diff --git a/CHANGES b/CHANGES index 3458b75b..1bfa104b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ 03 Sep 2008 - trunk ------------------- + * Fixed XML DTD/Schema validation which will now fail after request body + processing errors, even if the XML parser returns a document tree. + * Added ctl:requestBodyBuffering=on|off which, when enabled, will force the request body to be buffered and allow REQUEST_BODY to be inspected. Previously the REQUEST_BODY target was only populated if the request body diff --git a/apache2/re_operators.c b/apache2/re_operators.c index a7a8eebc..1545902c 100644 --- a/apache2/re_operators.c +++ b/apache2/re_operators.c @@ -872,6 +872,12 @@ static int msre_op_validateDTD_execute(modsec_rec *msr, msre_rule *rule, msre_va xmlValidCtxtPtr cvp; xmlDtdPtr dtd; + if (msr->msc_reqbody_error) { + *error_msg = apr_psprintf(msr->mp, "XML: DTD validation could not proceed" + " due to previous processing errors."); + return 1; + } + if ((msr->xml == NULL)||(msr->xml->doc == NULL)) { *error_msg = apr_psprintf(msr->mp, "XML document tree could not be found for " "DTD validation."); @@ -928,6 +934,12 @@ static int msre_op_validateSchema_execute(modsec_rec *msr, msre_rule *rule, msre xmlSchemaPtr schema; int rc; + if (msr->msc_reqbody_error) { + *error_msg = apr_psprintf(msr->mp, "XML: Schema validation could not proceed" + " due to previous processing errors."); + return 1; + } + if ((msr->xml == NULL)||(msr->xml->doc == NULL)) { *error_msg = apr_psprintf(msr->mp, "XML document tree could not be found for " "Schema validation."); diff --git a/apache2/t/regression/rule/10-xml.t b/apache2/t/regression/rule/10-xml.t index 9861457f..21eff807 100644 --- a/apache2/t/regression/rule/10-xml.t +++ b/apache2/t/regression/rule/10-xml.t @@ -111,9 +111,9 @@ "phase:2,deny,id:12345" ), match_log => { - debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error/s, 1 ], - -debug => [ qr/Failed to load/, 1 ], - -error => [ qr/Failed to load/, 1 ], + debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error.*validation could not proceed due to previous processing errors/s, 1 ], + -debug => [ qr/Failed to load|Successfully validated/, 1 ], + -error => [ qr/Failed to load|Successfully validated/, 1 ], }, match_response => { status => qr/^403$/, @@ -291,9 +291,9 @@ "phase:2,deny,id:12345" ), match_log => { - debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error/s, 1 ], - -debug => [ qr/Failed to load/, 1 ], - -error => [ qr/Failed to load/, 1 ], + debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error.*validation could not proceed due to previous processing errors/s, 1 ], + -debug => [ qr/Failed to load|Successfully validated/, 1 ], + -error => [ qr/Failed to load|Successfully validated/, 1 ], }, match_response => { status => qr/^403$/,