github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 13:56:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Changes MATCHED_VAR behaviour

Browse Source 
Only cleanup the variable if there wasn't a match within the rule
This commit is contained in:
Felipe Zimmerle 2016-07-29 10:40:45 -07:00
parent 665df04516
commit 0e5f72977e
3 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/rule.cc
View File

@ -270,6 +270,7 @@ bool Rule::evaluateActions(Transaction *trasn) {
bool Rule::evaluate(Transaction *trasn) { bool Rule::evaluate(Transaction *trasn) {
bool ret = false; bool ret = false;
bool globalRet = false;
std::vector<Variable *> *variables = this->variables; std::vector<Variable *> *variables = this->variables;
RuleMessage *ruleMessage = NULL; RuleMessage *ruleMessage = NULL;
@ -398,6 +399,7 @@ bool Rule::evaluate(Transaction *trasn) {
bool containsDisruptive = false; bool containsDisruptive = false;
bool chainResult = false; bool chainResult = false;
bool containsPassAction = false; bool containsPassAction = false;
globalRet = true;
ruleMessage->m_match = "Operator `" + this->op->op + ruleMessage->m_match = "Operator `" + this->op->op +
"' with parameter `" + this->op->param + "' against" \ "' with parameter `" + this->op->param + "' against" \
@ -517,7 +519,7 @@ bool Rule::evaluate(Transaction *trasn) {
} }
} }
} }
} else { } else if (globalRet != true) {
#ifndef NO_LOGS #ifndef NO_LOGS
trasn->debug(4, "Rule returned 0."); trasn->debug(4, "Rule returned 0.");
trasn->m_collections.storeOrUpdateFirst("MATCHED_VAR", ""); trasn->m_collections.storeOrUpdateFirst("MATCHED_VAR", "");
@ -547,7 +549,7 @@ bool Rule::evaluate(Transaction *trasn) {
delete ruleMessage; delete ruleMessage;
} }
return ret; return globalRet;
} }

4
test/test-cases/regression/config-calling_phases_by_name.json
View File

@ -38,7 +38,7 @@
"SecDebugLog \/tmp\/modsec_debug.log", "SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9", "SecDebugLogLevel 9",
"SecRule ARGS:key \"@contains other_value\" \"id:1,phase:request,chain\"", "SecRule ARGS:key \"@contains other_value\" \"id:1,phase:request,chain\"",
"SecRule MATCHED_VAR \"@eq asdf\" \"phase:request,pass\"" "SecRule MATCHED_VAR \"@contains asdf\" \"phase:request,pass\""
] ]
}, },
{ {
@ -80,7 +80,7 @@
"SecDebugLog \/tmp\/modsec_debug.log", "SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9", "SecDebugLogLevel 9",
"SecRule ARGS:key \"@contains other_value\" \"chain,phase:response,id:28\"", "SecRule ARGS:key \"@contains other_value\" \"chain,phase:response,id:28\"",
"SecRule MATCHED_VAR \"@eq Aasdf\" \"pass\"", "SecRule MATCHED_VAR \"@contains Aasdf\" \"pass\"",
"SecRule MATCHED_VAR \"@contains other_value\" \"id:29,phase:response,pass\"", "SecRule MATCHED_VAR \"@contains other_value\" \"id:29,phase:response,pass\"",
"SecRule MATCHED_VAR \"@contains other_value\" \"id:30,phase:response,pass\"" "SecRule MATCHED_VAR \"@contains other_value\" \"id:30,phase:response,pass\""
] ]

4
test/test-cases/regression/variable-MATCHED_VAR.json
View File

@ -38,7 +38,7 @@
"SecDebugLog \/tmp\/modsec_debug.log", "SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9", "SecDebugLogLevel 9",
"SecRule ARGS:key \"@contains other_value\" \"chain,id:28\"", "SecRule ARGS:key \"@contains other_value\" \"chain,id:28\"",
"SecRule MATCHED_VAR \"@eq asdf\" \"pass\"" "SecRule MATCHED_VAR \"@contains asdf\" \"pass\""
] ]
}, },
{ {
@ -80,7 +80,7 @@
"SecDebugLog \/tmp\/modsec_debug.log", "SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9", "SecDebugLogLevel 9",
"SecRule ARGS:key \"@contains other_value\" \"chain,id:28\"", "SecRule ARGS:key \"@contains other_value\" \"chain,id:28\"",
"SecRule MATCHED_VAR \"@eq Aasdf\" \"pass\"", "SecRule MATCHED_VAR \"@contains Aasdf\" \"pass\"",
"SecRule MATCHED_VAR \"@contains other_value\" \"id:29,pass\"", "SecRule MATCHED_VAR \"@contains other_value\" \"id:29,pass\"",
"SecRule MATCHED_VAR \"@contains other_value\" \"id:30,pass\"" "SecRule MATCHED_VAR \"@contains other_value\" \"id:30,pass\""
] ]