t:lowercase check

[theMiddleBlue]

is it possible to check if a rule has t:lowercase but the operator argument contains any character in A-Z range?

[airween]

I think secrules_parsing is not able to do that. But you can do that with msc_pyparser.

[fzipi]

@theMiddleBlue Finally dived into this one.

Wrote a test like this:

def test_lowercase_and_uppercase_in_argument() -> None:
    """Test that a collection argument can contain `$` (e.g., a key in a JSON document)"""
    rule_text = """
    SecRule REQUEST_FILENAME "@rx /[ABCD]+/$" \
    "id:1234,\
    phase:1,\
    pass,\
    t:lowercase,\
    nolog
    """

    uppercase_regex = re.compile('/[A-Z]/')
    parsed_rule = parser.process_from_str(rule_text)
    for rule in parsed_rule.rules:
        assert rule.__class__.__name__ == "SecRule"
        for action in rule.actions:
            if action.transformations:
                for t in action.transformations:
                    if t == "lowercase":
                        assert not uppercase_regex.match(rule.operator.rx)

So you can indeed write something similar to match your usage.