Re: [mod-security-users] My variable seems to never expire...

[Mikaël P. <mik...@bo...>]

Hi Ervin,

Thank you very much. I suspected it but I wanted to have confirmation 😢 ...
Do you know if there is a way to emulate this behavior?

Le mar. 15 sept. 2020 à 22:46, Ervin Hegedüs <ai...@gm...> a écrit :

> Hi logo,
>
> On Tue, Sep 15, 2020 at 10:29:47PM +0200, logo wrote:
> > > I didn't checked the logic of the rules, but after the quick view
> > > I assume the expirevar has no effect (it's not implemented).
> > >
> > > Btw it's documented:
> > >
> > >
> https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#expirevar
> > >
> > > "Supported on libModSecurity: TBI"
> > >
> >
> > What does TBI mean?
>
> I guess it means "To Be Implemented".
>
> But you can check it in the source - this is the parser, as you
> can see the scanned token points to the empty action:
>
>
> https://github.com/SpiderLabs/ModSecurity/blob/v3/master/src/parser/seclang-parser.cc#L5027-L5028
>
> and this action does nothing:
>
> https://github.com/SpiderLabs/ModSecurity/blob/v3/master/src/actions/action.cc
>
>
> a.
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>