Describe the bug
This bug is similar to: #3441, which also doesn't appear in ModSecurity2.
Logs and dumps
N/A
To Reproduce
Re-using the previous example in this issue, say I have this rule:
SecRule REQUEST_HEADERS:Referer "@contains <evil-string>" \
"id:2,\
phase:1,\
deny,\
t:none,\
log"
and I want to write a rule-exclusion for this rule via a configure-time rule-exclusion:
SecRuleUpdateTargetById 2 !REQUEST_HEADERS:referer
This rule-exclusion works if the client sends a lowercase referer header:
$ curl -H "referer: <evil-string>" localhost:8080
But if the client sends an uppercase referer header, then the request is wrongly blocked:
$ curl -H "Referer: <evil-string>" localhost:8080
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.28.3 (Ubuntu)</center>
</body>
</html>
If I exclude both uppercase and lowercase referer header, then the rule-exclusion works as expected.
SecRuleUpdateTargetById 2 !REQUEST_HEADERS:Referer
SecRuleUpdateTargetById 2 !REQUEST_HEADERS:referer
Expected behavior
Request header case should be ignored.
Server (please complete the following information):
- OS: Ubuntu 26.04
- ModSecurity Version: 3.0.17
- NGINX Connector Version: v1.0.4
- NGINX Version: 1.28.3
Rule Set (please complete the following information):
N/A
Additional context
Similar to: #3441
Describe the bug
This bug is similar to: #3441, which also doesn't appear in ModSecurity2.
Logs and dumps
N/A
To Reproduce
Re-using the previous example in this issue, say I have this rule:
and I want to write a rule-exclusion for this rule via a configure-time rule-exclusion:
This rule-exclusion works if the client sends a lowercase referer header:
But if the client sends an uppercase referer header, then the request is wrongly blocked:
If I exclude both uppercase and lowercase referer header, then the rule-exclusion works as expected.
Expected behavior
Request header case should be ignored.
Server (please complete the following information):
Rule Set (please complete the following information):
N/A
Additional context
Similar to: #3441