Tag not working with macro expansion

[fardin01]

According to tag action documentation, tag action supports Macro Expansions. However, it does not seem to work.

tag:'request-id:%{REQUEST_HEADERS.X-Request-ID}' produces [tag \"request-id:%{REQUEST_HEADERS.X-Request-ID}\"] in the log. I have also tried:

SecRule REQUEST_HEADERS:x-request-id ".*" "id:900001,phase:1,pass,nolog,setvar:tx.x-request-id=%{MATCHED_VAR}"

tag:'request-id:%{tx.x-request-id}',\

which produces [tag \"request-id:%{tx.x-request-id}\"]. How do I make this work?

[fardin01]

I should mention that it works in msg action:

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)\b(?:eval|set(?:timeout|interval)|new[\s\x0b]+Function|a(?:lert|tob)|btoa|prompt|confirm)[\s\x0b]*\(" \
  "id:941390,\
  phase:2,\
  block,\
  capture,\
  t:none,t:htmlEntityDecode,t:jsDecode,\
  msg:'Javascript method detected. Request ID %{REQUEST_HEADERS.X-Request-ID}'

Log:

Coraza: Access denied (phase 2). Javascript method detected. Request ID d55787bd-0fd6-4311-a3ba-f1a97022682c

[fardin01]

It does appear that msg and logdata have Macro expansion:
https://github.com/corazawaf/coraza/blob/main/internal/actions/msg.go#L31
https://github.com/corazawaf/coraza/blob/main/internal/actions/logdata.go#L31

but tag does not: https://github.com/corazawaf/coraza/blob/main/internal/actions/tag.go#L28

[fzipi]

Created issue #1118 from this one.