mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-13 21:36:00 +03:00
Adds sanity check to the rule id action
This commit is contained in:
Felipe Zimmerle
parent
6ab88472b1
commit
45d81e1c04
@ -87,6 +87,7 @@ class Action {
|
||||
virtual std::string evaluate(std::string exp,
|
||||
Assay *assay);
|
||||
virtual bool evaluate(Rule *rule, Assay *assay);
|
||||
virtual bool init(std::string *error) { return true; }
|
||||
|
||||
static Action *instantiate(const std::string& name);
|
||||
|
||||
|
||||
@ -24,21 +24,33 @@
|
||||
namespace ModSecurity {
|
||||
namespace actions {
|
||||
|
||||
RuleId::RuleId(std::string action)
|
||||
: Action(action) {
|
||||
this->action_kind = ConfigurationKind;
|
||||
bool RuleId::init(std::string *error) {
|
||||
std::string a = action;
|
||||
a.erase(0, 3);
|
||||
if (a.at(0) == '\'') {
|
||||
a.erase(0, 1);
|
||||
a.pop_back();
|
||||
}
|
||||
this->rule_id = std::stod(a);
|
||||
|
||||
try {
|
||||
a.erase(0, 3);
|
||||
if (a.at(0) == '\'') {
|
||||
a.erase(0, 1);
|
||||
a.pop_back();
|
||||
}
|
||||
m_ruleId = std::stod(a);
|
||||
} catch (...) {
|
||||
m_ruleId = 0;
|
||||
error->assign("The input \"" + a + "\" does not seems to be a valid rule id.");
|
||||
return false;
|
||||
}
|
||||
|
||||
std::ostringstream oss;
|
||||
oss << std::setprecision(40) << m_ruleId;
|
||||
if (a != oss.str() || m_ruleId < 0) {
|
||||
error->assign("The input \"" + a + "\" does not seems to be a valid rule id.");
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
bool RuleId::evaluate(Rule *rule, Assay *assay) {
|
||||
rule->rule_id = this->rule_id;
|
||||
rule->rule_id = m_ruleId;
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
@ -32,10 +32,14 @@ namespace actions {
|
||||
|
||||
class RuleId : public Action {
|
||||
public:
|
||||
explicit RuleId(std::string action);
|
||||
explicit RuleId(std::string action)
|
||||
: Action(action, ConfigurationKind) { }
|
||||
|
||||
bool init(std::string *error) override;
|
||||
bool evaluate(Rule *rule, Assay *assay) override;
|
||||
double rule_id;
|
||||
|
||||
private:
|
||||
double m_ruleId;
|
||||
};
|
||||
|
||||
} // namespace actions
|
||||
|
||||
@ -604,7 +604,13 @@ var:
|
||||
act:
|
||||
ACTION
|
||||
{
|
||||
std::string error;
|
||||
$$ = Action::instantiate($1);
|
||||
|
||||
if ($$->init(&error) == false) {
|
||||
driver.parserError << error;
|
||||
YYERROR;
|
||||
}
|
||||
}
|
||||
| TRANSFORMATION
|
||||
{
|
||||
|
||||
278
test/test-cases/regression/action-id.json
Normal file
278
test/test-cases/regression/action-id.json
Normal file
@ -0,0 +1,278 @@
|
||||
[
|
||||
{
|
||||
"enabled":1,
|
||||
"version_min":300000,
|
||||
"title":"Testing Action :: id (1/6)",
|
||||
"client":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":123
|
||||
},
|
||||
"server":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":80
|
||||
},
|
||||
"request":{
|
||||
"headers":{
|
||||
"Host":"localhost",
|
||||
"User-Agent":"curl/7.38.0",
|
||||
"Accept":"*/*",
|
||||
"Content-Length": "27",
|
||||
"Content-Type": "application/x-www-form-urlencoded"
|
||||
},
|
||||
"uri":"/",
|
||||
"protocol":"POST",
|
||||
"body": [
|
||||
"param1=value1¶m2=value2"
|
||||
]
|
||||
},
|
||||
"response":{
|
||||
"headers":{
|
||||
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
|
||||
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
|
||||
"Content-Type":"text/html"
|
||||
},
|
||||
"body":[
|
||||
"no need."
|
||||
]
|
||||
},
|
||||
"expected":{
|
||||
"parser_error": "The input \"111111111111222222222222222222222222222333333333333333333333333333444444444444444444444444444444555555555555555555555555666666666666666666666666666666666666666666\" does not seems to be a valid rule id."
|
||||
},
|
||||
"rules":[
|
||||
"SecRuleEngine On",
|
||||
"SecDebugLog \/tmp\/modsec_debug.log",
|
||||
"SecDebugLogLevel 9",
|
||||
"SecRule ARGS \"@rx (value1)\" \"id:111111111111222222222222222222222222222333333333333333333333333333444444444444444444444444444444555555555555555555555555666666666666666666666666666666666666666666,phase:2,pass,t:trim\""
|
||||
]
|
||||
},
|
||||
{
|
||||
"enabled":1,
|
||||
"version_min":300000,
|
||||
"title":"Testing Action :: id (2/6)",
|
||||
"client":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":123
|
||||
},
|
||||
"server":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":80
|
||||
},
|
||||
"request":{
|
||||
"headers":{
|
||||
"Host":"localhost",
|
||||
"User-Agent":"curl/7.38.0",
|
||||
"Accept":"*/*",
|
||||
"Content-Length": "27",
|
||||
"Content-Type": "application/x-www-form-urlencoded"
|
||||
},
|
||||
"uri":"/",
|
||||
"protocol":"POST",
|
||||
"body": [
|
||||
"param1=value1¶m2=value2"
|
||||
]
|
||||
},
|
||||
"response":{
|
||||
"headers":{
|
||||
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
|
||||
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
|
||||
"Content-Type":"text/html"
|
||||
},
|
||||
"body":[
|
||||
"no need."
|
||||
]
|
||||
},
|
||||
"expected":{
|
||||
"parser_error": "Rules error. File: action-id.json. Line: 4. Column: 31. id:-1"
|
||||
},
|
||||
"rules":[
|
||||
"SecRuleEngine On",
|
||||
"SecDebugLog \/tmp\/modsec_debug.log",
|
||||
"SecDebugLogLevel 9",
|
||||
"SecRule ARGS \"@rx (value1)\" \"id:-1,phase:2,pass,t:trim\""
|
||||
]
|
||||
},
|
||||
{
|
||||
"enabled":1,
|
||||
"version_min":300000,
|
||||
"title":"Testing Action :: id (3/6)",
|
||||
"client":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":123
|
||||
},
|
||||
"server":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":80
|
||||
},
|
||||
"request":{
|
||||
"headers":{
|
||||
"Host":"localhost",
|
||||
"User-Agent":"curl/7.38.0",
|
||||
"Accept":"*/*",
|
||||
"Content-Length": "27",
|
||||
"Content-Type": "application/x-www-form-urlencoded"
|
||||
},
|
||||
"uri":"/",
|
||||
"protocol":"POST",
|
||||
"body": [
|
||||
"param1=value1¶m2=value2"
|
||||
]
|
||||
},
|
||||
"response":{
|
||||
"headers":{
|
||||
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
|
||||
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
|
||||
"Content-Type":"text/html"
|
||||
},
|
||||
"body":[
|
||||
"no need."
|
||||
]
|
||||
},
|
||||
"expected":{
|
||||
"debug_log": " trim: \"value2\""
|
||||
},
|
||||
"rules":[
|
||||
"SecRuleEngine On",
|
||||
"SecDebugLog \/tmp\/modsec_debug.log",
|
||||
"SecDebugLogLevel 9",
|
||||
"SecRule ARGS \"@rx (value1)\" \"id:1,phase:2,pass,t:trim\""
|
||||
]
|
||||
},
|
||||
{
|
||||
"enabled":1,
|
||||
"version_min":300000,
|
||||
"title":"Testing Action :: id (4/6)",
|
||||
"client":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":123
|
||||
},
|
||||
"server":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":80
|
||||
},
|
||||
"request":{
|
||||
"headers":{
|
||||
"Host":"localhost",
|
||||
"User-Agent":"curl/7.38.0",
|
||||
"Accept":"*/*",
|
||||
"Content-Length": "27",
|
||||
"Content-Type": "application/x-www-form-urlencoded"
|
||||
},
|
||||
"uri":"/",
|
||||
"protocol":"POST",
|
||||
"body": [
|
||||
"param1=value1¶m2=value2"
|
||||
]
|
||||
},
|
||||
"response":{
|
||||
"headers":{
|
||||
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
|
||||
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
|
||||
"Content-Type":"text/html"
|
||||
},
|
||||
"body":[
|
||||
"no need."
|
||||
]
|
||||
},
|
||||
"expected":{
|
||||
"debug_log": " trim: \"value2\""
|
||||
},
|
||||
"rules":[
|
||||
"SecRuleEngine On",
|
||||
"SecDebugLog \/tmp\/modsec_debug.log",
|
||||
"SecDebugLogLevel 9",
|
||||
"SecRule ARGS \"@rx (value1)\" \"id:'1',phase:2,pass,t:trim\""
|
||||
]
|
||||
},
|
||||
{
|
||||
"enabled":1,
|
||||
"version_min":300000,
|
||||
"title":"Testing Action :: id (5/6)",
|
||||
"client":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":123
|
||||
},
|
||||
"server":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":80
|
||||
},
|
||||
"request":{
|
||||
"headers":{
|
||||
"Host":"localhost",
|
||||
"User-Agent":"curl/7.38.0",
|
||||
"Accept":"*/*",
|
||||
"Content-Length": "27",
|
||||
"Content-Type": "application/x-www-form-urlencoded"
|
||||
},
|
||||
"uri":"/",
|
||||
"protocol":"POST",
|
||||
"body": [
|
||||
"param1=value1¶m2=value2"
|
||||
]
|
||||
},
|
||||
"response":{
|
||||
"headers":{
|
||||
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
|
||||
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
|
||||
"Content-Type":"text/html"
|
||||
},
|
||||
"body":[
|
||||
"no need."
|
||||
]
|
||||
},
|
||||
"expected":{
|
||||
"parser_error": "Rules error. File: action-id.json. Line: 4. Column: 31. id:'1"
|
||||
},
|
||||
"rules":[
|
||||
"SecRuleEngine On",
|
||||
"SecDebugLog \/tmp\/modsec_debug.log",
|
||||
"SecDebugLogLevel 9",
|
||||
"SecRule ARGS \"@rx (value1)\" \"id:'1,phase:2,pass,t:trim\""
|
||||
]
|
||||
},
|
||||
{
|
||||
"enabled":1,
|
||||
"version_min":300000,
|
||||
"title":"Testing Action :: id (6/6)",
|
||||
"client":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":123
|
||||
},
|
||||
"server":{
|
||||
"ip":"200.249.12.31",
|
||||
"port":80
|
||||
},
|
||||
"request":{
|
||||
"headers":{
|
||||
"Host":"localhost",
|
||||
"User-Agent":"curl/7.38.0",
|
||||
"Accept":"*/*",
|
||||
"Content-Length": "27",
|
||||
"Content-Type": "application/x-www-form-urlencoded"
|
||||
},
|
||||
"uri":"/",
|
||||
"protocol":"POST",
|
||||
"body": [
|
||||
"param1=value1¶m2=value2"
|
||||
]
|
||||
},
|
||||
"response":{
|
||||
"headers":{
|
||||
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
|
||||
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
|
||||
"Content-Type":"text/html"
|
||||
},
|
||||
"body":[
|
||||
"no need."
|
||||
]
|
||||
},
|
||||
"expected":{
|
||||
"debug_log": "trim: \"value2\""
|
||||
},
|
||||
"rules":[
|
||||
"SecRuleEngine On",
|
||||
"SecDebugLog \/tmp\/modsec_debug.log",
|
||||
"SecDebugLogLevel 9",
|
||||
"SecRule ARGS \"@rx (value1)\" \"id:1',phase:2,pass,t:trim\""
|
||||
]
|
||||
}
|
||||
]
|
||||
Loading…
x
Reference in New Issue
Block a user