Is it possible to use regex groups with alternatives for SecRuleUpdateTargetById?

[studersi]

Describe the bug

If we use the following rule and rule exclusion, the configuration does not pass the syntax check:

SecRule ARGS:foo|ARGS:bar "@rx ^.*" "id:1,deny"
SecRuleUpdateTargetById 1 "!ARGS:/(foo|bar)/"

AH00526: Syntax error on line XXX of /opt/apache24/conf/httpd.conf:
Error parsing rule targets to append variable

However, the following is accepted by the syntax check and the rule exclusion is working as expected:

SecRule ARGS:foo|ARGS:bar "@rx ^.*" "id:1,deny"
SecRuleUpdateTargetById 1 "!ARGS:/(foo)/"

Should this be possible or is this simply not supported?

Logs and dumps

See above.

To Reproduce

Steps to reproduce the behavior:

1. Add rule and rule exclusion to config file
2. Restart Apache -> fails with error message

Expected behavior

I would expect the rule exclusion to remove both ARGS:foo and ARGS:bar from rule 1 instead of failing the syntax check.

Server (please complete the following information):

• ModSecurity version (and connector): v2.9.8
• WebServer: Apache 2.4.62
• OS (and distro): Linux, RHEL

[dune73]

Ah, interesting. I've come across this before. Good there is now a bug report covering it.

[studersi]

Yes, and we also found out that for older versions (confirmed on v2.9.7) there was no syntax error but the exclusion did not work either.

With respects to the case described above, it means that this rule exclusion would pass the syntax check but access to https://example.com/?foo=x would still be blocked.

SecRule ARGS:foo|ARGS:bar "@rx ^.*" "id:1,deny"
SecRuleUpdateTargetById 1 "!ARGS:/(foo|bar)/"

While the following would still work as expected, allowing https://example.com/?foo=x to be accessed.

SecRule ARGS:foo|ARGS:bar "@rx ^.*" "id:1,deny"
SecRuleUpdateTargetById 1 "!ARGS:/(foo)/"

[marcstern]

Can you try to enclose your regex in single quotes?
ARGS:'/(foo|bar)/'

[studersi]

Using single quotes instead of double quotes to surround the argument yields the same result as before:

SecRule ARGS:foo|ARGS:bar "@rx ^.*" "id:1,deny"
SecRuleUpdateTargetById 1 '!ARGS:/(foo|bar)/'

AH00526: Syntax error on line XXX of /opt/apache24/conf/httpd.conf:
Error parsing rule targets to append variable

However, using single quotes around only the regex, as @marcstern suggests, appears to solve the problem.

SecRule ARGS:foo|ARGS:bar "@rx ^.*" "id:1,deny"
SecRuleUpdateTargetById 1 !ARGS:'/(foo|bar)/'

I can now access both https://example.com/?foo=x and https://example.com/?bar=x. This is true for both v2.9.7 and v2.9.8.

Thank you @marcstern for the suggestion.