diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index 66be3535..d40fe9f0 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -1975,11 +1975,13 @@ SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1ARGS:p will not result in any - invocations against the operator if argument p does not exist. Some - variables are actually collections, which are expanded into more - variables at runtime. The following example will examine all request - arguments:SecRule ARGS dirty + expression). To look at only the query string or body arguments, see the + ARGS_GET and ARGS_POST + collections. + + Some variables are actually collections, which are expanded into + more variables at runtime. The following example will examine all + request arguments:SecRule ARGS dirty Sometimes, however, you will want to look only at parts of a collection. This can be achieved with the help of the selection operator(colon). The following example will only look at the @@ -2002,6 +2004,9 @@ SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1id_: SecRule ARGS:/^id_/ dirty + Using ARGS:p will not result in any + invocations against the operator if argument p does not exist. + In ModSecurity 1.X, the ARGS variable stood for QUERY_STRING + POST_PAYLOAD, whereas now it expands to to individual variables. @@ -2036,6 +2041,37 @@ SecRule ARGS_COMBINED_SIZE "@gt 25" ARGS_NAMES "!^(p|a)$" +
+ <literal moreinfo="none">ARGS_GET</literal> + + ARGS_GET is similar to ARGS, + but only contains arguments from the query string. +
+ +
+ <literal moreinfo="none">ARGS_GET_NAMES</literal> + + ARGS_GET_NAMES is similar to + ARGS_NAMES, but only contains argument names from the + query string. +
+ +
+ <literal moreinfo="none">ARGS_POST</literal> + + ARGS_POST is similar to + ARGS, but only contains arguments from the POST + body. +
+ +
+ <literal moreinfo="none">ARGS_POST_NAMES</literal> + + ARGS_POST_NAMES is similar to + ARGS_NAMES, but only contains argument names from the + POST body. +
+
<literal moreinfo="none">AUTH_TYPE</literal>