libmodsecurity (v3) incompatible ctl:ruleRemoveByTag in rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf

[theMiddleBlue]

the following two exclusion rules are not compatible with libmodsecurity (v3) due to ctl:ruleRemoveByTag:

file: rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf

9003100:

owasp-modsecurity-crs/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf

Lines 63 to 74 in fbac747

	SecRule REQUEST_FILENAME "@contains /remote.php/webdav" \
	"id:9003100,\
	phase:2,\
	pass,\
	t:none,\
	nolog,\
	ctl:ruleRemoveByTag=attack-injection-php,\
	ctl:ruleRemoveById=941000-942999,\
	ctl:ruleRemoveById=951000-951999,\
	ctl:ruleRemoveById=953100-953130,\
	ctl:ruleRemoveById=920420,\
	ctl:ruleRemoveById=920440"

9003340:

owasp-modsecurity-crs/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf

Lines 284 to 290 in fbac747

	SecRule REQUEST_FILENAME "@contains /index.php/apps/notes/" \
	"id:9003340,\
	phase:2,\
	pass,\
	t:none,\
	nolog,\
	ctl:ruleRemoveByTag=attack-injection-php"

[theMiddleBlue]

A PR will be available soon on ModSecurity that fix this problem. Thanks to @airween for the precious support.

[theMiddleBlue]

fixed by owasp-modsecurity/ModSecurity#2102 thanks @airween @zimmerle