feat: add opt-in build flag to match v2's @rx anchor semantics (#3295)

README.md

@@ -115,6 +115,11 @@ Windows build information can be found [here](build/win32/README.md).
   * **Default:** PCRE2 is detected and used.
   * **Fallback:** legacy PCRE can be used if `--with-pcre` is explicitly provided (`WITH_PCRE`).
 * In other words, current builds expect PCRE2 unless explicitly configured otherwise.
+* `@rx` and `@rxGlobal` compile patterns with `DOTALL | MULTILINE` by default. Pass
+  `--enable-regex-dollar-endonly=yes` to compile them with `DOTALL | DOLLAR_ENDONLY`
+  instead, matching ModSecurity v2's `@rx` behavior (`^`/`$` anchor only at the
+  start/end of the whole subject, not at internal line breaks). This flag is
+  disabled by default; see [issue #3295](https://github.com/owasp-modsecurity/ModSecurity/issues/3295).
 
 All other dependencies are related to operators specified within SecRules or configuration directives and may not be required for compilation.
 

configure.ac

@@ -285,6 +285,11 @@ MSC_ARG_ENABLE_BOOL([afl-fuzz], [Turn on the afl fuzzer compilation utilities],
 MSC_ARG_ENABLE_BOOL([examples], [Turn on the examples compilation (default option)], [true], [buildExamples])
 MSC_ARG_ENABLE_BOOL([parser-generation], [Enables parser generation during the build], [false], [buildParser])
 MSC_ARG_ENABLE_BOOL([mutex-on-pm], [Treat pm operations as critical section], [false], [mutexPm])
+MSC_ARG_ENABLE_BOOL([regex-dollar-endonly], [Compile @rx/@rxGlobal patterns with PCRE(2)_DOLLAR_ENDONLY instead of PCRE(2)_MULTILINE, matching ModSecurity v2 behavior (see issue #3295)], [false], [regexDollarEndonly])
+if test "$regexDollarEndonly" = "true"; then
+    MODSEC_REGEX_DOLLAR_ENDONLY_CPPFLAGS="-DMODSEC_REGEX_DOLLAR_ENDONLY=1"
+    GLOBAL_CPPFLAGS="$GLOBAL_CPPFLAGS $MODSEC_REGEX_DOLLAR_ENDONLY_CPPFLAGS"
+fi
 
 
 if test $buildParser = true; then

src/operators/rx.cc

@@ -26,10 +26,15 @@
 namespace modsecurity {
 namespace operators {
 
+#ifdef MODSEC_REGEX_DOLLAR_ENDONLY
+static const bool kRxMultiLine = false;
+#else
+static const bool kRxMultiLine = true;
+#endif
 
 bool Rx::init(const std::string &arg, std::string *error) {
     if (m_string->m_containsMacro == false) {
-        m_re = new Regex(m_param);
+        m_re = new Regex(m_param, false, kRxMultiLine);
     }
 
     return true;
@@ -46,7 +51,7 @@
 
     if (m_string->m_containsMacro) {
         std::string eparam(m_string->evaluate(transaction));
-        re = new Regex(eparam);
+        re = new Regex(eparam, false, kRxMultiLine);
     } else {
         re = m_re;
     }

src/operators/rx_global.cc

@@ -26,10 +26,15 @@
 namespace modsecurity {
 namespace operators {
 
+#ifdef MODSEC_REGEX_DOLLAR_ENDONLY
+static const bool kRxGlobalMultiLine = false;
+#else
+static const bool kRxGlobalMultiLine = true;
+#endif
 
 bool RxGlobal::init(const std::string &arg, std::string *error) {
     if (m_string->m_containsMacro == false) {
-        m_re = new Regex(m_param);
+        m_re = new Regex(m_param, false, kRxGlobalMultiLine);
     }
 
     return true;
@@ -46,7 +51,7 @@
 
     if (m_string->m_containsMacro) {
         std::string eparam(m_string->evaluate(transaction));
-        re = new Regex(eparam);
+        re = new Regex(eparam, false, kRxGlobalMultiLine);
     } else {
         re = m_re;
     }

src/utils/regex.cc

@@ -87,11 +87,12 @@ bool crlfIsNewline() {
     return crlf_is_newline;
 }
 
-Regex::Regex(const std::string& pattern_, bool ignoreCase)
+Regex::Regex(const std::string& pattern_, bool ignoreCase, bool multiLine)
     : pattern(pattern_.empty() ? ".*" : pattern_) {
 #ifndef WITH_PCRE
     PCRE2_SPTR pcre2_pattern = reinterpret_cast<PCRE2_SPTR>(pattern.c_str());
-    uint32_t pcre2_options = (PCRE2_DOTALL|PCRE2_MULTILINE);
+    uint32_t pcre2_options = PCRE2_DOTALL |
+        (multiLine ? PCRE2_MULTILINE : PCRE2_DOLLAR_ENDONLY);
     if (ignoreCase) {
         pcre2_options |= PCRE2_CASELESS;
     }
@@ -103,7 +104,7 @@ Regex::Regex(const std::string& pattern_, bool ignoreCase)
 #else
     const char *errptr = nullptr;
     int erroffset;
-    int flags = (PCRE_DOTALL|PCRE_MULTILINE);
+    int flags = PCRE_DOTALL | (multiLine ? PCRE_MULTILINE : PCRE_DOLLAR_ENDONLY);
 
     if (ignoreCase == true) {
         flags |= PCRE_CASELESS;

src/utils/regex.h

@@ -71,7 +71,8 @@ struct SMatchCapture {
 
 class Regex {
  public:
-    explicit Regex(const std::string& pattern_, bool ignoreCase = false);
+    explicit Regex(const std::string& pattern_, bool ignoreCase = false,
+        bool multiLine = true);
     ~Regex();
 
     // m_pc and m_pce can't be easily copied