github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-29 19:24:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adds support for Log and Rev actions

Browse Source
This commit is contained in:
Felipe Zimmerle
2015-08-07 02:29:24 -03:00
parent ad9393a8c2
commit c06179f18e
8 changed files with 196 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/parser/seclang-parser.yy
View File

@@ -19,6 +19,7 @@ class Driver;
#include "actions/action.h"
#include "actions/set_var.h"
#include "actions/msg.h"
#include "actions/rev.h"
#include "actions/tag.h"
#include "actions/transformations/transformation.h"
#include "operators/operator.h"
@@ -45,6 +46,7 @@ class Driver;
using ModSecurity::actions::Action;
using ModSecurity::actions::SetVar;
using ModSecurity::actions::Tag;
using ModSecurity::actions::Rev;
using ModSecurity::actions::Msg;
using ModSecurity::actions::transformations::Transformation;
using ModSecurity::operators::Operator;
@@ -192,6 +194,7 @@ using ModSecurity::Variables::Variable;
%token <std::string> ACTION_SETVAR
%token <std::string> ACTION_MSG
%token <std::string> ACTION_TAG
%token <std::string> ACTION_REV
%token <std::string> TRANSFORMATION
%token <double> CONFIG_VALUE_NUMBER
@@ -693,6 +696,28 @@ actions:
actions->push_back(tag);
$$ = actions;
}
| actions COMMA ACTION_REV
{
std::vector<Action *> *a = $1;
Rev *rev = new Rev($3);
a->push_back(rev);
$$ = $1;
}
| SPACE ACTION_REV
{
std::vector<Action *> *actions = new std::vector<Action *>;
Rev *rev = new Rev($2);
actions->push_back(rev);
$$ = actions;
}
| ACTION_REV
{
std::vector<Action *> *actions = new std::vector<Action *>;
Rev *rev = new Rev($1);
actions->push_back(rev);
$$ = actions;
}
%%
void

4
src/parser/seclang-scanner.ll
View File

@@ -23,11 +23,12 @@ using ModSecurity::split;
%}
%option noyywrap nounput batch debug noinput
ACTION (?i:accuracy|allow|append|auditlog|block|capture|chain|ctl|deny|deprecatevar|drop|exec|expirevar|id:[0-9]+|id:'[0-9]+'|initcol|log|logdata|maturity|multiMatch|noauditlog|nolog|pass|pause|phase:[0-9]+|prepend|proxy|redirect:[A-Z0-9_\|\&\:\/\/\.]+|rev|sanitiseArg|sanitiseMatched|sanitiseMatchedBytes|sanitiseRequestHeader|sanitiseResponseHeader|setuid|setrsc|setsid|setenv|skip|skipAfter|status:[0-9]+|ver|xmlns)
ACTION (?i:accuracy|allow|append|auditlog|block|capture|chain|ctl|deny|deprecatevar|drop|exec|expirevar|id:[0-9]+|id:'[0-9]+'|initcol|log|logdata|maturity|multiMatch|noauditlog|nolog|pass|pause|phase:[0-9]+|prepend|proxy|redirect:[A-Z0-9_\|\&\:\/\/\.]+|sanitiseArg|sanitiseMatched|sanitiseMatchedBytes|sanitiseRequestHeader|sanitiseResponseHeader|setuid|setrsc|setsid|setenv|skip|skipAfter|status:[0-9]+|ver|xmlns)
ACTION_SEVERITY (?i:severity:[0-9]+|severity:'[0-9]+'|severity:(EMERGENCY|ALERT|CRITICAL|ERROR|WARNING|NOTICE|INFO|DEBUG)|severity:'(EMERGENCY|ALERT|CRITICAL|ERROR|WARNING|NOTICE|INFO|DEBUG)')
ACTION_SETVAR (?i:setvar)
ACTION_MSG (?i:msg)
ACTION_TAG (?i:tag)
ACTION_REV (?i:rev)
DIRECTIVE SecRule
CONFIG_DIRECTIVE SecRequestBodyNoFilesLimit|SecRequestBodyInMemoryLimit|SecPcreMatchLimitRecursion|SecPcreMatchLimit|SecResponseBodyMimeType|SecTmpDir|SecDataDir|SecArgumentSeparator|SecCookieFormat|SecStatusEngine
@@ -202,6 +203,7 @@ FREE_TEXT_NEW_LINE [^\"|\n]+
}
{ACTION_MSG}:'{FREE_TEXT}' { return yy::seclang_parser::make_ACTION_MSG(strchr(yytext, ':') + 1, *driver.loc.back()); }
{ACTION_TAG}:'{FREE_TEXT}' { return yy::seclang_parser::make_ACTION_TAG(strchr(yytext, ':') + 1, *driver.loc.back()); }
{ACTION_REV}:'{FREE_TEXT}' { return yy::seclang_parser::make_ACTION_REV(strchr(yytext, ':') + 1, *driver.loc.back()); }
["] { return yy::seclang_parser::make_QUOTATION_MARK(*driver.loc.back()); }
[,] { return yy::seclang_parser::make_COMMA(*driver.loc.back()); }