added support for SecRuleUpdateTargetByTag and SecRuleUpdateTargetById

[Xhoenix]

plugin-lint fails when SecRuleUpdateTargetByTag is used. This issue can be taken as an example.

[Xhoenix]

• variable "ID" was declared but not defined. SecRuleRemoveById fails for single rules.
• added support for SecRuleUpdateTargetById

[fzipi]

Also ID has a special meaning in the textX library.

[Xhoenix]

In the code:-

IDRangeList:
    idlist+=ID | range=IDRange;

the idlist looks for an ID or an IDRange. But, this fails when trying to remove single rules with SecRuleRemoveById.

Is it okay if I change ID variable name to ruleID and use that in idlist+=ruleID? This will solve the problem with SecRuleRemoveById.

Update:- Using the RangeINT definition from TransientAction fixes everything. It uses the predefined INT definition. So, this is what I tested and it works:-

idlist+=INT

'SecRuleUpdateTargetById' ids=INT '"'? negated='!'? variables=Variable '"'?;

As SecRuleUpdateTargetById doesn't support Id range, I used a single ID.

[airween]

See my "big" comment :)

[airween]

Comment for both new rule above:

Here are the references of these directives, both for mod_security2 and libmodsecurity3:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#secruleupdatetargetbyid
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#secruleupdatetargetbytag
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v3.x)#secruleupdatetargetbyid
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v3.x)#secruleupdatetargetbytag

The syntax of two directives are almost the same, so we can take a look only for the first, for example.

Here are the syntax for mod_security2:

SecRuleUpdateTargetById RULEID TARGET1[,TARGET2,TARGET3] REPLACED_TARGET

and for libmodsecurity3:

SecRuleUpdateTargetById RULEID TARGET1[,TARGET2,TARGET3]

As you can see, the REPLACED_TARGET argument is gone.

IMHO without that this syntax makes no sense:

SecRuleUpdateTargetById 1234 "ARGS:foo"

Because you want to update a target - but for what? I mean there is no exclusion mark - with that, it makes sense:

SecRuleUpdateTargetById 1234 "!ARGS:foo"

This means you just want to remove this target.

If you want to be strict, you should allow one of these syntax:

SecRuleUpdateTargetById 1234 "!ARGS:foo"
SecRuleUpdateTargetById 1234 "ARGS:foo" "ARGS:bar"

But I'm sure this is not a critical thing, you can keep this as it is.

Also, both directives allows the list of TARGET:

... TARGET1[,TARGET2,TARGET3]

which is not allowed by this implementation. I suggest that you should add this syntax. Both mod_security2 and libmodsecurity3 allows this syntax.

[Xhoenix]

I've come up with this.

First, I'll create a new variable like this:-

TARGET: '"'? negated='!'? variables=Variable '"'?;

Then I'll change the rules based upon this. For e.g,

SecRuleUpdateTargetById:
    'SecRuleUpdateTargetById' id=INT targets+=TARGET[',']?;

What do you think about this? I tested this and it works.

[airween]

Could you pull this modification to your repository? Thanks.

[airween]

Thanks, I pulled down, tested, and looks now it works as we expect.

[airween]

LGTM.

[airween]

Thanks, I pulled down, tested, and looks now it works as we expect.