[Mod-security-developers] Question about ARGS Variable

[Jai H. <jai...@mu...>]

User-documentation states:

"ARGS is a collection and can be used on its own (means all arguments
including the POST Payload)..."

Based on my testing, it does not appear that ARGS is including the POST
payload. I am sending a POST request with the body shown below. I expect it
to trigger Rule 930120, but it does not.

Request Body:

<?xml version='1.0' encoding='UTF-8'?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
     <soapenv:Body>
          <ns1:echo xmlns:ns1="http://example1.org/example1">
                <Text>hello .bashrc</Text>
          </ns1:echo>
     </soapenv:Body>
</soapenv:Envelope>