I have a modsecurity with Core Rule Set. And I have POST-request with 3 parameters: Par1 = "base64-encoded XML "& Par2 = "url" & Par3 = "hash".
I want to modificate CRS rules to base64Decode only Par1 and use Par2 & Par3 'as is'.
I tried to use
SecRuleUpdateActionById directive, but it requires to write a directive for every rule in CRS.
SecDefaultAction directive does not work too, because all CRS-rules have "t:none" that overrides default actions.
I also found
multiMatch action, but I think it will cause a lot of false positives on base64-string.
Is there some way to update actions for multiple rules without rewriting this rules?