github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-13 13:26:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adds support to the collection RESOURCE

Browse Source
This commit is contained in:
Felipe Zimmerle 2017-10-30 09:06:23 -03:00
parent a9d54c30a1
commit 9369efcb90
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
9 changed files with 3320 additions and 3190 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@ -2,6 +2,8 @@
v3.0.????? - ?
---------------------------
- Adds support for RESOURCE variable collection.
[Issue #1014 - @zimmerle, @victorhora]
- Adds support for @fuzzyHash operator.
[Issue #997 - @zimmerle]
- Fix build on non x86 arch build

1
Makefile.am
View File

@ -285,4 +285,5 @@ TESTS+=test/test-cases/regression/config-update-target-by-tag.json
TESTS+=test/test-cases/regression/config-update-target-by-id.json
TESTS+=test/test-cases/regression/misc-variable-under-quotes.json
TESTS+=test/test-cases/regression/operator-fuzzyhash.json
TESTS+=test/test-cases/regression/collection-resource.json

884
src/parser/seclang-parser.cc
View File

File diff suppressed because it is too large Load Diff

16
src/parser/seclang-parser.yy
View File

@ -1760,6 +1760,18 @@ var:
{
VARIABLE_CONTAINER($$, new Variables::FilesTmpNames_NoDictElement());
}
| VARIABLE_RESOURCE DICT_ELEMENT
{
VARIABLE_CONTAINER($$, new Variables::Resource_DictElement($2));
}
| VARIABLE_RESOURCE DICT_ELEMENT_REGEXP
{
VARIABLE_CONTAINER($$, new Variables::Resource_DictElementRegexp($2));
}
| VARIABLE_RESOURCE
{
VARIABLE_CONTAINER($$, new Variables::Resource_NoDictElement());
}
| VARIABLE_IP DICT_ELEMENT
{
@ -2025,10 +2037,6 @@ var:
{
VARIABLE_CONTAINER($$, new Variables::RequestURIRaw());
}
| VARIABLE_RESOURCE
{
VARIABLE_CONTAINER($$, new Variables::Resource());
}
| VARIABLE_RESPONSE_BODY
{
VARIABLE_CONTAINER($$, new Variables::ResponseBody());

5504
src/parser/seclang-scanner.cc
View File

File diff suppressed because it is too large Load Diff

2
src/parser/seclang-scanner.ll
View File

@ -809,6 +809,8 @@ EQUALS_MINUS (?i:=\-)
{VARIABLE_IP} { return p::make_VARIABLE_IP(*driver.loc.back()); }
{VARIABLE_IP}[:] { BEGIN(EXPECTING_VAR_PARAMETER); return p::make_VARIABLE_IP(*driver.loc.back()); }
{VARIABLE_RESOURCE} { return p::make_VARIABLE_RESOURCE(*driver.loc.back()); }
{VARIABLE_RESOURCE}[:] { BEGIN(EXPECTING_VAR_PARAMETER); return p::make_VARIABLE_RESOURCE(*driver.loc.back()); }
{VARIABLE_GLOBAL} { return p::make_VARIABLE_GLOBAL(*driver.loc.back()); }
{VARIABLE_GLOBAL}[:] { BEGIN(EXPECTING_VAR_PARAMETER); return p::make_VARIABLE_GLOBAL(*driver.loc.back()); }
{VARIABLE_SESSION} { return p::make_VARIABLE_SESSION(*driver.loc.back()); }

2
src/variables/ip.h
View File

@ -33,7 +33,7 @@ namespace Variables {
class Ip_DictElement : public Variable {
public:
explicit Ip_DictElement(std::string dictElement)
: Variable("IP"),
: Variable("IP:" + dictElement),
m_dictElement("IP:" + dictElement) { }
void evaluate(Transaction *transaction,

45
src/variables/resource.h
View File

@ -29,18 +29,55 @@ namespace modsecurity {
class Transaction;
namespace Variables {
class Resource : public Variable {
class Resource_DictElement : public Variable {
public:
Resource()
explicit Resource_DictElement(std::string dictElement)
: Variable("RESOURCE:" + dictElement),
m_dictElement("RESOURCE:" + dictElement) { }
void evaluate(Transaction *transaction,
Rule *rule,
std::vector<const collection::Variable *> *l) override {
transaction->m_collections.resolveMultiMatches(m_dictElement, "RESOURCE", l);
}
std::string m_dictElement;
};
class Resource_NoDictElement : public Variable {
public:
Resource_NoDictElement()
: Variable("RESOURCE") { }
void evaluate(Transaction *transaction,
Rule *rule,
std::vector<const collection::Variable *> *l) {
transaction->m_variableResource.evaluate(l);
std::vector<const collection::Variable *> *l) override {
transaction->m_collections.resolveMultiMatches(m_name, "RESOURCE", l);
}
};
class Resource_DictElementRegexp : public Variable {
public:
explicit Resource_DictElementRegexp(std::string dictElement)
: Variable("RESOURCE:regex(" + dictElement + ")"),
m_r(dictElement),
m_dictElement("RESOURCE:" + dictElement) { }
void evaluate(Transaction *transaction,
Rule *rule,
std::vector<const collection::Variable *> *l) override {
transaction->m_collections.resolveRegularExpression(m_dictElement,
"RESOURCE", l);
}
Utils::Regex m_r;
std::string m_dictElement;
};
} // namespace Variables
} // namespace modsecurity

54
test/test-cases/regression/collection-resource.json Normal file
View File

@ -0,0 +1,54 @@
[
{
"enabled":1,
"version_min":300000,
"version_max":0,
"title":"Testing collection :: RESOURCE (1/2)",
"client":{
"ip":"200.249.12.31",
"port":2313
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
"Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language":"en-us,en;q=0.5",
"Accept-Encoding":"gzip,deflate",
"Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive":"300",
"Connection":"keep-alive",
"Cookie":"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Pragma":"no-cache",
"Cache-Control":"no-cache"
},
"uri":"\/test.pl?resource=whee",
"method":"GET",
"http_version":1.1,
"body":""
},
"response":{
"headers":{
"Content-Type":"text\/xml; charset=utf-8\n\r",
"Content-Length":"length\n\r"
},
"body":[
]
},
"expected":{
"audit_log":"",
"debug_log":"Target value: \"123\" \\(Variable: whee::RESOURCE:test\\)",
"error_log":""
},
"rules":[
"SecRuleEngine On",
"SecRule ARGS:resource \"@unconditionalmatch \" \"phase:2,pass,initcol:resource=%{ARGS.resource},id:900003\"",
"SecRule ARGS:resource \"@unconditionalmatch \" \"phase:2,pass,setvar:resource.test=123,id:900000\"",
"SecRule ARGS:resource \"@unconditionalmatch \" \"phase:2,pass,expirevar:resource.timeout=3600,id:9000033\"",
"SecRule RESOURCE:test \"@unconditionalmatch \" \"phase:2,pass,expirevar:resource.timeout=3600,id:9000034\""
]
}
]