From aa68fff10477c37e34de82a2ddd0f78a47df6952 Mon Sep 17 00:00:00 2001 From: brectanus Date: Fri, 14 Dec 2007 00:30:25 +0000 Subject: [PATCH] Fixed decoding \9 with t:escapeSeqDecode. See #423. --- CHANGES | 4 +++- apache2/msc_util.c | 2 +- doc/modsecurity2-apache-reference.xml | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/CHANGES b/CHANGES index a6b1a14c..b1d7aa27 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,8 @@ -12 Dec 2007 - 2.5.0-rc1 +13 Dec 2007 - 2.5.0-rc1 ----------------------- + * Fixed t:escapeSeqDecode to better follow ANSI C escapes. + * Added t:jsDecode to decode JavScript escape sequences. * Added IS_NEW and IS_EXPIRED built-in collection variables. diff --git a/apache2/msc_util.c b/apache2/msc_util.c index 32f5a572..ca8d1385 100644 --- a/apache2/msc_util.c +++ b/apache2/msc_util.c @@ -1054,7 +1054,7 @@ int ansi_c_sequences_decode_inplace(unsigned char *input, int input_len) { } } else - if (isdigit(input[i + 1])) { /* Octal. */ + if (ISODIGIT(input[i + 1])) { /* Octal. */ char buf[10]; int j = 0, l = 3; diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index 121ca773..08217c77 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -3,7 +3,7 @@ ModSecurity Reference Manual - Version 2.5.0-rc1/ (December 12, 2007) + Version 2.5.0-rc1/ (December 13, 2007) 2004-2007 @@ -5165,4 +5165,4 @@ SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" t:l - \ No newline at end of file +