github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-29 19:24:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

rx:exit after full match; fix TX population after unused group

Browse Source
This commit is contained in:
martinhsv
2020-06-29 06:13:45 -07:00
parent a1a8c0fda7
commit b9620c26a0
5 changed files with 184 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/operators/rx.cc
View File

@@ -38,7 +38,6 @@ bool Rx::init(const std::string &arg, std::string *error) {
bool Rx::evaluate(Transaction *transaction, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
std::list<SMatch> matches;
Regex *re;
if (m_param.empty() && !m_string->m_containsMacro) {
@@ -52,29 +51,29 @@ bool Rx::evaluate(Transaction *transaction, RuleWithActions *rule,
re = m_re;
}
matches = re->searchAll(input);
std::vector<Utils::SMatchCapture> captures;
re->searchOneMatch(input, captures);
if (rule && rule->hasCaptureAction() && transaction) {
int i = 0;
matches.reverse();
for (const SMatch& a : matches) {
for (const Utils::SMatchCapture& capture : captures) {
const std::string capture_substring(input.substr(capture.m_offset,capture.m_length));
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
std::to_string(i), a.str());
std::to_string(capture.m_group), capture_substring);
ms_dbg_a(transaction, 7, "Added regex subexpression TX." +
std::to_string(i) + ": " + a.str());
transaction->m_matched.push_back(a.str());
i++;
std::to_string(capture.m_group) + ": " + capture_substring);
transaction->m_matched.push_back(capture_substring);
}
}
for (const auto & i : matches) {
logOffset(ruleMessage, i.offset(), i.str().size());
for (const auto & capture : captures) {
logOffset(ruleMessage, capture.m_offset, capture.m_length);
}
if (m_string->m_containsMacro) {
delete re;
}
if (matches.size() > 0) {
if (captures.size() > 0) {
return true;
}