github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-17 06:36:13 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2912 from martinhsv/v2/master

Browse Source 
Do not escape special chars in regex pattern with macro
This commit is contained in:
martinhsv 2023-07-27 09:37:35 -04:00 committed by GitHub
commit 11f85b82e1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@ -1,6 +1,8 @@
DD mmm YYYY - 2.9.x (to be released) DD mmm YYYY - 2.9.x (to be released)
------------------- -------------------
* Do not escape special chars in rx pattern with macro
[Issue #2357 - @marcstern, @martinhsv]
* Substitute two equals-equals operators in build * Substitute two equals-equals operators in build
[Issue #2883 - @Polynomial-C] [Issue #2883 - @Polynomial-C]

10
apache2/re_operators.c
View File

@ -1,6 +1,6 @@
/* /*
* ModSecurity for Apache 2.x, http://www.modsecurity.org/ * ModSecurity for Apache 2.x, http://www.modsecurity.org/
* Copyright (c) 2004-2022 Trustwave Holdings, Inc. (http://www.trustwave.com/) * Copyright (c) 2004-2023 Trustwave Holdings, Inc. (http://www.trustwave.com/)
* *
* You may not use this file except in compliance with * You may not use this file except in compliance with
* the License.  You may obtain a copy of the License at * the License.  You may obtain a copy of the License at
@ -1024,7 +1024,7 @@ static int msre_op_rx_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
int matched = 0; int matched = 0;
int rc; int rc;
char *qspos = NULL; char *qspos = NULL;
const char *parm = NULL, *pattern = NULL; const char *parm = NULL;
msc_parm *mparm = NULL; msc_parm *mparm = NULL;
#ifdef WITH_PCRE_STUDY #ifdef WITH_PCRE_STUDY
#ifdef WITH_PCRE_JIT #ifdef WITH_PCRE_JIT
@ -1052,9 +1052,9 @@ static int msre_op_rx_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
expand_macros(msr, re_pattern, rule, msr->mp); expand_macros(msr, re_pattern, rule, msr->mp);
pattern = log_escape_re(msr->mp, re_pattern->value);
if (msr->txcfg->debuglog_level >= 6) { if (msr->txcfg->debuglog_level >= 6) {
msr_log(msr, 6, "Escaping pattern [%s]",pattern); char *pattern = log_escape_re(msr->mp, re_pattern->value);
msr_log(msr, 6, "Expanded-macro pattern [%s]",pattern);
} }
#ifdef WITH_PCRE2 #ifdef WITH_PCRE2
@ -1062,7 +1062,7 @@ static int msre_op_rx_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
#else #else
options = PCRE_DOTALL | PCRE_DOLLAR_ENDONLY; options = PCRE_DOTALL | PCRE_DOLLAR_ENDONLY;
#endif #endif
regex = msc_pregcomp_ex(msr->mp, pattern, options, &errptr, &erroffset, msc_pcre_match_limit, msc_pcre_match_limit_recursion); regex = msc_pregcomp_ex(msr->mp, re_pattern->value, options, &errptr, &erroffset, msc_pcre_match_limit, msc_pcre_match_limit_recursion);
if (regex == NULL) { if (regex == NULL) {
*error_msg = apr_psprintf(msr->mp, "Error compiling pattern (offset %d): %s", *error_msg = apr_psprintf(msr->mp, "Error compiling pattern (offset %d): %s",
erroffset, errptr); erroffset, errptr);