SpiderLabs/owasp-modsecurity-crs — pull request #8 by benwilliams (2012-11-12 00:36:49+00:00)
Title: Bug fixes

in RESPONSE_HEADERS:/Set-Cookie2?/ but did match in REQUEST_COOKIES.

Also there was a bug related to comparisons on collection keys that do
not exist. When a request contains a cookie that has not been saved to
the SESSION collection before, the intention is for tx.anomaly_score
to be incremented by 5 (critical) and the rest of the checks skipped,
but this does not happen. Any test on a collection key that does not
exist always returns false. This means the test on SESSION:VALID "!@eq
1" returns false, when the intention is for it to return true if the
session cookie has not been seen before. And the following rules in
the block are run which triggers 981059,981060,981061 to return true
since it is a new session collection withou ip_hash or ua_hash keys.