github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 13:56:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3202 from marcstern/v2/pr/assert

Browse Source 
Fixed assert() usage
This commit is contained in:
Ervin Hegedus 2024-08-18 22:58:06 +02:00 committed by GitHub
commit e7e11d972f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
13 changed files with 924 additions and 155 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

714
apache2/apache2_config.c
View File

File diff suppressed because it is too large Load Diff

2
apache2/modsecurity.c
View File

@ -670,6 +670,7 @@ static apr_status_t modsecurity_process_phase_response_headers(modsec_rec *msr)
*
*/
static apr_status_t modsecurity_process_phase_response_body(modsec_rec *msr) {
assert(msr != NULL);
apr_time_t time_before;
apr_status_t rc = 0;
@ -701,6 +702,7 @@ static apr_status_t modsecurity_process_phase_response_body(modsec_rec *msr) {
*
*/
static apr_status_t modsecurity_process_phase_logging(modsec_rec *msr) {
assert(msr != NULL);
apr_time_t time_before, time_after;
if (msr->txcfg->debuglog_level >= 4) {

2
apache2/msc_geo.c
View File

@ -12,6 +12,7 @@
* directly using the email address security@modsecurity.org.
*/
#include <assert.h>
#include "msc_geo.h"
@ -244,6 +245,7 @@ static int field_length(const char *field, int maxlen)
*/
int geo_init(directory_config *dcfg, const char *dbfn, char **error_msg)
{
assert(dcfg != NULL);
*error_msg = NULL;
if ((dcfg->geo == NULL) || (dcfg->geo == NOT_SET_P)) {

10
apache2/msc_json.c
View File

@ -21,6 +21,7 @@ const char *base_offset=NULL;
int json_add_argument(modsec_rec *msr, const char *value, unsigned length)
{
assert(msr != NULL);
assert(msr->json != NULL);
msc_arg *arg = (msc_arg *) NULL;
/**
@ -89,6 +90,7 @@ static int yajl_map_key(void *ctx, const unsigned char *key, size_t length)
{
modsec_rec *msr = (modsec_rec *) ctx;
assert(msr != NULL);
assert(msr->json != NULL);
unsigned char *safe_key = (unsigned char *) NULL;
/**
@ -168,6 +170,7 @@ static int yajl_number(void *ctx, const char *value, size_t length)
static int yajl_start_array(void *ctx) {
modsec_rec *msr = (modsec_rec *) ctx;
assert(msr != NULL);
assert(msr->json != NULL);
if (!msr->json->current_key && !msr->json->prefix) {
msr->json->prefix = apr_pstrdup(msr->mp, "array");
@ -198,6 +201,7 @@ static int yajl_start_array(void *ctx) {
static int yajl_end_array(void *ctx) {
modsec_rec *msr = (modsec_rec *) ctx;
assert(msr != NULL);
assert(msr->json != NULL);
unsigned char *separator = (unsigned char *) NULL;
/**
@ -235,6 +239,7 @@ static int yajl_start_map(void *ctx)
{
modsec_rec *msr = (modsec_rec *) ctx;
assert(msr != NULL);
assert(msr->json != NULL);
/**
* If we do not have a current_key, this is a top-level hash, so we do not
@ -274,6 +279,7 @@ static int yajl_end_map(void *ctx)
{
modsec_rec *msr = (modsec_rec *) ctx;
assert(msr != NULL);
assert(msr->json != NULL);
unsigned char *separator = (unsigned char *) NULL;
/**
@ -365,6 +371,7 @@ int json_init(modsec_rec *msr, char **error_msg) {
*/
int json_process_chunk(modsec_rec *msr, const char *buf, unsigned int size, char **error_msg) {
assert(msr != NULL);
assert(msr->json != NULL);
assert(error_msg != NULL);
*error_msg = NULL;
base_offset=buf;
@ -393,6 +400,7 @@ int json_process_chunk(modsec_rec *msr, const char *buf, unsigned int size, char
*/
int json_complete(modsec_rec *msr, char **error_msg) {
assert(msr != NULL);
assert(msr->json != NULL);
assert(error_msg != NULL);
char *json_data = (char *) NULL;
@ -419,6 +427,8 @@ int json_complete(modsec_rec *msr, char **error_msg) {
* Frees the resources used for JSON parsing.
*/
apr_status_t json_cleanup(modsec_rec *msr) {
assert(msr != NULL);
assert(msr->json != NULL);
msr_log(msr, 4, "JSON: Cleaning up JSON results");
if (msr->json->handle != NULL) {
yajl_free(msr->json->handle);

5
apache2/msc_logging.c
View File

@ -654,6 +654,7 @@ static void write_rule_json(modsec_rec *msr, const msre_rule *rule, yajl_gen g)
* Produce an audit log entry in JSON format.
*/
void sec_audit_logger_json(modsec_rec *msr) {
assert(msr != NULL);
const apr_array_header_t *arr = NULL;
apr_table_entry_t *te = NULL;
const apr_array_header_t *tarr_pattern = NULL;
@ -1547,6 +1548,7 @@ void sec_audit_logger_json(modsec_rec *msr) {
* Produce an audit log entry in native format.
*/
void sec_audit_logger_native(modsec_rec *msr) {
assert(msr != NULL);
const apr_array_header_t *arr = NULL;
apr_table_entry_t *te = NULL;
const apr_array_header_t *tarr_pattern = NULL;
@ -2235,7 +2237,7 @@ void sec_audit_logger_native(modsec_rec *msr) {
sec_auditlog_write(msr, text, strlen(text));
} else {
if ((rule != NULL) && (rule->actionset != NULL) && !rule->actionset->is_chained && (rule->chain_starter == NULL)) {
text = apr_psprintf(msr->mp, "%s\n\n", rule->unparsed);
text = apr_psprintf(msr->mp, "%s\n", rule->unparsed);
sec_auditlog_write(msr, text, strlen(text));
}
}
@ -2327,6 +2329,7 @@ void sec_audit_logger_native(modsec_rec *msr) {
*/
void sec_audit_logger(modsec_rec *msr) {
#ifdef WITH_YAJL
assert(msr != NULL);
if (msr->txcfg->auditlog_format == AUDITLOGFORMAT_JSON) {
sec_audit_logger_json(msr);
} else {

1
apache2/msc_multipart.c
View File

@ -1327,6 +1327,7 @@ int multipart_process_chunk(modsec_rec *msr, const char *buf,
*
*/
apr_status_t multipart_cleanup(modsec_rec *msr) {
assert(msr != NULL);
int keep_files = 0;
if (msr->mpd == NULL) return -1;

1
apache2/msc_parsers.c
View File

@ -245,6 +245,7 @@ int parse_arguments(modsec_rec *msr, const char *s, apr_size_t inputlength,
apr_table_t *arguments, int *invalid_count)
{
assert(msr != NULL);
assert(invalid_count != NULL);
msc_arg *arg;
apr_size_t i, j;
char *value = NULL;

3
apache2/msc_reqbody.c
View File

@ -25,6 +25,7 @@
void msre_engine_reqbody_processor_register(msre_engine *engine,
const char *name, void *fn_init, void *fn_process, void *fn_complete)
{
assert(engine != NULL);
msre_reqbody_processor_metadata *metadata =
(msre_reqbody_processor_metadata *)apr_pcalloc(engine->mp,
sizeof(msre_reqbody_processor_metadata));
@ -440,6 +441,7 @@ apr_status_t modsecurity_request_body_store(modsec_rec *msr,
apr_status_t modsecurity_request_body_to_stream(modsec_rec *msr, const char *buffer, int buflen, char **error_msg) {
assert(msr != NULL);
assert(error_msg != NULL);
assert(buffer != NULL || buflen == 0);
#ifndef MSC_LARGE_STREAM_INPUT
char *stream_input_body = NULL;
char *data = NULL;
@ -812,6 +814,7 @@ apr_status_t modsecurity_request_body_retrieve_start(modsec_rec *msr, char **err
*
*/
apr_status_t modsecurity_request_body_retrieve_end(modsec_rec *msr) {
assert(msr != NULL);
if (msr->msc_reqbody_storage == MSC_REQBODY_DISK) {
if (msr->msc_reqbody_fd > 0) {
close(msr->msc_reqbody_fd);

2
apache2/msc_xml.c
View File

@ -140,6 +140,8 @@ int xml_complete(modsec_rec *msr, char **error_msg) {
* Frees the resources used for XML parsing.
*/
apr_status_t xml_cleanup(modsec_rec *msr) {
assert(msr != NULL);
assert(msr->xml != NULL);
if (msr->xml->parsing_ctx != NULL) {
if (msr->xml->parsing_ctx->myDoc) {
xmlFreeDoc(msr->xml->parsing_ctx->myDoc);

41
apache2/re.c
View File

@ -203,6 +203,7 @@ char *msre_ruleset_phase_rule_update_target_matching_exception(modsec_rec *msr,
const char *p3)
{
assert(ruleset != NULL);
assert(phase_arr != NULL);
msre_rule **rules;
int i, j, mode;
char *err;
@ -212,7 +213,10 @@ char *msre_ruleset_phase_rule_update_target_matching_exception(modsec_rec *msr,
rules = (msre_rule **)phase_arr->elts;
for (i = 0; i < phase_arr->nelts; i++) {
msre_rule *rule = (msre_rule *)rules[i];
assert(rule != NULL);
if (mode == 0) { /* Looking for next rule. */
assert(rule->actionset != NULL);
if (msre_ruleset_rule_matches_exception(rule, re)) {
err = update_rule_target_ex(msr, ruleset, rule, p2, p3);
if (err) return err;
@ -527,10 +531,12 @@ end:
}
int msre_ruleset_rule_matches_exception(msre_rule *rule, rule_exception *re) {
assert(rule != NULL);
int match = 0;
/* Only remove non-placeholder rules */
if (rule->placeholder == RULE_PH_NONE) {
assert(re != NULL);
switch(re->type) {
case RULE_EXCEPTION_REMOVE_ID :
if ((rule->actionset != NULL)&&(rule->actionset->id != NULL)) {
@ -1468,6 +1474,7 @@ apr_status_t msre_ruleset_process_phase(msre_ruleset *ruleset, modsec_rec *msr)
rules = (msre_rule **)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msre_rule *rule = rules[i];
assert(rule != NULL);
rule->execution_time = 0;
}
@ -1480,6 +1487,7 @@ apr_status_t msre_ruleset_process_phase(msre_ruleset *ruleset, modsec_rec *msr)
rules = (msre_rule **)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msre_rule *rule = rules[i];
assert(rule != NULL);
/* Ignore markers, which are never processed. */
if (rule->placeholder == RULE_PH_MARKER) continue;
@ -1498,6 +1506,8 @@ static apr_status_t msre_ruleset_process_phase_(msre_ruleset *ruleset, modsec_re
#else
apr_status_t msre_ruleset_process_phase(msre_ruleset *ruleset, modsec_rec *msr) {
#endif
assert(ruleset != NULL);
assert(msr != NULL);
apr_array_header_t *arr = NULL;
msre_rule **rules;
apr_status_t rc;
@ -1542,10 +1552,11 @@ static apr_status_t msre_ruleset_process_phase_(msre_ruleset *ruleset, modsec_re
rules = (msre_rule **)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msre_rule *rule = rules[i];
assert(rule != NULL);
assert(rule->actionset != NULL);
#if defined(PERFORMANCE_MEASUREMENT)
apr_time_t time1 = 0;
#endif
assert(rule->actionset != NULL);
/* Reset the rule interception flag */
msr->rule_was_intercepted = 0;
@ -1974,6 +1985,9 @@ msre_ruleset *msre_ruleset_create(msre_engine *engine, apr_pool_t *mp) {
* Adds one rule to the given phase of the ruleset.
*/
int msre_ruleset_rule_add(msre_ruleset *ruleset, msre_rule *rule, int phase) {
assert(ruleset != NULL);
assert(rule != NULL);
assert(rule->actionset != NULL);
apr_array_header_t *arr = NULL;
switch (phase) {
@ -2011,6 +2025,8 @@ int msre_ruleset_rule_add(msre_ruleset *ruleset, msre_rule *rule, int phase) {
static msre_rule * msre_ruleset_fetch_phase_rule(const msre_ruleset *ruleset, const char *id,
const apr_array_header_t *phase_arr, int offset)
{
assert(id != NULL);
assert(phase_arr != NULL);
msre_rule **rules = (msre_rule **)phase_arr->elts;
int i;
@ -2067,6 +2083,7 @@ msre_rule * msre_ruleset_fetch_rule(msre_ruleset *ruleset, const char *id, int o
static int msre_ruleset_phase_rule_remove_with_exception(msre_ruleset *ruleset, rule_exception *re,
apr_array_header_t *phase_arr)
{
assert(phase_arr != NULL);
msre_rule **rules;
int i, j, mode, removed_count;
@ -2084,6 +2101,7 @@ static int msre_ruleset_phase_rule_remove_with_exception(msre_ruleset *ruleset,
/* Only remove non-placeholder rules */
if (rule->placeholder == RULE_PH_NONE) {
assert(re != NULL);
switch(re->type) {
case RULE_EXCEPTION_REMOVE_ID :
if (rule->actionset->id != NULL) {
@ -2304,6 +2322,7 @@ char *msre_format_metadata(modsec_rec *msr, msre_actionset *actionset) {
char * msre_rule_generate_unparsed(apr_pool_t *pool, const msre_rule *rule, const char *targets,
const char *args, const char *actions)
{
assert(rule != NULL);
char *unparsed = NULL;
const char *r_targets = targets;
const char *r_args = args;
@ -2363,12 +2382,19 @@ msre_rule *msre_rule_create(msre_ruleset *ruleset, int type,
const char *fn, int line, const char *targets,
const char *args, const char *actions, char **error_msg)
{
assert(ruleset != NULL);
assert(args != NULL);
assert(error_msg != NULL);
// Normally useless code, left to be safe for the moment
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, ruleset->mp, NULL, "msre_rule_create: error_msg is NULL");
return NULL;
}
msre_rule *rule;
char *my_error_msg;
const char *argsp;
int rc;
if (error_msg == NULL) return NULL;
*error_msg = NULL;
rule = (msre_rule *)apr_pcalloc(ruleset->mp, sizeof(msre_rule));
@ -2521,6 +2547,8 @@ static void msre_perform_disruptive_actions(modsec_rec *msr, msre_rule *rule,
{
assert(msr != NULL);
assert(actionset != NULL);
assert(actionset->intercept_action_rec != NULL);
assert(actionset->intercept_action_rec->metadata != NULL);
const apr_array_header_t *tarr;
const apr_table_entry_t *telts;
int i;
@ -2534,6 +2562,7 @@ static void msre_perform_disruptive_actions(modsec_rec *msr, msre_rule *rule,
telts = (const apr_table_entry_t*)tarr->elts;
for (i = 0; i < tarr->nelts; i++) {
msre_action *action = (msre_action *)telts[i].val;
assert(action->metadata != NULL);
if (action->metadata->type == ACTION_DISRUPTIVE) {
if (action->metadata->execute != NULL) {
action->metadata->execute(msr, mptmp, rule, action);
@ -2797,6 +2826,11 @@ static int execute_operator(msre_var *var, msre_rule *rule, modsec_rec *msr,
* Executes rule against the given transaction.
*/
static apr_status_t msre_rule_process_normal(msre_rule *rule, modsec_rec *msr) {
assert(rule != NULL);
assert(rule->actionset != NULL);
assert(rule->targets != NULL);
assert(msr != NULL);
assert(msr->txcfg != NULL);
const apr_array_header_t *arr = NULL;
const apr_table_entry_t *te = NULL;
msre_actionset *acting_actionset = NULL;
@ -3343,6 +3377,8 @@ static apr_status_t msre_rule_process_normal(msre_rule *rule, modsec_rec *msr) {
*
*/
static apr_status_t msre_rule_process_lua(msre_rule *rule, modsec_rec *msr) {
assert(rule != NULL);
assert(msr != NULL);
msre_actionset *acting_actionset = NULL;
char *my_error_msg = NULL;
int rc;
@ -3380,6 +3416,7 @@ static apr_status_t msre_rule_process_lua(msre_rule *rule, modsec_rec *msr) {
*
*/
static apr_status_t msre_rule_process(msre_rule *rule, modsec_rec *msr) {
assert(msr != NULL);
/* Use a fresh memory sub-pool for processing each rule */
if (msr->msc_rule_mptmp == NULL) {
if (apr_pool_create(&msr->msc_rule_mptmp, msr->mp) != APR_SUCCESS) {

89
apache2/re_actions.c
View File

@ -27,6 +27,8 @@ static void msre_engine_action_register(msre_engine *engine, const char *name,
unsigned int cardinality_group, fn_action_validate_t validate,
fn_action_init_t init, fn_action_execute_t execute)
{
assert(engine != NULL);
assert(name != NULL);
msre_action_metadata *metadata = (msre_action_metadata *)apr_pcalloc(engine->mp,
sizeof(msre_action_metadata));
if (metadata == NULL) return;
@ -93,6 +95,8 @@ msre_var *generate_single_var(modsec_rec *msr, msre_var *var, apr_array_header_t
rvar->value = rval;
rvar->value_len = rval_len;
assert(msr != NULL);
assert(msr->txcfg != NULL);
if (msr->txcfg->debuglog_level >= 9) {
msr_log(msr, 9, "T (%d) %s: \"%s\"", rc, tfn->name,
log_escape_nq_ex(mptmp, rvar->value, rvar->value_len));
@ -172,6 +176,7 @@ apr_table_t *generate_multi_var(modsec_rec *msr, msre_var *var, apr_array_header
*/
int expand_macros(modsec_rec *msr, msc_string *var, msre_rule *rule, apr_pool_t *mptmp) {
assert(msr != NULL);
assert(msr->txcfg != NULL);
assert(var != NULL);
char *data = NULL;
apr_array_header_t *arr = NULL;
@ -321,6 +326,7 @@ int expand_macros(modsec_rec *msr, msc_string *var, msre_rule *rule, apr_pool_t
*/
apr_status_t collection_original_setvar(modsec_rec *msr, const char *col_name, const msc_string *orig_var) {
assert(msr != NULL);
assert(msr->txcfg != NULL);
apr_table_t *table = NULL;
msc_string *var = NULL;
const char *var_name = NULL;
@ -379,6 +385,8 @@ apr_status_t collection_original_setvar(modsec_rec *msr, const char *col_name, c
static apr_status_t msre_action_marker_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->id = action->param;
return 1;
}
@ -388,6 +396,8 @@ static apr_status_t msre_action_marker_init(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_id_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->id = action->param;
return 1;
}
@ -414,6 +424,8 @@ static char *msre_action_id_validate(msre_engine *engine, apr_pool_t *mp, msre_a
static apr_status_t msre_action_rev_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->rev = action->param;
return 1;
}
@ -423,6 +435,8 @@ static apr_status_t msre_action_rev_init(msre_engine *engine, apr_pool_t *mp, ms
static apr_status_t msre_action_msg_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->msg = action->param;
return 1;
}
@ -432,6 +446,8 @@ static apr_status_t msre_action_msg_init(msre_engine *engine, apr_pool_t *mp, ms
static apr_status_t msre_action_logdata_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->logdata = action->param;
return 1;
}
@ -441,6 +457,8 @@ static apr_status_t msre_action_logdata_init(msre_engine *engine, apr_pool_t *mp
static apr_status_t msre_action_sanitizeMatchedBytes_init(msre_engine *engine, apr_pool_t *mp,
msre_actionset *actionset, msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
char *parse_parm = NULL;
char *ac_param = NULL;
char *savedptr = NULL;
@ -469,6 +487,8 @@ static apr_status_t msre_action_sanitizeMatchedBytes_init(msre_engine *engine, a
static apr_status_t msre_action_accuracy_init(msre_engine *engine, apr_pool_t *mp,
msre_actionset *actionset, msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->accuracy = atoi(action->param);
return 1;
}
@ -478,6 +498,8 @@ static apr_status_t msre_action_accuracy_init(msre_engine *engine, apr_pool_t *m
static apr_status_t msre_action_maturity_init(msre_engine *engine, apr_pool_t *mp,
msre_actionset *actionset, msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->maturity = atoi(action->param);
return 1;
}
@ -487,6 +509,8 @@ static apr_status_t msre_action_maturity_init(msre_engine *engine, apr_pool_t *m
static apr_status_t msre_action_ver_init(msre_engine *engine, apr_pool_t *mp,
msre_actionset *actionset, msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->version = action->param;
return 1;
}
@ -496,6 +520,8 @@ static apr_status_t msre_action_ver_init(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_severity_init(msre_engine *engine, apr_pool_t *mp,
msre_actionset *actionset, msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
if (strcasecmp(action->param, "emergency") == 0) {
actionset->severity = 0;
} else if (strcasecmp(action->param, "alert") == 0) {
@ -523,6 +549,7 @@ static apr_status_t msre_action_severity_init(msre_engine *engine, apr_pool_t *m
static apr_status_t msre_action_chain_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
actionset->is_chained = 1;
return 1;
}
@ -531,6 +558,7 @@ static apr_status_t msre_action_chain_init(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_log_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
actionset->log = 1;
return 1;
}
@ -539,6 +567,7 @@ static apr_status_t msre_action_log_init(msre_engine *engine, apr_pool_t *mp, ms
static apr_status_t msre_action_nolog_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
actionset->log = 0;
actionset->auditlog = 0;
return 1;
@ -548,6 +577,7 @@ static apr_status_t msre_action_nolog_init(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_auditlog_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
actionset->auditlog = 1;
return 1;
}
@ -556,6 +586,7 @@ static apr_status_t msre_action_auditlog_init(msre_engine *engine, apr_pool_t *m
static apr_status_t msre_action_noauditlog_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
actionset->auditlog = 0;
return 1;
}
@ -564,6 +595,7 @@ static apr_status_t msre_action_noauditlog_init(msre_engine *engine, apr_pool_t
static apr_status_t msre_action_block_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
/* Right now we just set a flag and inherit the real disruptive action */
actionset->block = 1;
return 1;
@ -573,6 +605,7 @@ static apr_status_t msre_action_block_init(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_deny_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
actionset->intercept_action = ACTION_DENY;
actionset->intercept_action_rec = action;
return 1;
@ -587,6 +620,8 @@ static char *msre_action_status_validate(msre_engine *engine, apr_pool_t *mp, ms
static apr_status_t msre_action_status_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->intercept_status = atoi(action->param);
return 1;
}
@ -595,6 +630,8 @@ static apr_status_t msre_action_status_init(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_drop_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->intercept_action = ACTION_DROP;
actionset->intercept_action_rec = action;
return 1;
@ -609,6 +646,8 @@ static char *msre_action_pause_validate(msre_engine *engine, apr_pool_t *mp, msr
static apr_status_t msre_action_pause_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->intercept_action = ACTION_PAUSE;
actionset->intercept_pause = action->param;
return 1;
@ -624,6 +663,8 @@ static char *msre_action_redirect_validate(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_redirect_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->intercept_action = ACTION_REDIRECT;
actionset->intercept_uri = action->param;
actionset->intercept_action_rec = action;
@ -634,6 +675,8 @@ static apr_status_t msre_action_redirect_execute(modsec_rec *msr, apr_pool_t *mp
msre_rule *rule, msre_action *action)
{
assert(msr != NULL);
assert(rule != NULL);
assert(rule->actionset != NULL);
assert(action != NULL);
msc_string *var = NULL;
@ -658,6 +701,8 @@ static char *msre_action_proxy_validate(msre_engine *engine, apr_pool_t *mp, msr
static apr_status_t msre_action_proxy_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->intercept_action = ACTION_PROXY;
actionset->intercept_uri = action->param;
actionset->intercept_action_rec = action;
@ -668,6 +713,7 @@ static apr_status_t msre_action_proxy_execute(modsec_rec *msr, apr_pool_t *mptmp
msre_rule *rule, msre_action *action)
{
assert(msr != NULL);
assert(rule != NULL);
assert(action != NULL);
msc_string *var = NULL;
@ -692,6 +738,8 @@ static apr_status_t msre_action_proxy_execute(modsec_rec *msr, apr_pool_t *mptmp
static apr_status_t msre_action_pass_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->intercept_action = ACTION_NONE;
actionset->intercept_action_rec = action;
return 1;
@ -707,6 +755,8 @@ static char *msre_action_skip_validate(msre_engine *engine, apr_pool_t *mp, msre
static apr_status_t msre_action_skip_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->skip_count = atoi(action->param);
if (actionset->skip_count <= 0) actionset->skip_count = 1;
return 1;
@ -722,6 +772,8 @@ static char *msre_action_skipAfter_validate(msre_engine *engine, apr_pool_t *mp,
static apr_status_t msre_action_skipAfter_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->skip_after = action->param;
return 1;
}
@ -731,6 +783,8 @@ static apr_status_t msre_action_skipAfter_init(msre_engine *engine, apr_pool_t *
static apr_status_t msre_action_allow_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
actionset->intercept_action = ACTION_ALLOW;
actionset->intercept_action_rec = action;
@ -747,6 +801,7 @@ static apr_status_t msre_action_allow_init(msre_engine *engine, apr_pool_t *mp,
}
static char *msre_action_allow_validate(msre_engine *engine, apr_pool_t *mp, msre_action *action) {
assert(action != NULL);
if (action->param != NULL) {
if (strcasecmp(action->param, "phase") == 0) {
return NULL;
@ -771,6 +826,8 @@ static char *msre_action_phase_validate(msre_engine *engine, apr_pool_t *mp, msr
static apr_status_t msre_action_phase_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(actionset != NULL);
assert(action != NULL);
if(strcasecmp(action->param,"request") == 0)
actionset->phase = 2;
else if(strcasecmp(action->param,"response") == 0)
@ -786,6 +843,7 @@ static apr_status_t msre_action_phase_init(msre_engine *engine, apr_pool_t *mp,
/* t */
static char *msre_action_t_validate(msre_engine *engine, apr_pool_t *mp, msre_action *action) {
assert(action != NULL);
msre_tfn_metadata *metadata = NULL;
metadata = msre_engine_tfn_resolve(engine, action->param);
if (metadata == NULL) return apr_psprintf(mp, "Invalid transformation function: %s",
@ -797,6 +855,7 @@ static char *msre_action_t_validate(msre_engine *engine, apr_pool_t *mp, msre_ac
static apr_status_t msre_action_t_init(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset,
msre_action *action)
{
assert(action != NULL);
msre_tfn_metadata *metadata = (msre_tfn_metadata *)action->param_data;
action->param_data = metadata;
return 1;
@ -804,6 +863,7 @@ static apr_status_t msre_action_t_init(msre_engine *engine, apr_pool_t *mp, msre
/* ctl */
static char *msre_action_ctl_validate(msre_engine *engine, apr_pool_t *mp, msre_action *action) {
assert(action != NULL);
char *name = NULL;
char *value = NULL;
@ -1327,6 +1387,7 @@ static apr_status_t msre_action_ctl_execute(modsec_rec *msr, apr_pool_t *mptmp,
/* xmlns */
static char *msre_action_xmlns_validate(msre_engine *engine, apr_pool_t *mp, msre_action *action) {
assert(action != NULL);
char *name = NULL;
char *value = NULL;
@ -1387,12 +1448,14 @@ static apr_status_t msre_action_sanitizeMatched_execute(modsec_rec *msr, apr_poo
const apr_table_entry_t *telts;
int i, type = 0;
msc_string *mvar = msr->matched_var;
assert(mvar != NULL);
if (mvar->name_len == 0) return 0;
/* IMP1 We need to extract the variable name properly here,
* taking into account it may have been escaped.
*/
assert(mvar->name != NULL);
if ((mvar->name_len > 5) && (strncmp(mvar->name, "ARGS:", 5) == 0)) {
sargname = apr_pstrdup(msr->mp, mvar->name + 5);
type = SANITISE_ARG;
@ -1427,10 +1490,13 @@ static apr_status_t msre_action_sanitizeMatched_execute(modsec_rec *msr, apr_poo
switch(type) {
case SANITISE_ARG :
assert(msr->arguments_to_sanitize != NULL);
tarr = apr_table_elts(msr->arguments);
assert(tarr != NULL);
telts = (const apr_table_entry_t*)tarr->elts;
for (i = 0; i < tarr->nelts; i++) {
msc_arg *arg = (msc_arg *)telts[i].val;
assert(arg != NULL);
if (strcasecmp(sargname, arg->name) == 0) {
apr_table_addn(msr->arguments_to_sanitize, arg->name, (void *)arg);
}
@ -1438,10 +1504,12 @@ static apr_status_t msre_action_sanitizeMatched_execute(modsec_rec *msr, apr_poo
break;
case SANITISE_REQUEST_HEADER :
assert(msr->request_headers_to_sanitize != NULL);
apr_table_set(msr->request_headers_to_sanitize, sargname, "1");
break;
case SANITISE_RESPONSE_HEADER :
assert(msr->response_headers_to_sanitize != NULL);
apr_table_set(msr->response_headers_to_sanitize, sargname, "1");
break;
@ -1458,7 +1526,9 @@ static apr_status_t msre_action_sanitizeRequestHeader_execute(modsec_rec *msr, a
msre_rule *rule, msre_action *action)
{
assert(msr != NULL);
assert(msr->request_headers_to_sanitize != NULL);
assert(action != NULL);
assert(action->param != NULL);
apr_table_set(msr->request_headers_to_sanitize, action->param, "1");
return 1;
}
@ -1468,7 +1538,9 @@ static apr_status_t msre_action_sanitizeResponseHeader_execute(modsec_rec *msr,
msre_rule *rule, msre_action *action)
{
assert(msr != NULL);
assert(msr->response_headers_to_sanitize != NULL);
assert(action != NULL);
assert(action->param != NULL);
apr_table_set(msr->response_headers_to_sanitize, action->param, "1");
return 1;
}
@ -1479,6 +1551,7 @@ static apr_status_t msre_action_setenv_execute(modsec_rec *msr, apr_pool_t *mptm
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
char *data = apr_pstrdup(mptmp, action->param);
char *env_name = NULL, *env_value = NULL;
char *s = NULL;
@ -1496,6 +1569,7 @@ static apr_status_t msre_action_setenv_execute(modsec_rec *msr, apr_pool_t *mptm
*s = '\0';
}
assert(msr->txcfg != NULL);
if (msr->txcfg->debuglog_level >= 9) {
msr_log(msr, 9, "Setting env variable: %s=%s", env_name, env_value);
}
@ -1514,6 +1588,7 @@ static apr_status_t msre_action_setenv_execute(modsec_rec *msr, apr_pool_t *mptm
/* Execute the requested action. */
if (env_name != NULL && env_name[0] == '!') {
/* Delete */
assert(msr->r != NULL);
apr_table_unset(msr->r->subprocess_env, env_name + 1);
if (msr->txcfg->debuglog_level >= 9) {
@ -1534,6 +1609,7 @@ static apr_status_t msre_action_setenv_execute(modsec_rec *msr, apr_pool_t *mptm
expand_macros(msr, val, rule, mptmp);
/* To be safe, we escape NULs as it goes in subprocess_env. */
assert(msr->mp != NULL);
val_value = log_escape_nul(msr->mp, (const unsigned char *)val->value, val->value_len);
apr_table_set(msr->r->subprocess_env, env_name, val_value);
@ -1744,6 +1820,7 @@ static apr_status_t msre_action_setvar_parse(modsec_rec *msr, apr_pool_t *mptmp,
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
char *data = apr_pstrdup(mptmp, action->param);
char *var_name = NULL, *var_value = NULL;
char *s = NULL;
@ -1771,6 +1848,7 @@ static apr_status_t msre_action_expirevar_execute(modsec_rec *msr, apr_pool_t *m
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
char *data = apr_pstrdup(mptmp, action->param);
char *col_name = NULL, *var_name = NULL, *var_value = NULL;
char *s = NULL;
@ -1870,6 +1948,7 @@ static apr_status_t msre_action_deprecatevar_execute(modsec_rec *msr, apr_pool_t
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
char *data = apr_pstrdup(mptmp, action->param);
char *col_name = NULL, *var_name = NULL, *var_value = NULL;
char *s = NULL;
@ -2005,6 +2084,8 @@ static apr_status_t init_collection(modsec_rec *msr, const char *real_col_name,
const char *col_name, const char *col_key, unsigned int col_key_len)
{
assert(msr != NULL);
assert(msr->collections != NULL);
assert(msr->txcfg != NULL);
assert(real_col_name != NULL);
apr_table_t *table = NULL;
msc_string *var = NULL;
@ -2141,6 +2222,7 @@ static apr_status_t msre_action_initcol_execute(modsec_rec *msr, apr_pool_t *mpt
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
char *data = apr_pstrdup(msr->mp, action->param);
char *col_name = NULL, *col_key = NULL;
unsigned int col_key_len;
@ -2174,6 +2256,7 @@ static apr_status_t msre_action_setsid_execute(modsec_rec *msr, apr_pool_t *mptm
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
msc_string *var = NULL;
char *real_col_name = NULL, *col_key = NULL;
unsigned int col_key_len;
@ -2200,6 +2283,7 @@ static apr_status_t msre_action_setuid_execute(modsec_rec *msr, apr_pool_t *mptm
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
msc_string *var = NULL;
char *real_col_name = NULL, *col_key = NULL;
unsigned int col_key_len;
@ -2226,6 +2310,7 @@ static apr_status_t msre_action_setrsc_execute(modsec_rec *msr, apr_pool_t *mptm
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
msc_string *var = NULL;
char *real_col_name = NULL, *col_key = NULL;
unsigned int col_key_len;
@ -2247,6 +2332,8 @@ static apr_status_t msre_action_setrsc_execute(modsec_rec *msr, apr_pool_t *mptm
/* exec */
static char *msre_action_exec_validate(msre_engine *engine, apr_pool_t *mp, msre_action *action) {
assert(action != NULL);
assert(action->param != NULL);
#if defined(WITH_LUA)
char *filename = (char *)action->param;
@ -2306,6 +2393,7 @@ static apr_status_t msre_action_prepend_execute(modsec_rec *msr, apr_pool_t *mpt
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
msc_string *var = NULL;
/* Expand any macros in the text */
@ -2328,6 +2416,7 @@ static apr_status_t msre_action_append_execute(modsec_rec *msr, apr_pool_t *mptm
{
assert(msr != NULL);
assert(action != NULL);
assert(action->param != NULL);
msc_string *var = NULL;
/* Expand any macros in the text */

117
apache2/re_operators.c
View File

@ -44,6 +44,8 @@
void msre_engine_op_register(msre_engine *engine, const char *name,
fn_op_param_init_t fn1, fn_op_execute_t fn2)
{
assert(engine != NULL);
assert(name != NULL);
msre_op_metadata *metadata = (msre_op_metadata *)apr_pcalloc(engine->mp,
sizeof(msre_op_metadata));
if (metadata == NULL) return;
@ -58,6 +60,7 @@ void msre_engine_op_register(msre_engine *engine, const char *name,
*
*/
msre_op_metadata *msre_engine_op_resolve(msre_engine *engine, const char *name) {
assert(engine != NULL);
return (msre_op_metadata *)apr_table_get(engine->operators, name);
}
@ -101,13 +104,17 @@ static int msre_op_nomatch_execute(modsec_rec *msr, msre_rule *rule,
* \retval 0 On Fail
*/
static int msre_op_ipmatch_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(error_msg != NULL);
// Normally useless code, left to be safe for the moment
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, "msre_op_ipmatch_param_init: error_msg is NULL");
return -1;
}
char *param = NULL;
int res = 0;
if (error_msg == NULL)
return -1;
else
*error_msg = NULL;
*error_msg = NULL;
param = apr_pstrdup(rule->ruleset->mp, rule->op_param);
@ -173,6 +180,8 @@ static int msre_op_ipmatch_execute(modsec_rec *msr, msre_rule *rule, msre_var *v
* \retval 0 On Fail
*/
static int msre_op_ipmatchFromFile_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(error_msg != NULL);
const char *rootpath = NULL;
const char *filepath = NULL;
const char *ipfile_path = NULL;
@ -300,6 +309,8 @@ static int msre_op_ipmatchFromFile_execute(modsec_rec *msr, msre_rule *rule,
/* rsub */
static char *param_remove_escape(msre_rule *rule, char *str, int len) {
assert(rule != NULL);
assert(str != NULL);
char *parm = apr_pcalloc(rule->ruleset->mp, len);
char *ret = parm;
@ -332,6 +343,14 @@ static char *param_remove_escape(msre_rule *rule, char *str, int len) {
*/
#if !defined(MSC_TEST)
static int msre_op_rsub_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
// Normally useless code, left to be safe for the moment
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, "msre_op_rsub_param_init: error_msg is NULL");
return -1;
}
#if AP_SERVER_MAJORVERSION_NUMBER > 1 && AP_SERVER_MINORVERSION_NUMBER > 0
ap_regex_t *regex;
#else
@ -349,7 +368,6 @@ static int msre_op_rsub_param_init(msre_rule *rule, char **error_msg) {
int ignore_case = 0;
unsigned short int op_len = 0;
if (error_msg == NULL) return -1;
*error_msg = NULL;
line = rule->op_param;
@ -674,6 +692,8 @@ nextround:
* \retval 0 On fail
*/
static int msre_op_validateHash_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(error_msg != NULL);
const char *errptr = NULL;
int erroffset;
msc_regex_t *regex;
@ -949,6 +969,8 @@ static int msre_op_validateHash_execute(modsec_rec *msr, msre_rule *rule, msre_v
/* rx */
static int msre_op_rx_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(error_msg != NULL);
const char *errptr = NULL;
int erroffset;
msc_regex_t *regex;
@ -1013,10 +1035,6 @@ static int msre_op_rx_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
assert(var != NULL);
assert(error_msg != NULL);
msc_regex_t *regex = (msc_regex_t *)rule->op_param_data;
if (!regex) {
msr_log(msr, 1, "rx: Memory allocation error");
return -1;
}
msc_string *re_pattern = (msc_string *)apr_pcalloc(msr->mp, sizeof(msc_string));
if (!re_pattern) {
msr_log(msr, 1, "rx: Memory allocation error");
@ -1270,6 +1288,9 @@ static int msre_op_rx_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
/* pm */
static int msre_op_pm_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
ACMP *p;
const char *phrase;
const char *next;
@ -1308,6 +1329,9 @@ static int msre_op_pm_param_init(msre_rule *rule, char **error_msg) {
/* pmFromFile */
static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
char errstr[1024];
char buf[HUGE_STRING_LEN + 1];
char *fn = NULL;
@ -1555,7 +1579,7 @@ static int msre_op_pm_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
* \retval url On Success
*/
static const char *gsb_replace_tpath(apr_pool_t *pool, const char *domain, int len) {
assert(domain != NULL);
char *pos = NULL, *data = NULL;
char *url = NULL;
int match = 0;
@ -1591,7 +1615,7 @@ static const char *gsb_replace_tpath(apr_pool_t *pool, const char *domain, int l
* \retval reduced On Success
*/
static const char *gsb_reduce_char(apr_pool_t *pool, const char *domain) {
assert(domain != NULL);
char *ptr = apr_pstrdup(pool, domain);
char *data = NULL;
char *reduced = NULL;
@ -1696,6 +1720,8 @@ static int verify_gsb(gsb_db *gsb, modsec_rec *msr, const char *match, unsigned
* \retval 0 On Fail
*/
static int msre_op_gsbLookup_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(error_msg != NULL);
const char *errptr = NULL;
int erroffset;
int options = 0;
@ -2079,6 +2105,10 @@ static int msre_op_gsbLookup_execute(modsec_rec *msr, msre_rule *rule, msre_var
/* within */
static int msre_op_within_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, char **error_msg) {
assert(msr != NULL);
assert(rule != NULL);
assert(var != NULL);
assert(error_msg != NULL);
msc_string *str = (msc_string *)apr_pcalloc(msr->mp, sizeof(msc_string));
const char *match = NULL;
const char *target;
@ -2239,7 +2269,6 @@ static int msre_op_detectSQLi_execute(modsec_rec *msr, msre_rule *rule, msre_var
assert(rule->actionset != NULL);
assert(rule->actionset->actions != NULL);
assert(var != NULL);
assert(var != NULL);
assert(error_msg != NULL);
char fingerprint[8];
int issqli;
@ -2276,6 +2305,7 @@ static int msre_op_detectXSS_execute(modsec_rec *msr, msre_rule *rule, msre_var
assert(rule != NULL);
assert(rule->actionset != NULL);
assert(rule->actionset->actions != NULL);
assert(var != NULL);
assert(error_msg != NULL);
int capture;
int is_xss;
@ -2538,6 +2568,13 @@ static int msre_op_beginsWith_execute(modsec_rec *msr, msre_rule *rule, msre_var
static int msre_op_endsWith_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, char **error_msg) {
assert(msr != NULL);
assert(rule != NULL);
assert(var != NULL);
assert(error_msg != NULL);
// Normally useless code, left to be safe for the moment
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, "msre_op_endsWith_execute: error_msg is NULL");
return -1;
}
const char *match = NULL;
const char *target;
unsigned int match_length;
@ -2603,12 +2640,19 @@ static int msre_op_endsWith_execute(modsec_rec *msr, msre_rule *rule, msre_var *
/* strmatch */
static int msre_op_strmatch_param_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
// Normally useless code, left to be safe for the moment
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, "msre_op_strmatch_param_init: error_msg is NULL");
return -1;
}
const apr_strmatch_pattern *compiled_pattern;
char *processed = NULL;
const char *pattern = rule->op_param;
unsigned short int op_len;
if (error_msg == NULL) return -1;
*error_msg = NULL;
op_len = strlen(pattern);
@ -2636,6 +2680,11 @@ static int msre_op_strmatch_execute(modsec_rec *msr, msre_rule *rule, msre_var *
assert(rule != NULL);
assert(var != NULL);
assert(error_msg != NULL);
// Normally useless code, left to be safe for the moment
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, "msre_op_strmatch_execute: error_msg is NULL");
return -1;
}
apr_strmatch_pattern *compiled_pattern = (apr_strmatch_pattern *)rule->op_param_data;
const char *target;
unsigned int target_length;
@ -2838,6 +2887,7 @@ static int msre_op_validateSchema_execute(modsec_rec *msr, msre_rule *rule, msre
* Luhn Mod-10 Method (ISO 2894/ANSI 4.13)
*/
static int luhn_verify(const char *ccnumber, int len) {
assert(ccnumber != NULL);
int sum[2] = { 0, 0 };
int odd = 0;
int digits = 0;
@ -2871,6 +2921,9 @@ static int luhn_verify(const char *ccnumber, int len) {
}
static int msre_op_verifyCC_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
const char *errptr = NULL;
int erroffset;
int options = 0;
@ -2900,6 +2953,7 @@ static int msre_op_verifyCC_init(msre_rule *rule, char **error_msg) {
static int msre_op_verifyCC_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, char **error_msg) {
assert(msr != NULL);
assert(rule != NULL);
assert(rule->actionset != NULL);
assert(var != NULL);
assert(error_msg != NULL);
msc_regex_t *regex = (msc_regex_t *)rule->op_param_data;
@ -3103,7 +3157,7 @@ static int msre_op_verifyCC_execute(modsec_rec *msr, msre_rule *rule, msre_var *
* \retval 1 On Valid CPF
*/
static int cpf_verify(const char *cpfnumber, int len) {
assert(cpfnumber != NULL);
int factor, part_1, part_2, var_len = len;
unsigned int sum = 0, i = 0, cpf_len = 11, c;
int cpf[11];
@ -3191,12 +3245,18 @@ static int cpf_verify(const char *cpfnumber, int len) {
* \retval 1 On Success
*/
static int msre_op_verifyCPF_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, "msre_op_verifyCPF_init: error_msg is NULL");
return -1;
}
const char *errptr = NULL;
int erroffset;
int options = 0;
msc_regex_t *regex;
if (error_msg == NULL) return -1;
*error_msg = NULL;
#ifdef WITH_PCRE2
@ -3511,6 +3571,9 @@ invalid:
* \retval 1 On Success
*/
static int msre_op_verifySSN_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
const char *errptr = NULL;
int erroffset;
int options = 0;
@ -4069,6 +4132,13 @@ static int msre_op_rbl_execute(modsec_rec *msr, msre_rule *rule, msre_var *var,
/* fuzzyHash */
static int msre_op_fuzzy_hash_init(msre_rule *rule, char **error_msg)
{
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, ":msre_op_fuzzy_hash_init error_msg is NULL");
return -1;
}
#ifdef WITH_SSDEEP
struct fuzzy_hash_param_data *param_data;
struct fuzzy_hash_chunk *chunk, *t;
@ -4089,11 +4159,6 @@ static int msre_op_fuzzy_hash_init(msre_rule *rule, char **error_msg)
threshold_str = data;
#endif
if (error_msg == NULL)
{
return -1;
}
*error_msg = NULL;
#ifdef WITH_SSDEEP
@ -4225,9 +4290,15 @@ static int msre_op_fuzzy_hash_execute(modsec_rec *msr, msre_rule *rule,
/* inspectFile */
static int msre_op_inspectFile_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
if (error_msg == NULL) {
ap_log_perror(APLOG_MARK, APLOG_EMERG, 0, rule->ruleset->mp, NULL, "msre_op_inspectFile_init: error_msg is NULL");
return -1;
}
char *filename = (char *)rule->op_param;
if (error_msg == NULL) return -1;
*error_msg = NULL;
if ((filename == NULL)||(is_empty_string(filename))) {
@ -4330,6 +4401,9 @@ static int msre_op_inspectFile_execute(modsec_rec *msr, msre_rule *rule, msre_va
/* validateByteRange */
static int msre_op_validateByteRange_init(msre_rule *rule, char **error_msg) {
assert(rule != NULL);
assert(rule->ruleset != NULL);
assert(error_msg != NULL);
char *p = NULL, *saveptr = NULL;
char *table = NULL, *data = NULL;
@ -4655,6 +4729,7 @@ static int msre_op_eq_execute(modsec_rec *msr, msre_rule *rule, msre_var *var,
{
assert(msr != NULL);
assert(rule != NULL);
assert(var != NULL);
assert(error_msg != NULL);
msc_string str;
int left, right;

92
apache2/re_variables.c
View File

@ -30,6 +30,9 @@
static int var_simple_generate_ex(msre_var *var, apr_table_t *vartab, apr_pool_t *mptmp,
const char *value, int value_len)
{
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
msre_var *rvar = NULL;
if (value == NULL) return 0;
@ -57,6 +60,9 @@ static int var_simple_generate(msre_var *var, apr_table_t *vartab, apr_pool_t *m
* care of the case when the parameter is a regular expression.
*/
static char *var_generic_list_validate(msre_ruleset *ruleset, msre_var *var) {
assert(ruleset != NULL);
assert(var != NULL);
/* It's OK if there's no parameter. */
if (var->param == NULL) return NULL;
@ -112,6 +118,7 @@ static int var_args_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_arg *arg = (msc_arg *)te[i].val;
assert(arg != NULL);
int match = 0;
/* Figure out if we want to include this argument. */
@ -161,6 +168,7 @@ static int var_args_combined_size_generate(modsec_rec *msr, msre_var *var, msre_
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_arg *arg = (msc_arg *)te[i].val;
assert(arg != NULL);
combined_size += arg->name_len;
combined_size += arg->value_len;
}
@ -190,6 +198,7 @@ static int var_args_names_generate(modsec_rec *msr, msre_var *var, msre_rule *ru
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_arg *arg = (msc_arg *)te[i].val;
assert(arg != NULL);
int match = 0;
/* Figure out if we want to include this variable. */
@ -237,6 +246,7 @@ static int var_args_get_generate(modsec_rec *msr, msre_var *var, msre_rule *rule
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_arg *arg = (msc_arg *)te[i].val;
assert(arg != NULL);
int match = 0;
/* Only QUERY_STRING arguments */
@ -287,6 +297,7 @@ static int var_args_get_names_generate(modsec_rec *msr, msre_var *var, msre_rule
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_arg *arg = (msc_arg *)te[i].val;
assert(arg != NULL);
int match = 0;
/* Only QUERY_STRING arguments */
@ -337,6 +348,7 @@ static int var_args_post_generate(modsec_rec *msr, msre_var *var, msre_rule *rul
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_arg *arg = (msc_arg *)te[i].val;
assert(arg != NULL);
int match = 0;
/* Only BODY arguments */
@ -387,6 +399,7 @@ static int var_args_post_names_generate(modsec_rec *msr, msre_var *var, msre_rul
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_arg *arg = (msc_arg *)te[i].val;
assert(arg != NULL);
int match = 0;
/* Only BODY arguments */
@ -470,6 +483,7 @@ static int var_rule_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
static char *var_env_validate(msre_ruleset *ruleset, msre_var *var) {
assert(ruleset != NULL);
assert(var != NULL);
if (var->param == NULL) {
return apr_psprintf(ruleset->mp, "Parameter required for ENV.");
}
@ -485,6 +499,7 @@ static int var_env_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
assert(var != NULL);
char *value = get_env_var(msr->r, (char *)var->param);
if (value != NULL) {
@ -499,6 +514,7 @@ static int var_request_uri_raw_generate(modsec_rec *msr, msre_var *var, msre_rul
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
return var_simple_generate(var, vartab, mptmp, msr->r->unparsed_uri);
}
@ -545,6 +561,8 @@ static int var_reqbody_processor_generate(modsec_rec *msr, msre_var *var, msre_r
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(var != NULL);
assert(vartab != NULL);
msre_var *rvar = apr_pmemdup(mptmp, var, sizeof(msre_var));
if (!rvar) {
msr_log(msr, 1, "REQBODY_PROCESSOR: Memory allocation error");
@ -569,7 +587,6 @@ static int var_sdbm_delete_error_generate(modsec_rec *msr, msre_var *var, msre_r
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -596,6 +613,9 @@ static int var_reqbody_processor_error_generate(modsec_rec *msr, msre_var *var,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
msre_var *rvar = apr_pmemdup(mptmp, var, sizeof(msre_var));
if (!rvar) {
msr_log(msr, 1, "REQBODY_ERROR: Memory allocation error");
@ -640,6 +660,8 @@ static int var_reqbody_processor_error_msg_generate(modsec_rec *msr, msre_var *v
/* XML */
static char *var_xml_validate(msre_ruleset *ruleset, msre_var *var) {
assert(var != NULL);
/* It's OK if there's no parameter. */
if (var->param == NULL) return NULL;
@ -830,6 +852,8 @@ static int var_remote_addr_generate(modsec_rec *msr, msre_var *var, msre_rule *r
#if !defined(MSC_TEST)
#if AP_SERVER_MAJORVERSION_NUMBER > 1 && AP_SERVER_MINORVERSION_NUMBER > 3
if (ap_find_linked_module("mod_remoteip.c") != NULL) {
assert(msr->r != NULL);
assert(msr->r->useragent_ip != NULL);
if(msr->r->useragent_ip != NULL) msr->remote_addr = apr_pstrdup(msr->mp, msr->r->useragent_ip);
return var_simple_generate(var, vartab, mptmp, msr->remote_addr);
}
@ -845,6 +869,7 @@ static int var_remote_host_generate(modsec_rec *msr, msre_var *var, msre_rule *r
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
const char *value1 = ap_get_remote_host(msr->r->connection, msr->r->per_dir_config,
REMOTE_NAME, NULL);
return var_simple_generate(var, vartab, mptmp, value1);
@ -883,9 +908,11 @@ static int var_tx_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
int i, count = 0;
arr = apr_table_elts(msr->tx_vars);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
int match;
/* Figure out if we want to include this variable. */
@ -938,9 +965,11 @@ static int var_geo_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
int i, count = 0;
arr = apr_table_elts(msr->geo_vars);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
int match;
/* Figure out if we want to include this variable. */
@ -976,6 +1005,7 @@ static int var_geo_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
static int var_highest_severity_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
return var_simple_generate(var, vartab, mptmp,
apr_psprintf(mptmp, "%d", msr->highest_severity));
}
@ -986,6 +1016,7 @@ static int var_ip_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->collections != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -998,9 +1029,11 @@ static int var_ip_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
if (target_col == NULL) return 0;
arr = apr_table_elts(target_col);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
int match;
/* Figure out if we want to include this variable. */
@ -1065,6 +1098,7 @@ static int var_session_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->collections != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -1080,6 +1114,7 @@ static int var_session_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
int match;
/* Figure out if we want to include this variable. */
@ -1120,6 +1155,7 @@ static int var_user_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->collections != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -1135,6 +1171,7 @@ static int var_user_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
int match;
/* Figure out if we want to include this variable. */
@ -1179,6 +1216,7 @@ static int var_global_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->collections != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -1194,6 +1232,7 @@ static int var_global_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
int match;
/* Figure out if we want to include this variable. */
@ -1230,6 +1269,7 @@ static int var_resource_generate(modsec_rec *msr, msre_var *var, msre_rule *rule
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->collections != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -1245,6 +1285,7 @@ static int var_resource_generate(modsec_rec *msr, msre_var *var, msre_rule *rule
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
int match;
/* Figure out if we want to include this variable. */
@ -1292,6 +1333,7 @@ static int var_files_tmp_contents_generate(modsec_rec *msr, msre_var *var,
int i, count = 0;
if (msr->mpd == NULL) return 0;
assert(msr->mpd->parts != NULL);
parts = (multipart_part **)msr->mpd->parts->elts;
for (i = 0; i < msr->mpd->parts->nelts; i++) {
@ -1373,9 +1415,11 @@ static int var_files_tmpnames_generate(modsec_rec *msr, msre_var *var, msre_rule
int i, count = 0;
if (msr->mpd == NULL) return 0;
assert(msr->mpd->parts != NULL);
parts = (multipart_part **)msr->mpd->parts->elts;
for(i = 0; i < msr->mpd->parts->nelts; i++) {
assert(parts[i] != NULL);
if ((parts[i]->type == MULTIPART_FILE)&&(parts[i]->tmp_file_name != NULL)) {
int match = 0;
@ -1421,9 +1465,11 @@ static int var_files_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
int i, count = 0;
if (msr->mpd == NULL) return 0;
assert(msr->mpd->parts != NULL);
parts = (multipart_part **)msr->mpd->parts->elts;
for(i = 0; i < msr->mpd->parts->nelts; i++) {
assert(parts[i] != NULL);
if (parts[i]->type == MULTIPART_FILE) {
int match = 0;
@ -1469,9 +1515,11 @@ static int var_files_sizes_generate(modsec_rec *msr, msre_var *var, msre_rule *r
int i, count = 0;
if (msr->mpd == NULL) return 0;
assert(msr->mpd->parts != NULL);
parts = (multipart_part **)msr->mpd->parts->elts;
for(i = 0; i < msr->mpd->parts->nelts; i++) {
assert(parts[i] != NULL);
if (parts[i]->type == MULTIPART_FILE) {
int match = 0;
@ -1517,9 +1565,11 @@ static int var_files_names_generate(modsec_rec *msr, msre_var *var, msre_rule *r
int i, count = 0;
if (msr->mpd == NULL) return 0;
assert(msr->mpd->parts != NULL);
parts = (multipart_part **)msr->mpd->parts->elts;
for(i = 0; i < msr->mpd->parts->nelts; i++) {
assert(parts[i] != NULL);
if (parts[i]->type == MULTIPART_FILE) {
msre_var *rvar = apr_pmemdup(mptmp, var, sizeof(msre_var));
if (!rvar) {
@ -1556,6 +1606,7 @@ static int var_files_combined_size_generate(modsec_rec *msr, msre_var *var, msre
if (msr->mpd != NULL) {
parts = (multipart_part **)msr->mpd->parts->elts;
for(i = 0; i < msr->mpd->parts->nelts; i++) {
assert(parts[i] != NULL);
if (parts[i]->type == MULTIPART_FILE) {
combined_size += parts[i]->tmp_file_size;
}
@ -1587,9 +1638,11 @@ static int var_multipart_part_headers_generate(modsec_rec *msr, msre_var *var, m
int i, j, count = 0;
if (msr->mpd == NULL) return 0;
assert(msr->mpd->parts != NULL);
parts = (multipart_part **)msr->mpd->parts->elts;
for(i = 0; i < msr->mpd->parts->nelts; i++) {
assert(parts[i] != NULL);
int match = 0;
/* Figure out if we want to include this variable. */
@ -1901,6 +1954,7 @@ static int var_outbound_error_generate(modsec_rec *msr, msre_var *var, msre_rule
}
static apr_time_t calculate_perf_combined(modsec_rec *msr) {
assert(msr != NULL);
return msr->time_phase1 + msr->time_phase2 + msr->time_phase3 + msr->time_phase4
+ msr->time_phase5 + msr->time_storage_write /* time_storage_read is already
included in phases */ + msr->time_logging + msr->time_gc;
@ -1921,9 +1975,8 @@ char *format_all_performance_variables(modsec_rec *msr, apr_pool_t *mp) {
static int generate_performance_variable(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp, apr_time_t value)
{
assert(msr != NULL);
assert(var != NULL);
assert( vartab!= NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
msre_var *rvar = NULL;
@ -1941,7 +1994,6 @@ static int generate_performance_variable(modsec_rec *msr, msre_var *var, msre_ru
static int var_perf_all_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -2060,6 +2112,7 @@ static int var_perf_rules_generate(modsec_rec *msr, msre_var *var, msre_rule *ru
int i, count = 0;
arr = apr_table_elts(msr->perf_rules);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
@ -2322,11 +2375,6 @@ static int var_time_mon_generate(modsec_rec *msr, msre_var *var, msre_rule *rule
tm = localtime(&tc);
rvar = apr_pmemdup(mptmp, var, sizeof(msre_var));
assert(msr != NULL);
assert(msr->r != NULL);
assert(var != NULL);
assert(rule != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
if (!rvar) {
msr_log(msr, 1, "TIME_MON: Memory allocation error");
return -1;
@ -2348,7 +2396,6 @@ static int var_time_day_generate(modsec_rec *msr, msre_var *var, msre_rule *rule
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
@ -2428,6 +2475,10 @@ static int var_request_basename_generate(modsec_rec *msr, msre_var *var, msre_ru
static int var_full_request_generate(modsec_rec *msr, msre_var *var,
msre_rule *rule, apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(var != NULL);
assert(vartab != NULL);
assert(mptmp != NULL);
const apr_array_header_t *arr = NULL;
char *full_request = NULL;
int full_request_length = 0;
@ -2548,6 +2599,7 @@ static int var_matched_vars_names_generate(modsec_rec *msr, msre_var *var, msre_
for (i = 0; i < arr->nelts; i++) {
int match = 0;
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
@ -2612,10 +2664,12 @@ static int var_matched_vars_generate(modsec_rec *msr, msre_var *var, msre_rule *
int i, count = 0;
arr = apr_table_elts(msr->matched_vars);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
msc_string *str = (msc_string *)te[i].val;
assert(str != NULL);
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
@ -2680,6 +2734,7 @@ static int var_request_cookies_generate(modsec_rec *msr, msre_var *var, msre_rul
int i, count = 0;
arr = apr_table_elts(msr->request_cookies);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
@ -2687,6 +2742,7 @@ static int var_request_cookies_generate(modsec_rec *msr, msre_var *var, msre_rul
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
else {
assert(te[i].key != NULL);
if (var->param_data != NULL) { /* Regex. */
char *my_error_msg = NULL;
if (msc_regexec((msc_regex_t *)var->param_data, te[i].key, strlen(te[i].key), &my_error_msg) >= 0) match = 1;
@ -2734,6 +2790,7 @@ static int var_request_cookies_names_generate(modsec_rec *msr, msre_var *var, ms
int i, count = 0;
arr = apr_table_elts(msr->request_cookies);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
@ -2741,6 +2798,7 @@ static int var_request_cookies_names_generate(modsec_rec *msr, msre_var *var, ms
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
else {
assert(te[i].key != NULL);
if (var->param_data != NULL) { /* Regex. */
char *my_error_msg = NULL;
if (msc_regexec((msc_regex_t *)var->param_data, te[i].key, strlen(te[i].key), &my_error_msg) >= 0) match = 1;
@ -2788,6 +2846,7 @@ static int var_request_headers_generate(modsec_rec *msr, msre_var *var, msre_rul
int i, count = 0;
arr = apr_table_elts(msr->request_headers);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
@ -2795,6 +2854,7 @@ static int var_request_headers_generate(modsec_rec *msr, msre_var *var, msre_rul
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
else {
assert(te[i].key != NULL);
if (var->param_data != NULL) { /* Regex. */
char *my_error_msg = NULL;
if (msc_regexec((msc_regex_t *)var->param_data, te[i].key, strlen(te[i].key), &my_error_msg) >= 0) match = 1;
@ -2842,6 +2902,7 @@ static int var_request_headers_names_generate(modsec_rec *msr, msre_var *var, ms
int i, count = 0;
arr = apr_table_elts(msr->request_headers);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
@ -2849,6 +2910,7 @@ static int var_request_headers_names_generate(modsec_rec *msr, msre_var *var, ms
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
else {
assert(te[i].key != NULL);
if (var->param_data != NULL) { /* Regex. */
char *my_error_msg = NULL;
if (msc_regexec((msc_regex_t *)var->param_data, te[i].key, strlen(te[i].key), &my_error_msg) >= 0) match = 1;
@ -2888,6 +2950,7 @@ static int var_request_filename_generate(modsec_rec *msr, msre_var *var, msre_ru
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
return var_simple_generate(var, vartab, mptmp, msr->r->parsed_uri.path);
}
@ -3047,6 +3110,7 @@ static int var_auth_type_generate(modsec_rec *msr, msre_var *var, msre_rule *rul
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
char *value = msr->r->ap_auth_type;
return var_simple_generate(var, vartab, mptmp, value);
}
@ -3057,6 +3121,8 @@ static int var_path_info_generate(modsec_rec *msr, msre_var *var, msre_rule *rul
apr_table_t *vartab, apr_pool_t *mptmp)
{
assert(msr != NULL);
assert(msr->r != NULL);
assert(mptmp != NULL);
const char *value = msr->r->path_info;
return var_simple_generate(var, vartab, mptmp, value);
}
@ -3119,6 +3185,7 @@ static int var_response_headers_generate(modsec_rec *msr, msre_var *var, msre_ru
if (msr->response_headers == NULL) return 0;
arr = apr_table_elts(msr->response_headers);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
@ -3126,6 +3193,7 @@ static int var_response_headers_generate(modsec_rec *msr, msre_var *var, msre_ru
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
else {
assert(te[i].key != NULL);
if (var->param_data != NULL) { /* Regex. */
char *my_error_msg = NULL;
if (msc_regexec((msc_regex_t *)var->param_data, te[i].key, strlen(te[i].key), &my_error_msg) >= 0) match = 1;
@ -3173,6 +3241,7 @@ static int var_response_headers_names_generate(modsec_rec *msr, msre_var *var, m
int i, count = 0;
arr = apr_table_elts(msr->response_headers);
assert(arr != NULL);
te = (apr_table_entry_t *)arr->elts;
for (i = 0; i < arr->nelts; i++) {
int match = 0;
@ -3180,6 +3249,7 @@ static int var_response_headers_names_generate(modsec_rec *msr, msre_var *var, m
/* Figure out if we want to include this variable. */
if (var->param == NULL) match = 1;
else {
assert(te[i].key != NULL);
if (var->param_data != NULL) { /* Regex. */
char *my_error_msg = NULL;
if (msc_regexec((msc_regex_t *)var->param_data, te[i].key, strlen(te[i].key), &my_error_msg) >= 0) match = 1;
@ -3305,6 +3375,7 @@ void msre_engine_variable_register(msre_engine *engine, const char *name,
fn_var_validate_t validate, fn_var_generate_t generate,
unsigned int is_cacheable, unsigned int availability)
{
assert(engine != NULL);
msre_var_metadata *metadata = (msre_var_metadata *)apr_pcalloc(engine->mp,
sizeof(msre_var_metadata));
if (metadata == NULL) return;
@ -3325,6 +3396,7 @@ void msre_engine_variable_register(msre_engine *engine, const char *name,
*
*/
void msre_engine_register_default_variables(msre_engine *engine) {
assert(engine != NULL);
/* ARGS */
msre_engine_variable_register(engine,