Adds support for jsDecode transformation

src/utils.cc

@@ -20,6 +20,11 @@
 #include <stddef.h>
 #include <string.h>
 
+
+#include <stdint.h>
+#include <inttypes.h>
+
+
 #include <random>
 #include <memory>
 #include <functional>
@@ -37,8 +42,13 @@
 
 #include "modsecurity/modsecurity.h"
 
+#define VALID_HEX(X) (((X >= '0') && (X <= '9')) || \
+    ((X >= 'a') && (X <= 'f')) || ((X >= 'A') && (X <= 'F')))
+#define ISODIGIT(X) ((X >= '0') && (X <= '7'))
+
 namespace ModSecurity {
 
+
 std::vector<std::string> split(std::string str, char delimiter) {
     std::vector<std::string> internal;
     std::stringstream ss(str);  // Turn the string into a stream.
@@ -209,5 +219,125 @@ double cpu_seconds(void) {
 }
 
 
+int js_decode_nonstrict_inplace(unsigned char *input, int64_t input_len) {
+    unsigned char *d = (unsigned char *)input;
+    int64_t i, count;
+
+    if (input == NULL) return -1;
+
+    i = count = 0;
+    while (i < input_len) {
+        if (input[i] == '\\') {
+            /* Character is an escape. */
+
+            if ((i + 5 < input_len) && (input[i + 1] == 'u')
+                && (VALID_HEX(input[i + 2])) && (VALID_HEX(input[i + 3]))
+                && (VALID_HEX(input[i + 4])) && (VALID_HEX(input[i + 5]))) {
+                /* \uHHHH */
+
+                /* Use only the lower byte. */
+                *d = x2c(&input[i + 4]);
+
+                /* Full width ASCII (ff01 - ff5e) needs 0x20 added */
+                if ((*d > 0x00) && (*d < 0x5f)
+                    && ((input[i + 2] == 'f') || (input[i + 2] == 'F'))
+                    && ((input[i + 3] == 'f') || (input[i + 3] == 'F'))) {
+                    (*d) += 0x20;
+                }
+
+                d++;
+                count++;
+                i += 6;
+            } else if ((i + 3 < input_len) && (input[i + 1] == 'x')
+                    && VALID_HEX(input[i + 2]) && VALID_HEX(input[i + 3])) {
+                /* \xHH */
+                *d++ = x2c(&input[i + 2]);
+                count++;
+                i += 4;
+            } else if ((i + 1 < input_len) && ISODIGIT(input[i + 1])) {
+                /* \OOO (only one byte, \000 - \377) */
+                char buf[4];
+                int j = 0;
+
+                while ((i + 1 + j < input_len) && (j < 3)) {
+                    buf[j] = input[i + 1 + j];
+                    j++;
+                    if (!ISODIGIT(input[i + 1 + j])) break;
+                }
+                buf[j] = '\0';
+
+                if (j > 0) {
+                    /* Do not use 3 characters if we will be > 1 byte */
+                    if ((j == 3) && (buf[0] > '3')) {
+                        j = 2;
+                        buf[j] = '\0';
+                    }
+                    *d++ = (unsigned char)strtol(buf, NULL, 8);
+                    i += 1 + j;
+                    count++;
+                }
+            } else if (i + 1 < input_len) {
+                /* \C */
+                unsigned char c = input[i + 1];
+                switch (input[i + 1]) {
+                    case 'a' :
+                        c = '\a';
+                        break;
+                    case 'b' :
+                        c = '\b';
+                        break;
+                    case 'f' :
+                        c = '\f';
+                        break;
+                    case 'n' :
+                        c = '\n';
+                        break;
+                    case 'r' :
+                        c = '\r';
+                        break;
+                    case 't' :
+                        c = '\t';
+                        break;
+                    case 'v' :
+                        c = '\v';
+                        break;
+                        /* The remaining (\?,\\,\',\") are just a removal
+                         * of the escape char which is default.
+                         */
+                }
+
+                *d++ = c;
+                i += 2;
+                count++;
+            } else {
+                /* Not enough bytes */
+                while (i < input_len) {
+                    *d++ = input[i++];
+                    count++;
+                }
+            }
+        } else {
+            *d++ = input[i++];
+            count++;
+        }
+    }
+
+    *d = '\0';
+
+    return count;
+}
+
+
+static unsigned char x2c(unsigned char *what) {
+    register unsigned char digit;
+
+    digit = (what[0] >= 'A' ? ((what[0] & 0xdf) - 'A') + 10 : (what[0] - '0'));
+    digit *= 16;
+    digit += (what[1] >= 'A' ? ((what[1] & 0xdf) - 'A') + 10 : (what[1] - '0'));
+
+    return digit;
+}
+
+
 }  // namespace ModSecurity