github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 05:45:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix tags not being populated in audit log when multiMatch is enabled

Browse Source 
Fixes #2754.
This commit is contained in:
Marios Levogiannis 2023-01-16 18:13:44 +02:00
parent dabf79eec2
commit d3a6b6a6fd
No known key found for this signature in database
GPG Key ID: DD03BC9E27BC45EA
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/rule_with_actions.cc
View File

@ -229,6 +229,9 @@ void RuleWithActions::executeActionsIndependentOfChainedRuleResult(Transaction *
if (m_msg) { if (m_msg) {
m_msg->evaluate(this, trans, ruleMessage); m_msg->evaluate(this, trans, ruleMessage);
} }
for (actions::Tag *a : m_actionsTag) {
a->evaluate(this, trans, ruleMessage);
}
} }
} }

8
test/test-cases/regression/auditlog.json
View File

@ -253,14 +253,14 @@
"body": "" "body": ""
}, },
"expected": { "expected": {
"audit_log": "\\[msg \"testmsg\"\\]", "audit_log": "\\[msg \"testmsg\"\\] \\[data \"testdata\"\\] \\[severity \"7\"\\] \\[ver \"\"\\] \\[maturity \"0\"\\] \\[accuracy \"0\"\\] \\[tag \"testtag1\"\\] \\[tag \"testtag2\"\\]",
"error_log": "", "error_log": "",
"http_code": 403 "http_code": 403
}, },
"rules": [ "rules": [
"SecRuleEngine On", "SecRuleEngine On",
"SecDefaultAction \"phase:1,nolog,auditlog,deny,status:403\"", "SecDefaultAction \"phase:1,nolog,auditlog,deny,status:403\"",
"SecRule ARGS \"@contains test2\" \"id:1557,phase:1,multiMatch,block,log,t:none,t:urlDecode,t:lowercase,msg:'testmsg'\"", "SecRule ARGS \"@contains test2\" \"id:1557,phase:1,multiMatch,block,log,t:none,t:urlDecode,t:lowercase,msg:'testmsg',logdata:'testdata',severity:'DEBUG',tag:'testtag1',tag:'testtag2'\"",
"SecAuditEngine RelevantOnly", "SecAuditEngine RelevantOnly",
"SecAuditLogParts ABCFHZ", "SecAuditLogParts ABCFHZ",
"SecAuditLog /tmp/test/modsec_audit_multimatch_1.log", "SecAuditLog /tmp/test/modsec_audit_multimatch_1.log",
@ -302,14 +302,14 @@
"body": "" "body": ""
}, },
"expected": { "expected": {
"audit_log": "\\[msg \"tstmsg\"\\]", "audit_log": "\\[msg \"testmsg\"\\] \\[data \"testdata\"\\] \\[severity \"7\"\\] \\[ver \"\"\\] \\[maturity \"0\"\\] \\[accuracy \"0\"\\] \\[tag \"testtag1\"\\] \\[tag \"testtag2\"\\]",
"error_log": "", "error_log": "",
"http_code": 403 "http_code": 403
}, },
"rules": [ "rules": [
"SecRuleEngine On", "SecRuleEngine On",
"SecDefaultAction \"phase:1,nolog,auditlog,deny,status:403\"", "SecDefaultAction \"phase:1,nolog,auditlog,deny,status:403\"",
"SecRule ARGS \"@streq tEst2\" \"id:1558,phase:1,multiMatch,block,log,t:none,t:trim,t:lowercase,msg:'tstmsg'\"", "SecRule ARGS \"@streq tEst2\" \"id:1558,phase:1,multiMatch,block,log,t:none,t:trim,t:lowercase,msg:'testmsg',logdata:'testdata',severity:'DEBUG',tag:'testtag1',tag:'testtag2'\"",
"SecAuditEngine RelevantOnly", "SecAuditEngine RelevantOnly",
"SecAuditLogParts ABCFHZ", "SecAuditLogParts ABCFHZ",
"SecAuditLog /tmp/test/modsec_audit_multimatch_2.log", "SecAuditLog /tmp/test/modsec_audit_multimatch_2.log",