Any instance of "1=1" in an HTTP request or cookie triggers a "SQL Injection Attack" alarm about owasp-modsecurity-crs HOT 3 CLOSED

Please provide an audit log example of a match and the full SecRule that is matching.

from owasp-modsecurity-crs.

Sorry, I don't have the time, resources, and expertise required to do that. I have switched software and the false positive is no longer impacting me personally. But I did want to make sure you folks knew about the false positive. Best wishes,
Jacob

from owasp-modsecurity-crs.

This is very delayed but still open and therefore deserves and answer. The rule that was causing this issue has been modified and the current release CRS v3rc1 no longer has thi problem. Both the following requests were tried

GET / HTTP/1.1
Host: localhost
User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.7.0_13
Cookie: xyz=1%3d1

GET / HTTP/1.1
Host: localhost
User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.7.0_13
Cookie: xyz=1=1

Netiher caused a FP. Thank you for the issue report and the patience :)

from owasp-modsecurity-crs.