10GB ModSecurity File - Tons of 920100 Warnings. Need Help Understanding Rule Violation

CRS 3.3.2 (and 4.0.0)
Paranoia Level: 1
ModSecurity 3.0.8
ModSecurity-nginx connector 1.0.3
Nginx 1.23.2
Ubuntu 22.04
CSR 920100 Warnings:
I had a question over at stackoverflow about this: https://stackoverflow.com/questions/74269998/10gb-modsecurity-file-tons-of-920100-warnings-need-help-understanding-rule-vi/74322954#74322954 . The person who answered says this is a false positive and recommended that I report it here. They provided a detailed confirmation with the regex as well.
Basically, almost every webpage loaded causes the same type of error. This is an example part of the log:
---5jn0CgkO---H-- ModSecurity: Warning. Matched "Operator Rx' with parameter ^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$' against variable REQUEST_LINE' (Value: GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/2.0' ) [file "/etc/nginx/modsec/coreruleset-3.3.2/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "47"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/2.0"] [severity "4"] [ver "OWASP_CRS/3.3.2"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "***.***.***.***"] [uri "/sale/kenwood-kac-6402-by-download-mauritron-221328-264064/"] [unique_id "166725616876.036760"] [ref "v0,72"]
I'm fairly unversed in CSR error analysis or regex, but was hoping there was a way to fix the root cause. It sounds like I will have to write a custom exception to hide the 10GB of warnings. Note, this doesn't appear to be blocking users, but I had so many warnings showing up in my logs that all the disk space on the web server got used up and crashed everything.

EDIT: I did upgrade to CSR 4.0.0 just to see if there was any change, but that didn't fix it. I added the exception for just the "/sale/" type urls, but the 920100 error shows up for just about anything. I should state that on Nginx, I have about 20 different domain names hosted on 1 IP address, so I'm not sure if a server misconfiguration is the cause of this problem - I switched to Nginx recently, so Ngnix is new to me. Here are a couple of other ModSecurity Warnings showing up in the logs:
---tOFjilPn---A--
[05/Nov/2022:01:46:27 +0000]<PHONE_NUMBER>78.177364 <IP_ADDRESS> 44998 ***.***.***.*** 443
---tOFjilPn---B--
GET /robots.txt HTTP/1.1
Host: www.********.com
Accept: */*
Accept-Encoding: gzip,deflate
Connection: close
User-Agent: Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)

---tOFjilPn---E--
User-agent: *\x0d\x0aDisallow: /search\x0d\x0aDisallow: /store/?*keywordsearch=\x0d\x0aDisallow: /account\x0d\x0aDisallow: /contact/\x0d\x0aDisallow: /sell/step2.php\x0d\x0aDisallow: /sale/report-item.php\x0d\x0aDisallow: /sale/print-item.php\x0d\x0aDisallow: /sale/save-seller.php\x0d\x0aDisallow: /sale/cart.php\x0d\x0aDisallow: /sale/make-an-offer.php\x0d\x0aDisallow: /email-friend.php\x0d\x0a\x0d\x0aUser-agent: Yandex\x0d\x0aDisallow: /\x0d\x0a\x0d\x0aUser-agent: Baiduspider\x0d\x0aDisallow: /\x0d\x0a\x0d\x0aSitemap: https://www.**********.com/sitemap/sitemap.xml

---tOFjilPn---F--
HTTP/1.1 200
X-Frame-Options: SAMEORIGIN
ETag: "5f2345fa-1c8"
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Thu, 30 Jul 2020 22:13:14 GMT
X-XSS-Protection: 1; mode=block
Connection: close
X-Content-Type-Options: nosniff
Content-Type: text/plain
Content-Length: 456
Date: Sat, 05 Nov 2022 01:46:27 GMT
Server: nginx
Referrer-Policy: strict-origin
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()

---tOFjilPn---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^# (19 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /robots.txt HTTP/1.1' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /robots.txt HTTP/1.1"] [severity "4"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "***.***.***.***"] [uri "/robots.txt"] [unique_id "166761278778.177364"] [ref "v0,24"]

---91jFkwcm---A--
[05/Nov/2022:01:46:24 +0000]<PHONE_NUMBER>38.117133 <IP_ADDRESS> 28928 ***.***.***.*** 443
---91jFkwcm---B--
GET /bootstrap/3.3.2/css/bootstrap.min.css HTTP/2.0
host: www.***********.com
cache-control: no-cache
pragma: no-cache
accept: */*
accept-encoding: gzip, deflate
from: bingbot(at)microsoft.com
user-agent: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)

---91jFkwcm---F--
HTTP/2.0 200
X-Frame-Options: SAMEORIGIN
ETag: "5aa597b3-1d156"
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Sun, 11 Mar 2018 20:55:15 GMT
X-XSS-Protection: 1; mode=block
Connection: close
X-Content-Type-Options: nosniff
Content-Type: text/css
Content-Length: 119126
Date: Sat, 05 Nov 2022 01:46:24 GMT
Server: nginx
Referrer-Policy: strict-origin
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()

---91jFkwcm---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^# (19 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /bootstrap/3.3.2/css/bootstrap.min.css HTTP/2.0' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /bootstrap/3.3.2/css/bootstrap.min.css HTTP/2.0"] [severity "4"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "***.***.***.***"] [uri "/bootstrap/3.3.2/css/bootstrap.min.css"] [unique_id "166761278438.117133"] [ref "v0,51"]

---N0QmJpHm---A--
[05/Nov/2022:01:46:13 +0000]<PHONE_NUMBER>85.635313 <IP_ADDRESS> 31088 ***.***.***.*** 443
---N0QmJpHm---B--
GET / HTTP/1.1
Accept: text/html,text/plain,text/xml,text/*,application/xml,application/xhtml+xml,application/rss+xml,application/atom+xml,application/rdf+xml,application/php,application/x-php,application/x-httpd-php
User-Agent: Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)
Accept-Encoding: br,gzip
Accept-Language: en
Host: www.*********.com
---N0QmJpHm---F--
HTTP/1.1 200
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Cache-Control: no-store, no-cache, must-revalidate
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Set-Cookie: NEWSESSID=8qeb2tpjmck10o91jt2asuavss; path=/; HttpOnly
Pragma: no-cache
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Date: Sat, 05 Nov 2022 01:46:13 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()

---N0QmJpHm---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^# (19 characters omitted)' against variable `REQUEST_LINE' (Value: `GET / HTTP/1.1' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET / HTTP/1.1"] [severity "4"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "***.***.***.***"] [uri "/"] [unique_id "166761277385.635313"] [ref "v0,14"]

---TKmw6kDO---A--
[05/Nov/2022:01:45:48 +0000]<PHONE_NUMBER>59.613099 <IP_ADDRESS> 20667 ***.***.***.*** 443
---TKmw6kDO---B--
GET /logo.jpg HTTP/1.1
host: www.*********.com
user-agent: Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)
accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
accept: */*
accept-encoding: gzip, deflate
accept-language: en-us;q=0.7,en;q=0.3
connection: close
if-modified-since: Thu, 01 Mar 2018 01:57:30 GMT
if-none-match: "5a975e0a-13380"

---TKmw6kDO---F--
HTTP/1.1 304
Server: nginx
Date: Sat, 05 Nov 2022 01:45:48 GMT
Last-Modified: Thu, 01 Mar 2018 01:57:30 GMT
Connection: close
X-XSS-Protection: 1; mode=block
ETag: "5a975e0a-13380"
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin

---TKmw6kDO---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^# (19 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /logo.jpg HTTP/1.1' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /logo.jpg HTTP/1.1"] [severity "4"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "***.***.***.***"] [uri "/logo.jpg"] [unique_id "166761274859.613099"] [ref "v0,22"]

I think I have the same issue, and I'm on CRS 3.3.4, and have been researching for 3 days now, followed your stackoverflow post yesterday, and now see you have a very similar environment to me, so I'll add my notes in case recognizing similarities between our environments may help narrow down the issue.
(I think I removed all personal identifiers)
My CRS error examples (from 2 different sites, domains, on same server):
-----1-----
ModSecurity: Warning. Matched "Operator Rx' with parameter ^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w-./](?::\d+)?)?/[^?#](?:?[^#\s])?(?:#[\S])?|connect (?:\d{1,3}.){3}\d{1,3}.?(?::\d+)?|options *)\s+[\w./]+|get /[^?#](?:?[^#\s])?(?:#[\S]*)?)$' against variable REQUEST_LINE' (Value: GET /2020/04/head-of-federal-vaccine-agency-says-trump-retaliated-we-know-better HTTP/1.1' ) [file "/etc/nginx/modsec/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "48"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /2020/04/head-of-federal-vaccine-agency-says-trump-retaliated-we-know-better HTTP/1.1"] [severity "4"] [ver "OWASP_CRS/3.3.4"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "<IP_ADDRESS>"] [uri "/2020/04/head-of-federal-vaccine-agency-says-trump-retaliated-we-know-better"] [unique_id "166761149793.780004"] [ref "v0,89"]
-----2-----
ModSecurity: Warning. Matched "Operator Rx' with parameter ^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w-./](?::\d+)?)?/[^?#](?:?[^#\s])?(?:#[\S])?|connect (?:\d{1,3}.){3}\d{1,3}.?(?::\d+)?|options *)\s+[\w./]+|get /[^?#](?:?[^#\s])?(?:#[\S]*)?)$' against variable REQUEST_LINE' (Value: GET /favicon.ico HTTP/1.1' ) [file "/etc/nginx/modsec/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "48"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /favicon.ico HTTP/1.1"] [severity "4"] [ver "OWASP_CRS/3.3.4"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "<IP_ADDRESS>"] [uri "/favicon.ico"] [unique_id "166761147420.114863"] [ref "v0,25"]
My environment:
CRS 3.3.4     (vs. your 3.3.2)
Paranoia Level: 1
ModSecurity 3.0.8
ModSecurity-nginx connector 1.0.3
Nginx 1.22.1    (vs your 1.23.2)
Ubuntu 22.04
My research of other unsolved reports and my intuition is telling me that this seems to be caused by some combination/sequence of dependencies and every report I've seen is specific to Ubuntu 22.04 with Nginx (no reports of this issue with Ubuntu 20.04, pointing to one of the core dependencies).
And I didn't have an issue until I performed system updates on 10/31 which included Nginx, ModSecurity, Modsecurity-nginx, OpenSSL v3, and other updates (i can check apt logs).
I'm about to spend my friday night building a new server from scratch because I dont know what part of it is causing this and it's about time I start fresh with a new mainline. As background this image is a couple years old, started as ubuntu 18.04, has had many [nonstandard] upgrade /downgrade paths. Also it's my own personal blog server (EC2 on AWS) so if Devs want access I could easly spin up a copy for you, in case it would help to check current dependencies or do your own testing on a snapshot of the live server.

I'm also experiencing an issue with 920600, which appears to be this one, in case it's related:
https://github.com/coreruleset/coreruleset/issues/2771

Also this piqued my interest and I was playing with nginx / gzip settings, but may have been a misguided rabbit hole:
https://github.com/SpiderLabs/ModSecurity-nginx/issues/251

My nginx build:
nginx version: nginx/1.22.1
built with OpenSSL 3.0.2 15 Mar 2022
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -ffile-prefix-map=/build/nginx-TNaH8h/nginx-1.22.1=. -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -flto=auto -ffat-lto-objects -flto=auto -Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module

Wow, this is quite the thing.
I do not see 920100 triggered in production at all and your request lines look very innocent.
Now @airween has pointed out that the regex in question is matching. That is correct. But it is matching as it should, since the rule negates the result of the match. That means this rule is meant to trigger on request lines that are semantically incorrect. Yet your request lines, the ones reported by @peppies as well as those by @Lenny1791 seem correct to me.
@airween: Please confirm.
I do not have a nginx running here, but this smells like bug to me.
Can you guys run ModSec in debug mode with a very high debug level? One request triggering this rule in debug would probably be enough.
And thank you for the details build info @Lenny1791. This could help.

Sure... hang on 10 min...

Well, Sorry it took me a while... the data in this debug log looks like a live exploit (and made cross-platform, utilizing IIS paths as well). So I just shut down nginx after documenting what I could live...
I wonder if @peppies has the same intrusion.
Anyway I wonder if this is more widespread... after all I did just add exceptions for those rules for a couple days and ignore it...
For posting here, I isolated one request for the favicon.ico in both audit and debug log and copied and pasted those into separate files that I'll attach here.
The other pair of log files I will upload on the security page represent only 4-5 requests I think over about 30 seconds, but have a lot more info for research (as I moved the log file then saved newly created versions after 30 secs).
Let me know what you find please and thank you!
audit.log
debug.log

@airween: Please confirm.

Yes, I can confirm that you're right: rule triggers only if the request line does not matches with the given pattern by the rule. That was my mistake, sorry everyone. I've updated my comment on SO too.
Btw, now I checked the given examples on Nginx with CRS 3.3.
The results were:

HTTP/1.1

[166764527238.898874] [/sale/kenwood-kac-6402-by-download-mauritron-221328-264064/] [4] (Rule: 920100) Executing operator "Rx" with param "^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" against REQUEST_LINE.
[166764527238.898874] [/sale/kenwood-kac-6402-by-download-mauritron-221328-264064/] [9] Target value: "GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/1.1" (Variable: REQUEST_LINE)
[166764527238.898874] [/sale/kenwood-kac-6402-by-download-mauritron-221328-264064/] [4] Rule returned 0.

[16676453575.521696] [/bootstrap/3.3.2/css/bootstrap.min.css] [4] (Rule: 920100) Executing operator "Rx" with param "^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" against REQUEST_LINE.
[16676453575.521696] [/bootstrap/3.3.2/css/bootstrap.min.css] [9] Target value: "GET /bootstrap/3.3.2/css/bootstrap.min.css HTTP/1.1" (Variable: REQUEST_LINE)
[16676453575.521696] [/bootstrap/3.3.2/css/bootstrap.min.css] [4] Rule returned 0.

[166764545155.322862] [/] [4] (Rule: 920100) Executing operator "Rx" with param "^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" against REQUEST_LINE.
[166764545155.322862] [/] [9] Target value: "GET / HTTP/1.1" (Variable: REQUEST_LINE)
[166764545155.322862] [/] [4] Rule returned 0.

[166764551097.221135] [/logo.jpg] [4] (Rule: 920100) Executing operator "Rx" with param "^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" against REQUEST_LINE.
[166764551097.221135] [/logo.jpg] [9] Target value: "GET /logo.jpg HTTP/1.1" (Variable: REQUEST_LINE)
[166764551097.221135] [/logo.jpg] [4] Rule returned 0.

I have a configured Nginx server with modsecurity, it's able to serve HTTP/2.0 too, and checked the your requests which were with h2:

[166764568789.501240] [/sale/kenwood-kac-6402-by-download-mauritron-221328-264064/] [4] (Rule: 920100) Executing operator "Rx" with param "^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" against REQUEST_LINE.
[166764568789.501240] [/sale/kenwood-kac-6402-by-download-mauritron-221328-264064/] [9] Target value: "GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/2.0" (Variable: REQUEST_LINE)
[166764568789.501240] [/sale/kenwood-kac-6402-by-download-mauritron-221328-264064/] [4] Rule returned 0.

[16676457568.279202] [/bootstrap/3.3.2/css/bootstrap.min.css] [4] (Rule: 920100) Executing operator "Rx" with param "^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" against REQUEST_LINE.
[16676457568.279202] [/bootstrap/3.3.2/css/bootstrap.min.css] [9] Target value: "GET /bootstrap/3.3.2/css/bootstrap.min.css HTTP/2.0" (Variable: REQUEST_LINE)
[16676457568.279202] [/bootstrap/3.3.2/css/bootstrap.min.css] [4] Rule returned 0.

In every cases I got what I expected, the rule 920100 never triggered.
As @dune73 wrote, perhaps it's some engine problem.
How did you install the Nginx and ModSecurity?
 I've built these packages, you can install any of them to Debian 10/11, and Ubuntu 18.04/20.04/22.04.

@peppies, @Lenny1791 - if you have the chance, you can try that you turn the debug log on for a while, like this:
    modsecurity on;
    modsecurity_rules '
        SecDebugLog /var/log/nginx/your.vhost.com/modsec_debug.log
        SecDebugLogLevel 9
    ';

That will gives you the output like as mine above. May be that would be help to investigate the problem.
After sending a request which triggers the rule, find the rule id in that log.

I concur. All of the request lines should match and, therefore, not trigger the rule. Smells like a ModSecurity bug to me...

I took a peek at the logs. Error with regular expression looks extremely suspicious but it doesn't seem to come from ModSecurity. Could it be comeing from PCRE?

Couldn't find that string in PCR2 either. @peppies @Lenny1791 Could you provide a list of dependencies (and their versions) that you use for ModSecurity?

Thank you for taking a look at the logs @theseion. Error with regular expression is telling.
But this might be a bug or behaviour we need to be aware of. Many thanks for reporting. How we can somehow reproduce this.
Anything unusual in the configure call provided by @Lenny1791 above?

I've also checked Modsecurity-nginx and nginx itself, no such error message.

Anything unusual in the configure call provided by @Lenny1791 above?

Not that I can tell. I think @Lenny1791 is right, it's likely an issue with some dependency / dependency version.

@Lenny1791, you shared your debug.log, which content is very weird, as @theseion wrote above.
Is this the only content in your log?
You shared with us the Nginx configure options, but I think your libmodsecurity3 build options would be more important. Please give us all the available information, eg. libmodsecurity3 version (git commit hash).

I was sure that I already seen this problem, but remembered it was an issue on ModSecurity's page, not here. Looked for an half an hour there...
Thanks @RedXanadu for the spotting.

My logs clearly show a remote shell exploit happening in real time.
I noticed several references to mosConfig_absolute_path function ...
Google that... looks like it's part of a remote file inclusion vulnerability in PHP or Joomla from 2011 that's been reintroduced in 2021 per the FortiGuard page.
https://www.fortiguard.com/encyclopedia/ips/48010i
I've never had Joomla on any of my servers. Just WordPress, phpmyadmin, roundcube, postfixadmin
Can you tell me exactly how to get the info you want about modsecurity?

Can you tell me exactly how to get the info you want about modsecurity?

How did you install libmodsecurity3? I guess you downloaded the source (from where? what version?), and run the configure script. It makes a config.log, you can see there the configure options. That's what we need.
Also an output of ldd /path/to/libmodsecurity3.so would be helpful.

I followed the guide at
https://www.linuxbabe.com/security/modsecurity-nginx-debian-ubuntu
Dynamic nginx module
But as a note it didn't work the first time, as I was using nginx from standard Ubuntu repo (older). So I added ondrej repo and updated nginx and then followed that tutorial again. Then it worked.
I'll get the info you requested in the next couple hours.

Greetings,
I turned on the debug log. Here is one example from the modsec_audit.log and debug.log
Audit Log:
---rXFCe4fq---A--
[05/Nov/2022:22:35:02 +0000]<PHONE_NUMBER>37.759649 <IP_ADDRESS> 51055 ***.***.***.*** 443
---rXFCe4fq---B--
GET /robots.txt HTTP/1.1
Host: www.*********.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Connection: Close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9,en;q=0.1
Accept-Encoding: gzip, deflate

---rXFCe4fq---E--
User-agent: *\x0d\x0aDisallow: \x0d\x0a\x0d\x0aSitemap: https://www.**********.com/sitemap.xml

---rXFCe4fq---F--
HTTP/1.1 200
X-Frame-Options: SAMEORIGIN
ETag: "56d4e934-50"
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Tue, 01 Mar 2016 00:58:28 GMT
X-XSS-Protection: 1; mode=block
Connection: close
X-Content-Type-Options: nosniff
Content-Type: text/plain
Content-Length: 80
Date: Sat, 05 Nov 2022 22:35:02 GMT
Server: nginx
Referrer-Policy: strict-origin
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()

---rXFCe4fq---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^# (19 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /robots.txt HTTP/1.1' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /robots.txt HTTP/1.1"] [severity "4"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "***.***.***.***"] [uri "/robots.txt"] [unique_id "166768770237.759649"] [ref "v0,24"]

Debug Log (relevant unique_id)
debug.log
Also, I recently installed a fresh version of Ngnix/Modsecurity like 2 or 3 days ago, using a step by step guide here:
https://www.linuxcapable.com/how-to-install-nginx-with-modsecurity-3-on-ubuntu-22-04-lts/?mtm_campaign=reddit
I chose to use following PPA mentioned in the guide: ppa:ondrej/nginx-mainline
The libmodsecurity3 dependencies mentioned in the guide were:
sudo apt install gcc make build-essential autoconf automake libtool libcurl4-openssl-dev liblua5.3-dev libfuzzy-dev ssdeep gettext pkg-config libpcre3 libpcre3-dev libxml2 libxml2-dev libcurl4 libgeoip-dev libyajl-dev doxygen libpcre++-dev libpcre2-16-0 libpcre2-dev libpcre2-posix3 -y
I did install Nginx 1.23.1 (using the same steps in the guide) about 2-3 weeks ago. With me being new to Nginx, I guess it works differently than Apache2, and I did "sudo apt-get upgrade" and it installed a new version of Nginx 1.23.2  (released October 19th, 2022) and that broke everything. I guess you have to manually recompile ModSecurity with Nginx all over again using the guide... I did that, but ModSecurity never worked right afterwards.  After everything was installed, ModSecurity finally worked like it did a few weeks ago, including the false-positives. Not sure if this is relevant or not, but just thought I'd mention it.

@peppies
Very relevant. Check my last comment. Very similar install process.

@Lenny1791
I actually came across that guide, but I thought the other one seemed easer to follow, less work on chown, etc. It's interesting that you are experiencing a remote shell exploit...
I should also mention that the whole reason I switched from Apache to Nginx, is because we experienced a massive DDoS attack on October 4th through the 7th - some guy demanding thousands of dollars ransom. We knocked them out, but we could see from the Apache ModSecurity that they were still trying to get into our system using SQL exploits and a bunch of other exploit attempts.
I switched to Nginx to be able to handle higher traffic loads and better handle DDoS issues, since our site was becoming more popular anyways, so it seemed like a good time to make the jump to Ngnix since many others commented on how good that web server is
Also, I upgraded PHP to version 8.1 on the new server. Was going to move our "money site" (the DDoS target site) to Ngnix after we got ModSecurity and everything else settled.
PHP version:
PHP 8.1.12 (cli) (built: Oct 28 2022 17:39:57) (NTS) Copyright (c) The PHP Group Zend Engine v4.1.12, Copyright (c) Zend Technologies     with Zend OPcache v8.1.12, Copyright (c), by Zend Technologies

@peppies
The exploit is on your server too.
Just didn't want you to miss that I edited my previous comment to show you where can see that in your debug output.

@peppies and all, to clarify I just noticed that part of the log but don't search for DOCROOT.
Instead the easiest way to identify this malicious code is to just search for
mosConfig_absolute_path
in the debug log, which is part of the malicious code injected into request body.

@Lenny1791
I saw your post. However, I am getting these errors even if it's just me accessing a page on the website from Chrome. I wonder if it's just ModSecurity doing checks on MS variables rather than an actual exploit attempt. For example, here is me accessing the debug log that I saved to my website:
Audit Log:
---NF0jGRDN---A--
[05/Nov/2022:23:02:55 +0000]<PHONE_NUMBER>17.820103 <IP_ADDRESS> 64596 ***.***.***.*** 443
---NF0jGRDN---B--
GET /debug.txt HTTP/2.0
sec-fetch-user: ?1
sec-ch-ua: "Google Chrome";v="107", "Chromium";v="107", "Not=A?Brand";v="24"
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<IP_ADDRESS> Safari/537.36
sec-fetch-site: none
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
if-none-match: "6366eae6-0"
sec-ch-ua-mobile: ?0
if-modified-since: Sat, 05 Nov 2022 22:59:50 GMT
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
cache-control: max-age=0
sec-fetch-mode: navigate
host: www.*********.com
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
cookie: _ga=GA1.2.553943545.1666396538; __gads=ID=1fd9b064696c5107-22da675457d600eb:T=1666396538:RT=1666396538:S=ALNI_MZZDNNm3a8zOBjPxARUqo3otGPfJg; _gid=GA1.2.693806637.1667427101; __gpi=UID=000008e24916b4ee:T=1666396538:RT=1667595083:S=ALNI_MZwxAoIKgMHKN5qm6AcURaVb-Xtfw; NEWSESSID=i4ft855h4edh2ok4vv95ql5a1o; ut=***
accept-language: en-US,en;q=0.9

---NF0jGRDN---F--
HTTP/2.0 200
Referrer-Policy: strict-origin
X-Frame-Options: SAMEORIGIN
ETag: "6366eb9b-0"
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Last-Modified: Sat, 05 Nov 2022 23:02:51 GMT
X-XSS-Protection: 1; mode=block
Connection: close
X-Content-Type-Options: nosniff
Content-Type: text/plain
Date: Sat, 05 Nov 2022 23:02:55 GMT
Server: nginx
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()

---NF0jGRDN---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^# (19 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /debug.txt HTTP/2.0' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /debug.txt HTTP/2.0"] [severity "4"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "***.***.***.***"] [uri "/debug.txt"] [unique_id "166768937517.820103"] [ref "v0,23"]

Debug Log (relevant unique_id only);
debug.log.2.txt

@peppies
No, it's injected from some module running on the server.
I had ports 80 and 443 blocked for all except my IP in AWS firewall when i noticed it as well.

@airween
Attached my config.log.
Also here is the ldd output:
ubuntu@xxxxx:/etc/nginx$ ldd /usr/lib/nginx/modules/ngx_http_modsecurity_module.so
linux-vdso.so.1 (0x00007fff86de1000)
libmodsecurity.so.3 => /usr/local/modsecurity/lib/libmodsecurity.so.3 (0x00007fd8fe880000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fd8fe64c000)
libcurl.so.4 => /lib/x86_64-linux-gnu/libcurl.so.4 (0x00007fd8fe5a6000)
libGeoIP.so.1 => /lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007fd8fe568000)
libxml2.so.2 => /lib/x86_64-linux-gnu/libxml2.so.2 (0x00007fd8fe386000)
liblua5.3.so.0 => /lib/x86_64-linux-gnu/liblua5.3.so.0 (0x00007fd8fe347000)
libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fd8fe2d5000)
libmaxminddb.so.0 => /lib/x86_64-linux-gnu/libmaxminddb.so.0 (0x00007fd8fe2ce000)
libfuzzy.so.2 => /lib/x86_64-linux-gnu/libfuzzy.so.2 (0x00007fd8fe2c7000)
libyajl.so.2 => /lib/x86_64-linux-gnu/libyajl.so.2 (0x00007fd8fe2bb000)
libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fd8fe091000)
/lib64/ld-linux-x86-64.so.2 (0x00007fd8feaf2000)
libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fd8fe06f000)
libnghttp2.so.14 => /lib/x86_64-linux-gnu/libnghttp2.so.14 (0x00007fd8fe045000)
libidn2.so.0 => /lib/x86_64-linux-gnu/libidn2.so.0 (0x00007fd8fe024000)
librtmp.so.1 => /lib/x86_64-linux-gnu/librtmp.so.1 (0x00007fd8fe005000)
libssh.so.4 => /lib/x86_64-linux-gnu/libssh.so.4 (0x00007fd8fdf98000)
libpsl.so.5 => /lib/x86_64-linux-gnu/libpsl.so.5 (0x00007fd8fdf84000)
libssl.so.3 => /lib/x86_64-linux-gnu/libssl.so.3 (0x00007fd8fdede000)
libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007fd8fda9c000)
libgssapi_krb5.so.2 => /lib/x86_64-linux-gnu/libgssapi_krb5.so.2 (0x00007fd8fda48000)
libldap-2.5.so.0 => /lib/x86_64-linux-gnu/libldap-2.5.so.0 (0x00007fd8fd9e9000)
liblber-2.5.so.0 => /lib/x86_64-linux-gnu/liblber-2.5.so.0 (0x00007fd8fd9d8000)
libzstd.so.1 => /lib/x86_64-linux-gnu/libzstd.so.1 (0x00007fd8fd909000)
libbrotlidec.so.1 => /lib/x86_64-linux-gnu/libbrotlidec.so.1 (0x00007fd8fd8f9000)
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fd8fd8dd000)
libicuuc.so.70 => /lib/x86_64-linux-gnu/libicuuc.so.70 (0x00007fd8fd6e2000)
liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007fd8fd6b7000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fd8fd5d0000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fd8fd5c9000)
libunistring.so.2 => /lib/x86_64-linux-gnu/libunistring.so.2 (0x00007fd8fd41f000)
libgnutls.so.30 => /lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007fd8fd234000)
libhogweed.so.6 => /lib/x86_64-linux-gnu/libhogweed.so.6 (0x00007fd8fd1ec000)
libnettle.so.8 => /lib/x86_64-linux-gnu/libnettle.so.8 (0x00007fd8fd1a6000)
libgmp.so.10 => /lib/x86_64-linux-gnu/libgmp.so.10 (0x00007fd8fd124000)
libkrb5.so.3 => /lib/x86_64-linux-gnu/libkrb5.so.3 (0x00007fd8fd057000)
libk5crypto.so.3 => /lib/x86_64-linux-gnu/libk5crypto.so.3 (0x00007fd8fd028000)
libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007fd8fd022000)
libkrb5support.so.0 => /lib/x86_64-linux-gnu/libkrb5support.so.0 (0x00007fd8fd014000)
libsasl2.so.2 => /lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007fd8fcff9000)
libbrotlicommon.so.1 => /lib/x86_64-linux-gnu/libbrotlicommon.so.1 (0x00007fd8fcfd6000)
libicudata.so.70 => /lib/x86_64-linux-gnu/libicudata.so.70 (0x00007fd8fb3b6000)
libp11-kit.so.0 => /lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007fd8fb27b000)
libtasn1.so.6 => /lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007fd8fb263000)
libkeyutils.so.1 => /lib/x86_64-linux-gnu/libkeyutils.so.1 (0x00007fd8fb25c000)
libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007fd8fb248000)
libffi.so.8 => /lib/x86_64-linux-gnu/libffi.so.8 (0x00007fd8fb239000)
ubuntu@minneapolispurge:/etc/nginx$
ModSecurity-config.log

@peppies
It would probably help them if you could attach your config.log too.
Mine was /usr/local/src/ModSecurity

@airween
@peppies
Actually I just realized... I'm assuming you need the log for the dynamic module compiled with nginx source?
Remember I used the linuxbabe tutorial with this command
sudo ./configure --with-compat --with-openssl=/usr/include/openssl/ --add-dynamic-module=/usr/local/src/ModSecurity-nginx
I dont have a config.log here?
ubuntu@minneapolispurge:/usr/local/src/nginx/nginx-1.22.1$ ll
total 848
drwxrwxr-x 11 ubuntu ubuntu   4096 Nov  6 00:40 ./
drwxrwxr-x  4 ubuntu ubuntu   4096 Nov  1 04:13 ../
drwxrwxr-x  4 ubuntu ubuntu   4096 Nov  6 00:40 .pc/
-rw-r--r--  1 ubuntu ubuntu 317399 Oct 19 08:02 CHANGES
-rw-r--r--  1 ubuntu ubuntu 485035 Oct 19 08:02 CHANGES.ru
-rw-r--r--  1 ubuntu ubuntu   1397 Oct 19 08:02 LICENSE
-rw-r--r--  1 root   root      438 Nov  1 05:44 Makefile
-rw-r--r--  1 ubuntu ubuntu     49 Oct 19 08:02 README
drwxr-xr-x  6 ubuntu ubuntu   4096 Nov  1 03:22 auto/
drwxr-xr-x  2 ubuntu ubuntu   4096 Nov  4 02:35 conf/
-rwxr-xr-x  1 ubuntu ubuntu   2692 Nov  1 03:22 configure*
drwxr-xr-x  4 ubuntu ubuntu   4096 Nov  1 03:22 contrib/
drwxrwxr-x 15 ubuntu ubuntu   4096 Oct 19 13:20 debian/
drwxr-xr-x  2 ubuntu ubuntu   4096 Nov  4 02:38 html/
drwxr-xr-x  2 ubuntu ubuntu   4096 Nov  1 03:22 man/
drwxr-xr-x  4 root   root     4096 Nov  1 05:44 objs/
drwxr-xr-x  9 ubuntu ubuntu   4096 Nov  1 03:22 src/

@airween
@Lenny1791
Here is some of the other data you requested:
ubuntu@home-nginx:/usr/share/nginx/modules$ sudo ldd ngx_http_modsecurity_module.so         linux-vdso.so.1 (0x00007ffc939d2000)         libmodsecurity.so.3 => /usr/local/modsecurity/lib/libmodsecurity.so.3 (0x00007f778b975000)         libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f778b744000)         libcurl.so.4 => /lib/x86_64-linux-gnu/libcurl.so.4 (0x00007f778b69e000)         libGeoIP.so.1 => /lib/x86_64-linux-gnu/libGeoIP.so.1 (0x00007f778b660000)         libxml2.so.2 => /lib/x86_64-linux-gnu/libxml2.so.2 (0x00007f778b47e000)         liblua5.3.so.0 => /lib/x86_64-linux-gnu/liblua5.3.so.0 (0x00007f778b43f000)         libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f778b3c9000)         libmaxminddb.so.0 => /lib/x86_64-linux-gnu/libmaxminddb.so.0 (0x00007f778b3c2000)         libfuzzy.so.2 => /lib/x86_64-linux-gnu/libfuzzy.so.2 (0x00007f778b3bb000)         libyajl.so.2 => /lib/x86_64-linux-gnu/libyajl.so.2 (0x00007f778b3af000)         libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f778b185000)         /lib64/ld-linux-x86-64.so.2 (0x00007f778bbe7000)         libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f778b163000)         libnghttp2.so.14 => /lib/x86_64-linux-gnu/libnghttp2.so.14 (0x00007f778b139000)         libidn2.so.0 => /lib/x86_64-linux-gnu/libidn2.so.0 (0x00007f778b118000)         librtmp.so.1 => /lib/x86_64-linux-gnu/librtmp.so.1 (0x00007f778b0f9000)         libssh.so.4 => /lib/x86_64-linux-gnu/libssh.so.4 (0x00007f778b08c000)         libpsl.so.5 => /lib/x86_64-linux-gnu/libpsl.so.5 (0x00007f778b078000)         libssl.so.3 => /lib/x86_64-linux-gnu/libssl.so.3 (0x00007f778afd2000)         libcrypto.so.3 => /lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007f778ab90000)         libgssapi_krb5.so.2 => /lib/x86_64-linux-gnu/libgssapi_krb5.so.2 (0x00007f778ab3c000)         libldap-2.5.so.0 => /lib/x86_64-linux-gnu/libldap-2.5.so.0 (0x00007f778aadd000)         liblber-2.5.so.0 => /lib/x86_64-linux-gnu/liblber-2.5.so.0 (0x00007f778aacc000)         libzstd.so.1 => /lib/x86_64-linux-gnu/libzstd.so.1 (0x00007f778a9fd000)         libbrotlidec.so.1 => /lib/x86_64-linux-gnu/libbrotlidec.so.1 (0x00007f778a9ed000)         libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f778a9d1000)         libicuuc.so.70 => /lib/x86_64-linux-gnu/libicuuc.so.70 (0x00007f778a7d6000)         liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f778a7ab000)         libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f778a6c4000)         libunistring.so.2 => /lib/x86_64-linux-gnu/libunistring.so.2 (0x00007f778a518000)         libgnutls.so.30 => /lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007f778a32d000)         libhogweed.so.6 => /lib/x86_64-linux-gnu/libhogweed.so.6 (0x00007f778a2e5000)         libnettle.so.8 => /lib/x86_64-linux-gnu/libnettle.so.8 (0x00007f778a29f000)         libgmp.so.10 => /lib/x86_64-linux-gnu/libgmp.so.10 (0x00007f778a21d000)         libkrb5.so.3 => /lib/x86_64-linux-gnu/libkrb5.so.3 (0x00007f778a150000)         libk5crypto.so.3 => /lib/x86_64-linux-gnu/libk5crypto.so.3 (0x00007f778a121000)         libcom_err.so.2 => /lib/x86_64-linux-gnu/libcom_err.so.2 (0x00007f778a11b000)         libkrb5support.so.0 => /lib/x86_64-linux-gnu/libkrb5support.so.0 (0x00007f778a10d000)         libsasl2.so.2 => /lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f778a0f2000)         libbrotlicommon.so.1 => /lib/x86_64-linux-gnu/libbrotlicommon.so.1 (0x00007f778a0cf000)         libicudata.so.70 => /lib/x86_64-linux-gnu/libicudata.so.70 (0x00007f77884af000)         libp11-kit.so.0 => /lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f7788374000)         libtasn1.so.6 => /lib/x86_64-linux-gnu/libtasn1.so.6 (0x00007f778835c000)         libkeyutils.so.1 => /lib/x86_64-linux-gnu/libkeyutils.so.1 (0x00007f7788355000)         libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f7788341000)         libffi.so.8 => /lib/x86_64-linux-gnu/libffi.so.8 (0x00007f7788332000)
/usr/local/src/ModSecurity/config.log:
modsec-config.log

@airween
Per your request I've updated nginx.conf with debug level 9 and attached audit and debug logs for one request.
modsec_audit.log
modsecdebug.log

Looks like a bug, and I'll bet it has to do with one of the libpcre packages, since our installations processes were similar.
To summarize one similarity between our installations,
Peppe used the guide from:
https://www.linuxcapable.com/how-to-install-nginx-with-modsecurity-3-on-ubuntu-22-04-lts/?mtm_campaign=reddit
apt install command:
sudo apt install gcc make build-essential autoconf automake libtool libcurl4-openssl-dev liblua5.3-dev libfuzzy-dev ssdeep gettext pkg-config libpcre3 libpcre3-dev libxml2 libxml2-dev libcurl4 libgeoip-dev libyajl-dev doxygen libpcre++-dev libpcre2-16-0 libpcre2-dev libpcre2-posix3 -y

Lenny used the guide from:
https://www.linuxbabe.com/security/modsecurity-nginx-debian-ubuntu
apt install command:
sudo apt install gcc make build-essential autoconf automake libtool libcurl4-openssl-dev liblua5.3-dev libpcre2-dev libfuzzy-dev ssdeep gettext pkg-config libpcre3 libpcre3-dev libxml2 libxml2-dev libcurl4 libgeoip-dev libyajl-dev doxygen

So here is my list of installed pcre packages.
ubuntu@xxxxx:/home/ubuntu$ apt list libpcre*
Listing... Done
libpcre++-dev/jammy 0.9.5-7 amd64
libpcre++0v5/jammy 0.9.5-7 amd64
libpcre-ocaml-dev/jammy 7.5.0-1 amd64
libpcre-ocaml/jammy 7.5.0-1 amd64
libpcre16-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre2-16-0/jammy-updates,jammy-security,now 10.39-3ubuntu0.1 amd64 [installed,automatic]
libpcre2-32-0/jammy-updates,jammy-security,now 10.39-3ubuntu0.1 amd64 [installed,automatic]
libpcre2-8-0/jammy-updates,jammy-security,now 10.39-3ubuntu0.1 amd64 [installed,automatic]
libpcre2-dev/jammy-updates,jammy-security,now 10.39-3ubuntu0.1 amd64 [installed]
libpcre2-posix3/jammy-updates,jammy-security,now 10.39-3ubuntu0.1 amd64 [installed,automatic]
libpcre3-dbg/jammy-updates,jammy-security 2:8.39-13ubuntu<IP_ADDRESS> amd64
libpcre3-dev/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre32-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcrecpp0v5/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]

To be clear, I stole that idea from @theseion as I remembered that he had mentioned PCRE.
I'm just shooting in the dark here, taking a black box approach if you will, trying to narrow down the search based upon similarities.

Light bulb idea - I don't know how they integrate with each other, but I wonder if it could be related to openssl v3 updates last week.

Debug Log (only for relevant unique_id "166768770237.759649") debug.log

thanks.
Unfortunately this is what I "expected":
[166768770237.759649] [/robots.txt] [4] (Rule: 920100) Executing operator "Rx" with param "(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$" against REQUEST_LINE.
[166768770237.759649] [/robots.txt] [9] Target value: "GET /robots.txt HTTP/1.1" (Variable: REQUEST_LINE)
[166768770237.759649] [/robots.txt] [3] Error with regular expression: "(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$"
[166768770237.759649] [/robots.txt] [9] Matched vars updated.

I think your engine is broken.

I chose to use following PPA mentioned in the guide: ppa:ondrej/nginx-mainline

Can you try this repository?
https://modsecurity.digitalwave.hu
Libmodsecurity3 and ModSecurity-Nginx connector are from Github repository, almost the last versions. The other components are same as in the operation system.
This works for me on few machines as well.

Ha! Found it!
    std::vector<Utils::SMatchCapture> captures;
    if (re->hasError()) {
        ms_dbg_a(transaction, 3, "Error with regular expression: \"" + re->pattern + "\"");
        return false;
    }

It's a new check int ModSecurity v3.0.7, introduced in https://github.com/SpiderLabs/ModSecurity/commit/1aa7616c189cd12226c74755b35538f4937a135e.

The new check verifies that the return value of pcre2_compile is not NULL. In theory, it should be possible to reproduce this by running pcre2test with the regex as input like this:
pcre2test
PCRE2 version 10.40 2022-04-14
  re> ~(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)~
data> get /foo/bar/
 0: get /foo/bar/
data> foo
No match
data>

@theseion So this appears to be related to ModSecurity 3 adding support for PCRE2? Is that right?

Yes, you're right. We actually did add support for PCRE2 to the containers about two weeks back.

Rule 920100's pattern does seem to compile using PCRE2, though. I've tested this and confirmed @theseion's test above: the patterns seems to compiled and execute correctly for me, also:
$ ./pcre2test
PCRE2 version 10.40 2022-04-14
  re> ~(?i)^(?:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?\/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:(?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|[\w\-\./]+:\d+)|options \*)\s+[\w\./]+|get \/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$~
data> CONNECT <IP_ADDRESS> HTTP/1.1
 0: CONNECT <IP_ADDRESS> HTTP/1.1
data> BLAH * NOPROTO
No match

The new check verifies that the return value of pcre2_compile is not NULL. In theory, it should be possible to reproduce this by running pcre2test with the regex as input like this:

But the given config.log and ldd output above, it seems user compiled libmodsecurity3 with the old PCRE, not with the PCRE2.
So I don't think it's a PCRE2 related bug.
Anyway, the regex 920100 (from 3.3) successfully compiled and matched both with PCRE and PCRE2. See msc_retest output (it supports the PCRE2 engine too - you can use both in same binary).
$ echo "GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/1.1" | src/pcre4msc3 -d regexes/920100_1.txt

PATTERN:
========
^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$

SUBJECT:
========
GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/1.1

JIT:
====
avaliable and used

RESULT:
=======
regexes/920100_1.txt - time elapsed: 0.000013880, match value: SUBJECT MATCHED 1 TIME

CAPTURES:
=========
GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/1.1

OVECTOR:
========
[0, 72]

Now add the -2 option:
$ echo "GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/1.1" | src/pcre4msc3 -2 -d regexes/920100_1.txt

PATTERN:
========
^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+)?)?/[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?|connect (?:\d{1,3}\.){3}\d{1,3}\.?(?::\d+)?|options \*)\s+[\w\./]+|get /[^?#]*(?:\?[^#\s]*)?(?:#[\S]*)?)$

SUBJECT:
========
GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/1.1

RESULT:
=======
regexes/920100_1.txt - time elapsed: 0.000154108, match value: SUBJECT MATCHED 1 TIME

CAPTURES:
=========
GET /sale/kenwood-kac-6402-by-download-mauritron-221328-264064/ HTTP/1.1

OVECTOR:
========
[0, 72]

I'm sure in the Summer there was a similar issue in ModSecurity's repository, but unfortunately I can't find it now...

I was thinking that it might fail to compile on one of their systems. In any case, I think the next step should be to try ModSecurity v3.0.6, before the introduction of that check and PCRE2 support.

@airween I see the suggestion
Can you try this repository?
https://modsecurity.digitalwave.hu
I'm wondering what exactly that means.
It sounds like we should just be able to change the one package with the bug (correct me if wrong)?
In other words what would be the minimal change required to rectify this error? For example just install libmodsecurity3 from this new repo and recompile with my existing nginx source?
Or is it definitely required for me to install all 4 packages including nginx from your repo?
Also I use the ondrej repo for other packages as well so I don't have to remove that, right?
I'm trying to simplify for me, but also would be nice to identify the minimal fix to notify both of the creators of the tutorials we followed, ad a courtesy, as surely there will be others looking for the solution.
Thanks

@theseion
I completely uninstalled and reinstalled everything using the guide here: https://www.linuxcapable.com/how-to-install-nginx-with-modsecurity-3-on-ubuntu-22-04-lts/?mtm_campaign=reddit#Install_OWASP_Core_Rule_Set_for_ModSecurity
The only exception is that I followed your recommendation to install v3.0.6 of ModSecurity using:
sudo git clone --depth 1 -b v3.0.6 https://github.com/SpiderLabs/ModSecurity /usr/local/src/ModSecurity/
This did not resolve the issue, I am still seeing the same warnings with rule 920100.

@peppies @airween @theseion @dune73
I suspected it was an issue with one of the PCRE dependencies, so in order to reduce variables, I decided to reinstall without using the ondrej repository.
Now I have everything working with
Nginx 1.23.2
ModSecurity 3.0.8
ModSecurity-nginx 1.0.3
Also I didn't have to touch my config files under /etc/nginx/modsec (including coreruleset-3.3.4 left alone).
How I did it:

Remove ondrej repository
sudo add-apt-repository --remove ppa:ondrej/nginx-mainline
sudo apt update
sudo apt install ppa-purge
sudo ppa-purge ppa:ondrej/nginx-mainline
sudo apt clean
sudo apt autoremove
sudo apt update

Remove nginx installed from ondrej repository
sudo apt remove nginx
sudo apt remove nginx-common

At this point there were some packages which showed error removing as still-in-use dependencies. List problem packages with:
sudo apt list libpcre* --installed

For example my list included
...
libpcre16-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre3-dev/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre32-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcrecpp0v5/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
Then for each, show available version from ubuntu repository, example:
sudo apt list libpcre16-3 -a
Listing... Done
libpcre16-3/jammy-updates,jammy-security,now 2:8.39-13ubuntu<IP_ADDRESS> amd64
libpcre16-3/jammy 2:8.39-13build5 amd64
Downgrade to version from jammy-updates repository
sudo apt install libpcre16-3=2:8.39-13ubuntu<IP_ADDRESS>
Repeat for all (5 packages downgraded in my case)

Install Nginx from official Nginx mainline repository (from http://nginx.org/en/linux_packages.html#Ubuntu)

sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor
| sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg]
http://nginx.org/packages/mainline/ubuntu lsb_release -cs nginx"
| sudo tee /etc/apt/sources.list.d/nginx.list
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n"
| sudo tee /etc/apt/preferences.d/99nginx
sudo apt update
sudo apt install nginx

Install ModSecurity and ModSecurity-nginx both from latest sources

apt-get install -y apt-utils autoconf automake build-essential git libcurl4-openssl-dev libgeoip-dev liblmdb-dev libpcre++-dev libtool libxml2-dev libyajl-dev pkgconf wget zlib1g-dev
sudo rm -rf /usr/local/modsecurity
sudo rm -rf /usr/local/src/*
cd /usr/local/src
git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity
git submodule init
git submodule update
./build.sh
./configure
make
sudo make install
cd ..
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
wget http://nginx.org/download/nginx-1.23.2.tar.gz
tar zxvf nginx-1.23.2.tar.gz
cd nginx-1.23.2
./configure --with-compat --add-dynamic-module=../ModSecurity-nginx
make modules
sudo cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules
cd ..

I'm wondering what exactly that means. It sounds like we should just be able to change the one package with the bug (correct me if wrong)?

No, I suggest remove the other 3rd party repositories (which related to ModSecurity and/or Nginx), and use only this one. As you can see on the page, that repository uses the same versions of each components, like the official operating system repository.

In other words what would be the minimal change required to rectify this error?

I have no idea. I don't know, what's the problem.

For example just install libmodsecurity3 from this new repo and recompile with my existing nginx source? Or is it definitely required for me to install all 4 packages including nginx from your repo?

Yes, I'm sure that would solve your problem.

Also I use the ondrej repo for other packages as well so I don't have to remove that, right?

No, I'm not sure about that. That repository uses the newest libpcre library, which is a core component on each Linux system. That's why I don't like to use it.

I'm trying to simplify for me, but also would be nice to identify the minimal fix to notify both of the creators of the tutorials we followed, as a courtesy, as surely there will be others looking for the solution. Which also begs the question is this still a problem for people who follow those 2 tutorials, I assume? Thanks

Because we don't know what's the problem, I'm not sure we can identify the minimal fix...

I suspected it was an issue with one of the PCRE dependencies, so in order to reduce variables, I decided to reinstall without using the ondrej repository. Now I have everything working with Nginx 1.23.2 ModSecurity 3.0.8 ModSecurity-nginx 1.0.3

So, the solution was that you removed the 3rd party repository (sury), and installed everything from source, including Nginx?
If you use this binary only one server, that's right, but if you have many servers...
Anyway, it's good to see that your problem had solved.
@Lenny1791, @peppies - can we close this issue?

Also I didn't have to touch my config files under /etc/nginx/modsec (including coreruleset-3.3.4 left alone).
How I did it:
1. Remove ondrej repository
   sudo add-apt-repository --remove ppa:ondrej/nginx-mainline
   sudo apt update
   sudo apt install ppa-purge
   sudo ppa-purge ppa:ondrej/nginx-mainline
   sudo apt clean
   sudo apt autoremove
   sudo apt update

2. Remove nginx installed from ondrej repository
   sudo apt remove nginx
   sudo apt remove nginx-common

3. At this point there were some packages which showed error removing as still-in-use dependencies. List problem packages with:
   sudo apt list libpcre* --installed

For example my list included ... libpcre16-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local] libpcre3-dev/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local] libpcre32-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local] libpcre3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local] libpcrecpp0v5/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
Then for each, show available version from ubuntu repository, example:
sudo apt list libpcre16-3 -a Listing... Done libpcre16-3/jammy-updates,jammy-security,now 2:8.39-13ubuntu<IP_ADDRESS> amd64 libpcre16-3/jammy 2:8.39-13build5 amd64
Downgrade to version from jammy-updates repository
sudo apt install libpcre16-3=2:8.39-13ubuntu<IP_ADDRESS>
Repeat for all (5 packages downgraded in my case)
4. Install Nginx from official Nginx mainline repository (from http://nginx.org/en/linux_packages.html#Ubuntu)

sudo apt install curl gnupg2 ca-certificates lsb-release ubuntu-keyring
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/mainline/ubuntu lsb_release -cs nginx" | sudo tee /etc/apt/sources.list.d/nginx.list
echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" | sudo tee /etc/apt/preferences.d/99nginx
sudo apt update sudo apt install nginx
5. Install ModSecurity and ModSecurity-nginx both from latest sources

apt-get install -y apt-utils autoconf automake build-essential git libcurl4-openssl-dev libgeoip-dev liblmdb-dev libpcre++-dev libtool libxml2-dev libyajl-dev pkgconf wget zlib1g-dev
sudo rm -rf /usr/local/modsecurity sudo rm -rf /usr/local/src/* cd /usr/local/src
git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
cd ModSecurity git submodule init git submodule update ./build.sh ./configure make sudo make install cd ..
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
wget http://nginx.org/download/nginx-1.23.2.tar.gz tar zxvf nginx-1.23.2.tar.gz
cd nginx-1.23.2 ./configure --with-compat --add-dynamic-module=../ModSecurity-nginx make modules sudo cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules cd ..

@airween
Just to clarify, I didn't install nginx from source. I uninstalled the version that was installed from Sury repo and installed from nginx.org official repo.
I only downloaded the source in order to compile the modsecurity-nginx dynamic module against it.
In the end, my guess is the resolution was actually just manually downgrading the PCRE 8.44 packages that were installed from Sury repo to PCRE 8.39 from Ubuntu.
So maybe there is an incompatibility in 8.44.
OR maybe the issue is they were compiled for Ubuntu 20.04 as I noticed that in the version string - I'm on Ubuntu 22.04 so I'm guessing those packages shouldn't have been provided to me by Sury repo?
Is that possibly a bug in the Sury repo that they should be notified of? Or bug in my local apt?
libpcre16-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre3-dev/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre32-3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcre3/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
libpcrecpp0v5/now 2:8.44-2+ubuntu20.04.1+deb.sury.org+1 amd64 [installed,local]
Anyway, if @peppies can also resolve the issue om his server using my example steps, you can close it as far as I'm concerned, but I'm still concerned the issue may reappear if Ubuntu repo upgrades to PCRE 8.44 as well, unless the issue was the 20.04 packages that I somehow installed from Sury.
@peppies Also a thought, you've could try to just downgrade those 5 packages (and see if they say Ubuntu 20.04 on yours as well). That may be the quickest and easiest resolution (and I'm curious if that alone would work without going through the long process I did).
Hope that all helps.
Thanks for your work gentlemen!

@airween Just to clarify, I didn't install nginx from source. I uninstalled the version that was installed from Sury repo and installed from nginx.org official repo. I only downloaded the source in order to compile the modsecurity-nginx dynamic module against it.

Oh, I see it. I just thought because you wrote:
zxvf nginx-1.23.2.tar.gz

cd nginx-1.23.2
./configure --with-compat --add-dynamic-module=../ModSecurity-nginx
make modules
sudo cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules
cd ..

But well, never mind - the point is that it works.

In the end, my guess is the resolution was actually just manually downgrading the PCRE 8.44 packages that were installed from Sury repo to PCRE 8.39 from Ubuntu. So maybe there is an incompatibility in 8.44. OR maybe the issue is they were compiled for Ubuntu 20.04 as I noticed that in the version string - I'm on Ubuntu 22.04 so I'm guessing those packages shouldn't have been provided to me by Sury repo? Is that possibly a bug in the Sury repo that they should be notified of? Or bug in my local apt?

I don't know, and sorry to say, but now I am not able to check that... :)

@airween
I know hard to say now.
I'll tell you what, I'm going to add the sury repo and upgrade those packages one by one and tell you which one breaks it 😁
If one of the 8.44 packages breaks it ill let you know which.
If I install all 8.44 packages and they say Ubuntu 22.04 and it still works, then probably safe to assume it was an issue with the 20.04 packages.
This is a personal server (not business critical) so I wouldn't mind doing that for you, if that would be helpful.

@airween @peppies
From my snapshot of my "Broken" install, I downgraded all of the libpcre packages to Ubuntu repo, no change, so the libpcre packages are not the problem.
Further comparing the 2 installs, I think I found the issue!
Nginx-full from Sury PPA includes libnginx-mod-http-lua/jammy 1.22.1-1+ubuntu22.04.1+deb.sury.org+1 amd64
Which has issues and should be removed, further "If someone has a bug with libnginx-mod-http-lua, they will only see it as an NGINX error" as reported in this bug from 2022-08-17:
https://bugs.launchpad.net/ubuntu/+source/libnginx-mod-http-lua/+bug/1986853
Possibly due to this (from https://github.com/openresty/lua-nginx-module#special-escaping-sequences):
"PCRE sequences such as \d, \s, or \w, require special attention because in string literals, the backslash character, , is stripped out by both the Lua language parser and by the Nginx config file parser before processing if not within a *_by_lua_block {} directive."
Further, the lud-nginx-module compatility page states only compatible with older Nginx releases (1.19).
https://github.com/openresty/lua-nginx-module#nginx-compatibility
So I'm guessing that's it!
Sury should remove from nginx packages.
Cheers

@airween
@Lenny1791
Thanks for the help. It took all day, but I followed a combination of Lenny1791's guide with other guides and finally got it working. The nginx I had was a "sites-available/sites-enabled" version, similar to Apache2. The new nginx was a "conf.d" type version and a slightly different PHP setup.
Nginx 1.23.2
ModSecurity 3.0.8
ModSecurity-Nginx 1.0.3
CRS 4.0.0-rc1
My ModSecurity logs are not growing to GBs in size anymore and the sites are working correctly as well.
Last question: Where is the best place to go to ask how to craft specific custom rules, and post ModSecurity examples in my logs to get an explanation for why a page gets blocked and how to fix it? This will mostly be for clearing up false positives that users are complaining about.
@airween - you should be able to close this thread if everyone else is settled.

Thanks for finding the issue @Lenny1791! Good to know that it's not some standard package that's broken.
@peppies First stop: https://coreruleset.org/docs/resources/. You should also check out the tutorials on netnea.com.
There are some tools that might be interesting to you but I'll let @dune73 jump in here.


Get rid of underscores in ItemizedValueDict table

Can't do much more, but we can kind make them look not like variables|
Need to test, I'll merge once I have
#191

Tested and it works fine. Also added a review screen to the demo to easy check on the out of the box situation for things like this


traceid and spandid information lost after spring cloud 2021.0.6 update

Hi Team,
This is continuation for the issue https://github.com/spring-cloud/spring-cloud-sleuth/issues/2270.
I am not sure, if the fix https://github.com/spring-cloud/spring-cloud-sleuth/pull/2275 actually propagating the spanId to OnComplete (or OnError).
I tried to replicate with a simple Spring webflux project, and I can't see the traceId and spanId propagated during completion and during onError.
Here is the sample code for your reference,
My Pom has
org.springframework.boot : spring-boot-starter-parent : 2.7.12
org.springframework.boot : spring-boot-starter-webflux
org.springframework.boot : spring-boot-starter-test
org.springframework.cloud : spring-cloud-starter-sleuth : 3.1.8
io.projectreactor:reactor-test

Route class:
return RouterFunctions.route(GET("/helloWorld/{one}")
.and(RequestPredicates.accept(MediaType.TEXT_PLAIN)), helloWorldHandler::helloWorld);

And a handler class
public Mono helloWorld(ServerRequest request) {
String value = request.pathVariable("one");
if(value.equals("1")) {
throw new RuntimeException("path should contain some value");
}
return ServerResponse.ok().contentType(MediaType.TEXT_PLAIN)
.body(BodyInserters.fromObject("Hello "+value));
}

If I run the application, and hit the following url "http://localhost:8080/helloWorld/1", here is the application log,
2023-05-23 18:11:41.911 TRACE [,,] 12100 --- [ctor-http-nio-2] o.s.w.s.adapter.HttpWebHandlerAdapter : [219e5b8d-1] HTTP GET "/helloWorld/start", headers={masked}
2023-05-23 18:11:41.961 DEBUG [,9dffbac718e4a18b,9dffbac718e4a18b] 12100 --- [ctor-http-nio-2] o.s.w.r.f.s.s.RouterFunctionMapping : [219e5b8d-1] Mapped to com.traceid.traceidIssue.controller.HelloWorldRouter$$Lambda$488/0x0000000800456040@34b085f5
2023-05-23 18:11:41.998 DEBUG [,9dffbac718e4a18b,9dffbac718e4a18b] 12100 --- [ctor-http-nio-2] org.springframework.web.HttpLogging : [219e5b8d-1] Writing "Hello start"
2023-05-23 18:11:42.035 TRACE [,,] 12100 --- [ctor-http-nio-2] o.s.w.s.adapter.HttpWebHandlerAdapter : [219e5b8d-1] Completed 200 OK, headers={masked}

The last log line is missing the traceId. This is a scenario of OnComplete.
Similarly, when run an error scenario , for example accessing "http://localhost:8080/helloWorld/1", here are the error logs.

2023-05-23 18:12:03.045 TRACE [,,] 12100 --- [ctor-http-nio-4] o.s.w.s.adapter.HttpWebHandlerAdapter : [e3f64717-2] HTTP GET "/helloWorld/1", headers={masked}
2023-05-23 18:12:03.046 DEBUG [,94da05e6b3c9fa90,94da05e6b3c9fa90] 12100 --- [ctor-http-nio-4] o.s.w.r.f.s.s.RouterFunctionMapping : [e3f64717-2] Mapped to com.traceid.traceidIssue.controller.HelloWorldRouter$$Lambda$488/0x0000000800456040@34b085f5
### 2023-05-23 18:12:03.070 DEBUG [,,] 12100 --- [ctor-http-nio-4] org.springframework.web.HttpLogging : [e3f64717-2] Resolved [RuntimeException: path should contain some value] for HTTP GET /helloWorld/1
2023-05-23 18:12:03.078 ERROR [,,] 12100 --- [ctor-http-nio-4] a.w.r.e.AbstractErrorWebExceptionHandler : [e3f64717-2] 500 Server Error for HTTP GET "/helloWorld/1"

java.lang.RuntimeException: path should contain some value
at com.traceid.traceidIssue.controller.HelloWorldHandler.helloWorld(HelloWorldHandler.java:17) ~[classes/:na]
Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:
2023-05-23 18:12:03.080 DEBUG [,,] 12100 --- [ctor-http-nio-4] org.springframework.web.HttpLogging : [e3f64717-2] Writing
2023-05-23 18:12:03.083 TRACE [,,] 12100 --- [ctor-http-nio-4] o.s.w.s.adapter.HttpWebHandlerAdapter : [e3f64717-2] Completed 500 INTERNAL_SERVER_ERROR, headers={masked}

As you can see above (highlighted in Italics ), the traceId is missing, when the exception is thrown.
If I change the following in pom file and restart the application,
org.springframework.cloud : spring-cloud-starter-sleuth : 3.1.5
then for positive scenario, I could see the traceId propagated during onComplete. (TraceId marked in In Bold)
2023-05-23 18:09:37.110 TRACE [,,] 19444 --- [ctor-http-nio-2] o.s.w.s.adapter.HttpWebHandlerAdapter : [fd841721-5] HTTP GET "/helloWorld/test", headers={masked}
2023-05-23 18:09:37.111 DEBUG [,3eeeb7e23074ad47,3eeeb7e23074ad47] 19444 --- [ctor-http-nio-2] o.s.w.r.f.s.s.RouterFunctionMapping : [fd841721-5] Mapped to com.traceid.traceidIssue.controller.HelloWorldRouter$$Lambda$488/0x0000000800456040@21c4efeb
2023-05-23 18:09:37.111 DEBUG [,3eeeb7e23074ad47,3eeeb7e23074ad47] 19444 --- [ctor-http-nio-2] org.springframework.web.HttpLogging : [fd841721-5] Writing "Hello test"
2023-05-23 18:09:37.113 TRACE [,3eeeb7e23074ad47,3eeeb7e23074ad47] 19444 --- [ctor-http-nio-2] o.s.w.s.adapter.HttpWebHandlerAdapter : [fd841721-5] Completed 200 OK, headers={masked}

Similarly for the error scenario,
2023-05-23 18:10:15.946 TRACE [,,] 19444 --- [ctor-http-nio-4] o.s.w.s.adapter.HttpWebHandlerAdapter : [d738a83e-6] HTTP GET "/helloWorld/1", headers={masked}
2023-05-23 18:10:15.946 DEBUG [,cafe29d9a35fd3bc,cafe29d9a35fd3bc] 19444 --- [ctor-http-nio-4] o.s.w.r.f.s.s.RouterFunctionMapping : [d738a83e-6] Mapped to com.traceid.traceidIssue.controller.HelloWorldRouter$$Lambda$488/0x0000000800456040@21c4efeb
_2023-05-23 18:10:15.948 DEBUG [,cafe29d9a35fd3bc,cafe29d9a35fd3bc] 19444 --- [ctor-http-nio-4] org.springframework.web.HttpLogging : [d738a83e-6] Resolved [RuntimeException: path should contain some value] for HTTP GET /helloWorld/1
2023-05-23 18:10:15.949 ERROR [,cafe29d9a35fd3bc,cafe29d9a35fd3bc] 19444 --- [ctor-http-nio-4] a.w.r.e.AbstractErrorWebExceptionHandler : [d738a83e-6] 500 Server Error for HTTP GET "/helloWorld/1"
java.lang.RuntimeException: path should contain some value
at com.traceid.traceidIssue.controller.HelloWorldHandler.helloWorld(HelloWorldHandler.java:17) ~[classes/:na]
Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException:

2023-05-23 18:10:15.951 DEBUG [,cafe29d9a35fd3bc,cafe29d9a35fd3bc] 19444 --- [ctor-http-nio-4] org.springframework.web.HttpLogging : [d738a83e-6] Writing "
2023-05-23 18:10:15.952 TRACE [,cafe29d9a35fd3bc,cafe29d9a35fd3bc] 19444 --- [ctor-http-nio-4] o.s.w.s.adapter.HttpWebHandlerAdapter : [d738a83e-6] Completed 500 INTERNAL_SERVER_ERROR, headers={masked}_

Clearly, here as well, the traceId and spanId were propagated to OnError condition, while using spring-cloud-starter-sleuth:3.1.5
The concern here is, the feature which was working in version 3.1.5 is broken in subsequent versions (3.1.6 and above).
Appreciate, if you look into the issue and let us know if you require any further details.

I've edited your comment to improve the formatting. You might want to check out this Mastering Markdown guide for future reference.

I've edited your comment to improve the formatting. You might want to check out this Mastering Markdown guide for future reference.
Thanks for the feedback and pointing out the guidelines. Will use it for future reference.

cc @OlegDokuka

Waiting for update for this issue, @OlegDokuka  @marcingrzejszczak

Please upgrade to Micrometer Tracing. Spring Cloud Sleuth is feature complete and out of OSS support.


Allow winners to withdraw funds on their own after the 'redemption' period.

Currently an admin has to send DisburseEarnings() in order to players to get paid. What if the players could call a function like DisburseEarnings() on their own at the end of the 'redemption' period? This would make the contract less centralized, as an admin would only be required to deploy the contract and draw the winning numbers.
Having this new function available after the redemption period ensures that there is no change to the timeframe where a player can run check(), and the earnings calculation can be made with the first call.

that's a good idea; although, entirely a personal preference on my part I prefer the admin disbursing the winnings. Nevertheless, since this is a learning exercise I implemented your suggestion by creating the function CollectEarning() that should co-exist with the DisburseEarnings() function so that both options of paying out winners are available.
I also modified the function DrawWinning() to immediately pay out the administrator to keep the calculations simpler in CollectEarning() and DisburseEarnings().

Very cool. I'm playing around with github issues and couldn't figure out how to make this look like an enhancement instead of an issue.

let me know when you find out. I'm learning github as well. :-)

Relevant: https://github.com/ConsenSys/smart-contract-best-practices#favor-pull-over-push-for-external-calls
Its best practice to have users pull their own individual rewards out rather than push sends out all at once.

Is this a finished project? I would like to use it or something similar for charitable purposes if so, just looking around for well written smart contracts at the moment. The problem with RNG's is common but if the organisation is small and there is a lot of trust already from the ticket purchasers we think using the administrator to "pick" the winning numbers is the best work around.
Any and all info or links to other works are hugely appreciated.

thanks for the interest @HolaBula. This was just an experimental project to learn Solidity. I never commercialized due to legal gambling restrictions in the U.S., but you're welcome to leverage it for your project. I'm happy to help out or consult depending on your needs and as time permits.
I would use a set and commit pattern to do the drawing of balls and other improvements. I've learned a lot more since writing my first smart contract. I've written the smart contracts for an ICO, and I'm currently writing smart contracts to do identity on the blockchain (i.e. DID and Verified Claims).


refactor: 💡 Added extended props and tests

👋 Thanks for creating a pull request! 🚀 Checkout the storybook we created for it here.


Databse Content

When making a standalone install, the database is nearly Empty
It would be helpfull to be able to get a Databse Dump

@nicmel
If your goal is to get a development environment set up, you may want to give rails db:seed a look. This will get your database seeded with placeholder data that will allow the UI to render properly.
If your goal is to create an offline copy of openfarm.cc, we do not provide that sort of thing yet.


super parameters break non-const subclasses of const superclasses

void main() {
  Extended(value: 10);
}

class Foo {
  const Foo({this.value, this.list});

  final int? value;
  final List? list;
}

class Extended extends Foo {
  // 🔥 Error: Constant expression expected.
  Extended({super.value}) : super(list: List.filled(10, null));

  // No Error:
  // Extended({int? value}) : super(value: value, list: List.filled(10, null));
}

Running the above program with Dart 2.17.0-226.0.dev on macos_x64 gives the following error:
lib/super_params.dart:14:46: Error: Constant expression expected.
Try inserting 'const'.
  Extended({super.value}) : super(list: List.filled(10, null));
                                             ^^^^^^
lib/super_params.dart:14:46: Error: Cannot invoke a non-'const' factory where a const expression is expected.
Try using a constructor or factory that is 'const'.
  Extended({super.value}) : super(list: List.filled(10, null));
                                             ^^^^^^

When not using the new super parameter feature for value of Extended (see commented out constructor above) everything compiles and runs as expected.

/cc @mit-mit
Noticed this while trying to upgrade the flutter code base to use super parameters where appropriate. There are a couple of instances in our code base that trigger this problem. Here's one real life example: https://github.com/flutter/flutter/blob/2e5ad37b063928d080de7839f08999ed0dc521c9/dev/integration_tests/flutter_gallery/lib/gallery/about.dart#L25

cc @johnniwinther @lrhn  This reproduces at head for me.  The analyzer reports no errors.

I'm working on the fix in https://dart-review.googlesource.com/c/sdk/+/238700


QA: /terms, /privacy

These pages are essentially using the same styling/template.
There is only a Word doc currently for /terms :
Terms & conditions page Design QA v1.docx
https://www.figma.com/file/vw24IPXXt4vCh9BNumka9A/Web--Merative-Digital-Design-System-2.0?node-id=9144-47867&t=ioM89z7PTF32MfAj-4
https://main--merative2--hlxsites.hlx.page/terms
https://main--merative2--hlxsites.hlx.page/privacy

Sharing QA document
Terms & conditions page Design QA v2.pdf
CC: @anabarcelona

@keith-kaplan you might want to have someone proofread the text in these 2 pages. Some areas are all caps (seems to be on purpose). Otherwise the items flagged in this ticket should be complete.

We can close this out. The all caps stuff is not a big deal and is what our legal team has in their copy docs. We don't have worry about this.


Inconsistent results with shard_map when switching PRNG Implementation from threefry2x32 to rbg

Description
I've noticed strange behavior when I change the jax_default_prng_impl from threefry2x32 to rbg. I get the same results with threefry2x32, but when I switch to rbg, the results with shard_map start to differ. Here is the script to reproduce the issue:
import functools

import jax
import jax.numpy as jnp

from jax.experimental import mesh_utils
from jax.sharding import Mesh, PositionalSharding, PartitionSpec as P
from jax.experimental.shard_map import shard_map

jax.config.update("jax_default_prng_impl", "rbg")
# jax.config.update("jax_default_prng_impl", "threefry2x32")

def independent_permutation(rngs, array, axis):
    _permutation_fn = functools.partial(
        jax.random.permutation,
        axis=axis - 1,
    )
    return jax.vmap(_permutation_fn, in_axes=0, out_axes=0)(rngs, array)

if __name__ == "__main__":
    batch_size = 10
    seq_len = 16
    values = jnp.tile(jnp.arange(seq_len)[None, ...], reps=(batch_size, 1))

    num_devices = len(jax.devices())
    device_mesh = mesh_utils.create_device_mesh(mesh_shape=(num_devices))
    mesh = Mesh(device_mesh.reshape(num_devices, 1), axis_names=("data", "model"))

    values = jax.device_put(
        values,
        PositionalSharding(device_mesh).reshape(-1, 1),
    )

    key = jax.random.split(jax.random.PRNGKey(0), batch_size)
    result = independent_permutation(key, values, axis=1)

    perm_fn = functools.partial(independent_permutation, axis=1)

    perm_fn = shard_map(
        perm_fn,
        in_specs=(P("data",), P("data", None)),
        out_specs=P("data", None),
        mesh=mesh,
    )

    result_shard = jax.jit(perm_fn)(key, values)
    print("Results are same:", jnp.sum(jnp.abs(result - result_shard)) == 0)

With jax_default_prng_impl == threefry2x32  I get Results are same: True,
But with jax_default_prng_impl == rbg  I get Results are same: False
System info (python version, jaxlib version, accelerator, etc.)
jax:    0.4.28
jaxlib: 0.4.28
numpy:  1.24.3
python: 3.10.12 (main, Nov 20 2023, 15:14:05) [GCC 11.4.0]
jax.devices (2 total, 2 local): [cuda(id=0) cuda(id=1)]
process_count: 1
$ nvidia-smi
Wed Jun  5 12:08:42 2024
+---------------------------------------------------------------------------------------+
| NVIDIA-SMI 535.104.12             Driver Version: 535.104.12   CUDA Version: 12.3     |
|-----------------------------------------+----------------------+----------------------+
| GPU  Name                 Persistence-M | Bus-Id        Disp.A | Volatile Uncorr. ECC |
| Fan  Temp   Perf          Pwr:Usage/Cap |         Memory-Usage | GPU-Util  Compute M. |
|                                         |                      |               MIG M. |
|=========================================+======================+======================|
|   0  NVIDIA H100 80GB HBM3          On  | 00000000:95:00.0 Off |                    0 |
| N/A   35C    P0              84W / 700W |    537MiB / 81559MiB |      2%      Default |
|                                         |                      |             Disabled |
+-----------------------------------------+----------------------+----------------------+
|   1  NVIDIA H100 80GB HBM3          On  | 00000000:99:00.0 Off |                    0 |
| N/A   33C    P0              88W / 700W |    537MiB / 81559MiB |      1%      Default |
|                                         |                      |             Disabled |
+-----------------------------------------+----------------------+----------------------+
+---------------------------------------------------------------------------------------+
| Processes:                                                                            |
|  GPU   GI   CI        PID   Type   Process name                            GPU Memory |
|        ID   ID                                                             Usage      |
|=======================================================================================|
+---------------------------------------------------------------------------------------+

I suspect that this doesn't have much to do with shard_map or sharding, but rather results from the rbg PRNG implementation's intended behavior under vmap (as of https://github.com/google/jax/pull/20094). When generating random numbers with rbg, and vmapping over keys, the values produced are not guaranteed to be the same as what we'd get from mapping generation over each key by a means other than vmap (e.g. map, or a loop).
Here is a concrete local example of what I mean by that:
>>> import jax; import jax.numpy as jnp
>>> def f(k): return jax.random.choice(k, 4)
...

>>> keys = jax.random.split(jax.random.key(17, impl='threefry2x32'), 12)
>>> jnp.stack([f(k) for k in keys])
Array([1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 2, 1], dtype=int32)
>>> jax.vmap(f)(keys)
Array([1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 2, 1], dtype=int32)

>>> keys = jax.random.split(jax.random.key(17, impl='rbg'), 12)
>>> jnp.stack([f(k) for k in keys])
Array([0, 0, 0, 2, 2, 0, 0, 2, 1, 0, 2, 0], dtype=int32)
>>> jax.vmap(f)(keys)
Array([0, 1, 2, 1, 1, 3, 3, 1, 0, 3, 3, 1], dtype=int32)

There isn't an efficient way to batch in rbg mode because the XLA compiler's rng_bit_generator operation isn't batchable over keys. So we went with this choice instead, where vmap acts as a map "in distribution" although not in value. We could do a better job of documenting this (probably here)!


r-patched: Added post_install script so r-studio can recognize it.

Relates to https://github.com/ScoopInstaller/Extras/issues/10533

[x] I have read the Contributing Guide.

/verify

/verify

As https://github.com/ScoopInstaller/Main/pull/4500#issuecomment-1455859966


"Next" button greyed out when creating new connnection

Able to click "Finish" but not able to click Next to change connection name and type.
DBeaver 5.2.4

Click on "Connection details"  link (above Edit Driver button) in order to change name, description, etc.
Since 5.2 we have only one configuration page in the New Connection wizard.

Thanks a lot for your help!


Revamp the catalog filtering

Kind of a combination between GH Issues search and Google Cloud Console. Consider using MUI Chips to display currently selected filters with the option to remove them with an X.

Working version of the new catalog filtering design is here: https://github.com/dictybase-playground/catalog-search

To get the version above to work, it needs to use a version of the graphql schema that has a filter list object. See https://github.com/dictyBase/dicty-graphql-schema/issues/10

Show "All" chip for the dropdown "All Available Strains"


rp adapter: map credentialSubject to rp object

(note: this is a different issue than #127)
The RP adapter is currently sending the contents of the credentialSubject directly to the RP. This results in the RP getting an id_token with claims that look like this:
{
    "at_hash": "1MVV-ulQL0Q-gvhQX9Yp_A",
    "aud": [
        "a65f906c-c30c-4e53-81f3-80862bf9644b"
    ],
    "auth_time":<PHONE_NUMBER>,
    "exp":<PHONE_NUMBER>,
    "iat":<PHONE_NUMBER>,
    "id": "did:peer:user",
    "iss": "https://localhost:4444/",
    "jti": "45b00aee-62fa-4a4c-ac01-ca67f6e7adff",
    "nonce": "",
    "rat":<PHONE_NUMBER>,
    "sid": "544a57db-fe04-45e0-9b2b-4f14a4cd9c63",
    "stmt": {
        "accountId": "xxxx-xxxx-xxxx-1234",
        "billingPeriod": "P30D",
        "customer": {
            "@type": "Person",
            "name": "Jane Doe"
        },
        "description": "June 2020 Credit Card Statement",
        "minimumPaymentDue": {
            "@type": "PriceSpecification",
            "price": 15,
            "priceCurrency": "CAD"
        },
        "paymentDueDate": "2020-06-30T12:00:00",
        "paymentStatus": "http://schema.org/PaymentDue",
        "totalPaymentDue": {
            "@type": "PriceSpecification",
            "price": 200,
            "priceCurrency": "CAD"
        },
        "url": "http://acmebank.com/invoice.pdf"
    },
    "sub": "26c45ac2-e056-4dd0-acbb-1101fd9a1e7a"
}

The RP Adapter should employ rules that define the transformation of one object to the other such that:
a. the RP understands it, and
b. removes risks of field collisions. Eg. the id field in the example above was actually received inside the credentialSubject

As described in PR #252, all claims are now inserted in an array that is mapped to a new attribute verified_claims.


Fullscreen is broken (sometimes?)

Release Type: Github + Official
Version: Github latest commit + Latest <IP_ADDRESS>8
Platform(s): Windows, DX11 Level 11_1
Describe the bug
When enabling fullscreen, a DXGI_ERROR_INVALID_CALL/InvalidCall error is thrown, otherwise (very rarely) a black screen is being presented.
Can't seem to reproduce using a empty project. :(
To Reproduce
Steps to reproduce the behavior:

Create a project
Use this function and call it inside a Start() method of a StartupScript

public void ChangeScreen(bool fullscreen, int width, int height)
{
	Game.Window.Visible = false;

	var size = new Int2(width, height);

	if (fullscreen)
		Game.Window.PreferredFullscreenSize = size;
	else
	{
		Game.Window.SetSize(size);
		Game.Window.PreferredWindowedSize = size;
	}

	Game.Window.IsFullscreen = fullscreen;

	Game.Window.Visible = true;
}

Expected behavior
Crash bad.
Log and callstacks
[Game]: Error: Unexpected exception. Stride.Graphics.GraphicsException: Unexpected error on Present (device status: Normal)
 ---> SharpDX.SharpDXException: HRESULT: [0x887A0001], Module: [SharpDX.DXGI], ApiCode: [DXGI_ERROR_INVALID_CALL/InvalidCall], Message: The application made a call that is invalid. Either the parameters of the call or the state of some object was incorrect.
Enable the D3D debug layer in order to see details via debug messages.

   at Stride.Graphics.SwapChainGraphicsPresenter.Present()
   --- End of inner exception stack trace ---
   at Stride.Graphics.SwapChainGraphicsPresenter.Present()
   at Stride.Games.GraphicsDeviceManager.Stride.Games.IGraphicsDeviceManager.EndDraw(Boolean present)
   at Stride.Games.GameBase.EndDraw(Boolean present)
   at Stride.Engine.Game.EndDraw(Boolean present) in D:\Projects\stride\sources\engine\Stride.Engine\Engine\Game.cs:line 445
   at Stride.Games.GameBase.RawTick(TimeSpan elapsedTimePerUpdate, Int32 updateCount, Single drawInterpolationFactor, Boolean drawFrame)
   at Stride.Games.GameBase.RawTickProducer()
Stride.Graphics.GraphicsException: Unexpected error on Present (device status: Normal)
 ---> SharpDX.SharpDXException: HRESULT: [0x887A0001], Module: [SharpDX.DXGI], ApiCode: [DXGI_ERROR_INVALID_CALL/InvalidCall], Message: The application made a call that is invalid. Either the parameters of the call or the state of some object was incorrect.
Enable the D3D debug layer in order to see details via debug messages.

   at Stride.Graphics.SwapChainGraphicsPresenter.Present()
   --- End of inner exception stack trace ---
   at Stride.Graphics.SwapChainGraphicsPresenter.Present()
   at Stride.Games.GraphicsDeviceManager.Stride.Games.IGraphicsDeviceManager.EndDraw(Boolean present)
   at Stride.Games.GameBase.EndDraw(Boolean present)
   at Stride.Engine.Game.EndDraw(Boolean present) in D:\Projects\stride\sources\engine\Stride.Engine\Engine\Game.cs:line 445
   at Stride.Games.GameBase.RawTick(TimeSpan elapsedTimePerUpdate, Int32 updateCount, Single drawInterpolationFactor, Boolean drawFrame)
   at Stride.Games.GameBase.RawTickProducer()

Workaround
Use borderless fullscreen, like so:
Game.Window.SetSize(new Int2(1920, 1080));
Game.Window.Position = new Int2(0, 0);

got the same issue here:
SharpDX.SharpDXException
  HResult=0x80070005
  Mensaje = HRESULT: [0x80070005], Module: [General], ApiCode: [E_ACCESSDENIED/General access denied error], Message: Acceso denegado.

  Origen = SharpDX
  Seguimiento de la pila:
   en SharpDX.Result.CheckError() en C:\projects\sharpdx\Source\SharpDX\Result.cs: línea 195
   en SharpDX.DXGI.Factory.CreateSwapChain(IUnknown deviceRef, SwapChainDescription& descRef, SwapChain swapChainOut) en C:\projects\sharpdx\Source\SharpDX.DXGI\Generated\REFERENCE\Interfaces.cs: línea 1519
   en SharpDX.DXGI.SwapChain..ctor(Factory factory, ComObject device, SwapChainDescription description) en C:\projects\sharpdx\Source\SharpDX.DXGI\SwapChain.cs: línea 43
   en Stride.Graphics.SwapChainGraphicsPresenter.CreateSwapChainForDesktop(IntPtr handle)
   en Stride.Graphics.SwapChainGraphicsPresenter.CreateSwapChainForWindows()
   en Stride.Graphics.SwapChainGraphicsPresenter.CreateSwapChain()
   en Stride.Graphics.SwapChainGraphicsPresenter.OnRecreated()
   en Stride.Graphics.ResumeManager.OnRecreate()
   en Stride.Games.GameBase.GraphicsDeviceService_DeviceReset(Object sender, EventArgs e)
   en Stride.Games.GraphicsDeviceManager.OnDeviceReset(Object sender, EventArgs args)
   en Stride.Games.GraphicsDeviceManager.CreateDevice(GraphicsDeviceInformation newInfo)
   en Stride.Games.GraphicsDeviceManager.ChangeOrCreateDevice(Boolean forceCreate)
   en Stride.Games.GraphicsDeviceManager.ApplyChanges()
   en Stride.Games.GraphicsDeviceManager.Window_FullscreenChanged(Object sender, EventArgs eventArgs)
   en Stride.Games.GameWindow.set_IsFullscreen(Boolean value)
   en Stride.Games.GameWindow.OnDisableFullScreen(Object source, EventArgs e)
   en Stride.Games.GameForm.OnDisableFullScreen(EventArgs e)
   en Stride.Games.GameForm.WndProc(Message& m)
   en System.Windows.Forms.NativeWindow.Callback(HWND hWnd, MessageId msg, WPARAM wparam, LPARAM lparam)
   en Stride.Games.Win32Native.CallWindowProc(IntPtr wndProc, IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam)
   en Stride.Input.InputSourceWinforms.WndProc(IntPtr hWnd, Int32 msg, IntPtr wParam, IntPtr lParam)

Stride <IP_ADDRESS>2
Graphics api: d3d 11.1
Windows 10 build 19045.4894

I am having this issue now as well but I have a few more details.

All are defaults, no resizing in the project
It crashed when I click a close button in the top toolbar
It doesn't crash on my primary screen, where it starts
It crashes only when I close it on my 2 secondary screens

SharpDX.SharpDXException
  HResult=0x80070005
  Message=HRESULT: [0x80070005], Module: [General], ApiCode: [E_ACCESSDENIED/General access denied error], Message: Access is denied.

  Source=SharpDX
  StackTrace:
   at SharpDX.Result.CheckError() in C:\projects\sharpdx\Source\SharpDX\Result.cs:line 195
   at SharpDX.DXGI.Factory.CreateSwapChain(IUnknown deviceRef, SwapChainDescription& descRef, SwapChain swapChainOut) in C:\projects\sharpdx\Source\SharpDX.DXGI\Generated\REFERENCE\Interfaces.cs:line 1519
   at SharpDX.DXGI.SwapChain..ctor(Factory factory, ComObject device, SwapChainDescription description) in C:\projects\sharpdx\Source\SharpDX.DXGI\SwapChain.cs:line 43
   at Stride.Graphics.SwapChainGraphicsPresenter.CreateSwapChainForDesktop(IntPtr handle)
   at Stride.Graphics.SwapChainGraphicsPresenter.CreateSwapChainForWindows()
   at Stride.Graphics.SwapChainGraphicsPresenter.CreateSwapChain()
   at Stride.Graphics.SwapChainGraphicsPresenter.OnRecreated()
   at Stride.Graphics.ResumeManager.OnRecreate()
   at Stride.Games.GameBase.GraphicsDeviceService_DeviceReset(Object sender, EventArgs e)
   at Stride.Games.GraphicsDeviceManager.OnDeviceReset(Object sender, EventArgs args)
   at Stride.Games.GraphicsDeviceManager.CreateDevice(GraphicsDeviceInformation newInfo)
   at Stride.Games.GraphicsDeviceManager.ChangeOrCreateDevice(Boolean forceCreate)
   at Stride.Games.GraphicsDeviceManager.Window_ClientSizeChanged(Object sender, EventArgs e)
   at Stride.Games.GameWindow.OnClientSizeChanged(Object source, EventArgs e)
   at Stride.Games.GameForm.OnUserResized(EventArgs e)
   at Stride.Games.GameForm.OnClientSizeChanged(EventArgs e)
   at System.Windows.Forms.Control.UpdateBounds(Int32 x, Int32 y, Int32 width, Int32 height, Int32 clientWidth, Int32 clientHeight)
   at System.Windows.Forms.Control.UpdateBounds()
   at System.Windows.Forms.Control.WmWindowPosChanged(Message& m)
   at System.Windows.Forms.Control.WndProc(Message& m)
   at System.Windows.Forms.ScrollableControl.WndProc(Message& m)
   at System.Windows.Forms.Form.WmWindowPosChanged(Message& m)
   at System.Windows.Forms.Form.WndProc(Message& m)
   at Stride.Games.GameForm.WndProc(Message& m)
   at System.Windows.Forms.NativeWindow.Callback(HWND hWnd, MessageId msg, WPARAM wparam, LPARAM lparam)
   at Stride.Games.Win32Native.CallWindowProc(IntPtr wndProc, IntPtr hwnd, Int32 msg, IntPtr wParam, IntPtr lParam)
   at Stride.Input.InputSourceWinforms.WndProc(IntPtr hWnd, Int32 msg, IntPtr wParam, IntPtr lParam)

Other observation, the error is further affected by this settings.

If my primary screen is =< 150%, then it doesn't crash even when I close the application on other screens.
If my primary screen is > 150%, the crash happens when the game is closed on both secondary screens.
When I drag a window from the primary screen to secondary, the windows resizes, which is a correct behaviour but it seems that will cause a crash on closing the application.
When it doesn't crash, the window just resizes slightly.

I just tested under the master branch, I get the "Access denied" error when exiting the app using Alt+F4. Otherwise switching to fullscreen works. My scaling is set to 100%.
Also tested with the project I've had this issue originally, still no changes.


Fixed the menu links hover effect on smaller devices

Fixes #672
Before Changes:

After Changes:

Can this be fixed instead with something like box-sizing: border-box? Or would it break something else?

Sure sir, I will look on it

@limzykenneth I searched all over the website & couldn't find links with similar behaviour

thanks!


Add cost estimate feature

Calculates number of tokens/user cost and requires user permission to proceed.
User permission bypass is built-in to allow for non-human users.

This looks good, however, rather than having the same code in two different places, you could add it on it's own file and import it on both scripts/ingest_rst.py and scripts/ingest_rst_sphinx.py.


File contents in URL may need to be re-thought...

Limit is around 2000 chars:
http://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers
Perhaps some kind of pastebin action would be more suitable.

I'm open to suggestions here - from my experimentation I found that the 2000 char limit doesn't tend to apply to the hash part of the url but do correct me if I'm wrong there. For example it's perfectly happy with the complete text of Hamlet and that's definitely longer than 2000 characters.
The concern around the size of the url is also the reason for DEFLATE-ing everything before putting it in the url.
I do have some thoughts and a prototype around creating a version with a real storage backend - the only problem is what to use as that backend - I'm not too keen on (for example) opening up one of my own S3 buckets for people to store whatever they like. Again, open to suggestions what to do here.

Seeing all of the base64 (assuming) chars pop up in my URL as I typed was a sort-of WTF moment when I first used it, but then I read your note and was cool with it.
Then I was writing a moderately long post (probably around 5 8.5" x 11" pages worth), and I noticed the editor becoming progressively less responsive as the character count grew.  The type-deflate-base64-url loop may be contributing to that (fairly certain all of the translate/format/color stuff still has the greater impact).
Making this an on-demand feature with a key-combo instead of an automatic one would be my preference.
When I remembered the URL "limit", pastebin was the first thing that came to my mind.  The guy who had the most thorough answer in that stack overflow post is Paul Dixon, author of pastebin.  From his post, he has already struggled with this, and pastebin was his solution -- not to say it is the best one.
If you were ambitious, this would be a starting place for some kind of tightly-integrated free/premium cloud service.
Great job overall though.  Was using MarkdownPad, which is fast on input, but very slow to start.  Your markdown-editor is fantastic as long as I keep my posts short.

@jbt niu

@BourgeoisBear this feature has been made available via a button on http:/rohitt.me/markdown-editor for now. I'm open to further discussion if you're interested.
Closing this. Please read #77.


added mac tutorial

Added a tutorial for mac users to set up an encrypted configuration -- process is different from the linux tutorial.
I thought it was useful because my setup is an always-on iMac, not a linux box.

Could we make it TUTORIAL_OSX.md vs TUTORIAL_MAC.md

MongoDB will be going away with the newer version.