Regular expressions in rule targets not respected

[ghost]

I am using core rule set 3.0.2 with latest libmodsecurity built from v3/master on nginx.

By appending the following to rule 942420 for example with:
|!REQUEST_COOKIES:Example.Session
I am able to successfully ignore the offending cookie.

However if I do the same to cover any of my Example cookies like this:
|!REQUEST_COOKIES:/Example/
The target is not respected and the cookie is blocked.

I have also tried variations like /^Example/ or /^Example\./ and cannot make the target match.

[zimmerle]

Hi @Slabber,

Thank you for the bug report. The pipe line inside the regex was considered to be part of the regexp, making the parser to understand __utm/|!REQUEST_COOKIES:/_pk_ref/|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/ as the regular expression for the first REQUEST_COOKIES:/. As of 30797a4 the pipe is no longer accepted inside the regex, instead it was treated like a variable separator. That is the behavior that we can find on ModSecurity version 2.