diff --git a/review/pre-2.5-brian.review b/review/pre-2.5-brian.review index fd10ad0d..ec326e81 100644 --- a/review/pre-2.5-brian.review +++ b/review/pre-2.5-brian.review @@ -159,12 +159,12 @@ 2008-01-04 :: 11:25:25:879 GMT-08:00 - 2008-01-04 :: 11:26:10:856 GMT-08:00 + 2008-01-09 :: 12:54:38:835 GMT-08:00 brian brian apache2/apache2_util.c - Suggestion + item.type.label.suggestion item.severity.label.trivial Portable way to format sizeof()? msr_log(msr, 1, "Exec: Unable to allocate %lu bytes.", (unsigned long)sizeof(*procnew)); @@ -467,14 +467,14 @@ 2008-01-04 :: 15:49:05:878 GMT-08:00 - 2008-01-04 :: 15:51:13:090 GMT-08:00 + 2008-01-09 :: 13:15:53:256 GMT-08:00 brian brian apache2/re_operators.c item.type.label.suggestion item.severity.label.major - Need to resolve the TODOs introduced by Lua processing. + Change from TODO to ENH. @@ -1719,5 +1719,1190 @@ int msre_ruleset_rule_remove_with_exception(msre_ruleset *ruleset, rule_exceptio item.resolution.label.validNeedsfixing item.status.label.open + + + 2008-01-08 :: 21:29:14:889 GMT-08:00 + 2008-01-08 :: 21:30:41:759 GMT-08:00 + + brian + brian + apache2/re_tfns.c + item.type.label.optimization + item.severity.label.trivial + No need to set this on all. Only set it once when we find the first non-space char. + (*rval)[i] = '\0'; + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-08 :: 22:09:10:463 GMT-08:00 + 2008-01-08 :: 22:09:21:755 GMT-08:00 + + brian + brian + apache2/re_variables.c + item.type.label.suggestion + item.severity.label.trivial + Indention off. + return var_simple_generate_ex(var, vartab, mptmp, + apr_pmemdup(mptmp, + msr->matched_var->value, + msr->matched_var->value_len), + msr->matched_var->value_len); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-08 :: 22:09:35:664 GMT-08:00 + 2008-01-08 :: 22:09:42:366 GMT-08:00 + + brian + brian + apache2/re_variables.c + item.type.label.suggestion + item.severity.label.trivial + Indention off. + return var_simple_generate_ex(var, vartab, mptmp, + apr_pmemdup(mptmp, + msr->matched_var->name, + msr->matched_var->name_len), + msr->matched_var->name_len); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 10:55:38:639 GMT-08:00 + 2008-01-09 :: 10:55:46:491 GMT-08:00 + + brian + brian + apache2/acmp.c + item.type.label.suggestion + item.severity.label.trivial + Remove comment. + //return acmp_child_for_code(node, letter) + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 11:01:01:815 GMT-08:00 + 2008-01-09 :: 11:01:33:567 GMT-08:00 + + brian + brian + apache2/acmp.c + item.type.label.suggestion + item.severity.label.trivial + Change to #idef DEBUG_ACMP or similar. + /* printf("%c ->left %c \n", node->node->letter, node->left->node->letter); */ + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 11:01:41:424 GMT-08:00 + 2008-01-09 :: 11:01:46:101 GMT-08:00 + + brian + brian + apache2/acmp.c + item.type.label.suggestion + item.severity.label.trivial + Change to #idef DEBUG_ACMP or similar. + /* printf("%c ->right %c \n", node->node->letter, node->right->node->letter); */ + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 11:02:22:279 GMT-08:00 + 2008-01-09 :: 11:02:26:609 GMT-08:00 + + brian + brian + apache2/acmp.c + item.type.label.suggestion + item.severity.label.trivial + Change to #idef DEBUG_ACMP or similar. + /* printf("fail direction: *%s* => *%s*\n", child->text, child->fail->text); */ + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 11:02:42:897 GMT-08:00 + 2008-01-09 :: 11:02:46:061 GMT-08:00 + + brian + brian + apache2/acmp.c + item.type.label.suggestion + item.severity.label.trivial + Change to #idef DEBUG_ACMP or similar. + /* printf("fail direction: *%s* => *%s*\n", node->text, node->fail->text); */ + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 11:10:25:157 GMT-08:00 + 2008-01-09 :: 11:14:15:361 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + The 'tag' and 'severity' metadata actions should be included. Some actions are missing from the log msg. + /* Must NOT use metadata actions. */ + if ((rule->actionset->id != NOT_SET_P) + ||(rule->actionset->rev != NOT_SET_P) + ||(rule->actionset->msg != NOT_SET_P) + ||(rule->actionset->logdata != NOT_SET_P)) + { + return apr_psprintf(cmd->pool, "ModSecurity: Metadata actions (id, rev, msg) " + " can only be specified by chain starter rules."); + } + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 11:18:38:672 GMT-08:00 + 2008-01-09 :: 11:18:53:777 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Probably should check we were able to allocate. + msre_rule *phrule = apr_palloc(rule->ruleset->mp, sizeof(msre_rule)); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:05:40:949 GMT-08:00 + 2008-01-09 :: 12:05:54:630 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Comment or remove. + TODO + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:06:48:653 GMT-08:00 + 2008-01-09 :: 12:06:58:541 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + ENH instead of TODO + TODO + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:09:17:114 GMT-08:00 + 2008-01-09 :: 12:09:22:181 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + The 'tag' and 'severity' metadata actions should be included. Some actions are missing from the log msg. + /* Must not use metadata actions. */ + if ((dcfg->tmp_default_actionset->id != NOT_SET_P) + ||(dcfg->tmp_default_actionset->rev != NOT_SET_P) + ||(dcfg->tmp_default_actionset->msg != NOT_SET_P) + ||(dcfg->tmp_default_actionset->logdata != NOT_SET_P)) + { + return apr_psprintf(cmd->pool, "ModSecurity: SecDefaultAction must not " + "contain any metadata actions (id, rev, msg)."); + } + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:17:06:712 GMT-08:00 + 2008-01-09 :: 12:19:23:680 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or make ENH + // TODO Validate encoding + // return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecRequestBodyAccess: %s", p1); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:17:55:545 GMT-08:00 + 2008-01-09 :: 12:25:33:617 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.irrelevant + item.severity.label.trivial + Remove code? + /* +static const char *cmd_rule_import_by_id(cmd_parms *cmd, void *_dcfg, const char *p1) { + directory_config *dcfg = (directory_config *)_dcfg; + rule_exception *re = apr_pcalloc(cmd->pool, sizeof(rule_exception)); + if (dcfg == NULL) return NULL; + + re->type = RULE_EXCEPTION_IMPORT_ID; + // TODO verify p1 + re->param = p1; + *(rule_exception **)apr_array_push(dcfg->rule_exceptions) = re; + + return NULL; +} + +static const char *cmd_rule_import_by_msg(cmd_parms *cmd, void *_dcfg, const char *p1) { + directory_config *dcfg = (directory_config *)_dcfg; + rule_exception *re = apr_pcalloc(cmd->pool, sizeof(rule_exception)); + if (dcfg == NULL) return NULL; + + re->type = RULE_EXCEPTION_IMPORT_MSG; + // TODO verify p1 + re->param = p1; + *(rule_exception **)apr_array_push(dcfg->rule_exceptions) = re; + + return NULL; +} +*/ + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:18:34:399 GMT-08:00 + 2008-01-09 :: 12:19:04:870 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix or TODO->ENH + // TODO enforce format (letters, digits, ., _, -) + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:20:16:234 GMT-08:00 + 2008-01-09 :: 12:20:36:635 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Need to allow for relative filename based of rule file. + /* -- Geo Lookup configuration -- */ + +static const char *cmd_geo_lookup_db(cmd_parms *cmd, void *_dcfg, + const char *p1) +{ + char *error_msg; + directory_config *dcfg = (directory_config *)_dcfg; + if (dcfg == NULL) return NULL; + + if (geo_init(dcfg, p1, &error_msg) <= 0) { + return error_msg; + } + + return NULL; +} + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:22:58:798 GMT-08:00 + 2008-01-09 :: 12:23:11:462 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Portable? + /* The NOT_SET indicator is -1, a signed long, and therfore + * we cannot be >= the unsigned value of NOT_SET. + */ + if ((unsigned long)intval >= (unsigned long)NOT_SET) { + return apr_psprintf(cmd->pool, "ModSecurity: SecCacheTransformations minlen must be less than: %lu", (unsigned long)NOT_SET); + } + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:23:33:676 GMT-08:00 + 2008-01-09 :: 12:23:39:437 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Portable? + /* The NOT_SET indicator is -1, a signed long, and therfore + * we cannot be >= the unsigned value of NOT_SET. + */ + if ((unsigned long)intval >= (unsigned long)NOT_SET) { + return apr_psprintf(cmd->pool, "ModSecurity: SecCacheTransformations maxlen must be less than: %lu", (unsigned long)NOT_SET); + } + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:24:06:001 GMT-08:00 + 2008-01-09 :: 12:24:23:994 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Could use strtol as Ivan has as well. + intval = apr_atoi64(charval); + if (errno == ERANGE) { + return apr_psprintf(cmd->pool, "ModSecurity: SecCacheTransformations minlen out of range: %s", charval); + } + if (intval < 0) { + return apr_psprintf(cmd->pool, "ModSecurity: SecCacheTransformations minlen must be positive: %s", charval); + } + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:24:37:453 GMT-08:00 + 2008-01-09 :: 12:24:42:462 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Could use strtol as Ivan has as well. + intval = apr_atoi64(charval); + if (errno == ERANGE) { + return apr_psprintf(cmd->pool, "ModSecurity: SecCacheTransformations maxlen out of range: %s", charval); + } + if (intval < 0) { + return apr_psprintf(cmd->pool, "ModSecurity: SecCacheTransformations maxlen must be positive: %s", charval); + } + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:25:36:799 GMT-08:00 + 2008-01-09 :: 12:31:35:264 GMT-08:00 + + brian + brian + apache2/apache2_io.c + item.type.label.programLogic + item.severity.label.major + Remove code? It is actually used below, so need to verify. + #if 0 +static void dummy_free_func(void *data) {} +#endif + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:27:10:252 GMT-08:00 + 2008-01-09 :: 12:29:31:617 GMT-08:00 + + brian + brian + apache2/apache2_io.c + item.type.label.programLogic + item.severity.label.major + dummy_free_func() is defined where? It is ifdef'd out at the top of source, so need to verify it is valid. + /* Do not make a copy of the data we received in the chunk. */ + bucket = apr_bucket_heap_create(chunk->data, chunk->length, dummy_free_func, + f->r->connection->bucket_alloc); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:35:21:613 GMT-08:00 + 2008-01-09 :: 13:02:40:668 GMT-08:00 + + brian + brian + apache2/apache2_io.c + item.type.label.suggestion + item.severity.label.trivial + Yes, why do we ignore the rc - why have one at all? + // TODO: Why ignore the return code here? + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:55:19:633 GMT-08:00 + 2008-01-09 :: 12:55:25:567 GMT-08:00 + + brian + brian + apache2/msc_reqbody.c + item.type.label.suggestion + item.severity.label.trivial + Portable way to format sizeof()? + *error_msg = apr_psprintf(msr->mp, "Input filter: Failed to allocate %lu bytes for request body chunk.", (unsigned long)sizeof(msc_data_chunk)); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:55:39:585 GMT-08:00 + 2008-01-09 :: 12:55:46:993 GMT-08:00 + + brian + brian + apache2/msc_reqbody.c + item.type.label.suggestion + item.severity.label.trivial + Portable way to format sizeof()? + *error_msg = apr_psprintf(msr->mp, "Failed to allocate %lu bytes for request body disk chunk.", (unsigned long)sizeof(msc_data_chunk)); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:56:05:302 GMT-08:00 + 2008-01-09 :: 12:56:08:927 GMT-08:00 + + brian + brian + apache2/msc_reqbody.c + item.type.label.suggestion + item.severity.label.trivial + Portable way to format sizeof()? + *error_msg = apr_psprintf(msr->mp, "Failed to allocate %lu bytes for request body disk chunk.", (unsigned long)sizeof(msc_data_chunk)); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:56:51:734 GMT-08:00 + 2008-01-09 :: 12:57:16:674 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + // TODO check whether the parameter is a valid MIME type of "null" + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:58:11:331 GMT-08:00 + 2008-01-09 :: 12:58:18:022 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE1 ( + "SecAction", + cmd_action, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:58:29:461 GMT-08:00 + 2008-01-09 :: 12:58:33:945 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE1 ( + "SecDataDir", + cmd_data_dir, + NULL, + CMD_SCOPE_MAIN, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:58:45:647 GMT-08:00 + 2008-01-09 :: 12:58:50:500 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE1 ( + "SecDefaultAction", + cmd_default_action, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:59:03:959 GMT-08:00 + 2008-01-09 :: 12:59:08:138 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE1 ( + "SecResponseBodyLimit", + cmd_response_body_limit, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 12:59:17:580 GMT-08:00 + 2008-01-09 :: 12:59:25:064 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE1 ( + "SecResponseBodyLimitAction", + cmd_response_body_limit_action, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:00:04:205 GMT-08:00 + 2008-01-09 :: 13:00:12:200 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE23 ( + "SecRule", + cmd_rule, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:00:30:606 GMT-08:00 + 2008-01-09 :: 13:00:38:609 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE12 ( + "SecRuleScript", + cmd_rule_script, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + AP_INIT_ITERATE ( + "SecRuleRemoveById", + cmd_rule_remove_by_id, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + AP_INIT_ITERATE ( + "SecRuleRemoveByMsg", + cmd_rule_remove_by_msg, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:00:56:319 GMT-08:00 + 2008-01-09 :: 13:01:04:256 GMT-08:00 + + brian + brian + apache2/apache2_config.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + AP_INIT_TAKE1 ( + "SecTmpDir", + cmd_tmp_dir, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + AP_INIT_TAKE1 ( + "SecUploadDir", + cmd_upload_dir, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + AP_INIT_TAKE1 ( + "SecUploadKeepFiles", + cmd_upload_keep_files, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + AP_INIT_TAKE1 ( + "SecWebAppId", + cmd_web_app_id, + NULL, + CMD_SCOPE_ANY, + "" // TODO + ), + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:01:32:996 GMT-08:00 + 2008-01-09 :: 13:01:39:326 GMT-08:00 + + brian + brian + apache2/mod_security2.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + /* Update the request headers. They might have changed after + * the body was read (trailers). + */ + // TODO We still need to keep a copy of the original headers + // to log in the audit log. + msr->request_headers = apr_table_copy(msr->mp, r->headers_in); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:02:05:035 GMT-08:00 + 2008-01-09 :: 13:02:47:482 GMT-08:00 + + brian + brian + apache2/modsecurity.c + item.type.label.suggestion + item.severity.label.trivial + Yes, why do we ignore the rc - why have one at all? + // TODO: Why do we ignore return code here? + modsecurity_request_body_clear(msr, &my_error_msg); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:03:24:928 GMT-08:00 + 2008-01-09 :: 13:04:49:633 GMT-08:00 + + brian + brian + apache2/msc_geo.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO. + offset = -3; + apr_file_seek(geo->db, APR_END, &offset); + /* TODO check offset */ + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:04:20:937 GMT-08:00 + 2008-01-09 :: 13:04:39:295 GMT-08:00 + + brian + brian + apache2/msc_geo.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO. + rc = apr_file_read_full(geo->db, &buf, 1, &nbytes); + /* TODO: check rc */ + geo->dbtype = (int)buf[0]; + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:05:16:204 GMT-08:00 + 2008-01-09 :: 13:05:27:720 GMT-08:00 + + brian + brian + apache2/msc_geo.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO. + apr_file_seek(geo->db, APR_SET, &seekto); + /* TODO: check rc */ + rc = apr_file_read_full(geo->db, &buf, (2 * reclen), &nbytes); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:05:58:953 GMT-08:00 + 2008-01-09 :: 13:06:03:494 GMT-08:00 + + brian + brian + apache2/msc_geo.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO. + apr_file_seek(geo->db, APR_SET, &seekto); + /* TODO: check rc */ + rc = apr_file_read_full(geo->db, &cbuf, sizeof(cbuf), &nbytes); + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:06:45:422 GMT-08:00 + 2008-01-09 :: 13:06:56:494 GMT-08:00 + + brian + brian + apache2/msc_logging.c + item.type.label.suggestion + item.severity.label.trivial + Fix TODO or change to ENH. + /* The audit log storage directory should be explicitly + * defined. But if it isn't try to write to the same + * directory where the index file is placed. Of course, + * it is *very* bad practice to allow the Apache user + * to write to the same directory where a root user is + * writing to but it's not us that's causing the problem + * and there isn't anything we can do about that. + * + * TODO Actually there is something we can do! We will make + * SecAuditStorageDir mandatory, ask the user to explicitly + * define the storage location *and* refuse to work if the + * index and the storage location are in the same folder. + */ + if (msr->txcfg->auditlog_storage_dir == NULL) { + entry_filename = file_dirname(msr->mp, msr->txcfg->auditlog_name); + } + else { + entry_filename = msr->txcfg->auditlog_storage_dir; + } + if (entry_filename == NULL) return; + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:07:22:398 GMT-08:00 + 2008-01-09 :: 13:07:33:012 GMT-08:00 + + brian + brian + apache2/msc_logging.c + item.type.label.suggestion + item.severity.label.trivial + Change TODO to ENH. + /* AUDITLOG_PART_UPLOADS */ + // TODO: Implement + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:08:02:613 GMT-08:00 + 2008-01-09 :: 13:08:21:014 GMT-08:00 + + brian + brian + apache2/msc_lua.c + item.type.label.missing + item.severity.label.trivial + Log an error. + } else { + // TODO Error + return NULL; + } + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:08:51:978 GMT-08:00 + 2008-01-09 :: 13:09:44:680 GMT-08:00 + + brian + brian + apache2/msc_util.c + item.type.label.suggestion + item.severity.label.normal + Fix TODO. + char *resolve_relative_path(apr_pool_t *pool, const char *parent_filename, const char *filename) { + if (filename == NULL) return NULL; + // TODO Support paths on operating systems other than Unix. + if (filename[0] == '/') return (char *)filename; + + return apr_pstrcat(pool, apr_pstrndup(pool, parent_filename, + strlen(parent_filename) - strlen(apr_filepath_name_get(parent_filename))), + filename, NULL); +} + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:10:22:786 GMT-08:00 + 2008-01-09 :: 13:10:31:982 GMT-08:00 + + brian + brian + apache2/pdf_protect.c + item.type.label.suggestion + item.severity.label.trivial + Change from TODO to ENH. + // TODO We need ID and REV values for the PDF XSS alert. + +// TODO It would be nice if the user could choose the ID/REV/SEVERITY/MESSAGE, etc. + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:10:53:181 GMT-08:00 + 2008-01-09 :: 13:11:06:931 GMT-08:00 + + brian + brian + apache2/pdf_protect.c + item.type.label.suggestion + item.severity.label.trivial + Change from TODO to ENH. + // TODO Should we look at err_headers_out too? + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:11:23:251 GMT-08:00 + 2008-01-09 :: 13:11:28:132 GMT-08:00 + + brian + brian + apache2/pdf_protect.c + item.type.label.suggestion + item.severity.label.trivial + Change from TODO to ENH. + // TODO application/x-pdf, application/vnd.fdf, application/vnd.adobe.xfdf, + // application/vnd.adobe.xdp+xml, application/vnd.adobe.xfd+xml, application/vnd.pdf + // application/acrobat, text/pdf, text/x-pdf ??? + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:11:54:942 GMT-08:00 + 2008-01-09 :: 13:12:24:617 GMT-08:00 + + brian + brian + apache2/pdf_protect.c + item.type.label.missing + item.severity.label.trivial + Add the missing alert. + // TODO Log alert + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:13:04:159 GMT-08:00 + 2008-01-09 :: 13:13:38:064 GMT-08:00 + + brian + brian + apache2/re_actions.c + item.type.label.suggestion + item.severity.label.trivial + Not positive why the TODO here. Perhaps for a decision as to log and/or at what level? + msr_log(msr, 4, "Ctl: Set auditEngine to %d.", msr->txcfg->auditlog_flag); // TODO + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:14:02:379 GMT-08:00 + 2008-01-09 :: 13:14:19:589 GMT-08:00 + + brian + brian + apache2/re_operators.c + item.type.label.suggestion + item.severity.label.trivial + Change from TODO to ENH. + // TODO Write & use string_ends(s, e). + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:14:29:571 GMT-08:00 + 2008-01-09 :: 13:14:57:669 GMT-08:00 + + brian + brian + apache2/re_operators.c + item.type.label.suggestion + item.severity.label.trivial + Remove the ifdef as lua is required? + #ifdef WITH_LUA + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:17:47:759 GMT-08:00 + 2008-01-09 :: 13:17:59:417 GMT-08:00 + + brian + brian + CHANGES + item.type.label.suggestion + item.severity.label.trivial + Remove TODO. + TODO: more to come + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:35:00:891 GMT-08:00 + 2008-01-09 :: 13:35:40:975 GMT-08:00 + + brian + brian + apache2/modsecurity.h + item.type.label.optimization + item.severity.label.trivial + Need to re-test implementing this as just a table. + /* data cache */ + apr_hash_t *tcache; + + + item.resolution.label.validNeedsfixing + item.status.label.open + + + + 2008-01-09 :: 13:37:04:264 GMT-08:00 + 2008-01-09 :: 13:37:25:196 GMT-08:00 + + brian + brian + apache2/modsecurity.h + item.type.label.suggestion + item.severity.label.trivial + Should probably use STRINGIFY and define the numeric value. + #define MODSEC_VERSION_MAJOR "2" +#define MODSEC_VERSION_MINOR "5" +#define MODSEC_VERSION_MAINT "0" +#define MODSEC_VERSION_TYPE "rc" +#define MODSEC_VERSION_RELEASE "1" + + + item.resolution.label.validNeedsfixing + item.status.label.open +