sanitiseMatchedBytes range does not work on POST arguments

[tunetheweb]

If you have the following rule:

SecRule ARGS "@verifyCC \d{13,16}" "id:1,phase:5,pass,sanitiseMatchedBytes:4/4,capture"

Sending a GET request (www.example.com/test?a=1001200230034004) produces the following in the log as expected:

GET /test?a=1001********4004 HTTP/1.1

Sending a POST request however produces the following in the log:

a=****************

So it's not showing the first and last 4 characters as expected, but is instead doing a full sanitisation.

[victorhora]

Maybe related with #673

Should be fixed once Sanitize is implemented on libModSecurity/v3.