Knowledgebase

A specific Modsecurity question...

Posted by iquestionshard, 11-03-2010, 08:20 AM

Hello modsecurity experts. I am hoping to do something specific that may save me hours of work. Is there a way to always use a transform action on a specific variable? For example, ARGS:b64 is encoded as base64, if I could let modsecurity know that this specific argument should always be transformed using t:base64decode it would stop me from having to create a lot of similar looking rules for just 1 variable. SecAction doesn't work, as it only takes actions, no varialbes. SecRule doesn't work, as it is only for specific matches. Any ideas?

Add to Favourites

Print this Article