diff --git a/CHANGES b/CHANGES index 39c0d133..956fa054 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,12 @@ +04 Apr 2007 - 2.1.1-rc2 +----------------------- + + * Add the PCRE_DOLLAR_ENDONLY option when compiling regular expression + for the @rx operator and variables. + + * Really set PCRE_DOTALL option when compiling the regular expression + for the @rx operator as the docs state. + 11 Mar 2007 - 2.1.1-rc1 ----------------------- diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h index 6f0dabbd..2738cf6a 100644 --- a/apache2/modsecurity.h +++ b/apache2/modsecurity.h @@ -50,7 +50,7 @@ typedef struct msc_string msc_string; #include "http_protocol.h" #define MODULE_NAME "ModSecurity" -#define MODULE_RELEASE "2.1.1-rc1" +#define MODULE_RELEASE "2.1.1-rc2" #define MODULE_NAME_FULL (MODULE_NAME " v" MODULE_RELEASE " (Apache 2.x)") #define PHASE_REQUEST_HEADERS 1 diff --git a/apache2/re_operators.c b/apache2/re_operators.c index 4e47bac8..f6b8f33e 100644 --- a/apache2/re_operators.c +++ b/apache2/re_operators.c @@ -64,7 +64,7 @@ static int msre_op_rx_param_init(msre_rule *rule, char **error_msg) { *error_msg = NULL; /* Compile pattern */ - regex = msc_pregcomp(rule->ruleset->mp, pattern, 0, &errptr, &erroffset); + regex = msc_pregcomp(rule->ruleset->mp, pattern, PCRE_DOTALL | PCRE_DOLLAR_ENDONLY, &errptr, &erroffset); if (regex == NULL) { *error_msg = apr_psprintf(rule->ruleset->mp, "Error compiling pattern (pos %i): %s", erroffset, errptr); diff --git a/apache2/re_variables.c b/apache2/re_variables.c index 9a9b85ad..360f5b57 100644 --- a/apache2/re_variables.c +++ b/apache2/re_variables.c @@ -69,7 +69,7 @@ static char *var_generic_list_validate(msre_ruleset *ruleset, msre_var *var) { pattern = apr_pstrmemdup(ruleset->mp, var->param + 1, strlen(var->param + 1) - 1); if (pattern == NULL) return FATAL_ERROR; - regex = msc_pregcomp(ruleset->mp, pattern, PCRE_DOTALL | PCRE_CASELESS, &errptr, &erroffset); + regex = msc_pregcomp(ruleset->mp, pattern, PCRE_DOTALL | PCRE_CASELESS | PCRE_DOLLAR_ENDONLY, &errptr, &erroffset); if (regex == NULL) { return apr_psprintf(ruleset->mp, "Error compiling pattern (pos %i): %s", erroffset, errptr); diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index 02f76d60..94d97aca 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -3,7 +3,7 @@ ModSecurity Reference Manual - Version 2.1.1-rc1 / (March 11, 2007) + Version 2.1.1-rc2 / (April 04, 2007) 2004-2007 @@ -3998,9 +3998,11 @@ SecRule XML:/soap:Envelope/soap:Body/q1:getInput/id() "123" phase:2,deny - The PCRE_DOTALL flag is set + The PCRE_DOTALL and + PCRE_DOLLAR_ENDONLY flags are set during compilation, meaning a single dot will match any character, - including the newlines. + including the newlines and a $ + end anchor will not match a trailing newline charater.