### PCRE Limits

{
	type => "misc",
	comment => "PCRE limits",
	conf => qq(
		SecRuleEngine On
		SecDebugLog $ENV{DEBUG_LOG}
		SecDebugLogLevel 9

        SecRequestBodyAccess On
        SecRequestBodyLimit 1000000
        SecRequestBodyInMemoryLimit 1000000

        # Set Limits low
        SecPcreMatchLimit 100
        SecPcreMatchLimitRecursion 100

        # Poor REGEX
        SecRule ARGS "(?:(.{2,})\\1{32,})" "phase:2,deny,capture,msg:'REDoS'"
		# Detect PCRE limits exceeded
        SecRule TX:MSC_PCRE_LIMITS_EXCEEDED "!\@streq 0" "phase:2,deny,msg:'ModSecurity Internal Error Flagged: %{MATCHED_VAR_NAME}'"
	),
	match_log => {
		debug => [ qr/PCRE limits exceeded/, 1 ],
	},
	match_response => {
		status => qr/^403$/,
	},
	request => new HTTP::Request(
		POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/index.html",
		[
			"Content-Type" => "application/x-www-form-urlencoded",
		],
		#  Args
		"[encoded data, 71879 characters]",
	),
},
