github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 05:45:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

MODSEC-261

Browse Source
This commit is contained in:
brenosilva 2012-10-03 13:49:00 +00:00
parent 73e87c035a
commit aee22ea461
5 changed files with 45 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
apache2/apache2_config.c
View File

@ -64,6 +64,7 @@ void *create_directory_config(apr_pool_t *mp, char *path)
dcfg->cookie_format = NOT_SET;
dcfg->argument_separator = NOT_SET;
dcfg->cookiev0_separator = NOT_SET_P;
dcfg->rule_inheritance = NOT_SET;
dcfg->rule_exceptions = apr_array_make(mp, 16, sizeof(rule_exception *));
@ -366,6 +367,8 @@ void *merge_directory_configs(apr_pool_t *mp, void *_parent, void *_child)
? parent->cookie_format : child->cookie_format);
merged->argument_separator = (child->argument_separator == NOT_SET
? parent->argument_separator : child->argument_separator);
merged->cookiev0_separator = (child->cookiev0_separator == NOT_SET_P
? parent->cookiev0_separator : child->cookiev0_separator);
/* rule inheritance */
@ -627,6 +630,7 @@ void init_directory_config(directory_config *dcfg)
if (dcfg->cookie_format == NOT_SET) dcfg->cookie_format = 0;
if (dcfg->argument_separator == NOT_SET) dcfg->argument_separator = '&';
if (dcfg->cookiev0_separator == NOT_SET_P) dcfg->cookiev0_separator = ";";
if (dcfg->rule_inheritance == NOT_SET) dcfg->rule_inheritance = 1;
@ -1098,6 +1102,21 @@ static const char *cmd_argument_separator(cmd_parms *cmd, void *_dcfg,
return NULL;
}
static const char *cmd_cookiev0_separator(cmd_parms *cmd, void *_dcfg,
const char *p1)
{
directory_config *dcfg = (directory_config *)_dcfg;
if (strlen(p1) != 1) {
return apr_psprintf(cmd->pool, "ModSecurity: Invalid cookie v0 separator: %s", p1);
}
dcfg->cookiev0_separator = p1;
return NULL;
}
static const char *cmd_audit_engine(cmd_parms *cmd, void *_dcfg, const char *p1)
{
directory_config *dcfg = _dcfg;
@ -2913,6 +2932,14 @@ const command_rec module_directives[] = {
"version of the Cookie specification to use for parsing. Possible values are 0 and 1."
),
AP_INIT_TAKE1 (
"SecCookieV0Separator",
cmd_cookiev0_separator,
NULL,
CMD_SCOPE_ANY,
"character that will be used as separator when parsing cookie v0 content."
),
AP_INIT_TAKE1 (
"SecDataDir",
cmd_data_dir,

2
apache2/modsecurity.c
View File

@ -401,7 +401,7 @@ apr_status_t modsecurity_tx_init(modsec_rec *msr) {
for (i = 0; i < arr->nelts; i++) {
if (strcasecmp(te[i].key, "Cookie") == 0) {
if (msr->txcfg->cookie_format == COOKIES_V0) {
parse_cookies_v0(msr, te[i].val, msr->request_cookies);
parse_cookies_v0(msr, te[i].val, msr->request_cookies, msr->txcfg->cookiev0_separator);
} else {
parse_cookies_v1(msr, te[i].val, msr->request_cookies);
}

1
apache2/modsecurity.h
View File

@ -467,6 +467,7 @@ struct directory_config {
int cookie_format;
int argument_separator;
const char *cookiev0_separator;
int rule_inheritance;
apr_array_header_t *rule_exceptions;

7
apache2/msc_parsers.c
View File

@ -19,7 +19,7 @@
*
*/
int parse_cookies_v0(modsec_rec *msr, char *_cookie_header,
apr_table_t *cookies)
apr_table_t *cookies, const char *delim)
{
char *attr_name = NULL, *attr_value = NULL;
char *cookie_header;
@ -35,7 +35,8 @@ int parse_cookies_v0(modsec_rec *msr, char *_cookie_header,
cookie_header = strdup(_cookie_header);
if (cookie_header == NULL) return -1;
p = apr_strtok(cookie_header, ";", &saveptr);
p = apr_strtok(cookie_header, delim, &saveptr);
while(p != NULL) {
attr_name = NULL;
attr_value = NULL;
@ -73,7 +74,7 @@ int parse_cookies_v0(modsec_rec *msr, char *_cookie_header,
cookie_count++;
}
p = apr_strtok(NULL, ";", &saveptr);
p = apr_strtok(NULL, delim, &saveptr);
}
free(cookie_header);

3
apache2/msc_parsers.h
View File

@ -17,7 +17,8 @@
#include "modsecurity.h"
int DSOLOCAL parse_cookies_v0(modsec_rec *msr, char *_cookie_header, apr_table_t *cookies);
int DSOLOCAL parse_cookies_v0(modsec_rec *msr, char *_cookie_header, apr_table_t *cookies,
const char *delim);
int DSOLOCAL parse_cookies_v1(modsec_rec *msr, char *_cookie_header, apr_table_t *cookies);