github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-27 02:08:49 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3442 from airween/v3/caseinsruleremovetarget

Browse Source 
fix: ignore case when evaluating exceptions
This commit is contained in:
Ervin Hegedus 2025-09-17 21:25:28 +03:00 committed by GitHub
commit e523d7223b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 78 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/rule_with_operator.cc
View File

@ -158,7 +158,7 @@ inline void RuleWithOperator::getFinalVars(variables::Variables *vars,
variables::Variables addition; variables::Variables addition;
getVariablesExceptions(*trans, exclusion, &addition); // cppcheck-suppress ctunullpointer getVariablesExceptions(*trans, exclusion, &addition); // cppcheck-suppress ctunullpointer
for (int i = 0; i < m_variables->size(); i++) { for (std::size_t i = 0; i < m_variables->size(); i++) {
Variable *variable = m_variables->at(i); Variable *variable = m_variables->at(i);
if (exclusion->contains(variable)) { if (exclusion->contains(variable)) {
continue; continue;
@ -166,8 +166,15 @@ inline void RuleWithOperator::getFinalVars(variables::Variables *vars,
if (std::find_if(trans->m_ruleRemoveTargetById.begin(), if (std::find_if(trans->m_ruleRemoveTargetById.begin(),
trans->m_ruleRemoveTargetById.end(), trans->m_ruleRemoveTargetById.end(),
[&, variable, this](const auto &m) -> bool { [&, variable, this](const auto &m) -> bool {
return m.first == m_ruleId const auto& str1 = m.second;
&& m.second == *variable->m_fullName.get(); const auto& str2 = *variable->m_fullName.get();
return m.first == m_ruleId &&
str1.size() == str2.size() &&
std::equal(str1.begin(), str1.end(), str2.begin(),
[](char a, char b) {
return std::tolower(static_cast<unsigned char>(a)) ==
std::tolower(static_cast<unsigned char>(b));
}); // end-of std::equal
}) != trans->m_ruleRemoveTargetById.end()) { }) != trans->m_ruleRemoveTargetById.end()) {
continue; continue;
} }

68
test/test-cases/regression/action-ctl_rule_remove_target_by_id.json
View File

@ -95,5 +95,73 @@
"SecRule REQUEST_FILENAME \"@endsWith /wp-login.php\" \"id:9002100,phase:2,t:none,nolog,pass,ctl:ruleRemoveTargetById=1;ARGS\"", "SecRule REQUEST_FILENAME \"@endsWith /wp-login.php\" \"id:9002100,phase:2,t:none,nolog,pass,ctl:ruleRemoveTargetById=1;ARGS\"",
"SecRule ARGS \"@contains lhebs\" \"id:1,phase:3,t:none,status:202,block,deny,tag:'CRS'\"" "SecRule ARGS \"@contains lhebs\" \"id:1,phase:3,t:none,status:202,block,deny,tag:'CRS'\""
] ]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing CtlRuleRemoveTargetById (4): uppercase `Referer` header",
"expected":{
"http_code": 200
},
"client":{
"ip":"200.249.12.31",
"port":123
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Content-Type": "text/xml",
"Referer": "This is an attack"
},
"uri":"/index.html",
"method":"GET",
"body": [ ]
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"rules":[
"SecRuleEngine On",
"SecRule REQUEST_FILENAME \"@unconditionalMatch\" \"id:1,phase:1,pass,t:none,ctl:ruleRemoveTargetById=2;REQUEST_HEADERS:referer\"",
"SecRule REQUEST_HEADERS:Referer \"@contains attack\" \"id:2,phase:1,deny,t:none,log\""
]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing CtlRuleRemoveTargetById (5): lowercase `Referer` header",
"expected":{
"http_code": 200
},
"client":{
"ip":"200.249.12.31",
"port":123
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Content-Type": "text/xml",
"referer": "This is an attack"
},
"uri":"/index.html",
"method":"GET",
"body": [ ]
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"rules":[
"SecRuleEngine On",
"SecRule REQUEST_FILENAME \"@unconditionalMatch\" \"id:1,phase:1,pass,t:none,ctl:ruleRemoveTargetById=2;REQUEST_HEADERS:referer\"",
"SecRule REQUEST_HEADERS:Referer \"@contains attack\" \"id:2,phase:1,deny,t:none,log\""
]
} }
] ]