github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-13 13:26:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Creates RuleUnconditional

Browse Source 
Makes RuleScript child of RuleWithActions instead of Operator
This commit is contained in:
Felipe Zimmerle 2019-02-19 21:31:35 -03:00
parent f63bd1a45d
commit 7a48245aed
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
94 changed files with 1315 additions and 1167 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
headers/modsecurity/rule.h
View File

@ -73,6 +73,8 @@ class Rule {
m_phase(modsecurity::Phases::RequestHeadersPhase) {
}
virtual bool evaluate(Transaction *transaction) = 0;
virtual bool evaluate(Transaction *transaction,
std::shared_ptr<RuleMessage> rm) = 0;

3
headers/modsecurity/rule_marker.h
View File

@ -47,7 +47,10 @@ class RuleMarker : public Rule {
virtual bool evaluate(Transaction *transaction,
std::shared_ptr<RuleMessage> rm) override {
return evaluate(transaction);
}
virtual bool evaluate(Transaction *transaction) override {
if (transaction->isInsideAMarker()) {
if (*transaction->getCurrentMarker() == *m_name) {
transaction->removeMarker();

42
headers/modsecurity/rule_message.h
View File

@ -42,7 +42,13 @@ class RuleMessage {
ClientLogMessageInfo = 4
};
explicit RuleMessage(RuleWithOperator *rule, Transaction *trans) :
/**
*
* FIXME: RuleMessage is currently too big, doing a lot of
* unnecessary data duplication. Needs to be shrink down.
*
*/
RuleMessage(RuleWithActions *rule, Transaction *trans) :
m_accuracy(rule->m_accuracy),
m_clientIpAddress(trans->m_clientIpAddress),
m_data(""),
@ -66,6 +72,38 @@ class RuleMessage {
m_ver(rule->m_ver)
{ }
explicit RuleMessage(RuleMessage *rule) :
m_accuracy(rule->m_accuracy),
m_clientIpAddress(rule->m_clientIpAddress),
m_data(rule->m_data),
m_id(rule->m_id),
m_isDisruptive(rule->m_isDisruptive),
m_match(rule->m_match),
m_maturity(rule->m_maturity),
m_message(rule->m_message),
m_noAuditLog(rule->m_noAuditLog),
m_phase(rule->m_phase),
m_reference(rule->m_reference),
m_rev(rule->m_rev),
m_rule(rule->m_rule),
m_ruleFile(rule->m_ruleFile),
m_ruleId(rule->m_ruleId),
m_ruleLine(rule->m_ruleLine),
m_saveMessage(rule->m_saveMessage),
m_serverIpAddress(rule->m_serverIpAddress),
m_severity(rule->m_severity),
m_uriNoQueryStringDecoded(rule->m_uriNoQueryStringDecoded),
m_ver(rule->m_ver)
{ }
void clean() {
m_data = "";
m_match = "";
m_isDisruptive = false;
m_reference = "";
m_severity = 0;
m_ver = "";
}
std::string log() {
return log(this, 0);
@ -104,7 +142,7 @@ class RuleMessage {
int m_phase;
std::string m_reference;
std::string m_rev;
RuleWithOperator *m_rule;
RuleWithActions *m_rule;
std::shared_ptr<std::string> m_ruleFile;
int m_ruleId;
int m_ruleLine;

59
headers/modsecurity/rule_unconditional.h Normal file
View File

@ -0,0 +1,59 @@
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#ifdef __cplusplus
#include <stack>
#include <vector>
#include <string>
#include <list>
#include <memory>
#include <utility>
#endif
#ifndef HEADERS_MODSECURITY_RULE_UNCONDITIONAL_H_
#define HEADERS_MODSECURITY_RULE_UNCONDITIONAL_H_
#include "modsecurity/modsecurity.h"
#include "modsecurity/variable_value.h"
#include "modsecurity/rule.h"
#include "modsecurity/rules_set.h"
#include "modsecurity/rule_with_actions.h"
#include "modsecurity/actions/action.h"
#ifdef __cplusplus
namespace modsecurity {
class RuleUnconditional : public RuleWithActions {
public:
RuleUnconditional(
std::vector<actions::Action *> *actions,
Transformations *transformations,
std::unique_ptr<std::string> fileName,
int lineNumber)
: RuleWithActions(actions, transformations, std::move(fileName), lineNumber) { }
virtual bool evaluate(Transaction *transaction, std::shared_ptr<RuleMessage> ruleMessage) override;
private:
};
} // namespace modsecurity
#endif
#endif // HEADERS_MODSECURITY_RULE_UNCONDITIONAL_H_

24
headers/modsecurity/rule_with_actions.h
View File

@ -45,6 +45,21 @@ class RuleWithActions : public Rule {
~RuleWithActions();
virtual bool evaluate(Transaction *transaction, std::shared_ptr<RuleMessage> ruleMessage) override;
virtual bool evaluate(Transaction *transaction) override;
void executeActionsIndependentOfChainedRuleResult(
Transaction *trasn,
bool *containsDisruptive,
std::shared_ptr<RuleMessage> ruleMessage);
void executeActionsAfterFullMatch(
Transaction *trasn,
bool containsDisruptive,
std::shared_ptr<RuleMessage> ruleMessage);
void executeAction(Transaction *trans,
bool containsBlock,
std::shared_ptr<RuleMessage> ruleMessage,
@ -63,10 +78,6 @@ class RuleWithActions : public Rule {
std::string *path,
int *nth) const;
void executeActionsIndependentOfChainedRuleResult(Transaction *trasn,
bool *b, std::shared_ptr<RuleMessage> ruleMessage);
void executeActionsAfterFullMatch(Transaction *trasn,
bool containsDisruptive, std::shared_ptr<RuleMessage> ruleMessage);
std::vector<actions::Action *> getActionsByName(const std::string& name,
Transaction *t);
@ -95,6 +106,9 @@ class RuleWithActions : public Rule {
int64_t m_ruleId;
std::unique_ptr<RuleWithActions> m_chainedRuleChild;
RuleWithActions *m_chainedRuleParent;
private:
/* actions */
actions::Action *m_disruptiveAction;
@ -118,4 +132,4 @@ class RuleWithActions : public Rule {
#endif
#endif // HEADERS_MODSECURITY_RULE_WITH_ACTIONS_H_
#endif // HEADERS_MODSECURITY_RULE_WITH_ACTIONS_H_

7
headers/modsecurity/rule_with_operator.h
View File

@ -62,7 +62,6 @@ class RuleWithOperator : public RuleWithActions {
const std::string &value);
static void cleanMatchedVars(Transaction *trasn);
inline bool isUnconditional() const { return m_operator == NULL; }
std::string getOperatorName() const;
@ -70,15 +69,9 @@ class RuleWithOperator : public RuleWithActions {
return std::to_string(m_ruleId);
}
std::unique_ptr<RuleWithOperator> m_chainedRuleChild;
RuleWithOperator *m_chainedRuleParent;
private:
modsecurity::variables::Variables *m_variables;
operators::Operator *m_operator;
bool m_unconditional:1;
};

2
src/Makefile.am
View File

@ -43,6 +43,7 @@ pkginclude_HEADERS = \
../headers/modsecurity/modsecurity.h \
../headers/modsecurity/rule.h \
../headers/modsecurity/rule_marker.h \
../headers/modsecurity/rule_unconditional.h \
../headers/modsecurity/rule_with_actions.h \
../headers/modsecurity/rule_with_operator.h \
../headers/modsecurity/rules.h \
@ -285,6 +286,7 @@ libmodsecurity_la_SOURCES = \
debug_log/debug_log_writer.cc \
run_time_string.cc \
rule.cc \
rule_unconditional.cc \
rule_with_actions.cc \
rule_with_operator.cc \
rule_message.cc \

2
src/operators/begins_with.cc
View File

@ -24,7 +24,7 @@ namespace modsecurity {
namespace operators {
bool BeginsWith::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool BeginsWith::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
std::string p(m_string->evaluate(transaction));

2
src/operators/begins_with.h
View File

@ -32,7 +32,7 @@ class BeginsWith : public Operator {
explicit BeginsWith(std::unique_ptr<RunTimeString> param)
: Operator("BeginsWith", std::move(param)) { }
bool evaluate(Transaction *transaction, RuleWithOperator *rule, const std::string &str,
bool evaluate(Transaction *transaction, RuleWithActions *rule, const std::string &str,
std::shared_ptr<RuleMessage> ruleMessage) override;
};

2
src/operators/contains.cc
View File

@ -21,7 +21,7 @@
namespace modsecurity {
namespace operators {
bool Contains::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool Contains::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &input, std::shared_ptr<RuleMessage> ruleMessage) {
std::string p(m_string->evaluate(transaction));
size_t offset = input.find(p);

2
src/operators/contains.h
View File

@ -34,7 +34,7 @@ class Contains : public Operator {
/** @ingroup ModSecurity_Operator */
explicit Contains(std::unique_ptr<RunTimeString> param)
: Operator("Contains", std::move(param)) { }
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str,
std::shared_ptr<RuleMessage> ruleMessage) override;
};

2
src/operators/contains_word.cc
View File

@ -36,7 +36,7 @@ bool ContainsWord::acceptableChar(const std::string& a, size_t pos) {
return true;
}
bool ContainsWord::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool ContainsWord::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
std::string paramTarget(m_string->evaluate(transaction));

2
src/operators/contains_word.h
View File

@ -32,7 +32,7 @@ class ContainsWord : public Operator {
explicit ContainsWord(std::unique_ptr<RunTimeString> param)
: Operator("ContainsWord", std::move(param)) { }
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/detect_sqli.cc
View File

@ -25,7 +25,7 @@ namespace modsecurity {
namespace operators {
bool DetectSQLi::evaluate(Transaction *t, RuleWithOperator *rule,
bool DetectSQLi::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
char fingerprint[8];
int issqli;

2
src/operators/detect_sqli.h
View File

@ -32,7 +32,7 @@ class DetectSQLi : public Operator {
m_match_message.assign("detected SQLi using libinjection.");
}
bool evaluate(Transaction *t, RuleWithOperator *rule,
bool evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;
};

2
src/operators/detect_xss.cc
View File

@ -25,7 +25,7 @@ namespace modsecurity {
namespace operators {
bool DetectXSS::evaluate(Transaction *t, RuleWithOperator *rule,
bool DetectXSS::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
int is_xss;

2
src/operators/detect_xss.h
View File

@ -31,7 +31,7 @@ class DetectXSS : public Operator {
m_match_message.assign("detected XSS using libinjection.");
}
bool evaluate(Transaction *t, RuleWithOperator *rule,
bool evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;
};

2
src/operators/ends_with.cc
View File

@ -23,7 +23,7 @@ namespace modsecurity {
namespace operators {
bool EndsWith::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool EndsWith::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
bool ret = false;
std::string p(m_string->evaluate(transaction));

2
src/operators/ends_with.h
View File

@ -33,7 +33,7 @@ class EndsWith : public Operator {
: Operator("EndsWith", std::move(param)) {
m_couldContainsMacro = true;
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str,
std::shared_ptr<RuleMessage> ruleMessage) override;
};

4
src/operators/operator.cc
View File

@ -70,7 +70,7 @@ namespace operators {
bool Operator::evaluateInternal(Transaction *transaction,
RuleWithOperator *rule, const std::string& a, std::shared_ptr<RuleMessage> rm) {
RuleWithActions *rule, const std::string& a, std::shared_ptr<RuleMessage> rm) {
bool res = evaluate(transaction, rule, a, rm);
if (m_negation) {
@ -81,7 +81,7 @@ bool Operator::evaluateInternal(Transaction *transaction,
}
bool Operator::evaluateInternal(Transaction *transaction,
RuleWithOperator *rule, const std::string& a) {
RuleWithActions *rule, const std::string& a) {
bool res = evaluate(transaction, rule, a);
if (m_negation) {

11
src/operators/operator.h
View File

@ -111,24 +111,23 @@ class Operator {
std::string key, std::string value);
bool evaluateInternal(Transaction *t, const std::string& a);
bool evaluateInternal(Transaction *t, RuleWithOperator *rule,
bool evaluateInternal(Transaction *t, RuleWithActions *rule,
const std::string& a);
bool evaluateInternal(Transaction *t, RuleWithOperator *rule,
bool evaluateInternal(Transaction *t, RuleWithActions *rule,
const std::string& a, std::shared_ptr<RuleMessage> ruleMessage);
virtual bool evaluate(Transaction *transaction, const std::string &str);
virtual bool evaluate(Transaction *transaction, RuleWithOperator *rule,
virtual bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str) {
return evaluate(transaction, str);
}
virtual bool evaluate(Transaction *transaction, RuleWithOperator *rule,
virtual bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
return evaluate(transaction, str);
}
static void logOffset(std::shared_ptr<RuleMessage> ruleMessage,
int offset, int len) {
static void logOffset(std::shared_ptr<RuleMessage> ruleMessage, int offset, int len) {
if (ruleMessage) {
ruleMessage->m_reference.append("o"
+ std::to_string(offset) + ","

2
src/operators/pm.cc
View File

@ -81,7 +81,7 @@ void Pm::postOrderTraversal(acmp_btree_node_t *node) {
}
bool Pm::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool Pm::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &input, std::shared_ptr<RuleMessage> ruleMessage) {
int rc;
ACMPT pt;

2
src/operators/pm.h
View File

@ -41,7 +41,7 @@ class Pm : public Operator {
m_p = acmp_create(0);
}
~Pm();
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/rbl.cc
View File

@ -200,7 +200,7 @@ void Rbl::furtherInfo(struct sockaddr_in *sin, const std::string &ipStr,
}
bool Rbl::evaluate(Transaction *t, RuleWithOperator *rule,
bool Rbl::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& ipStr,
std::shared_ptr<RuleMessage> ruleMessage) {
struct addrinfo *info = NULL;

2
src/operators/rbl.h
View File

@ -76,7 +76,7 @@ class Rbl : public Operator {
m_provider = RblProvider::httpbl;
}
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/rx.cc
View File

@ -36,7 +36,7 @@ bool Rx::init(const std::string &arg, std::string *error) {
}
bool Rx::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool Rx::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
std::list<SMatch> matches;
Regex *re;

10
src/operators/rx.h
View File

@ -49,15 +49,7 @@ class Rx : public Operator {
}
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
const std::string &input) override {
return evaluate(transaction, NULL, input, NULL);
}
bool evaluate(Transaction *transaction,
const std::string &input) override {
return evaluate(transaction, NULL, input);
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/validate_byte_range.cc
View File

@ -110,7 +110,7 @@ bool ValidateByteRange::init(const std::string &file,
}
bool ValidateByteRange::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool ValidateByteRange::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &input, std::shared_ptr<RuleMessage> ruleMessage) {
bool ret = true;

2
src/operators/validate_byte_range.h
View File

@ -37,7 +37,7 @@ class ValidateByteRange : public Operator {
}
~ValidateByteRange() override { }
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &input,
std::shared_ptr<RuleMessage> ruleMessage) override;
bool getRange(const std::string &rangeRepresentation, std::string *error);

2
src/operators/validate_url_encoding.cc
View File

@ -68,7 +68,7 @@ int ValidateUrlEncoding::validate_url_encoding(const char *input,
}
bool ValidateUrlEncoding::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool ValidateUrlEncoding::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &input, std::shared_ptr<RuleMessage> ruleMessage) {
size_t offset = 0;
bool res = false;

2
src/operators/validate_url_encoding.h
View File

@ -31,7 +31,7 @@ class ValidateUrlEncoding : public Operator {
ValidateUrlEncoding()
: Operator("ValidateUrlEncoding") { }
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &input,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/validate_utf8_encoding.cc
View File

@ -113,7 +113,7 @@ int ValidateUtf8Encoding::detect_utf8_character(
return unicode_len;
}
bool ValidateUtf8Encoding::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool ValidateUtf8Encoding::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
unsigned int i, bytes_left;

2
src/operators/validate_utf8_encoding.h
View File

@ -38,7 +38,7 @@ class ValidateUtf8Encoding : public Operator {
ValidateUtf8Encoding()
: Operator("ValidateUtf8Encoding") { }
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/verify_cc.cc
View File

@ -117,7 +117,7 @@ bool VerifyCC::init(const std::string &param2, std::string *error) {
}
bool VerifyCC::evaluate(Transaction *t, RuleWithOperator *rule,
bool VerifyCC::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& i, std::shared_ptr<RuleMessage> ruleMessage) {
int offset = 0;
int target_length = i.length();

2
src/operators/verify_cc.h
View File

@ -35,7 +35,7 @@ class VerifyCC : public Operator {
m_pce(NULL) { }
~VerifyCC();
bool evaluate(Transaction *t, RuleWithOperator *rule,
bool evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;
bool init(const std::string &param, std::string *error) override;

2
src/operators/verify_cpf.cc
View File

@ -108,7 +108,7 @@ bool VerifyCPF::verify(const char *cpfnumber, int len) {
}
bool VerifyCPF::evaluate(Transaction *t, RuleWithOperator *rule,
bool VerifyCPF::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
std::list<SMatch> matches;
bool is_cpf = false;

10
src/operators/verify_cpf.h
View File

@ -46,15 +46,7 @@ class VerifyCPF : public Operator {
bool operator=(const VerifyCPF &a) = delete;
VerifyCPF(const VerifyCPF &a) = delete;
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
const std::string &input) override {
return evaluate(transaction, NULL, input, NULL);
}
bool evaluate(Transaction *transaction,
const std::string &input) override {
return evaluate(transaction, NULL, input);
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/verify_ssn.cc
View File

@ -110,7 +110,7 @@ invalid:
}
bool VerifySSN::evaluate(Transaction *t, RuleWithOperator *rule,
bool VerifySSN::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
std::list<SMatch> matches;
bool is_ssn = false;

10
src/operators/verify_ssn.h
View File

@ -46,15 +46,7 @@ class VerifySSN : public Operator {
bool operator=(const VerifySSN &a) = delete;
VerifySSN(const VerifySSN &a) = delete;
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
const std::string &input) override {
return evaluate(transaction, NULL, input, NULL);
}
bool evaluate(Transaction *transaction,
const std::string &input) override {
return evaluate(transaction, NULL, input);
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/verify_svnr.cc
View File

@ -77,7 +77,7 @@ bool VerifySVNR::verify(const char *svnrnumber, int len) {
}
bool VerifySVNR::evaluate(Transaction *t, RuleWithOperator *rule,
bool VerifySVNR::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
std::list<SMatch> matches;
bool is_svnr = false;

10
src/operators/verify_svnr.h
View File

@ -32,15 +32,7 @@ class VerifySVNR : public Operator {
bool operator=(const VerifySVNR &a) = delete;
VerifySVNR(const VerifySVNR &a) = delete;
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
const std::string &input) override {
return evaluate(transaction, NULL, input, NULL);
}
bool evaluate(Transaction *transaction,
const std::string &input) override {
return evaluate(transaction, NULL, input);
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string& input,
std::shared_ptr<RuleMessage> ruleMessage) override;

2
src/operators/within.cc
View File

@ -24,7 +24,7 @@ namespace modsecurity {
namespace operators {
bool Within::evaluate(Transaction *transaction, RuleWithOperator *rule,
bool Within::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
bool res = false;
size_t pos = 0;

2
src/operators/within.h
View File

@ -33,7 +33,7 @@ class Within : public Operator {
: Operator("Within", std::move(param)) {
m_couldContainsMacro = true;
}
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
bool evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) override;
};

6
src/parser/driver.cc
View File

@ -54,7 +54,7 @@ int Driver::addSecMarker(std::string marker, std::unique_ptr<std::string> fileNa
}
int Driver::addSecAction(std::unique_ptr<RuleWithOperator> rule) {
int Driver::addSecAction(std::unique_ptr<RuleWithActions> rule) {
if (rule->getPhase() >= modsecurity::Phases::NUMBER_OF_PHASES) {
m_parserError << "Unknown phase: " << std::to_string(rule->getPhase());
m_parserError << std::endl;
@ -73,7 +73,7 @@ int Driver::addSecRuleScript(std::unique_ptr<RuleScript> rule) {
}
int Driver::addSecRule(std::unique_ptr<RuleWithOperator> r) {
int Driver::addSecRule(std::unique_ptr<RuleWithActions> r) {
if (r->getPhase() >= modsecurity::Phases::NUMBER_OF_PHASES) {
m_parserError << "Unknown phase: " << std::to_string(r->getPhase());
m_parserError << std::endl;
@ -94,7 +94,7 @@ int Driver::addSecRule(std::unique_ptr<RuleWithOperator> r) {
return true;
}
std::shared_ptr<RuleWithOperator> rule(std::move(r));
std::shared_ptr<RuleWithActions> rule(std::move(r));
/*
* Checking if the rule has an ID and also checking if this ID is not used
* by other rule

6
src/parser/driver.h
View File

@ -66,8 +66,8 @@ class Driver : public RulesSetProperties {
Driver();
virtual ~Driver();
int addSecRule(std::unique_ptr<RuleWithOperator> rule);
int addSecAction(std::unique_ptr<RuleWithOperator> rule);
int addSecRule(std::unique_ptr<RuleWithActions> rule);
int addSecAction(std::unique_ptr<RuleWithActions> rule);
int addSecMarker(std::string marker, std::unique_ptr<std::string> fileName, int lineNumber);
int addSecRuleScript(std::unique_ptr<RuleScript> rule);
@ -89,7 +89,7 @@ class Driver : public RulesSetProperties {
std::list<yy::location *> loc;
std::string buffer;
RuleWithOperator *m_lastRule;
RuleWithActions *m_lastRule;
RulesSetPhases m_rulesSetPhases;
};

1678
src/parser/seclang-parser.cc
View File

File diff suppressed because it is too large Load Diff

7
src/parser/seclang-parser.hh
View File

@ -55,6 +55,7 @@ class Driver;
}
}
#include "modsecurity/rule_unconditional.h"
#include "src/rule_script.h"
#include "src/actions/accuracy.h"
@ -347,7 +348,7 @@ using namespace modsecurity::operators;
a = std::move(c);
#line 351 "seclang-parser.hh"
#line 352 "seclang-parser.hh"
# include <cassert>
# include <cstdlib> // std::abort
@ -481,7 +482,7 @@ using namespace modsecurity::operators;
#endif
namespace yy {
#line 485 "seclang-parser.hh"
#line 486 "seclang-parser.hh"
@ -8111,7 +8112,7 @@ switch (yytype)
}
} // yy
#line 8115 "seclang-parser.hh"
#line 8116 "seclang-parser.hh"

5
src/parser/seclang-parser.yy
View File

@ -17,6 +17,7 @@ class Driver;
}
}
#include "modsecurity/rule_unconditional.h"
#include "src/rule_script.h"
#include "src/actions/accuracy.h"
@ -1123,9 +1124,7 @@ expression:
a->push_back(i.release());
}
}
std::unique_ptr<RuleWithOperator> rule(new RuleWithOperator(
/* op */ NULL,
/* variables */ NULL,
std::unique_ptr<RuleUnconditional> rule(new RuleUnconditional(
/* actions */ a,
/* transformations */ t,
/* file name */ std::unique_ptr<std::string>(new std::string(*@1.end.filename)),

7
src/rule_script.cc
View File

@ -24,19 +24,16 @@ bool RuleScript::init(std::string *err) {
bool RuleScript::evaluate(Transaction *trans,
std::shared_ptr<RuleMessage> ruleMessage) {
ms_dbg_a(trans, 4, " Executing script: " + m_name + ".");
bool containsDisruptive = false;
if (ruleMessage == NULL) {
ruleMessage = std::shared_ptr<RuleMessage>(
new RuleMessage(this, trans));
}
executeActionsIndependentOfChainedRuleResult(trans,
&containsDisruptive, ruleMessage);
bool ret = m_lua.run(trans);
if (ret) {
executeActionsAfterFullMatch(trans, containsDisruptive, ruleMessage);
}

4
src/rule_script.h
View File

@ -42,14 +42,14 @@ namespace modsecurity {
using actions::Action;
/** @ingroup ModSecurity_CPP_API */
class RuleScript : public RuleWithOperator {
class RuleScript : public RuleWithActions {
public:
RuleScript(const std::string &name,
std::vector<Action *> *actions,
Transformations *t,
std::unique_ptr<std::string> fileName,
int lineNumber)
: RuleWithOperator(NULL, NULL, actions, t, std::move(fileName), lineNumber),
: RuleWithActions(actions, t, std::move(fileName), lineNumber),
m_name(name) { }
bool init(std::string *err);

61
src/rule_unconditional.cc Normal file
View File

@ -0,0 +1,61 @@
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include "modsecurity/rule_unconditional.h"
#include "modsecurity/rule_message.h"
namespace modsecurity {
bool RuleUnconditional::evaluate(Transaction *trans,
std::shared_ptr<RuleMessage> ruleMessage) {
RuleWithActions::evaluate(trans, ruleMessage);
// FIXME: This needs to be romeved on the runtime exeption review.
bool containsBlock = false;
ms_dbg_a(trans, 4, "(Rule: " + std::to_string(m_ruleId) \
+ ") Executing unconditional rule...");
executeActionsIndependentOfChainedRuleResult(trans,
&containsBlock, ruleMessage);
executeActionsAfterFullMatch(trans, containsBlock, ruleMessage);
/* last rule in the chain. */
bool isItToBeLogged = ruleMessage->m_saveMessage;
if (isItToBeLogged && !hasMultimatch()
&& !ruleMessage->m_message.empty()) {
/* warn */
trans->m_rulesMessages.push_back(*ruleMessage);
/* error */
if (!ruleMessage->m_isDisruptive) {
trans->serverLog(ruleMessage);
}
}
else if (hasBlockAction() && !hasMultimatch()) {
/* warn */
trans->m_rulesMessages.push_back(*ruleMessage);
/* error */
if (!ruleMessage->m_isDisruptive) {
trans->serverLog(ruleMessage);
}
}
return true;
}
} // namespace modsecurity

174
src/rule_with_actions.cc
View File

@ -65,6 +65,8 @@ RuleWithActions::RuleWithActions(
m_accuracy(0),
m_maturity(0),
m_ruleId(0),
m_chainedRuleChild(nullptr),
m_chainedRuleParent(nullptr),
m_disruptiveAction(nullptr),
m_logData(nullptr),
m_msg(nullptr),
@ -77,6 +79,7 @@ RuleWithActions::RuleWithActions(
m_containsMultiMatchAction(false),
m_containsStaticBlockAction(false),
m_isChained(false) {
if (actions) {
for (Action *a : *actions) {
if (a->action_kind == Action::ConfigurationKind) {
@ -163,6 +166,29 @@ RuleWithActions::~RuleWithActions() {
}
}
bool RuleWithActions::evaluate(Transaction *transaction) {
RuleMessage rm(this, transaction);
std::shared_ptr<RuleMessage> rm2 = std::make_shared<RuleMessage>(&rm);
return evaluate(transaction, rm2);
}
bool RuleWithActions::evaluate(Transaction *transaction,
std::shared_ptr<RuleMessage> ruleMessage) {
/* Rule evaluate is pure virtual.
*
* Rule::evaluate(transaction, ruleMessage);
*/
/* Matched vars needs to be clear at every new rule execution */
transaction->m_matched.clear();
return true;
}
void RuleWithActions::executeActionsIndependentOfChainedRuleResult(Transaction *trans,
bool *containsBlock, std::shared_ptr<RuleMessage> ruleMessage) {
@ -203,6 +229,76 @@ void RuleWithActions::executeActionsIndependentOfChainedRuleResult(Transaction *
}
void RuleWithActions::executeActionsAfterFullMatch(Transaction *trans,
bool containsBlock, std::shared_ptr<RuleMessage> ruleMessage) {
bool disruptiveAlreadyExecuted = false;
for (auto &a : trans->m_rules->m_defaultActions[getPhase()]) {
if (a.get()->action_kind != actions::Action::RunTimeOnlyIfMatchKind) {
continue;
}
if (!a.get()->isDisruptive()) {
executeAction(trans, containsBlock, ruleMessage, a.get(), true);
}
}
for (actions::Tag *a : this->m_actionsTag) {
ms_dbg_a(trans, 4, "Running (non-disruptive) action: " \
+ *a->m_name.get());
a->evaluate(this, trans, ruleMessage);
}
for (auto &b :
trans->m_rules->m_exceptions.m_action_pos_update_target_by_id) {
if (m_ruleId != b.first) {
continue;
}
actions::Action *a = dynamic_cast<actions::Action*>(b.second.get());
executeAction(trans, containsBlock, ruleMessage, a, false);
disruptiveAlreadyExecuted = true;
}
for (Action *a : this->m_actionsRuntimePos) {
if (!a->isDisruptive()
&& !(disruptiveAlreadyExecuted
&& dynamic_cast<actions::Block *>(a))) {
executeAction(trans, containsBlock, ruleMessage, a, false);
}
}
if (!disruptiveAlreadyExecuted && m_disruptiveAction != nullptr) {
executeAction(trans, containsBlock, ruleMessage,
m_disruptiveAction, false);
}
}
void RuleWithActions::executeAction(Transaction *trans,
bool containsBlock, std::shared_ptr<RuleMessage> ruleMessage,
Action *a, bool defaultContext) {
if (a->isDisruptive() == false && *a->m_name.get() != "block") {
ms_dbg_a(trans, 9, "Running " \
"action: " + *a->m_name.get());
a->evaluate(this, trans, ruleMessage);
return;
}
if (defaultContext && !containsBlock) {
ms_dbg_a(trans, 4, "Ignoring action: " + *a->m_name.get() + \
" (rule does not cotains block)");
return;
}
if (trans->getRuleEngineState() == RulesSet::EnabledRuleEngine) {
ms_dbg_a(trans, 4, "Running (disruptive) action: " + *a->m_name.get() + \
".");
a->evaluate(this, trans, ruleMessage);
return;
}
ms_dbg_a(trans, 4, "Not running any disruptive action (or block): " \
+ *a->m_name.get() + ". SecRuleEngine is not On.");
}
inline void RuleWithActions::executeTransformation(
actions::transformations::Transformation *a,
std::shared_ptr<std::string> *value,
@ -326,46 +422,6 @@ void RuleWithActions::executeTransformations(
}
}
void RuleWithActions::executeActionsAfterFullMatch(Transaction *trans,
bool containsBlock, std::shared_ptr<RuleMessage> ruleMessage) {
bool disruptiveAlreadyExecuted = false;
for (auto &a : trans->m_rules->m_defaultActions[getPhase()]) {
if (a.get()->action_kind != actions::Action::RunTimeOnlyIfMatchKind) {
continue;
}
if (!a.get()->isDisruptive()) {
executeAction(trans, containsBlock, ruleMessage, a.get(), true);
}
}
for (actions::Tag *a : this->m_actionsTag) {
ms_dbg_a(trans, 4, "Running (non-disruptive) action: " \
+ *a->m_name.get());
a->evaluate(this, trans, ruleMessage);
}
for (auto &b :
trans->m_rules->m_exceptions.m_action_pos_update_target_by_id) {
if (m_ruleId != b.first) {
continue;
}
actions::Action *a = dynamic_cast<actions::Action*>(b.second.get());
executeAction(trans, containsBlock, ruleMessage, a, false);
disruptiveAlreadyExecuted = true;
}
for (Action *a : this->m_actionsRuntimePos) {
if (!a->isDisruptive()
&& !(disruptiveAlreadyExecuted
&& dynamic_cast<actions::Block *>(a))) {
executeAction(trans, containsBlock, ruleMessage, a, false);
}
}
if (!disruptiveAlreadyExecuted && m_disruptiveAction != nullptr) {
executeAction(trans, containsBlock, ruleMessage,
m_disruptiveAction, false);
}
}
bool RuleWithActions::containsTag(const std::string& name, Transaction *t) {
for (auto &tag : m_actionsTag) {
@ -381,6 +437,44 @@ bool RuleWithActions::containsMsg(const std::string& name, Transaction *t) {
return m_msg && m_msg->data(t) == name;
}
std::vector<actions::Action *> RuleWithActions::getActionsByName(const std::string& name,
Transaction *trans) {
std::vector<actions::Action *> ret;
for (auto &z : m_actionsRuntimePos) {
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
for (auto &z : m_transformations) {
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
for (auto &b :
trans->m_rules->m_exceptions.m_action_pre_update_target_by_id) {
if (m_ruleId != b.first) {
continue;
}
actions::Action *z = dynamic_cast<actions::Action*>(b.second.get());
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
for (auto &b :
trans->m_rules->m_exceptions.m_action_pos_update_target_by_id) {
if (m_ruleId != b.first) {
continue;
}
actions::Action *z = dynamic_cast<actions::Action*>(b.second.get());
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
return ret;
}
std::string RuleWithActions::logData(Transaction *t) { return m_logData->data(t); }
std::string RuleWithActions::msg(Transaction *t) { return m_msg->data(t); }
int RuleWithActions::severity() const { return m_severity->m_severity; }

93
src/rule_with_operator.cc
View File

@ -58,12 +58,8 @@ RuleWithOperator::RuleWithOperator(Operator *op,
std::unique_ptr<std::string> fileName,
int lineNumber)
: RuleWithActions(actions, transformations, std::move(fileName), lineNumber),
m_chainedRuleChild(nullptr),
m_chainedRuleParent(NULL),
m_operator(op),
m_variables(_variables),
m_unconditional(false) { /* */ }
m_variables(_variables) { /* */ }
RuleWithOperator::~RuleWithOperator() {
@ -118,6 +114,7 @@ bool RuleWithOperator::executeOperatorAt(Transaction *trans, const std::string &
+ "\" (Variable: " + key + ")");
ret = this->m_operator->evaluateInternal(trans, this, value, ruleMessage);
if (ret == false) {
return false;
}
@ -216,35 +213,6 @@ inline void RuleWithOperator::getFinalVars(variables::Variables *vars,
}
void RuleWithActions::executeAction(Transaction *trans,
bool containsBlock, std::shared_ptr<RuleMessage> ruleMessage,
Action *a, bool defaultContext) {
if (a->isDisruptive() == false && *a->m_name.get() != "block") {
ms_dbg_a(trans, 9, "Running " \
"action: " + *a->m_name.get());
a->evaluate(this, trans, ruleMessage);
return;
}
if (defaultContext && !containsBlock) {
ms_dbg_a(trans, 4, "Ignoring action: " + *a->m_name.get() + \
" (rule does not cotains block)");
return;
}
if (trans->getRuleEngineState() == RulesSet::EnabledRuleEngine) {
ms_dbg_a(trans, 4, "Running (disruptive) action: " + *a->m_name.get() + \
".");
a->evaluate(this, trans, ruleMessage);
return;
}
ms_dbg_a(trans, 4, "Not running any disruptive action (or block): " \
+ *a->m_name.get() + ". SecRuleEngine is not On.");
}
bool RuleWithOperator::evaluate(Transaction *trans,
std::shared_ptr<RuleMessage> ruleMessage) {
bool globalRet = false;
@ -256,25 +224,10 @@ bool RuleWithOperator::evaluate(Transaction *trans,
vars.reserve(4);
variables::Variables exclusion;
if (ruleMessage == NULL) {
ruleMessage = std::shared_ptr<RuleMessage>(
new RuleMessage(this, trans));
}
RuleWithActions::evaluate(trans, ruleMessage);
trans->m_matched.clear();
if (isMarker() == true) {
return true;
}
if (isUnconditional() == true) {
ms_dbg_a(trans, 4, "(Rule: " + std::to_string(m_ruleId) \
+ ") Executing unconditional rule...");
executeActionsIndependentOfChainedRuleResult(trans,
&containsBlock, ruleMessage);
goto end_exec;
}
// FIXME: Make a class runTimeException to handle this cases.
for (auto &i : trans->m_ruleRemoveById) {
if (m_ruleId != i) {
continue;
@ -314,6 +267,7 @@ bool RuleWithOperator::evaluate(Transaction *trans,
+ variables + ".");
}
getFinalVars(&vars, &exclusion, trans);
for (auto &var : vars) {
@ -442,43 +396,6 @@ end_exec:
}
std::vector<actions::Action *> RuleWithActions::getActionsByName(const std::string& name,
Transaction *trans) {
std::vector<actions::Action *> ret;
for (auto &z : m_actionsRuntimePos) {
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
for (auto &z : m_transformations) {
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
for (auto &b :
trans->m_rules->m_exceptions.m_action_pre_update_target_by_id) {
if (m_ruleId != b.first) {
continue;
}
actions::Action *z = dynamic_cast<actions::Action*>(b.second.get());
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
for (auto &b :
trans->m_rules->m_exceptions.m_action_pos_update_target_by_id) {
if (m_ruleId != b.first) {
continue;
}
actions::Action *z = dynamic_cast<actions::Action*>(b.second.get());
if (*z->m_name.get() == name) {
ret.push_back(z);
}
}
return ret;
}
std::string RuleWithOperator::getOperatorName() const { return m_operator->m_op; }

31
src/rules_set.cc
View File

@ -135,13 +135,13 @@ int RulesSet::evaluate(int phase, Transaction *t) {
for (int i = 0; i < rules->size(); i++) {
// FIXME: This is not meant to be here. At the end of this refactoring,
// the shared pointer won't be used.
std::shared_ptr<Rule> rule = rules->at(i);
auto rule = rules->at(i);
if (t->isInsideAMarker() && !rule->isMarker()) {
ms_dbg_a(t, 9, "Skipped rule id '" + rule->getReference() \
+ "' due to a SecMarker: " + *t->getCurrentMarker());
} else if (rule->isMarker()) {
rule->evaluate(t, NULL);
rule->evaluate(t);
} else if (t->m_skip_next > 0) {
t->m_skip_next--;
ms_dbg_a(t, 9, "Skipped rule id '" + rule->getReference() \
@ -153,18 +153,19 @@ int RulesSet::evaluate(int phase, Transaction *t) {
+ "' as request trough the utilization of an `allow' action.");
} else {
Rule *base = rule.get();
RuleWithOperator *ruleWithOperator = dynamic_cast<RuleWithOperator *>(base);
if (m_exceptions.contains(ruleWithOperator->m_ruleId)) {
RuleWithActions *ruleWithActions = dynamic_cast<RuleWithActions *>(base);
// FIXME: Those should be treated inside the rule itself
if (ruleWithActions && m_exceptions.contains(ruleWithActions->m_ruleId)) {
ms_dbg_a(t, 9, "Skipped rule id '" + rule->getReference() \
+ "'. Removed by an SecRuleRemove directive.");
continue;
}
bool remove_rule = false;
if (m_exceptions.m_remove_rule_by_msg.empty() == false) {
if (ruleWithActions && m_exceptions.m_remove_rule_by_msg.empty() == false) {
for (auto &z : m_exceptions.m_remove_rule_by_msg) {
if (ruleWithOperator->containsMsg(z, t) == true) {
if (ruleWithActions->containsMsg(z, t) == true) {
ms_dbg_a(t, 9, "Skipped rule id '" \
+ ruleWithOperator->getReference() \
+ ruleWithActions->getReference() \
+ "'. Removed by a SecRuleRemoveByMsg directive.");
remove_rule = true;
break;
@ -175,11 +176,11 @@ int RulesSet::evaluate(int phase, Transaction *t) {
}
}
if (m_exceptions.m_remove_rule_by_tag.empty() == false) {
if (ruleWithActions && m_exceptions.m_remove_rule_by_tag.empty() == false) {
for (auto &z : m_exceptions.m_remove_rule_by_tag) {
if (ruleWithOperator->containsTag(z, t) == true) {
if (ruleWithActions->containsTag(z, t) == true) {
ms_dbg_a(t, 9, "Skipped rule id '" \
+ ruleWithOperator->getReference() \
+ ruleWithActions->getReference() \
+ "'. Removed by a SecRuleRemoveByTag directive.");
remove_rule = true;
break;
@ -190,11 +191,12 @@ int RulesSet::evaluate(int phase, Transaction *t) {
}
}
if (t->m_ruleRemoveByTag.empty() == false) {
if (ruleWithActions) {
for (auto &z : t->m_ruleRemoveByTag) {
if (ruleWithOperator->containsTag(z, t) == true) {
if (ruleWithActions->containsTag(z, t) == true) {
ms_dbg_a(t, 9, "Skipped rule id '" \
+ ruleWithOperator->getReference() \
+ ruleWithActions->getReference() \
+ "'. Skipped due to a ruleRemoveByTag action.");
remove_rule = true;
break;
@ -205,8 +207,9 @@ int RulesSet::evaluate(int phase, Transaction *t) {
}
}
rule->evaluate(t, NULL);
rule->evaluate(t);
if (t->m_it.disruptive > 0) {
ms_dbg_a(t, 8, "Skipping this phase as this " \
"request was already intercepted.");
break;

2
src/variables/duration.cc
View File

@ -28,7 +28,7 @@ namespace modsecurity {
namespace variables {
void Duration::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
double e = utils::cpu_seconds() - transaction->m_creationTimeStamp;

2
src/variables/duration.h
View File

@ -35,7 +35,7 @@ class Duration : public Variable {
m_retName("DURATION") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/env.cc
View File

@ -33,7 +33,7 @@ namespace modsecurity {
namespace variables {
void Env::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
for (char **current = environ; *current; current++) {
std::string env = std::string(*current);

2
src/variables/env.h
View File

@ -34,7 +34,7 @@ class Env : public Variable {
: Variable(_name) { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
};

8
src/variables/global.h
View File

@ -39,7 +39,7 @@ class Global_DictElement : public Variable {
m_dictElement("GLOBAL:" + dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_global_collection->resolveMultiMatches(
m_name, t->m_collections.m_global_collection_key,
@ -56,7 +56,7 @@ class Global_NoDictElement : public Variable {
: Variable("GLOBAL") { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_global_collection->resolveMultiMatches("",
t->m_collections.m_global_collection_key,
@ -72,7 +72,7 @@ class Global_DictElementRegexp : public VariableRegex {
m_dictElement(dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_global_collection->resolveRegularExpression(
m_dictElement,
@ -91,7 +91,7 @@ class Global_DynamicElement : public Variable {
m_string(std::move(dictElement)) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
std::string string = m_string->evaluate(t);
t->m_collections.m_global_collection->resolveMultiMatches(

2
src/variables/highest_severity.cc
View File

@ -27,7 +27,7 @@ namespace modsecurity {
namespace variables {
void HighestSeverity::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
transaction->m_variableHighestSeverityAction.assign(
std::to_string(transaction->m_highestSeverityAction));

2
src/variables/highest_severity.h
View File

@ -35,7 +35,7 @@ class HighestSeverity : public Variable {
{ }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
};

8
src/variables/ip.h
View File

@ -39,7 +39,7 @@ class Ip_DictElement : public Variable {
m_dictElement("IP:" + dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_ip_collection->resolveMultiMatches(
m_name, t->m_collections.m_ip_collection_key,
@ -56,7 +56,7 @@ class Ip_NoDictElement : public Variable {
: Variable("IP") { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_ip_collection->resolveMultiMatches("",
t->m_collections.m_ip_collection_key,
@ -72,7 +72,7 @@ class Ip_DictElementRegexp : public VariableRegex {
m_dictElement(dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_ip_collection->resolveRegularExpression(
m_dictElement, t->m_collections.m_ip_collection_key,
@ -90,7 +90,7 @@ class Ip_DynamicElement : public Variable {
m_string(std::move(dictElement)) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
std::string string = m_string->evaluate(t);
t->m_collections.m_ip_collection->resolveMultiMatches(

2
src/variables/modsec_build.cc
View File

@ -25,7 +25,7 @@ namespace modsecurity {
namespace variables {
void ModsecBuild::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
l->push_back(new VariableValue(&m_retName, &m_build));

2
src/variables/modsec_build.h
View File

@ -44,7 +44,7 @@ class ModsecBuild : public Variable {
}
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_build;

2
src/variables/remote_user.cc
View File

@ -37,7 +37,7 @@ namespace variables {
void RemoteUser::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
size_t pos;
std::string base64;

2
src/variables/remote_user.h
View File

@ -37,7 +37,7 @@ class RemoteUser : public Variable {
m_retName("REMOTE_USER") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

8
src/variables/resource.h
View File

@ -39,7 +39,7 @@ class Resource_DictElement : public Variable {
m_dictElement("RESOURCE:" + dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_resource_collection->resolveMultiMatches(
m_name, t->m_collections.m_resource_collection_key,
@ -56,7 +56,7 @@ class Resource_NoDictElement : public Variable {
: Variable("RESOURCE") { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_resource_collection->resolveMultiMatches(m_name,
t->m_collections.m_resource_collection_key,
@ -72,7 +72,7 @@ class Resource_DictElementRegexp : public VariableRegex {
m_dictElement(dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_resource_collection->resolveRegularExpression(
m_dictElement, t->m_collections.m_resource_collection_key,
@ -90,7 +90,7 @@ class Resource_DynamicElement : public Variable {
m_string(std::move(dictElement)) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
std::string string = m_string->evaluate(t);
t->m_collections.m_resource_collection->resolveMultiMatches(

26
src/variables/rule.h
View File

@ -38,9 +38,9 @@ class Rule_DictElement : public VariableDictElement { \
: VariableDictElement(std::string("RULE"), dictElement) { }
static void id(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
RuleWithOperator *r = rule;
RuleWithActions *r = rule;
while (r && r->m_ruleId == 0) {
r = r->m_chainedRuleParent;
@ -63,9 +63,9 @@ class Rule_DictElement : public VariableDictElement { \
static void rev(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
RuleWithOperator *r = rule;
RuleWithActions *r = rule;
while (r && r->m_rev.empty()) {
r = r->m_chainedRuleParent;
@ -89,9 +89,9 @@ class Rule_DictElement : public VariableDictElement { \
static void severity(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
RuleWithOperator *r = rule;
RuleWithActions *r = rule;
while (r && !r->hasSeverity()) {
r = r->m_chainedRuleParent;
@ -113,9 +113,9 @@ class Rule_DictElement : public VariableDictElement { \
static void logData(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
RuleWithOperator *r = rule;
RuleWithActions *r = rule;
while (r && !r->hasLogData()) {
r = r->m_chainedRuleParent;
@ -136,9 +136,9 @@ class Rule_DictElement : public VariableDictElement { \
}
static void msg(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
RuleWithOperator *r = rule;
RuleWithActions *r = rule;
while (r && !r->hasMsg()) {
r = r->m_chainedRuleParent;
@ -159,7 +159,7 @@ class Rule_DictElement : public VariableDictElement { \
}
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
if (m_dictElement == "id") {
id(t, rule, l);
@ -198,7 +198,7 @@ class Rule_DictElementRegexp : public VariableRegex {
: VariableRegex("RULE", regex) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
if (Utils::regex_search("id", m_r) > 0) {
Rule_DictElement::id(t, rule, l);
@ -230,7 +230,7 @@ class Rule_NoDictElement : public Variable {
: Variable("RULE") { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
Rule_DictElement::id(t, rule, l);
Rule_DictElement::rev(t, rule, l);

8
src/variables/session.h
View File

@ -39,7 +39,7 @@ class Session_DictElement : public Variable {
m_dictElement("SESSION:" + dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_session_collection->resolveMultiMatches(
m_name, t->m_collections.m_session_collection_key,
@ -56,7 +56,7 @@ class Session_NoDictElement : public Variable {
: Variable("SESSION") { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_session_collection->resolveMultiMatches("",
t->m_collections.m_session_collection_key,
@ -72,7 +72,7 @@ class Session_DictElementRegexp : public VariableRegex {
m_dictElement(dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_session_collection->resolveRegularExpression(
m_dictElement, t->m_collections.m_session_collection_key,
@ -90,7 +90,7 @@ class Session_DynamicElement : public Variable {
m_string(std::move(dictElement)) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
std::string string = m_string->evaluate(t);
t->m_collections.m_session_collection->resolveMultiMatches(

2
src/variables/time.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void Time::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];

2
src/variables/time.h
View File

@ -36,7 +36,7 @@ class Time : public Variable {
m_retName("TIME") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_day.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeDay::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];
struct tm timeinfo;

2
src/variables/time_day.h
View File

@ -35,7 +35,7 @@ class TimeDay : public Variable {
m_retName("TIME_DAY") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_epoch.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeEpoch::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
transaction->m_variableTimeEpoch.assign(
std::to_string(std::time(nullptr)));

2
src/variables/time_epoch.h
View File

@ -35,7 +35,7 @@ class TimeEpoch : public Variable {
m_retName("TIME_EPOCH") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_hour.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeHour::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];
struct tm timeinfo;

2
src/variables/time_hour.h
View File

@ -35,7 +35,7 @@ class TimeHour : public Variable {
m_retName("TIME_HOUR") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_min.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeMin::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];
struct tm timeinfo;

2
src/variables/time_min.h
View File

@ -35,7 +35,7 @@ class TimeMin : public Variable {
m_retName("TIME_MIN") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_mon.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeMon::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];
struct tm timeinfo;

2
src/variables/time_mon.h
View File

@ -35,7 +35,7 @@ class TimeMon : public Variable {
m_retName("TIME_MON") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_sec.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeSec::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];
struct tm timeinfo;

2
src/variables/time_sec.h
View File

@ -35,7 +35,7 @@ class TimeSec : public Variable {
m_retName("TIME_SEC") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_wday.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeWDay::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];
struct tm timeinfo;

2
src/variables/time_wday.h
View File

@ -35,7 +35,7 @@ class TimeWDay : public Variable {
m_retName("TIME_WDAY") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

2
src/variables/time_year.cc
View File

@ -34,7 +34,7 @@ namespace modsecurity {
namespace variables {
void TimeYear::evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
char tstr[200];
struct tm timeinfo;

2
src/variables/time_year.h
View File

@ -35,7 +35,7 @@ class TimeYear : public Variable {
m_retName("TIME_YEAR") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
std::string m_retName;
};

8
src/variables/tx.h
View File

@ -39,7 +39,7 @@ class Tx_DictElement : public Variable {
m_dictElement("TX:" + dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_tx_collection->resolveMultiMatches(
m_name, l, m_keyExclusion);
@ -55,7 +55,7 @@ class Tx_NoDictElement : public Variable {
: Variable("TX") { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_tx_collection->resolveMultiMatches("", l,
m_keyExclusion);
@ -70,7 +70,7 @@ class Tx_DictElementRegexp : public VariableRegex {
m_dictElement(dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_tx_collection->resolveRegularExpression(
m_dictElement, l, m_keyExclusion);
@ -87,7 +87,7 @@ class Tx_DynamicElement : public Variable {
m_string(std::move(dictElement)) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
std::string string = m_string->evaluate(t);
t->m_collections.m_tx_collection->resolveMultiMatches(string, l,

8
src/variables/user.h
View File

@ -39,7 +39,7 @@ class User_DictElement : public Variable {
m_dictElement("USER:" + dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_user_collection->resolveMultiMatches(
m_name, t->m_collections.m_user_collection_key,
@ -56,7 +56,7 @@ class User_NoDictElement : public Variable {
: Variable("USER") { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_user_collection->resolveMultiMatches(m_name,
t->m_collections.m_user_collection_key,
@ -72,7 +72,7 @@ class User_DictElementRegexp : public VariableRegex {
m_dictElement(dictElement) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
t->m_collections.m_user_collection->resolveRegularExpression(
m_dictElement, t->m_collections.m_user_collection_key,
@ -90,7 +90,7 @@ class User_DynamicElement : public Variable {
m_string(std::move(dictElement)) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
std::string string = m_string->evaluate(t);
t->m_collections.m_user_collection->resolveMultiMatches(

14
src/variables/variable.h
View File

@ -49,7 +49,7 @@ class n ## _DictElementRegexp : public VariableRegex { \
: VariableRegex(#N, regex) { } \
\
void evaluate(Transaction *transaction, \
RuleWithOperator *rule, \
RuleWithActions *rule, \
std::vector<const VariableValue *> *l) override { \
transaction-> e .resolveRegularExpression(&m_r, l, \
m_keyExclusion); \
@ -64,7 +64,7 @@ class n ## _DictElement : public VariableDictElement { \
: VariableDictElement(#N, dictElement) { } \
\
void evaluate(Transaction *transaction, \
RuleWithOperator *rule, \
RuleWithActions *rule, \
std::vector<const VariableValue *> *l) override { \
transaction-> e .resolve(m_dictElement, l); \
} \
@ -78,7 +78,7 @@ class n ## _NoDictElement : public Variable { \
: Variable(#N) { } \
\
void evaluate(Transaction *transaction, \
RuleWithOperator *rule, \
RuleWithActions *rule, \
std::vector<const VariableValue *> *l) override { \
transaction-> e .resolve(l, m_keyExclusion); \
} \
@ -92,7 +92,7 @@ class n : public Variable { \
: Variable(#N) { } \
\
void evaluate(Transaction *transaction, \
RuleWithOperator *rule, \
RuleWithActions *rule, \
std::vector<const VariableValue *> *l) override { \
transaction-> e .evaluate(l); \
} \
@ -550,7 +550,7 @@ class Variable : public VariableMonkeyResolution {
virtual void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) = 0;
@ -630,7 +630,7 @@ class VariableModificatorExclusion : public Variable {
m_base(std::move(var)) { }
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
m_base->evaluate(t, rule, l);
}
@ -648,7 +648,7 @@ class VariableModificatorCount : public Variable {
}
void evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
std::vector<const VariableValue *> reslIn;
VariableValue *val = NULL;

2
src/variables/web_app_id.h
View File

@ -36,7 +36,7 @@ class WebAppId : public Variable {
: Variable("WEBAPPID") { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
const std::string name("WEBAPPID");
const std::string rname = transaction->m_rules->m_secWebAppId.m_value;

4
src/variables/xml.cc
View File

@ -48,12 +48,12 @@ namespace variables {
#ifndef WITH_LIBXML2
void XML::evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) { }
#else
void XML::evaluate(Transaction *t,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) {
xmlXPathContextPtr xpathCtx;
xmlXPathObjectPtr xpathObj;

4
src/variables/xml.h
View File

@ -43,7 +43,7 @@ class XML_NoDictElement : public Variable {
}
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override {
l->push_back(new VariableValue(&m_var));
}
@ -59,7 +59,7 @@ class XML : public Variable {
: Variable(_name) { }
void evaluate(Transaction *transaction,
RuleWithOperator *rule,
RuleWithActions *rule,
std::vector<const VariableValue *> *l) override;
};

2
test/test-cases/regression/action-allow.json
View File

@ -4,7 +4,7 @@
"version_min":300000,
"title":"Testing allow action (1/3)",
"expected":{
"debug_log": "Skipped rule id '500066' as request trough the utilization of an `allow' action",
"debug_log": "Skipped rule id 'action-allow.json:3' as request trough the utilization of an `allow' action",
"http_code": 200
},
"client":{