github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-13 21:36:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix case sensitive variable resolution in in memory backend

Browse Source 
Variables are case insensitive
This commit is contained in:
Felipe Zimmerle 2016-07-22 13:10:18 -03:00
parent 5d64f73817
commit f723870f18
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
3 changed files with 66 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/collection/backend/in_memory-per_process.cc
View File

@ -99,7 +99,9 @@ void InMemoryPerProcess::resolveMultiMatches(const std::string& var,
if (x.first.at(keySize) != ':') {
continue;
}
if (x.first.compare(0, keySize, var) != 0) {
std::string fu = toupper(x.first);
std::string fvar = toupper(var);
if (fu.compare(0, keySize, fvar) != 0) {
continue;
}
l->insert(l->begin(), new Variable(x.first, x.second));

2
src/collection/backend/in_memory-per_process.h
View File

@ -59,7 +59,7 @@ struct MyHash{
// You might need a better hash function than this
size_t h = 0;
std::for_each(Keyval.begin(), Keyval.end(), [&](char c) {
h += c;
h += tolower(c);
});
return h;
}

62
test/test-cases/regression/collection-case-insensitive.json Normal file
View File

@ -0,0 +1,62 @@
[
{
"enabled":1,
"version_min":300000,
"version_max":0,
"title":"Testing collection :: Case insensitive (1/1)",
"client":{
"ip":"200.249.12.31",
"port":2313
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
"Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language":"en-us,en;q=0.5",
"Accept-Encoding":"gzip,deflate",
"Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive":"300",
"Connection":"keep-alive",
"Cookie":"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Pragma":"no-cache",
"Cache-Control":"no-cache"
},
"uri":"\/test.pl?param1= test &param2=test2",
"method":"GET",
"http_version":1.1,
"body":""
},
"response":{
"headers":{
"Content-Type":"text\/xml; charset=utf-8\n\r",
"Content-Length":"length\n\r"
},
"body":[
"<?xml version=\"1.0\" encoding=\"utf-8\"?>\n\r",
"<soap:Envelope xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\" xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\" xmlns:soap=\"http:\/\/schemas.xmlsoap.org\/soap\/envelope\/\">\n\r",
" <soap:Body>\n\r",
" <EnlightenResponse xmlns=\"http:\/\/clearforest.com\/\">\n\r",
" <EnlightenResult>string<\/EnlightenResult>\n\r",
" <\/EnlightenResponse>\n\r",
" <\/soap:Body>\n\r",
"<\/soap:Envelope>\n\r"
]
},
"expected":{
"audit_log":"",
"debug_log":"Target value: \"matched_var:PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120\" \\(Variable: TX:something\\)",
"error_log":""
},
"rules":[
"SecRuleEngine On",
"SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9",
"SecRule REQUEST_headers \"@contains PHPSESSID\" \"id:1,t:lowercase,t:none,setvar:TX.something=matched_var:%{matched_var}%\"",
"SecRule TX \"@contains to_test\" \"id:2,t:lowercase,t:none\""
]
}
]