mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-09-30 11:44:32 +03:00
Contionuation of 1 time variable patch
Now we have almost 100% of the transaction variables hosted on the new schema. Variable modifcators (count and exclusion) are not yet supported on the new schema. Notice that setvar is now using the parser.
This commit is contained in:
committed by
Felipe Zimmerle
parent
703da3c4f0
commit
e95555132e
@@ -28,7 +28,8 @@ namespace ctl {
|
||||
bool RequestBodyProcessorJSON::evaluate(Rule *rule,
|
||||
Transaction *transaction) {
|
||||
transaction->m_requestBodyProcessor = Transaction::JSONRequestBody;
|
||||
transaction->m_collections.store("REQBODY_PROCESSOR", "JSON");
|
||||
transaction->m_variableReqbodyProcessor.set("JSON",
|
||||
transaction->m_variableOffset);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
@@ -28,7 +28,8 @@ namespace ctl {
|
||||
bool RequestBodyProcessorXML::evaluate(Rule *rule,
|
||||
Transaction *transaction) {
|
||||
transaction->m_requestBodyProcessor = Transaction::XMLRequestBody;
|
||||
transaction->m_collections.store("REQBODY_PROCESSOR", "XML");
|
||||
transaction->m_variableReqbodyProcessor.set("XML",
|
||||
transaction->m_variableOffset);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
@@ -49,7 +49,7 @@ bool SetSID::evaluate(Rule *rule, Transaction *t) {
|
||||
#endif
|
||||
|
||||
t->m_collections.m_session_collection_key = colNameExpanded;
|
||||
t->m_collections.storeOrUpdateFirst("SESSIONID", colNameExpanded);
|
||||
t->m_variableSessionID.set(colNameExpanded, t->m_variableOffset);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
@@ -49,7 +49,7 @@ bool SetUID::evaluate(Rule *rule, Transaction *t) {
|
||||
#endif
|
||||
|
||||
t->m_collections.m_user_collection_key = colNameExpanded;
|
||||
t->m_collections.storeOrUpdateFirst("USERID", colNameExpanded);
|
||||
t->m_variableUserID.set(colNameExpanded, t->m_variableOffset);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
@@ -31,6 +31,20 @@ namespace actions {
|
||||
bool SetVar::init(std::string *error) {
|
||||
size_t pos;
|
||||
|
||||
if (m_variableName.empty() == false) {
|
||||
pos = m_variableName.find(".");
|
||||
if (pos != std::string::npos) {
|
||||
m_collectionName = std::string(m_variableName, 0, pos);
|
||||
m_collectionName = utils::string::toupper(m_collectionName);
|
||||
m_variableName = std::string(m_variableName, pos + 1,
|
||||
m_variableName.size() - (pos + 1));
|
||||
} else {
|
||||
error->assign("Missing the collection and/or variable name");
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
// Resolv operation
|
||||
m_operation = setToOne;
|
||||
pos = m_parser_payload.find("=");
|
||||
|
@@ -26,6 +26,16 @@ class Rule;
|
||||
|
||||
namespace actions {
|
||||
|
||||
enum SetVarOperation {
|
||||
/* Set variable to something */
|
||||
setOperation,
|
||||
/* read variable, sum predicate and set */
|
||||
sumAndSetOperation,
|
||||
/* read variable, substract predicate and set */
|
||||
substractAndSetOperation,
|
||||
/* set variable to 1 */
|
||||
setToOne
|
||||
};
|
||||
|
||||
class SetVar : public Action {
|
||||
public:
|
||||
@@ -35,20 +45,24 @@ class SetVar : public Action {
|
||||
m_variableName(""),
|
||||
m_predicate("") { }
|
||||
|
||||
SetVar(SetVarOperation operation,
|
||||
std::string variableName,
|
||||
std::string predicate) : Action("setvar"),
|
||||
m_operation(operation),
|
||||
m_predicate(predicate),
|
||||
m_collectionName(""),
|
||||
m_variableName(variableName) { }
|
||||
|
||||
SetVar(SetVarOperation operation,
|
||||
std::string variableName) : Action("setvar"),
|
||||
m_operation(operation),
|
||||
m_predicate(""),
|
||||
m_collectionName(""),
|
||||
m_variableName(variableName) { }
|
||||
|
||||
bool evaluate(Rule *rule, Transaction *transaction) override;
|
||||
bool init(std::string *error) override;
|
||||
|
||||
enum SetVarOperation {
|
||||
/* Set variable to something */
|
||||
setOperation,
|
||||
/* read variable, sum predicate and set */
|
||||
sumAndSetOperation,
|
||||
/* read variable, substract predicate and set */
|
||||
substractAndSetOperation,
|
||||
/* set variable to 1 */
|
||||
setToOne
|
||||
};
|
||||
|
||||
private:
|
||||
SetVarOperation m_operation;
|
||||
std::string m_collectionName;
|
||||
|
Reference in New Issue
Block a user