I just discovered a bug while using the "ruleRemoveTargetById" action. When the action is used with multiple targets in a specific order: specific (like ARGS:test) followed by generic ones (like REQUEST_BODY, ARGS), the exception will not be applied to the simple targets (Cf. https://www.modsecurity.org/tracker/browse/MODSEC-333).

For example, if the action is used this way:

the exception will work for "ARGS:test" but not for "REQUEST_BODY".

The workaround for this is to put generic targets ("ARGS", "REQUEST_BODY") before specific ones ("ARGS:test").