Hi, Apologies for cross-posting this message here, but I think this CRS list might get more traffic than the mod-security-users one.
To summarise my message. Is it possible to have @rsub replace all occurrences of a string, or does it just match and replace the first occurrence? Cheers, Kirk ---------- Forwarded message ---------- From: Kirk Jackson <k...@pageofwords.com> Date: Mon, Aug 21, 2017 at 3:39 PM Subject: Multiple matches with @rsub and @rx over STREAM_OUTPUT_BODY To: mod-security-us...@lists.sourceforge.net Hi, I've written some rules that act across RESPONSE_BODY and STREAM_OUTPUT_BODY, using @rx and @rsub. Would you expect these rules to fire multiple times, once per match in the response text, or just once when the first match is found? >From what I can tell, the @rsub only replaces the first occurrence of the regular expression match, and both @rx and @rsub only trigger the rule once per request. I was hoping that if my output had the same string in multiple places that @rsub would replace all occurrences of that string. Please let me know whether just seeing one replacement is the correct behaviour. Thanks, Kirk
_______________________________________________ Owasp-modsecurity-core-rule-set mailing list Owasp-modsecurity-core-rule-set@lists.owasp.org https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
