Hi Kirk, You can use an apache external filter or mod substitute to do the substitutions, for example, to fix hardcoded urls in html pages.
Cheers! On Aug 24, 2017 00:49, "Kirk Jackson" <k...@pageofwords.com> wrote: > Hi, > > Apologies for cross-posting this message here, but I think this CRS list > might get more traffic than the mod-security-users one. > > To summarise my message. Is it possible to have @rsub replace all > occurrences of a string, or does it just match and replace the first > occurrence? > > Cheers, > > Kirk > > ---------- Forwarded message ---------- > From: Kirk Jackson <k...@pageofwords.com> > Date: Mon, Aug 21, 2017 at 3:39 PM > Subject: Multiple matches with @rsub and @rx over STREAM_OUTPUT_BODY > To: mod-security-us...@lists.sourceforge.net > > > Hi, > > I've written some rules that act across RESPONSE_BODY and > STREAM_OUTPUT_BODY, using @rx and @rsub. > > Would you expect these rules to fire multiple times, once per match in the > response text, or just once when the first match is found? > > From what I can tell, the @rsub only replaces the first occurrence of the > regular expression match, and both @rx and @rsub only trigger the rule once > per request. > > I was hoping that if my output had the same string in multiple places that > @rsub would replace all occurrences of that string. > > Please let me know whether just seeing one replacement is the correct > behaviour. > > Thanks, > > Kirk > > > _______________________________________________ > Owasp-modsecurity-core-rule-set mailing list > Owasp-modsecurity-core-rule-set@lists.owasp.org > https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set > >
_______________________________________________ Owasp-modsecurity-core-rule-set mailing list Owasp-modsecurity-core-rule-set@lists.owasp.org https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
