Re: the @pm operator inmodsecurity_crs_40_generic_attacks.conf

Yes, that helps a lot - to use it as a speedy filter.

After RTFM, it appears to have the same functionality as @contain and
that I can use @streq if I want a whole word match.

Thanks,
Stephen

On Wed, Jul 2, 2008 at 8:24 PM, Ryan Barnett <Ryan.Barnett <at> breach.com> wrote:
> It is important to understand the value/purpose that the set-based matching operator brings - speed.  It
is much faster that the regex operator (especially when the data it is inspecting is very large).  With this
being said, you also need to realiaze its shortcoming - decreased logic.  It is simply a text string matcher
and does not have the advaced logic of a regex.
>
> What we chose to do with the core rule set was to use the set-based matching operator as a "pre-qualifier"
before running the more expensive regex checks.  The @pm check casts a wide net to see if the data even has a
chance of matching (as your example shows) and then the regex check would do further analysis (such as
apply word boudary checks) to both rule out this false positive and confirm attack payloads with
increased logic.
>
> Hope this helps.
>
> Thanks,
> Ryan C. Barnett
>
> ----- Original Message -----
> From: mod-security-users-bounces <at> lists.sourceforge.net <mod-security-users-bounces <at> lists.sourceforge.net>
> To: mod-security-users <at> lists.sourceforge.net <mod-security-users <at> lists.sourceforge.net>
> Sent: Tue Jul 01 23:24:59 2008
> Subject: [mod-security-users] the @pm operator inmodsecurity_crs_40_generic_attacks.conf