feat: add opt-in build flag to match v2's @rx anchor semantics (#3295) by fzipi · Pull Request #3600 · owasp-modsecurity/ModSecurity

fzipi · 2026-07-19T03:30:20Z

Summary

Closes the behavioral gap described in #3295: @rx in libmodsecurity (v3) compiles patterns with PCRE(2)_DOTALL | PCRE(2)_MULTILINE, while ModSecurity v2's @rx (msre_op_rx_param_init) uses PCRE(2)_DOTALL | PCRE(2)_DOLLAR_ENDONLY. This means ^/$ anchors behave differently against multi-line values (e.g. multi-line ARGS) between the two engines, which is what surfaced as a CRS false-positive/negative report in coreruleset/coreruleset#3277.

Both commenters on #3295 agreed the target behavior should be v2's flags; the open question was only the rollout mechanism. This PR follows airween's proposal to use a build flag, mirroring the approach Coraza already shipped for the same issue (corazawaf/coraza#876, merged, gated behind coraza.rule.no_regex_multiline, off by default).

configure.ac: adds --enable-regex-dollar-endonly (off by default), defining MODSEC_REGEX_DOLLAR_ENDONLY when enabled.
src/utils/regex.h / regex.cc: Regex gains a multiLine constructor parameter, defaulting to true (current behavior). All existing callers (verifyCC, verifySSN, verifyCPF, internal chain/audit-log/collection regexes, etc.) are unaffected since they don't pass the new parameter.
src/operators/rx.cc / rx_global.cc: only @rx and @rxGlobal pass multiLine=false when the build flag is set, compiling with DOTALL | DOLLAR_ENDONLY instead of DOTALL | MULTILINE. This mirrors v2, where only @rx uses DOLLAR_ENDONLY while other operators (verifyCC, verifySSN, gsbLookup) keep MULTILINE unconditionally.
README.md: documents the new flag next to the existing PCRE2/PCRE section.

Test plan

Standalone harness exercising Utils::Regex directly against both the PCRE2 and legacy PCRE1 backends, confirming multiLine=false reproduces v2's dollar-endonly anchor semantics (no match across internal line breaks; trailing-newline $ behavior matches PCRE's DOLLAR_ENDONLY docs) while multiLine=true preserves current behavior.
Full ./configure && make succeeds with the flag both off (default) and on (--enable-regex-dollar-endonly=yes).
End-to-end: built a small program against the compiled library with SecRule ARGS:param1 "^hello.*world$" "deny" evaluated against a multi-line ARGS value. Default build blocks (reproducing the current v3 behavior described in Operator @rx has different flags in two engines #3295); with the flag enabled it does not block (matching v2).

🤖 Generated with Claude Code

@rx

libmodsecurity's shared Regex class compiles all patterns with PCRE(2)_MULTILINE, while ModSecurity v2's @rx operator uses PCRE(2)_DOLLAR_ENDONLY, so ^/$ anchor differently against multi-line values between the two engines (owasp-modsecurity#3295). Add --enable-regex-dollar-endonly, off by default, mirroring the build-flag rollout Coraza used for the same issue (corazawaf/coraza#876). When enabled, only @rx and @rxglobal compile with DOLLAR_ENDONLY instead of MULTILINE; every other Regex caller (verifyCC, verifySSN, verifyCPF, internal chain/audit-log regexes) keeps its current behavior, matching how v2 itself only applies DOLLAR_ENDONLY to @rx. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Copilot

Pull request overview

Adds an opt-in build-time switch to make libmodsecurity v3’s @rx/@rxGlobal anchor behavior match ModSecurity v2 by compiling those operators with DOLLAR_ENDONLY instead of MULTILINE, while keeping existing behavior as the default.

Changes:

Introduces --enable-regex-dollar-endonly to define MODSEC_REGEX_DOLLAR_ENDONLY at build time.
Extends Utils::Regex with a multiLine constructor parameter controlling whether MULTILINE or DOLLAR_ENDONLY is used.
Updates @rx and @rxGlobal to use the new mode when the build flag is enabled and documents the flag in README.md.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
configure.ac	Adds a new `--enable-regex-dollar-endonly` configure switch that injects `-DMODSEC_REGEX_DOLLAR_ENDONLY=1` into build flags.
src/utils/regex.h	Extends the `Regex` constructor with a `multiLine` parameter (defaulting to current behavior).
src/utils/regex.cc	Switches regex compilation options between `MULTILINE` and `DOLLAR_ENDONLY` based on `multiLine`.
src/operators/rx.cc	Makes `@rx` select `multiLine=false` when `MODSEC_REGEX_DOLLAR_ENDONLY` is enabled.
src/operators/rx_global.cc	Makes `@rxGlobal` select `multiLine=false` when `MODSEC_REGEX_DOLLAR_ENDONLY` is enabled.
README.md	Documents the new build flag and the intended behavioral difference for anchors.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- README: clarify that MULTILINE controls where ^/$ can anchor (per-line vs. whole-subject), while DOLLAR_ENDONLY only further refines $ against a trailing newline; DOTALL is unchanged either way so . still matches across internal line breaks. - Add test/unit/regex_multiline_test.cc, a standalone regression test for the multiLine constructor parameter added to Utils::Regex, covering both the multiLine=true (default) and multiLine=false paths. Wired into test/Makefile.am as its own noinst_PROGRAMS binary and into test/test-suite.in / test-suite.sh (the existing dispatcher only knew how to run JSON test-case files against unit_tests/regression_tests). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

@airween

…ndalone test binary Per @airween's review feedback: the regression test framework already supports skipping a JSON test case at runtime via a "resource" key (test/regression/regression.cc), matching it against a list of compile-time-enabled features (WITH_CURL, WITH_LUA, WITH_LIBXML2, etc.). Register "regex-dollar-endonly" the same way under MODSEC_REGEX_DOLLAR_ENDONLY, and add test/test-cases/regression/operator-rx-dollar-endonly.json gated on it, covering both a single-line match (still blocks) and a multi-line ARGS value (anchors no longer span line breaks). Builds without the flag skip these two cases; builds with it pass. This replaces the standalone regex_multiline_test.cc binary and its Makefile.am/test-suite.in/test-suite.sh wiring from the previous commit, which needlessly diverged from how every other test in this project is structured. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

sonarqubecloud · 2026-07-19T19:53:39Z

Quality Gate passed

Issues
0 New issues
5 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

theMiddleBlue · 2026-08-03T20:49:29Z

Hey 👋 nice work on this one! (I was working on a similar issue and I found this PR)

From a bit of poking around, this doesn't seem to fully close things on the security side (though I'm not sure whether you're already aware of it). Didn't want to drop specifics in a public thread, so I'm happy to share more if that's useful. Thanks 🙏

airween · 2026-08-03T21:41:43Z

From a bit of poking around, this doesn't seem to fully close things on the security side (though I'm not sure whether you're already aware of it). Didn't want to drop specifics in a public thread, so I'm happy to share more if that's useful. Thanks 🙏

Feel free to open a security advisory, there we can discuss the details.

Thank you.

fzipi · 2026-08-04T15:28:43Z

Hey @theMiddleBlue, nice to see you around! 👋

fzipi · 2026-08-04T15:30:27Z

JFYI: this PR is scoped for closing the gap between v2 and v3.

fzipi mentioned this pull request Jul 19, 2026

Operator @rx has different flags in two engines #3295

Open

fzipi changed the title ~~Add opt-in build flag to match v2's @rx anchor semantics (#3295)~~ feat: add opt-in build flag to match v2's @rx anchor semantics (#3295) Jul 19, 2026

fzipi requested a review from Copilot July 19, 2026 12:32

fzipi added the 3.x Related to ModSecurity version 3.x label Jul 19, 2026

Copilot started reviewing on behalf of fzipi July 19, 2026 12:33 View session

Copilot AI reviewed Jul 19, 2026

View reviewed changes

Comment thread README.md Outdated

Comment thread src/utils/regex.cc

airween reviewed Jul 19, 2026

View reviewed changes

Comment thread test/unit/regex_multiline_test.cc Outdated

Comment thread test/test-suite.sh

Navigation Menu

Uh oh!

feat: add opt-in build flag to match v2's @rx anchor semantics (#3295) - #3600

feat: add opt-in build flag to match v2's @rx anchor semantics (#3295)#3600
fzipi wants to merge 3 commits into
owasp-modsecurity:v3/masterfrom
fzipi:fix/rx-regex-dollar-endonly-flag

fzipi commented Jul 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 19, 2026 •

edited

Loading

Uh oh!

theMiddleBlue commented Aug 3, 2026

Uh oh!

airween commented Aug 3, 2026

Uh oh!

fzipi commented Aug 4, 2026

Uh oh!

fzipi commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

fzipi commented Jul 19, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Quality Gate passed

Uh oh!

theMiddleBlue commented Aug 3, 2026

Uh oh!

airween commented Aug 3, 2026

Uh oh!

fzipi commented Aug 4, 2026

Uh oh!

fzipi commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sonarqubecloud Bot commented Jul 19, 2026 •

edited

Loading