From 5bef19aa4d0f9e5b55d6693c39a7150c86a5b676 Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Wed, 4 Nov 2015 15:51:22 -0300
Subject: [PATCH] Variables resolution results now stored into a std::vector
 instead of std::list

---
 headers/modsecurity/transaction/collections.h | 17 +++---
 headers/modsecurity/transaction/variables.h   | 11 ++--
 src/assay.cc                                  |  8 +--
 src/collections.cc                            | 35 +++---------
 src/rule.cc                                   | 25 +++++----
 src/variables.cc                              | 53 +++----------------
 src/variables/duration.cc                     | 10 ++--
 src/variables/duration.h                      |  4 +-
 src/variables/env.cc                          | 15 ++----
 src/variables/env.h                           |  4 +-
 src/variables/highest_severity.cc             | 11 ++--
 src/variables/highest_severity.h              |  4 +-
 src/variables/modsec_build.cc                 | 11 ++--
 src/variables/modsec_build.h                  |  4 +-
 src/variables/time.cc                         | 10 ++--
 src/variables/time.h                          |  4 +-
 src/variables/time_day.cc                     | 11 ++--
 src/variables/time_day.h                      |  4 +-
 src/variables/time_epoch.cc                   | 11 ++--
 src/variables/time_epoch.h                    |  4 +-
 src/variables/time_hour.cc                    | 11 ++--
 src/variables/time_hour.h                     |  4 +-
 src/variables/time_min.cc                     | 11 ++--
 src/variables/time_min.h                      |  4 +-
 src/variables/time_mon.cc                     | 11 ++--
 src/variables/time_mon.h                      |  4 +-
 src/variables/time_sec.cc                     | 11 ++--
 src/variables/time_sec.h                      |  4 +-
 src/variables/time_wday.cc                    | 11 ++--
 src/variables/time_wday.h                     |  4 +-
 src/variables/time_year.cc                    | 11 ++--
 src/variables/time_year.h                     |  4 +-
 src/variables/tx.cc                           | 14 ++---
 src/variables/tx.h                            |  4 +-
 src/variables/variable.cc                     | 15 ++++--
 src/variables/variable.h                      |  6 ++-
 src/variables/variations/count.cc             | 16 +++---
 src/variables/variations/count.h              |  4 +-
 src/variables/variations/exclusion.cc         |  9 ++--
 src/variables/variations/exclusion.h          |  4 +-
 40 files changed, 143 insertions(+), 275 deletions(-)

diff --git a/headers/modsecurity/transaction/collections.h b/headers/modsecurity/transaction/collections.h
index 9dc8aa0f..b6b1b5ed 100644
--- a/headers/modsecurity/transaction/collections.h
+++ b/headers/modsecurity/transaction/collections.h
@@ -60,26 +60,21 @@ class Collections :
     std::string* resolveFirst(const std::string& collectionName,
         const std::string& var);
 
-    void resolve(const std::string& var,
-        std::list<transaction::Variable *> *l);
-    std::list<transaction::Variable *> *resolve(const std::string& var);
-
-
     void resolveSingleMatch(const std::string& var,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
     void resolveSingleMatch(const std::string& var,
         const std::string& collection,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
     void resolveMultiMatches(const std::string& var,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
     void resolveMultiMatches(const std::string& var,
         const std::string& collection,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
     void resolveRegularExpression(const std::string& var,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
     void resolveRegularExpression(const std::string& var,
         const std::string& collection,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
 
     /**
      * This is a special collection to host the transaction variables.
diff --git a/headers/modsecurity/transaction/variables.h b/headers/modsecurity/transaction/variables.h
index 7a458d2e..cdb0214d 100644
--- a/headers/modsecurity/transaction/variables.h
+++ b/headers/modsecurity/transaction/variables.h
@@ -19,6 +19,7 @@
 #include <iostream>
 #include <unordered_map>
 #include <list>
+#include <vector>
 #endif
 
 
@@ -53,17 +54,13 @@ class Variables :
     std::string* resolveFirst(const std::string& collectionName,
         const std::string& var);
 
-    std::list<transaction::Variable *> resolve(const std::string& key);
-
-    std::list<Variable *> resolve(const std::string& var,
-        std::list<transaction::Variable *> *l);
 
     void resolveSingleMatch(const std::string& var,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
     void resolveMultiMatches(const std::string& var,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
     void resolveRegularExpression(const std::string& var,
-        std::list<transaction::Variable *> *l);
+        std::vector<const transaction::Variable *> *l);
 
 };
 
diff --git a/src/assay.cc b/src/assay.cc
index 3477e891..cd7c45fa 100644
--- a/src/assay.cc
+++ b/src/assay.cc
@@ -676,8 +676,8 @@ int Assay::processRequestBody() {
      * computationally intensive.
      */
     std::string fullRequest;
-    std::list<transaction::Variable *> l;
-    m_collections.resolve("REQUEST_HEADERS", &l);
+    std::vector<const transaction::Variable *> l;
+    m_collections.resolveMultiMatches("REQUEST_HEADERS", &l);
     for (auto &a : l) {
         fullRequest = fullRequest + \
             std::string(a->m_key, 16, a->m_key.length() - 16) + ": " \
@@ -685,8 +685,8 @@ int Assay::processRequestBody() {
     }
 
     while (l.empty() == false) {
-        delete l.front();
-        l.pop_front();
+        delete l.back();
+        l.pop_back();
     }
 
     fullRequest = fullRequest + "\n\n";
diff --git a/src/collections.cc b/src/collections.cc
index 68c2b8f6..82ff5bfd 100644
--- a/src/collections.cc
+++ b/src/collections.cc
@@ -21,6 +21,7 @@
 #include <iostream>
 #include <unordered_map>
 #include <list>
+#include <vector>
 #endif
 
 #include "modsecurity/transaction/variable.h"
@@ -115,33 +116,11 @@ std::string* Collections::resolveFirst(const std::string& collectionName,
         }
 
         return NULL;
-    }
-
-
-void Collections::resolve(const std::string& var,
-    std::list<transaction::Variable *> *l) {
-
-    m_transient.resolve(var, l);
-
-    /* It may be a collection */
-    for (auto &a : *this) {
-        transaction::Variables *t = a.second;
-        a.second->resolve(var, l);
-    }
-}
-
-
-std::list<transaction::Variable *> *
-    Collections::resolve(const std::string& var) {
-    std::list<transaction::Variable *> *l =
-        new std::list<transaction::Variable *>();
-
-    resolve(var, l);
 }
 
 
 void Collections::resolveSingleMatch(const std::string& var,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
 
     m_transient.resolveSingleMatch(var, l);
 }
@@ -149,7 +128,7 @@ void Collections::resolveSingleMatch(const std::string& var,
 
 void Collections::resolveSingleMatch(const std::string& var,
     const std::string& collection,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
 
     try {
         this->at(collection)->resolveSingleMatch(var, l);
@@ -159,7 +138,7 @@ void Collections::resolveSingleMatch(const std::string& var,
 }
 
 void Collections::resolveMultiMatches(const std::string& var,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
 
     m_transient.resolveMultiMatches(var, l);
 }
@@ -167,7 +146,7 @@ void Collections::resolveMultiMatches(const std::string& var,
 
 void Collections::resolveMultiMatches(const std::string& var,
     const std::string& collection,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
     try {
         this->at(collection)->resolveMultiMatches(var, l);
     } catch (...) {
@@ -176,14 +155,14 @@ void Collections::resolveMultiMatches(const std::string& var,
 }
 
 void Collections::resolveRegularExpression(const std::string& var,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
     m_transient.resolveRegularExpression(var, l);
 }
 
 
 void Collections::resolveRegularExpression(const std::string& var,
     const std::string& collection,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
 
     try {
         this->at(collection)->resolveRegularExpression(var, l);
diff --git a/src/rule.cc b/src/rule.cc
index e4c6fc55..f8cb476c 100644
--- a/src/rule.cc
+++ b/src/rule.cc
@@ -280,13 +280,12 @@ bool Rule::evaluate(Assay *assay) {
     for (int i = 0; i < variables->size(); i++) {
         Variable *variable = variables->at(i);
         if (variable->m_isExclusion) {
-            std::list<transaction::Variable *> *z =
-                variable->evaluate(assay);
-            for (auto &y : *z) {
+            std::vector<const transaction::Variable *> z;
+            variable->evaluateInternal(assay, &z);
+            for (auto &y : z) {
                 exclusions.push_back(y->m_key);
             }
             exclusions.push_back(variable->m_name);
-            delete z;
         }
     }
 
@@ -297,10 +296,10 @@ bool Rule::evaluate(Assay *assay) {
             continue;
         }
 
-        std::list<transaction::Variable *> *e =
-            variable->evaluate(assay);
+        std::vector<const transaction::Variable *> e;
+        variable->evaluateInternal(assay, &e);
 
-        for (auto &v : *e) {
+        for (auto &v : e) {
             if (std::find(exclusions.begin(), exclusions.end(),
                 v->m_key) != exclusions.end()) {
 #ifndef NO_LOGS
@@ -312,7 +311,7 @@ bool Rule::evaluate(Assay *assay) {
             std::string value = v->m_value;
             int none = 0;
             for (Action *a : this->actions_runtime_pre) {
-                if (a->m_isNone != NULL) {
+                if (a->m_isNone) {
                     none++;
                 }
             }
@@ -345,7 +344,7 @@ bool Rule::evaluate(Assay *assay) {
 #endif
                     transformations++;
                 }
-                if (a->m_isNone != NULL) {
+                if (a->m_isNone) {
                     none--;
                 }
             }
@@ -485,11 +484,11 @@ bool Rule::evaluate(Assay *assay) {
             }
         }
 
-        while (e->empty() == false) {
-            delete e->front();
-            e->pop_front();
+        while (e.empty() == false) {
+            delete e.back();
+            e.pop_back();
         }
-        delete e;
+        //delete e;
     }
     return ret;
 }
diff --git a/src/variables.cc b/src/variables.cc
index c2010d3f..cbfb7213 100644
--- a/src/variables.cc
+++ b/src/variables.cc
@@ -65,9 +65,8 @@ void Variables::del(const std::string& key) {
 }
 
 
-
 void Variables::resolveSingleMatch(const std::string& var,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
     auto range = this->equal_range(var);
 
     for (auto it = range.first; it != range.second; ++it) {
@@ -77,16 +76,17 @@ void Variables::resolveSingleMatch(const std::string& var,
 
 
 void Variables::resolveMultiMatches(const std::string& var,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
     size_t keySize = var.size();
+    l->reserve(15);
 
     auto range = this->equal_range(var);
 
     for (auto it = range.first; it != range.second; ++it) {
-        l->push_back(new transaction::Variable(var, it->second));
+        l->insert(l->begin(), new transaction::Variable(var, it->second));
     }
 
-    for (auto& x : *this) {
+    for (const auto& x : *this) {
         if (x.first.size() <= keySize + 1) {
             continue;
         }
@@ -96,55 +96,18 @@ void Variables::resolveMultiMatches(const std::string& var,
         if (x.first.compare(0, keySize, var) != 0) {
             continue;
         }
-        l->push_back(new transaction::Variable(x.first, x.second));
+        const transaction::Variable *v = new transaction::Variable(x.first, x.second);
+        l->insert(l->begin(), v);
     }
 }
 
 
 void Variables::resolveRegularExpression(const std::string& var,
-    std::list<transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *l) {
     /* Not ready */
 }
 
 
-std::list<transaction::Variable *> Variables::resolve(const std::string& key,
-    std::list<transaction::Variable *> *l) {
-    auto range = this->equal_range(key);
-
-    for (auto it = range.first; it != range.second; ++it) {
-        l->push_back(new transaction::Variable(key, it->second));
-    }
-
-    if (key.find(":") == std::string::npos && l->size() == 0) {
-        size_t keySize = key.size() + 1;
-        for (auto& x : *this) {
-            if (x.first.size() <= keySize) {
-                continue;
-            }
-            if (x.first.at(keySize - 1) != ':') {
-                continue;
-            }
-            if (x.first.compare(0, keySize, key + ":") != 0) {
-                 continue;
-            }
-            //  auto range = this->equal_range(x.first);
-
-            //  for (auto it = range.first; it != range.second; ++it) {
-            l->push_back(new transaction::Variable(x.first, x.second));
-            //  }
-        }
-    }
-
-    return *l;
-}
-
-
-std::list<transaction::Variable *> Variables::resolve(const std::string& key) {
-    std::list<transaction::Variable *> l;
-    return resolve(key, &l);
-}
-
-
 std::string* Variables::resolveFirst(const std::string& var) {
     auto range = equal_range(var);
 
diff --git a/src/variables/duration.cc b/src/variables/duration.cc
index 5878e09f..8fd18cad 100644
--- a/src/variables/duration.cc
+++ b/src/variables/duration.cc
@@ -27,19 +27,15 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    Duration::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
+void Duration::evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) {
     std::string res;
 
     double e = cpu_seconds() - assay->start;
 
     res = std::to_string(e);
 
-    resl->push_back(new transaction::Variable("DURATION",  std::string(res)));
-
-    return resl;
+    l->push_back(new transaction::Variable("DURATION",  std::string(res)));
 }
 
 
diff --git a/src/variables/duration.h b/src/variables/duration.h
index 7de5241b..7131a62b 100644
--- a/src/variables/duration.h
+++ b/src/variables/duration.h
@@ -33,8 +33,8 @@ class Duration : public Variable {
     explicit Duration(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 
diff --git a/src/variables/env.cc b/src/variables/env.cc
index a624790f..5fc74762 100644
--- a/src/variables/env.cc
+++ b/src/variables/env.cc
@@ -33,11 +33,8 @@ extern char **environ;
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    Env::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void Env::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     std::map<std::string, std::string> envs;
     for (char **current = environ; *current; current++) {
         std::string env = std::string(*current);
@@ -50,8 +47,8 @@ std::list<transaction::Variable *> *
 
         envs.insert(std::pair<std::string, std::string>("ENV:" + key, value));
         if ("env:" + key == m_name) {
-            resl->push_back(new transaction::Variable(m_name, value));
-            return resl;
+            l->push_back(new transaction::Variable(m_name, value));
+            return;
         }
     }
 
@@ -60,10 +57,8 @@ std::list<transaction::Variable *> *
             && (x.first != m_name)) {
             continue;
         }
-        resl->push_back(new transaction::Variable(x.first, x.second));
+        l->push_back(new transaction::Variable(x.first, x.second));
     }
-
-    return resl;
 }
 
 
diff --git a/src/variables/env.h b/src/variables/env.h
index 2c39799a..b08ee108 100644
--- a/src/variables/env.h
+++ b/src/variables/env.h
@@ -33,8 +33,8 @@ class Env : public Variable {
     explicit Env(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 
diff --git a/src/variables/highest_severity.cc b/src/variables/highest_severity.cc
index 5a91e992..039f7d3d 100644
--- a/src/variables/highest_severity.cc
+++ b/src/variables/highest_severity.cc
@@ -26,15 +26,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    HighestSeverity::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
-    resl->push_back(new transaction::Variable("HIGHEST_SEVERITY",
+void HighestSeverity::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
+    l->push_back(new transaction::Variable("HIGHEST_SEVERITY",
         std::to_string(assay->highest_severity)));
-
-    return resl;
 }
 
 
diff --git a/src/variables/highest_severity.h b/src/variables/highest_severity.h
index 19786dc9..e0859eb7 100644
--- a/src/variables/highest_severity.h
+++ b/src/variables/highest_severity.h
@@ -33,8 +33,8 @@ class HighestSeverity : public Variable {
     explicit HighestSeverity(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 
diff --git a/src/variables/modsec_build.cc b/src/variables/modsec_build.cc
index 709ecc6b..179517d7 100644
--- a/src/variables/modsec_build.cc
+++ b/src/variables/modsec_build.cc
@@ -27,20 +27,15 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    ModsecBuild::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void ModsecBuild::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     std::ostringstream ss;
     ss << std::setw(2) << std::setfill('0') << MODSECURITY_MAJOR;
     ss << std::setw(2) << std::setfill('0') << MODSECURITY_MINOR;
     ss << std::setw(2) << std::setfill('0') << MODSECURITY_PATCHLEVEL;
     ss << std::setw(2) << std::setfill('0') << MODSECURITY_TAG_NUM;
 
-    resl->push_back(new transaction::Variable("MODSEC_BUILD", ss.str()));
-
-    return resl;
+    l->push_back(new transaction::Variable("MODSEC_BUILD", ss.str()));
 }
 
 
diff --git a/src/variables/modsec_build.h b/src/variables/modsec_build.h
index 4436bea0..7851aefe 100644
--- a/src/variables/modsec_build.h
+++ b/src/variables/modsec_build.h
@@ -33,8 +33,8 @@ class ModsecBuild : public Variable {
     explicit ModsecBuild(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 
diff --git a/src/variables/time.cc b/src/variables/time.cc
index 4dd58952..b833dc38 100644
--- a/src/variables/time.cc
+++ b/src/variables/time.cc
@@ -33,10 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    Time::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
+void Time::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
 
     char tstr[200];
     struct tm timeinfo;
@@ -48,9 +46,7 @@ std::list<transaction::Variable *> *
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%H:%M:%S", &timeinfo);
 
-    resl->push_back(new transaction::Variable("TIME", std::string(tstr)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME", std::string(tstr)));
 }
 
 
diff --git a/src/variables/time.h b/src/variables/time.h
index 6a648457..ffa86e02 100644
--- a/src/variables/time.h
+++ b/src/variables/time.h
@@ -34,8 +34,8 @@ class Time : public Variable {
     explicit Time(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_day.cc b/src/variables/time_day.cc
index 7575c0ad..87c33e7b 100644
--- a/src/variables/time_day.cc
+++ b/src/variables/time_day.cc
@@ -33,11 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeDay::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void TimeDay::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -48,9 +45,7 @@ std::list<transaction::Variable *> *
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%d", &timeinfo);
 
-    resl->push_back(new transaction::Variable("TIME_DAY",  std::string(tstr)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME_DAY",  std::string(tstr)));
 }
 
 
diff --git a/src/variables/time_day.h b/src/variables/time_day.h
index 77904cbe..fc698961 100644
--- a/src/variables/time_day.h
+++ b/src/variables/time_day.h
@@ -33,8 +33,8 @@ class TimeDay : public Variable {
     explicit TimeDay(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_epoch.cc b/src/variables/time_epoch.cc
index 0efbdd06..1160b72a 100644
--- a/src/variables/time_epoch.cc
+++ b/src/variables/time_epoch.cc
@@ -33,15 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeEpoch::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
-    resl->push_back(new transaction::Variable("TIME_EPOCH",
+void TimeEpoch::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
+    l->push_back(new transaction::Variable("TIME_EPOCH",
         std::to_string(std::time(nullptr))));
-
-    return resl;
 }
 
 
diff --git a/src/variables/time_epoch.h b/src/variables/time_epoch.h
index 55f75a09..503462d2 100644
--- a/src/variables/time_epoch.h
+++ b/src/variables/time_epoch.h
@@ -33,8 +33,8 @@ class TimeEpoch : public Variable {
     explicit TimeEpoch(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_hour.cc b/src/variables/time_hour.cc
index d37a1898..1c15ff8c 100644
--- a/src/variables/time_hour.cc
+++ b/src/variables/time_hour.cc
@@ -33,11 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeHour::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void TimeHour::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -48,9 +45,7 @@ std::list<transaction::Variable *> *
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%H", &timeinfo);
 
-    resl->push_back(new transaction::Variable("TIME_HOUR",  std::string(tstr)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME_HOUR",  std::string(tstr)));
 }
 
 
diff --git a/src/variables/time_hour.h b/src/variables/time_hour.h
index 20178cbd..cfea2c3c 100644
--- a/src/variables/time_hour.h
+++ b/src/variables/time_hour.h
@@ -33,8 +33,8 @@ class TimeHour : public Variable {
     explicit TimeHour(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_min.cc b/src/variables/time_min.cc
index ae2de008..bace4b1b 100644
--- a/src/variables/time_min.cc
+++ b/src/variables/time_min.cc
@@ -33,11 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeMin::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void TimeMin::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -48,9 +45,7 @@ std::list<transaction::Variable *> *
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%M", &timeinfo);
 
-    resl->push_back(new transaction::Variable("TIME_MIN",  std::string(tstr)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME_MIN",  std::string(tstr)));
 }
 
 
diff --git a/src/variables/time_min.h b/src/variables/time_min.h
index 9b9a007e..5dc28d74 100644
--- a/src/variables/time_min.h
+++ b/src/variables/time_min.h
@@ -33,8 +33,8 @@ class TimeMin : public Variable {
     explicit TimeMin(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_mon.cc b/src/variables/time_mon.cc
index 19fde7af..4e51cf22 100644
--- a/src/variables/time_mon.cc
+++ b/src/variables/time_mon.cc
@@ -33,11 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeMon::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void TimeMon::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -50,9 +47,7 @@ std::list<transaction::Variable *> *
     int a = atoi(tstr);
     a--;
 
-    resl->push_back(new transaction::Variable("TIME_MON",  std::to_string(a)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME_MON",  std::to_string(a)));
 }
 
 
diff --git a/src/variables/time_mon.h b/src/variables/time_mon.h
index 2fe3e726..5981eeac 100644
--- a/src/variables/time_mon.h
+++ b/src/variables/time_mon.h
@@ -33,8 +33,8 @@ class TimeMon : public Variable {
     explicit TimeMon(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_sec.cc b/src/variables/time_sec.cc
index 391ab91e..08caf139 100644
--- a/src/variables/time_sec.cc
+++ b/src/variables/time_sec.cc
@@ -33,11 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeSec::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void TimeSec::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -48,9 +45,7 @@ std::list<transaction::Variable *> *
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%S", &timeinfo);
 
-    resl->push_back(new transaction::Variable("TIME_SEC",  std::string(tstr)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME_SEC",  std::string(tstr)));
 }
 
 
diff --git a/src/variables/time_sec.h b/src/variables/time_sec.h
index cd3fc3bc..082a11eb 100644
--- a/src/variables/time_sec.h
+++ b/src/variables/time_sec.h
@@ -33,8 +33,8 @@ class TimeSec : public Variable {
     explicit TimeSec(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_wday.cc b/src/variables/time_wday.cc
index 8b1c4721..1ff798e7 100644
--- a/src/variables/time_wday.cc
+++ b/src/variables/time_wday.cc
@@ -33,11 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeWDay::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void TimeWDay::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -50,9 +47,7 @@ std::list<transaction::Variable *> *
     int a = atoi(tstr);
     a--;
 
-    resl->push_back(new transaction::Variable("TIME_WDAY",  std::to_string(a)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME_WDAY",  std::to_string(a)));
 }
 
 
diff --git a/src/variables/time_wday.h b/src/variables/time_wday.h
index 8054d97c..bab36e0d 100644
--- a/src/variables/time_wday.h
+++ b/src/variables/time_wday.h
@@ -33,8 +33,8 @@ class TimeWDay : public Variable {
     explicit TimeWDay(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/time_year.cc b/src/variables/time_year.cc
index a29a039c..0ad3424b 100644
--- a/src/variables/time_year.cc
+++ b/src/variables/time_year.cc
@@ -33,11 +33,8 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    TimeYear::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
-
+void TimeYear::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -48,9 +45,7 @@ std::list<transaction::Variable *> *
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%Y", &timeinfo);
 
-    resl->push_back(new transaction::Variable("TIME_YEAR",  std::string(tstr)));
-
-    return resl;
+    l->push_back(new transaction::Variable("TIME_YEAR",  std::string(tstr)));
 }
 
 
diff --git a/src/variables/time_year.h b/src/variables/time_year.h
index f9339135..715bdf58 100644
--- a/src/variables/time_year.h
+++ b/src/variables/time_year.h
@@ -33,8 +33,8 @@ class TimeYear : public Variable {
     explicit TimeYear(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/tx.cc b/src/variables/tx.cc
index fb62ff36..bc23ad29 100644
--- a/src/variables/tx.cc
+++ b/src/variables/tx.cc
@@ -33,20 +33,16 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<transaction::Variable *> *
-    Tx::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *resl =
-        new std::list<transaction::Variable *>();
 
+void Tx::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
     if (m_type == SingleMatch) {
-        assay->m_collections.resolveSingleMatch(m_name, "TX", resl);
+        assay->m_collections.resolveSingleMatch(m_name, "TX", l);
     } else if (m_type == MultipleMatches) {
-        assay->m_collections.resolveMultiMatches(m_name, "TX", resl);
+        assay->m_collections.resolveMultiMatches(m_name, "TX", l);
     } else if (m_type == RegularExpression) {
-        assay->m_collections.resolveRegularExpression(m_name, "TX", resl);
+        assay->m_collections.resolveRegularExpression(m_name, "TX", l);
     }
-
-    return resl;
 }
 
 
diff --git a/src/variables/tx.h b/src/variables/tx.h
index b0f7e380..5802524d 100644
--- a/src/variables/tx.h
+++ b/src/variables/tx.h
@@ -34,8 +34,8 @@ class Tx : public Variable {
     explicit Tx(std::string _name)
         : Variable(_name) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 };
 
 }  // namespace Variables
diff --git a/src/variables/variable.cc b/src/variables/variable.cc
index a9ab0ec0..bac67d6e 100644
--- a/src/variables/variable.cc
+++ b/src/variables/variable.cc
@@ -73,11 +73,15 @@ Variable::Variable(std::string name, VariableKind kind)
 }
 
 
-std::list<transaction::Variable *> *
+std::vector<const transaction::Variable *> *
     Variable::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *l =
-        new std::list<transaction::Variable *>();
+    std::vector<const transaction::Variable *> *l = new std::vector<const transaction::Variable *>();
+    evaluate(assay, l);
 
+    return l;
+}
+
+void Variable::evaluateInternal(Assay *assay, std::vector<const transaction::Variable *> *l) {
     if (m_collectionName.empty() == false) {
         if (m_kind == CollectionVarible && m_type == MultipleMatches) {
             assay->m_collections.resolveMultiMatches(m_name, m_collectionName, l);
@@ -95,8 +99,11 @@ std::list<transaction::Variable *> *
             assay->m_collections.resolveSingleMatch(m_name, l);
         }
     }
+}
 
-    return l;
+
+void Variable::evaluate(Assay *assay, std::vector<const transaction::Variable *> *l) {
+    evaluateInternal(assay, l);
 }
 
 
diff --git a/src/variables/variable.h b/src/variables/variable.h
index 8e999fec..50dd597e 100644
--- a/src/variables/variable.h
+++ b/src/variables/variable.h
@@ -66,8 +66,10 @@ class Variable {
 
     static std::string to_s(std::vector<Variable *> *variables);
 
-    virtual std::list<transaction::Variable *> *evaluate(Assay *assay);
-    //virtual std::list<transaction::Variable *> *eval_int(Assay *assay);
+    virtual std::vector<const transaction::Variable *> *evaluate(Assay *assay);
+    virtual void evaluate(Assay *assay, std::vector<const transaction::Variable *> *l);
+    virtual void evaluateInternal(Assay *assay, std::vector<const transaction::Variable *> *l);
+
 
     std::string m_name;
     std::string m_collectionName;
diff --git a/src/variables/variations/count.cc b/src/variables/variations/count.cc
index 927337d5..247c335a 100644
--- a/src/variables/variations/count.cc
+++ b/src/variables/variations/count.cc
@@ -28,11 +28,9 @@ namespace ModSecurity {
 namespace Variables {
 namespace Variations {
 
-std::list<transaction::Variable *> *
-    Count::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *reslIn;
-    std::list<transaction::Variable *> *reslOut =
-        new std::list<transaction::Variable *>();
+void Count::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
+    std::vector<const transaction::Variable *> *reslIn;
     int count = 0;
 
     reslIn = var->evaluate(assay);
@@ -42,17 +40,15 @@ std::list<transaction::Variable *> *
     }
 
     while (reslIn->empty() == false) {
-        delete reslIn->front();
-        reslIn->pop_front();
+        delete reslIn->back();
+        reslIn->pop_back();
     }
     delete reslIn;
 
     std::string res = std::to_string(count);
 
-    reslOut->push_back(new transaction::Variable(std::string(var->m_name),
+    l->push_back(new transaction::Variable(std::string(var->m_name),
         std::string(res)));
-
-    return reslOut;
 }
 
 
diff --git a/src/variables/variations/count.h b/src/variables/variations/count.h
index da085ac8..aa92a5cc 100644
--- a/src/variables/variations/count.h
+++ b/src/variables/variations/count.h
@@ -35,8 +35,8 @@ class Count : public Variable {
         : Variable("count(" + v->m_name + ")"),
         var(v) { }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 
     Variable *var;
 };
diff --git a/src/variables/variations/exclusion.cc b/src/variables/variations/exclusion.cc
index e196aa67..bae82a8f 100644
--- a/src/variables/variations/exclusion.cc
+++ b/src/variables/variations/exclusion.cc
@@ -29,12 +29,9 @@ namespace Variables {
 namespace Variations {
 
 
-std::list<transaction::Variable *> *
-    Exclusion::evaluate(Assay *assay) {
-    std::list<transaction::Variable *> *l =
-        new std::list<transaction::Variable *>();
-    assay->m_collections.resolve(this->m_name, l);
-    return l;
+void Exclusion::evaluateInternal(Assay *assay,
+    std::vector<const transaction::Variable *> *l) {
+    assay->m_collections.resolveMultiMatches(m_name, l);
 }
 
 
diff --git a/src/variables/variations/exclusion.h b/src/variables/variations/exclusion.h
index f50c7807..9b93abf6 100644
--- a/src/variables/variations/exclusion.h
+++ b/src/variables/variations/exclusion.h
@@ -37,8 +37,8 @@ class Exclusion : public Variable {
         var(v)
         { m_isExclusion = true; }
 
-    std::list<transaction::Variable *> *
-        evaluate(Assay *assay) override;
+    void evaluateInternal(Assay *assay,
+        std::vector<const transaction::Variable *> *l) override;
 
     Variable *var;
 };