|
From: Ervin H. <ai...@gm...> - 2026-10-22 19:39:23
|
Hi Brant, On Thu, Oct 22, 2026 at 01:55:58PM +0200, Brent Clark wrote: > We want to retain PL1 as our overall paranoia level and avoid enabling > unrelated PL2 rules. > > Is it at all possible run / include rule (i.e id:932239) from > owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf > > Hope to include the id 932239 in crs-setup.conf, > > I'd appreciate any advice or examples from anyone who has implemented > something similar. > > Thanks in advance for your help. Christian beat me to it :), and he was totally accurate. There is no chance to do that out of box. But there is a syntax parser for SecLang, which builds an "AST" (well, we can call it as AST...), where you can do many transformations you want - like the one you asked. Let me know if you have any question. Regards, a. |
