Minimal test config to demonstrate PCRE data leaks in ModSecurity2

test.conf

SecRuleEngine On

# Default HTTP policy: allowed_request_content_type (rule 900220)
SecRule &TX:allowed_request_content_type "@eq 0" \
    "id:901162,\
    phase:1,\
    pass,\
    nolog,\
    setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain'"


SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \
    "id:920420,\
    phase:2,\
    block,\
    capture,\
    t:none,\
    msg:'Request content type is not allowed by policy',\
    logdata:'%{MATCHED_VAR}',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-protocol',\
    tag:'paranoia-level/1',\
    tag:'OWASP_CRS',\
    tag:'OWASP_CRS/POLICY/CONTENT_TYPE_NOT_ALLOWED',\
    tag:'WASCTC/WASC-20',\
    tag:'OWASP_TOP_10/A1',\
    tag:'OWASP_AppSensor/EE2',\
    tag:'PCI/12.1',\
    ver:'OWASP_CRS/3.2.0',\
    severity:'CRITICAL',\
    chain"
    SecRule TX:0 "!@rx ^%{tx.allowed_request_content_type}$" \
        "t:none,\
        ctl:forceRequestBodyVariable=On,\
        setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"