From 6f93563fc288739abf65c6db743f71deb11e6c25 Mon Sep 17 00:00:00 2001 From: Felipe Zimmerle Date: Mon, 4 Apr 2016 15:23:30 -0300 Subject: [PATCH] Fix in parser: now understanding the removeCommentsChar transformation SpiderLabs/ModSecurity#1098 --- src/actions/transformations/transformation.cc | 2 +- src/parser/seclang-scanner.ll | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/actions/transformations/transformation.cc b/src/actions/transformations/transformation.cc index c7449a9c..8f3b5d70 100644 --- a/src/actions/transformations/transformation.cc +++ b/src/actions/transformations/transformation.cc @@ -95,7 +95,7 @@ Transformation* Transformation::instantiate(std::string a) { IF_MATCH(parity_even_7bit) { return new ParityEven7bit(a); } IF_MATCH(parity_odd_7bit) { return new ParityOdd7bit(a); } IF_MATCH(parity_zero_7bit) { return new ParityZero7bit(a); } - IF_MATCH(remove_comments_char) { return new RemoveCommentsChar(a); } + IF_MATCH(removeCommentsChar) { return new RemoveCommentsChar(a); } IF_MATCH(remove_comments) { return new RemoveComments(a); } IF_MATCH(removeNulls) { return new RemoveNulls(a); } IF_MATCH(remove_whitespace) { return new RemoveWhitespace(a); } diff --git a/src/parser/seclang-scanner.ll b/src/parser/seclang-scanner.ll index e60574d1..2e23b63b 100755 --- a/src/parser/seclang-scanner.ll +++ b/src/parser/seclang-scanner.ll @@ -113,7 +113,7 @@ OPERATOR (?i:(?:@inspectFile|@fuzzyHash|@validateByteRange|@validateDTD|@ OPERATORNOARG (?i:@detectSQLi|@detectXSS|@validateUrlEncoding|@validateUtf8Encoding) OPERATOR_GEOIP (?i:@geoLookup) -TRANSFORMATION t:(?i:(cmdLine|sha1|hexEncode|lowercase|urlDecodeUni|urlDecode|none|compressWhitespace|removeWhitespace|replaceNulls|removeNulls|htmlEntityDecode|jsDecode|cssDecode|trim|normalizePathWin|normalisePathWin|normalisePath|length|utf8toUnicode|urldecode|removeComments|replaceComments)) +TRANSFORMATION t:(?i:(cmdLine|sha1|hexEncode|lowercase|urlDecodeUni|urlDecode|none|compressWhitespace|removeWhitespace|replaceNulls|removeNulls|htmlEntityDecode|jsDecode|cssDecode|trim|normalizePathWin|normalisePathWin|normalisePath|length|utf8toUnicode|urldecode|removeCommentsChar|removeComments|replaceComments)) VARIABLE (?i:(RESOURCE|ARGS_COMBINED_SIZE|ARGS_GET_NAMES|ARGS_POST_NAMES|FILES_COMBINED_SIZE|FULL_REQUEST_LENGTH|REQUEST_BODY_LENGTH|REQUEST_URI_RAW|UNIQUE_ID|SERVER_PORT|SERVER_ADDR|REMOTE_PORT|REMOTE_HOST|MULTIPART_STRICT_ERROR|PATH_INFO|MULTIPART_CRLF_LF_LINES|MATCHED_VAR_NAME|MATCHED_VAR|INBOUND_DATA_ERROR|OUTBOUND_DATA_ERROR|FULL_REQUEST|AUTH_TYPE|ARGS_NAMES|REMOTE_ADDR|REQUEST_BASENAME|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS_NAMES|REQUEST_METHOD|REQUEST_PROTOCOL|REQUEST_URI|RESPONSE_BODY|RESPONSE_CONTENT_LENGTH|RESPONSE_CONTENT_TYPE|RESPONSE_HEADERS_NAMES|RESPONSE_PROTOCOL|RESPONSE_STATUS|REQBODY_PROCESSOR))