[
  {
    "enabled": 1,
    "version_min": 209000,
    "version_max": -1,
    "title": "ctl:ruleRemoveById doesn't handle all ranges equally 1",
    "url": "https://github.com/SpiderLabs/ModSecurity/issues/1956",
    "client": {
      "ip": "200.249.12.31",
      "port": 2313
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "request": {
      "headers": {
        "Host": "www.google.com",
        "Content-Length": "0"
      },
      "uri": "/test.pl?param1=   test   &param2=<a href=\"javascript:alert(1)\">)",
      "method": "GET",
      "http_version": 1.1,
      "body": [
        ""
      ]
    },
    "response": {
      "headers": {
        "Content-Length": "0"
      },
      "body": [
        ""
      ]
    },
    "expected": {
      "debug_log": "Rule id: 913104 was skipped due to a ruleRemoveById",
      "http_code": 200
    },
    "rules": [
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:913104,phase:request,pass,nolog,t:none,msg:'whee'\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 209000,
    "version_max": -1,
    "title": "ctl:ruleRemoveById doesn't handle all ranges equally 2",
    "url": "https://github.com/SpiderLabs/ModSecurity/issues/1956",
    "client": {
      "ip": "200.249.12.31",
      "port": 2313
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "request": {
      "headers": {
        "Host": "www.google.com",
        "Content-Length": "0"
      },
      "uri": "/test.pl?param1=   test   &param2=<a href=\"javascript:alert(1)\">)",
      "method": "GET",
      "http_version": 1.1,
      "body": [
        ""
      ]
    },
    "response": {
      "headers": {
        "Content-Length": "0"
      },
      "body": [
        ""
      ]
    },
    "expected": {
      "debug_log": "Rule id: 913104 was skipped due to a ruleRemoveById",
      "http_code": 200
    },
    "rules": [
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913104\"",
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:913104,phase:request,pass,nolog,t:none,msg:'whee'\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 209000,
    "version_max": -1,
    "title": "ctl:ruleRemoveById doesn't handle all ranges equally 3",
    "url": "https://github.com/SpiderLabs/ModSecurity/issues/1956",
    "client": {
      "ip": "200.249.12.31",
      "port": 2313
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "request": {
      "headers": {
        "Host": "www.google.com",
        "Content-Length": "0"
      },
      "uri": "/test.pl?param1=   test   &param2=<a href=\"javascript:alert(1)\">)",
      "method": "GET",
      "http_version": 1.1,
      "body": [
        ""
      ]
    },
    "response": {
      "headers": {
        "Content-Length": "0"
      },
      "body": [
        ""
      ]
    },
    "expected": {
      "debug_log": "Rule id: 913103 was skipped due to a ruleRemoveById",
      "http_code": 200
    },
    "rules": [
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:913103,phase:request,pass,nolog,t:none,msg:'whee'\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 209000,
    "version_max": -1,
    "title": "ctl:ruleRemoveById doesn't handle all ranges equally 4",
    "url": "https://github.com/SpiderLabs/ModSecurity/issues/1956",
    "client": {
      "ip": "200.249.12.31",
      "port": 2313
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "request": {
      "headers": {
        "Host": "www.google.com",
        "Content-Length": "0"
      },
      "uri": "/test.pl?param1=   test   &param2=<a href=\"javascript:alert(1)\">)",
      "method": "GET",
      "http_version": 1.1,
      "body": [
        ""
      ]
    },
    "response": {
      "headers": {
        "Content-Length": "0"
      },
      "body": [
        ""
      ]
    },
    "expected": {
      "debug_log": "Rule id: 913105 was skipped due to a ruleRemoveById",
      "http_code": 200
    },
    "rules": [
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:913105,phase:request,pass,nolog,t:none,msg:'whee'\""
    ]
  },
  {
    "enabled": 1,
    "version_min": 209000,
    "version_max": -1,
    "title": "ctl:ruleRemoveById doesn't handle all ranges equally 5",
    "url": "https://github.com/SpiderLabs/ModSecurity/issues/1956",
    "client": {
      "ip": "200.249.12.31",
      "port": 2313
    },
    "server": {
      "ip": "200.249.12.31",
      "port": 80
    },
    "request": {
      "headers": {
        "Host": "www.google.com",
        "Content-Length": "0"
      },
      "uri": "/test.pl?param1=   test   &param2=<a href=\"javascript:alert(1)\">)",
      "method": "GET",
      "http_version": 1.1,
      "body": [
        ""
      ]
    },
    "response": {
      "headers": {
        "Content-Length": "0"
      },
      "body": [
        ""
      ]
    },
    "expected": {
      "debug_log": "Rule: 913102. Executing operator",
      "http_code": 200
    },
    "rules": [
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
      "SecRule REQUEST_URI \"@beginsWith /test\" \"id:913102,phase:request,pass,nolog,t:none,msg:'whee'\""
    ]
  }
]
