Ahhh perfect. Good ol control codes. Thought I was going to have to go with   Thanks again!


On Thu, Jan 17, 2013 at 8:32 AM, Breno Silva <breno.silva@gmail.com> wrote:
Could you try ?

SecRule STREAM_OUTPUT_BODY "@rsub s/stuff to find/|20|/d" "phase:4,id:100003,t:none,
nolog,pass,msg:'content stripped!'"


On Thu, Jan 17, 2013 at 1:14 PM, Scott Gerlach <sgerlach@gmail.com> wrote:
One more question if you'll indulge me

I have a rsub rule like so in ModSec 2.7.1
SecRule STREAM_OUTPUT_BODY "@rsub s/stuff to find//d" "phase:4,id:100003,t:none,nolog,pass,msg:'content stripped!'"

And it leaves a / in the output content

if I write the rule like this in ModSec2.6.7
SecRule STREAM_OUTPUT_BODY "@rsub s/stuff to find/ /d" "phase:4,id:100003,t:none,nolog,pass,msg:'content stripped!'"

It replaces with a space, but in 2.7.1 it returns a config error "Error creating rule: Error rsub operator parsing input data". Is this a new feature and if so, how do you replace a sting with nothing?


On Wed, Jan 16, 2013 at 4:15 PM, Scott Gerlach <sgerlach@gmail.com> wrote:
Hmmmm, makes sense based on my testing, but just making sure I didn't miss something. Appreciate the response. 


On Wed, Jan 16, 2013 at 3:50 PM, Breno Silva <breno.silva@gmail.com> wrote:
Yes Scott. It is required.

On Wed, Jan 16, 2013 at 6:42 PM, Scott Gerlach <sgerlach@gmail.com> wrote:
Question about SecStreamOutBodyInspection

Documentation seems to indicate that you do not need SecResponseBodyAccess On but with it turned off debug logs indicate that the rules have nothing to match against.

Is SecResponseBodyAccess required to make SecStreamOutBodyInspection/SecContentInjection work?

-Thanks
Scott

------------------------------------------------------------------------------
Master Java SE, Java EE, Eclipse, Spring, Hibernate, JavaScript, jQuery
and much more. Keep your Java skills current with LearnJavaNow -
200+ hours of step-by-step video tutorials by Java experts.
SALE $49.99 this month only -- learn more at:
http://p.sf.net/sfu/learnmore_122612
_______________________________________________
mod-security-users mailing list
mod-security-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/





------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnmore_122712

_______________________________________________
mod-security-users mailing list
mod-security-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/