mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-09-30 11:44:32 +03:00
Makes regular expression selection on collections key case insensitive
This issue was initially reported by @michaelgranzow-avi on #2296. @airween made an initial attempt to provide a fixed at #2107; As a consequence of the pull request review - provided by @victorhora, @zimmerle, and @michaelgranzow-avi - @airween made a second attempt at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed the essential pieces from @airween patch into this one. This patch differs from @airween's because @airween's patches were partially working: Key exclusions with regex weren't covered, same for anchored variables (e.g. ARGS). During the review, I have highlighted the importance of having elementary test cases. A simple test case on ARGS could spot the issue. Since that is an important fix, I don't want to hold this for one more review cycle; therefore, I am committing the fix myself. Thank you all involved in the solution of this very own issue.
This commit is contained in:
@@ -134,7 +134,7 @@ void InMemoryPerProcess::resolveRegularExpression(const std::string& var,
|
||||
//std::string name = std::string(var, var.find(":") + 2,
|
||||
// var.size() - var.find(":") - 3);
|
||||
//size_t keySize = col.size();
|
||||
Utils::Regex r(var);
|
||||
Utils::Regex r(var, true);
|
||||
|
||||
for (const auto& x : *this) {
|
||||
//if (x.first.size() <= keySize + 1) {
|
||||
|
@@ -537,7 +537,7 @@ void LMDB::resolveRegularExpression(const std::string& var,
|
||||
MDB_stat mst;
|
||||
MDB_cursor *cursor;
|
||||
|
||||
Utils::Regex r(var);
|
||||
Utils::Regex r(var, true);
|
||||
|
||||
rc = mdb_txn_begin(m_env, NULL, 0, &txn);
|
||||
lmdb_debug(rc, "txn", "resolveRegularExpression");
|
||||
|
Reference in New Issue
Block a user