<>]\(.*\)/" command in RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf but no luck.
I am grateful for your help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
谢谢您的回复。
我通过使用命令
secruleuleupdateTargetById 932130“！args”内部 wendment-999-999-eclusion-eclusion-rules-rules-rules-after.crs.crs.crs.crs.crs.crs.conf 来解决此问题。之后，我在自定义文件（CRS之前）中创建了一个新规则（在CRS之前）与932130相同，但仅使用ARGS变量，并且没有Regex
[＆lt;＆gt;]（。*）（。*））。因此原始文件尚未手动修改。在这种情况下，变量保存表名和字段（示例-Args [设备] [Description]，它是动态的 - 具有相同字段的更多表。描述字段具有HTML段落标签
＆lt; p＆gt; ，并且每当用户在诸如 （test） 之类的括号中键入某些内容时，它触发规则932130和匹配的值就像 ＆gt;（test） 。Thank you for your response.
I resolved this by removing ARGS from the 932130 rule with command
SecRuleUpdateTargetById 932130 "!ARGS"inside RESPONSE-999-ECLUSION-RULES-AFTER.CRS.conf.After that, I created a new rule in my custom file(before CRS) same as 932130 but only with the ARGS variable and without regex
[<>](.*)). So the original file has not been manually modified.In this case, the variable holds the table name and field(example - ARGS[equipment][description] which is dynamic - more tables with the same field. The description field has the HTML paragraph tag
<p>and, whenever the user types something in brackets like (test), it triggers rule 932130 and matched value is like >(test).CRS Dev-On Duty。您无法更改此规则的正则表达式。
如果您必须调整OWASP MODSECURITY核心规则集（CRS）规则，则具有以下可能性：
完全使用
secrulereremovebyid 932130- ＆gt;＆gt;＆gt;包括CRS之后 - ＆GT;不建议，还有更多的颗粒状可能性，例如：删除特定参数的规则
secruleuleupdateTargetById 932130“ args：yourarg”- ＆gt;包括CRS之后包括在删除特定参数的规则与其他条件（例如路径）的其他条件 - ＆gt;在CRS之前包括
secrule request_uri“ @beginswith /my /path”
“阶段：1，Nog，Pass，ID：10000，CTL：RulereMovetArgetById = 932130; args：yourarg'
如果您想进一步了解CRS中的假阳性调整，我强烈建议CRS CORS COEDERS领导者tutearials Tutearials，特别是这样，尤其是这样一：
CRS Dev-On-Duty here. You can not change the regular expression of this rule.
If you have to tune an OWASP ModSecurity Core Rule Set (CRS) rule, you have the following possibilities:
Remove the rule entirely with
SecRuleRemoveById 932130-> include after CRS -> not recommended, there are more granular possibilities like:Remove the rule for a specific argument
SecRuleUpdateTargetById 932130 "ARGS:yourArg"-> include after CRSRemove the rule for a specific argument in combination with additional conditions like a path for example -> include before CRS
SecRule REQUEST_URI "@beginsWith /my/path"
"phase:1,nolog,pass,id:10000,ctl:ruleRemoveTargetById=932130;ARGS:yourArg"
If you want to learn more about the tuning of false positives in CRS, I highly recommend the CRS co-leaders tutorials, especially this one: https://www.netnea.com/cms/apache-tutorial-8_handling-false-positives-modsecurity-core-rule-set/.