Open
Description
As detailed in #3046, there's a bug in libmodsecurity3 where line break characters may be part of the header value, e.g. charset=utf-8\r\n
. This leads to false positives in rule 922110. @airween found that using t:removeWhiteSpace
fixes the false positives.
It appears to me that it should be possible to simplify the regular expression in 922110 by adding t:removeWhiteSpace
, without impacting detection quality.