mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-09-30 03:34:29 +03:00
Makes regular expression selection on collections key case insensitive
This issue was initially reported by @michaelgranzow-avi on #2296. @airween made an initial attempt to provide a fixed at #2107; As a consequence of the pull request review - provided by @victorhora, @zimmerle, and @michaelgranzow-avi - @airween made a second attempt at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed the essential pieces from @airween patch into this one. This patch differs from @airween's because @airween's patches were partially working: Key exclusions with regex weren't covered, same for anchored variables (e.g. ARGS). During the review, I have highlighted the importance of having elementary test cases. A simple test case on ARGS could spot the issue. Since that is an important fix, I don't want to hold this for one more review cycle; therefore, I am committing the fix myself. Thank you all involved in the solution of this very own issue.
This commit is contained in:
@@ -134,7 +134,7 @@ void InMemoryPerProcess::resolveRegularExpression(const std::string& var,
|
||||
//std::string name = std::string(var, var.find(":") + 2,
|
||||
// var.size() - var.find(":") - 3);
|
||||
//size_t keySize = col.size();
|
||||
Utils::Regex r(var);
|
||||
Utils::Regex r(var, true);
|
||||
|
||||
for (const auto& x : *this) {
|
||||
//if (x.first.size() <= keySize + 1) {
|
||||
|
@@ -537,7 +537,7 @@ void LMDB::resolveRegularExpression(const std::string& var,
|
||||
MDB_stat mst;
|
||||
MDB_cursor *cursor;
|
||||
|
||||
Utils::Regex r(var);
|
||||
Utils::Regex r(var, true);
|
||||
|
||||
rc = mdb_txn_begin(m_env, NULL, 0, &txn);
|
||||
lmdb_debug(rc, "txn", "resolveRegularExpression");
|
||||
|
@@ -52,12 +52,16 @@ bool crlfIsNewline() {
|
||||
return crlf_is_newline;
|
||||
}
|
||||
|
||||
Regex::Regex(const std::string& pattern_)
|
||||
Regex::Regex(const std::string& pattern_, bool ignoreCase)
|
||||
: pattern(pattern_.empty() ? ".*" : pattern_) {
|
||||
const char *errptr = NULL;
|
||||
int erroffset;
|
||||
int flags = (PCRE_DOTALL|PCRE_MULTILINE);
|
||||
|
||||
m_pc = pcre_compile(pattern.c_str(), PCRE_DOTALL|PCRE_MULTILINE,
|
||||
if (ignoreCase == true) {
|
||||
flags |= PCRE_CASELESS;
|
||||
}
|
||||
m_pc = pcre_compile(pattern.c_str(), flags,
|
||||
&errptr, &erroffset, NULL);
|
||||
|
||||
m_pce = pcre_study(m_pc, pcre_study_opt, &errptr);
|
||||
|
@@ -61,7 +61,7 @@ struct SMatchCapture {
|
||||
|
||||
class Regex {
|
||||
public:
|
||||
explicit Regex(const std::string& pattern_);
|
||||
explicit Regex(const std::string& pattern_, bool ignoreCase = false);
|
||||
~Regex();
|
||||
|
||||
// m_pc and m_pce can't be easily copied
|
||||
|
@@ -116,9 +116,9 @@ class KeyExclusion {
|
||||
class KeyExclusionRegex : public KeyExclusion {
|
||||
public:
|
||||
explicit KeyExclusionRegex(const Utils::Regex &re)
|
||||
: m_re(re.pattern) { }
|
||||
: m_re(re.pattern, true) { }
|
||||
explicit KeyExclusionRegex(const std::string &re)
|
||||
: m_re(re) { }
|
||||
: m_re(re, true) { }
|
||||
|
||||
~KeyExclusionRegex() override { }
|
||||
|
||||
@@ -595,7 +595,7 @@ class VariableDictElement : public Variable {
|
||||
class VariableRegex : public Variable {
|
||||
public:
|
||||
VariableRegex(const std::string &name, const std::string ®ex)
|
||||
: m_r(regex),
|
||||
: m_r(regex, true),
|
||||
m_regex(regex),
|
||||
Variable(name + ":" + "regex(" + regex + ")") { }
|
||||
|
||||
|
Reference in New Issue
Block a user