@pmf operator on libModSecurity3 is not ignoring "#" on an otherwise empty line as it should

[dune73]

The CRS rule 913100 is based on scanners-user-agents.data and this file contains lines with only a #. A user-agent with a # leads to a false positive.

Logs and dumps

See SpiderLabs/owasp-modsecurity-crs#1215

Notice: Be carefully to not leak any confidential information.

To Reproduce

Steps to reproduce the behavior:

curl -v localhost -H "User-Agent: Sogou Pic Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"

Expected behavior

All lines starting with # are being ignored like with ModSec 2.x.

[victorhora]

Hi @dune73

Thanks for the report. It seems like this is a duplicate of #1645. Do you mind sharing your findings there so we can better keep track of the issues?

Thanks.

[dune73]

Don't mind at all. Thanks for the pointer.