290 Commits

Author SHA1 Message Date
Ervin Hegedus
f62de58632
Added new cc and h files 2025-04-20 18:29:59 +02:00
Ervin Hegedus
d3c1ad7177
Make utf variable const pointer 2025-03-12 22:07:46 +01:00
Ervin Hegedus
c82e831b66
fix: fixed htmlEntityDecode methods 2025-02-24 16:44:17 +01:00
Eduardo Arias
bbef22b3b5 Added const reported by cppcheck 2.14 2024-10-19 11:48:05 -03:00
Eduardo Arias
d053ec6de6 Add cppcheck suppressions for false positives 2024-10-19 11:48:05 -03:00
Eduardo Arias
7d9c80dede Address cppcheck warnings: uselessOverride (The function '...' overrides a function in a base class but is identical to the overridden function) 2024-10-19 11:48:05 -03:00
Eduardo Arias
da38f20e19 Added missing override keyword as reported by cppcheck 2.14 2024-10-19 11:48:05 -03:00
Eduardo Arias
0613ceeb75 Replace usage of range-checked 'at' method when vector/string has already been size checked 2024-10-15 15:12:10 -03:00
Ervin Hegedus
99ce9779e6
Merge pull request #3253 from eduar-hte/rule-message
Simplified handling of RuleMessage by removing usage of std::shared_ptr
2024-10-15 18:13:31 +02:00
eduar-hte
4df297b596 Avoid passing RuleMessage by std::shared_ptr and use a reference instead.
- Avoids copying std::shared_ptr when lifetime of the RuleMessage
  is controlled by the caller.
  - The RuleMessage instance is created in RuleWithActions::evaluate and
    then used to call the overloaded version of this method that is
    specialized by subclasses.
  - Once the call to the overloaded method returns, the std::shared_ptr
    is destroyed as it's not stored by any of the callers, so it can
    be replaced with a stack variable and avoid paying the cost of
    copying the std::shared_ptr (and its control block that is
    guaranteed to be thread-safe and thus is not a straightforward
    pointer copy)
- Introduced RuleMessage::reset because this is required by
  RuleWithActions::performLogging when it's not the 'last log', the rule
  has multimatch and it's to be logged.
  - The current version is creating allocating another instance of
    RuleMessage on the heap to copy the Rule & Transaction related state
    while all the other members in the RuleMessage are set to their
    default values.
  - The new version leverages the existent, unused and incomplete
    function 'clean' (renamed as 'reset') to do this on the current
    instance.
    - Notice that the current code preserves the value of m_saveMessage,
      so 'reset' provides an argument for the caller to control whether
      this member should be reinitialized.
2024-10-07 11:45:00 -03:00
Eduardo Arias
c6c06c4f33 leverage std::make_unique & std::make_shared
- Simpler code & more efficient because control block can be allocated
  with object.
2024-09-10 09:45:13 -03:00
Eduardo Arias
a6d64bf615 Replaced VALID_HEX, ISODIGIT & NBSP macros in string.h
- Moved them into modsecurity::utils::string to avoid polluting the
  global namespace.
2024-08-27 10:00:54 -03:00
Eduardo Arias
2f5dac5c4c Simplified initialization of Transformation's action_kind
- Some of the Transformation classes would initialize their Action's
  action_kind using the default (using Transformation constructor
  without an action_kind parameter).
- Others, however, would use that constructor and initialize action_kind
  manually in their constructor, but setting the default value
  (RunTimeBeforeMatchAttemptKind = 1), which was redundant.
- Removed unused Transformation constructor to specify action_kind.
- Converted Action::Kind into an 'enum class' to require using the enum
  constants (instead of integer values, which are difficult to track in
  the codebase and change)
2024-08-27 10:00:54 -03:00
Eduardo Arias
b647dbd905 Remove unnecessary heap-allocation & copy in Transaction::extractArguments
- utils::urldecode_nonstrict_inplace decodes inplace so key & value,
  which are values returned by utils::string::ssplit_pair can be
  just be modified and do not need to be copied.
- Updated signature of utils::urldecode_nonstrict_inplace, as its
  two callers already have std::string values.
2024-08-27 10:00:18 -03:00
Eduardo Arias
021d0caa33 Perform NormalisePath & NormalisePathWin transformations in-place 2024-08-27 10:00:18 -03:00
Eduardo Arias
2c3c228725 Perform Utf8ToUnicode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
17a2cbd164 Perform UrlDecodeUni & UrlDecode transformations in-place
- Use std::string in UrlEncode transformation, instead of manually
  memory management. This avoids an additional copy after completing
  encoding by just swapping the encoded value and the input.
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
8bf4d96e6b Perform HtmlEntityDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
7d5c9faa43 Perform JsDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
a520369da0 Perform EscapeSeqDecode transformation in-place
- Removed ansi_c_sequences_decode_inplace helper function from the
  class, as it's only referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
727f2bf840 Perform CssDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:17 -03:00
Eduardo Arias
e687140d05 Perform HexDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:17 -03:00
Eduardo Arias
4670710376 Perform LowerCase & UpperCase transformations in-place
- Refactored to share implementation and reduce code duplication.
2024-08-27 10:00:17 -03:00
Eduardo Arias
fd8a979463 Perform SqlHexDecode transformation in-place
- Validate buffer size before accessing data. The previous
  implementation would only check that there was a character available
  in the buffer but could continue processing/reading characters from
  an hex representation without checking bounds.
- Removed inplace & mytolower helper functions from the class, as
  they're only referenced by the implementation.
- Removed duplicate VALID_HEX & ISODIGIT macros, already in
  src/utils/string.h.
2024-08-27 10:00:17 -03:00
Eduardo Arias
2915ee60e2 Perform Trim, TrimLeft & TrimRight transformations in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
74d150c068 Perform RemoveCommentsChar, RemoveComments & ReplaceComments transformations in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
da775eca81 Perform ReplaceNulls transformation in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
1505025990 Perform RemoveNulls & RemoveWhitespace transformations in-place
- Refactored to share implementation.
2024-08-27 10:00:17 -03:00
Eduardo Arias
1236d9a7cd Perform CompressWhitespace transformation in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
13203ae5e7 Perform CmdLine transformation in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
3ff72fbbc5 Perform ParityEven7bit, ParityOdd7bit & ParityZero7bit transformations in-place
- Refactored to share implementations of ParityEven7bit & ParityOdd7bit.
2024-08-27 10:00:17 -03:00
Eduardo Arias
5d39890783 Updated Transformation::evaluate signature to allow for in-place updates, removing unnecessary heap allocated copies.
- Renamed Transformation::evaluate to Transformation::transform to avoid
  confusion with Action's overload methods.
- Updated Transformation::transform signature to receive the value by
  reference and perform the transformation inline, if possible.
  - Some transformations still need to use a temporary std::string to
    perform their work, and then copy the result back.
- Made Transformation::transform methods const and updated Transaction
  parameter to be const.
  - Transaction parameter could not be removed because it's used by just
    a single transformation, UrlDecodeUni.
- Removed std::string Action::evaluate(const std::string &exp,
  Transaction *transaction); which was only implemented by
  Transformation but was not used from the base class, but only after
  downcasting to Transformation, so it can just be declared there (and
  not pollute other actions with a default member implementation -that
  does nothing- which is never called).
2024-08-27 10:00:17 -03:00
Ervin Hegedus
7bdc3c825c
Merge pull request #3220 from eduar-hte/string-null
Creating a std::string with a null pointer is undefined behaviour
2024-08-09 17:37:47 +02:00
Eduardo Arias
c917d6a2dc Initialize variable in if statement to avoid doing dynamic_cast twice
- Refactored duplicate code in RuleWithOperator::getVariablesExceptions
- Leveraged auto to simplify declaration of dynamic_cast pointers.
2024-08-08 13:37:23 -07:00
Eduardo Arias
30a68de92d Creating a std::string with a null pointer is undefined behaviour.
- cppreference mentions this about the constructor that receives a
  const char *:
  - Constructs the string with the contents initialized with a copy of
    the null-terminated character string pointed to by s. The length of
    the string is determined by the first null character. The behavior
    is undefined if [s, s + Traits::length(s)) is not a valid range
    (for example, if s is a null pointer).
- C++23 introduces a deleted constructor to prevent this in static
  scenarios, which is how this issue was detected.
2024-08-08 11:39:37 -07:00
Eduardo Arias
35949179a4 setenv is not available in Windows build, replaced with _putenv_s 2024-05-03 23:05:34 -03:00
Eduardo Arias
a48856822c Updated included headers to support compilation on Windows (using Visual C++)
- most of posix related functions and constants in unistd.h can be
  found in io.h in Visual C++
- introduced src/compat/msvc.h to adjust for compiler differences (and
  avoid updating code with #ifdef blocks for Windows support)
- removed some included headers that are not needed (both on Unix and
  Windows builds)
2024-05-03 23:05:34 -03:00
Elia Pinto
9842b92bd1 src/actions/transformations/hex_decode.cc: reduce the scope of variable in a for () loop
In general, it is always preferable to reduce
the scope of a variable in a for loop
2024-02-29 20:20:41 +01:00
Martin Vierula
cb4d7ae371
Adjust some copyright dates 2023-10-31 06:23:19 -07:00
Martin Vierula
36adc58ea3
const-ify some references (satisfy cppcheck) 2023-10-27 06:20:01 -07:00
Martin Vierula
118e1b3a44 Support expirevar for in-memory collection 2023-09-29 11:40:03 -07:00
Martin Vierula
ab5658f2d4
Fix: worst-case time in implementation of four transformations 2023-07-25 05:50:16 -07:00
Martin Vierula
222e09ea0b
Fix typo in debug log text 2022-09-17 14:55:27 -07:00
Martin Vierula
f7f8a9827f
Fix initcol error message wording 2022-04-26 16:40:03 -07:00
Martin Vierula
2d51efae49 Add ctl:auditengine action support 2022-01-20 14:04:30 -08:00
Felipe Zimmerle
7fccb0d225 Cosmetic: pleasing cppcheck 2021-05-11 10:27:58 -03:00
Felipe Zimmerle
6fdba42c02 Cosmetics: Having cppcheck pleased
(...) remove_comments.cc,62,style,knownConditionTrueFalse,Condition 'incomment==0' is always true
(...) remove_comments.cc,66,style,knownConditionTrueFalse,Condition 'incomment==0' is always true
(...) remove_comments.cc,69,style,knownConditionTrueFalse,Condition 'incomment==0' is always true
2021-05-10 12:32:09 -03:00
Felipe Zimmerle
f1f2527c03
Using setenv instead of putenv on SetEnv action 2021-01-24 14:59:59 -03:00
Felipe Zimmerle
3748d62f19
Changes copyright dates on the code 2021-01-19 09:24:37 -03:00
Felipe Zimmerle
9b40a045bb
Cosmetics: fix some cppcheck complains to please QA 2021-01-13 13:30:04 -03:00