Inconsistent use of SecArgumentsLimit in Recommended Rules

[studersi]

Describe the bug

The limit SecArgumentsLimit is inconsistently used an documented.

	v2.9.8	v3.0.13
Supported (code)	x	? (could not find it in source code, only in recommended rules)
Supported (documentation)	x (2.9.7)	x (3.0.5)
ModSecurity Recommended Rules	-	x

Logs and dumps

Not applicable.

To Reproduce

Not applicable.

Expected behavior

I would expect the recommended rules for v2.9.8 to also include the SecArgumentsLimit configuration, like 3.0.13.

Server (please complete the following information):

• ModSecurity version (and connector): v2.9.8
• WebServer: Not applicable.
• OS (and distro): Not applicable.

Rule Set (please complete the following information):

• Running any public or commercial rule set? ModSecurity Recommended Rules
• What is the version number? v2.9.8

Additional context

[airween]

Hi @studersi,

thanks for reporting this. You're completely right, it would be much better to make the both versions' default configuration files consistent.

For the record: in libmodsecurity3 the initial set step of that variable is here. (This is a "compiled" code (by Bison), the original part is here).

Would you mind to send a PR for v2 to fix this?

My side note: I'm not sure this rule makes sense; if the engine is in DetectionOnly mode (which is the default...!) then this rule does nothing... But of course we can start to discuss, what would be the nice solution.

[dune73]

I'm not sure I get your argument about the engine. All the blocking recommended rules do nothing unless you put the engine in - well - blocking mode. So what's the difference here?

[airween]

There is no difference, I just think it's a bit confuse that in the "recommended" configuration file we set the engine to "DetectionOnly" and add a rule without any notification that won't work after installation.

My other comment regarding this rule that rule 200002 does (almost) the same (but in another way). If the SecArgumentsLimit is set (and it is here), then if the number of arguments has reached the limit, then it sets the REQBODY_ERROR, which triggers rule 200002.

I really don't know that rule 200007 is necessary. But not really disturbing, just my 2 cents.

[airween]

@studersi, @dune73, @marcstern - what do you think guys, do we need rule 200007 in recommended modsecurity.conf file? As I explained above I don't think it's necessary, but I don't want to decide alone. I will gladly create a PR if it's really need.