3521 Commits

Author SHA1 Message Date
Ervin Hegedus
63201ae39f
chore: add 'log' action to rule 200005 2024-10-02 16:33:56 +02:00
Ervin Hegedus
9e02b3cf01
Merge pull request #3248 from eduar-hte/simplified-constructors
Simplified constructors, copy constructors & assignment operators
2024-09-09 16:14:09 +02:00
Eduardo Arias
6ecfee7ab7 Simplify and reduce code duplication in Transaction constructors
- Leverage delegating constructor to avoid code duplication between the
  two available Transaction constructors.
  - The constructor without 'id' argument delegates to the one that
    receives it by providing `nullptr` as a value, which is used to
    flag that an id needs to be generated.
- Simplified constructor by removing member initialization where the
  default constructor will be invoked.
2024-09-04 11:16:34 -03:00
Eduardo Arias
2c613fb77c Simplify initialization of fileName member of Rule instances 2024-09-04 10:51:21 -03:00
Eduardo Arias
2ad87f640f Reference RuleWithActions & Transaction object instead of copying values in RuleMessage
- Because the lifetime of the RuleMessage instances do not extend beyond
  the lifetime of the enclosing RuleWithActions & Transaction,
  RuleMessage can just reference it and simplify its definition.
- Additionally, make the references const to show that it doesn't modify it.
- Replace RuleMessage copy constructor with default implementations.
- Removed unused RuleMessage assignment operator (which cannot be implemented
  now that it has reference members).
- Removed constructor from RuleMessage pointer.
- Addressed Sonarcloud suggestions: Do not use the constructor's
  initializer list for data member "xxx". Use the in-class initializer
  instead.
2024-09-04 10:48:07 -03:00
Eduardo Arias
2ec640fd76 Delete unused copy constructor & assignment operator in Rule, RuleMarker & Action
- Declare other unsupported copy constructor & assignment operators as
  deleted too (RuleWithActions, RuleUnconditional & RuleScript)
2024-09-04 10:48:05 -03:00
Ervin Hegedus
580fe192df
Merge pull request #3247 from airween/v3/master
Release v3 version 3.0.13
v3.0.13
2024-09-03 15:44:47 +02:00
Ervin Hegedus
24dbcfe637
Change release version to v3.0.13 2024-09-03 15:24:29 +02:00
Ervin Hegedus
1a8c96a1cd
Merge pull request #3206 from airween/v3/release2408
Add PR's to CHANGES
2024-09-03 15:20:34 +02:00
Ervin Hegedus
b489fd3562
Format fix
Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com>
2024-09-03 07:45:09 +02:00
Ervin Hegedus
2ab970be2e
Finalize CHANGES 2024-09-02 22:23:19 +02:00
Ervin Hegedus
865b75b8fa
Merge branch 'owasp-modsecurity:v3/master' into v3/release2408 2024-08-28 16:37:12 +02:00
Ervin Hegedus
542a5ea35c
Added PR #3243 2024-08-28 16:08:23 +02:00
Ervin Hegedus
f180e647a1
Merge pull request #3243 from eduar-hte/valid-hex-fix
Adjust reference to modsecurity::utils::string::VALID_HEX
2024-08-28 16:07:44 +02:00
Ervin Hegedus
a4604b66f7 Added new tests to op @pm 2024-08-28 10:45:59 -03:00
Eduardo Arias
27cc8edbfe Adjust reference to modsecurity::utils::string::VALID_HEX
- This function (previously a #define) was previously in the global
  namespace and was moved into modsecurity::utils::string in commit
  a6d64bf.
2024-08-28 10:14:53 -03:00
Ervin Hegedus
358618951a
Added PR #3240 2024-08-28 14:37:56 +02:00
Ervin Hegedus
9403cf6f5d
Merge pull request #3240 from frozenice/patch-1
Lua::run: Move logging of `str` parameter to higher log level.
2024-08-28 14:36:36 +02:00
Ervin Hegedus
07fb580415
Added PR's #3233 and #3231 2024-08-28 14:34:58 +02:00
Ervin Hegedus
9148668571
Merge pull request #3231 from eduar-hte/remove-copies-transformations
Remove unnecessary heap allocated copies in Transformation actions
2024-08-28 14:33:59 +02:00
Ervin Hegedus
4951702d45
Merge pull request #3233 from eduar-hte/remove-copies-pm-operator
Removed multiple heap-allocated copies in Pm::init & parse_pm_content
2024-08-28 13:31:02 +02:00
Eduardo Arias
3e9d8107a8 Removed multiple heap-allocated copies in parse_pm_content
- The previous version of this function was doing three strdup copies
  to parse the pm content. The updated version only copies the value
  once (in order not to modify the Operator's m_param member variable),
  and then performs the updates inline.
- Binary parsing was broken because digits were not compared as
  characters.
  - Fail parsing when an invalid hex character is found.
- Error message in parse_pm_content would reference freed memory if
  accessed by caller. Removed anyway because it was unused.
2024-08-27 10:43:07 -03:00
Eduardo Arias
a6d64bf615 Replaced VALID_HEX, ISODIGIT & NBSP macros in string.h
- Moved them into modsecurity::utils::string to avoid polluting the
  global namespace.
2024-08-27 10:00:54 -03:00
Eduardo Arias
2f5dac5c4c Simplified initialization of Transformation's action_kind
- Some of the Transformation classes would initialize their Action's
  action_kind using the default (using Transformation constructor
  without an action_kind parameter).
- Others, however, would use that constructor and initialize action_kind
  manually in their constructor, but setting the default value
  (RunTimeBeforeMatchAttemptKind = 1), which was redundant.
- Removed unused Transformation constructor to specify action_kind.
- Converted Action::Kind into an 'enum class' to require using the enum
  constants (instead of integer values, which are difficult to track in
  the codebase and change)
2024-08-27 10:00:54 -03:00
Eduardo Arias
7023c0a8b4 Refactored sha1 & md5 utils to share implementation and reduce code duplication. 2024-08-27 10:00:54 -03:00
Eduardo Arias
fedec96a7e Refactored base64 utils to share implementation and reduce code duplication. 2024-08-27 10:00:38 -03:00
Eduardo Arias
34da8eeeee Pass RuleWithActions::executeTransformation arguments by reference
- This function already expects these arguments not to be null pointers,
  doesn't validate them and just dereference them.
- In order to make this explicit and enforced by the compiler, they're
  now passed as references.
2024-08-27 10:00:38 -03:00
Eduardo Arias
b647dbd905 Remove unnecessary heap-allocation & copy in Transaction::extractArguments
- utils::urldecode_nonstrict_inplace decodes inplace so key & value,
  which are values returned by utils::string::ssplit_pair can be
  just be modified and do not need to be copied.
- Updated signature of utils::urldecode_nonstrict_inplace, as its
  two callers already have std::string values.
2024-08-27 10:00:18 -03:00
Eduardo Arias
021d0caa33 Perform NormalisePath & NormalisePathWin transformations in-place 2024-08-27 10:00:18 -03:00
Eduardo Arias
2c3c228725 Perform Utf8ToUnicode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
17a2cbd164 Perform UrlDecodeUni & UrlDecode transformations in-place
- Use std::string in UrlEncode transformation, instead of manually
  memory management. This avoids an additional copy after completing
  encoding by just swapping the encoded value and the input.
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
8bf4d96e6b Perform HtmlEntityDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
7d5c9faa43 Perform JsDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
a520369da0 Perform EscapeSeqDecode transformation in-place
- Removed ansi_c_sequences_decode_inplace helper function from the
  class, as it's only referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
727f2bf840 Perform CssDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:17 -03:00
Eduardo Arias
e687140d05 Perform HexDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:17 -03:00
Eduardo Arias
4670710376 Perform LowerCase & UpperCase transformations in-place
- Refactored to share implementation and reduce code duplication.
2024-08-27 10:00:17 -03:00
Eduardo Arias
fd8a979463 Perform SqlHexDecode transformation in-place
- Validate buffer size before accessing data. The previous
  implementation would only check that there was a character available
  in the buffer but could continue processing/reading characters from
  an hex representation without checking bounds.
- Removed inplace & mytolower helper functions from the class, as
  they're only referenced by the implementation.
- Removed duplicate VALID_HEX & ISODIGIT macros, already in
  src/utils/string.h.
2024-08-27 10:00:17 -03:00
Eduardo Arias
2915ee60e2 Perform Trim, TrimLeft & TrimRight transformations in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
74d150c068 Perform RemoveCommentsChar, RemoveComments & ReplaceComments transformations in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
da775eca81 Perform ReplaceNulls transformation in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
1505025990 Perform RemoveNulls & RemoveWhitespace transformations in-place
- Refactored to share implementation.
2024-08-27 10:00:17 -03:00
Eduardo Arias
1236d9a7cd Perform CompressWhitespace transformation in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
13203ae5e7 Perform CmdLine transformation in-place 2024-08-27 10:00:17 -03:00
Eduardo Arias
3ff72fbbc5 Perform ParityEven7bit, ParityOdd7bit & ParityZero7bit transformations in-place
- Refactored to share implementations of ParityEven7bit & ParityOdd7bit.
2024-08-27 10:00:17 -03:00
Eduardo Arias
5d39890783 Updated Transformation::evaluate signature to allow for in-place updates, removing unnecessary heap allocated copies.
- Renamed Transformation::evaluate to Transformation::transform to avoid
  confusion with Action's overload methods.
- Updated Transformation::transform signature to receive the value by
  reference and perform the transformation inline, if possible.
  - Some transformations still need to use a temporary std::string to
    perform their work, and then copy the result back.
- Made Transformation::transform methods const and updated Transaction
  parameter to be const.
  - Transaction parameter could not be removed because it's used by just
    a single transformation, UrlDecodeUni.
- Removed std::string Action::evaluate(const std::string &exp,
  Transaction *transaction); which was only implemented by
  Transformation but was not used from the base class, but only after
  downcasting to Transformation, so it can just be declared there (and
  not pollute other actions with a default member implementation -that
  does nothing- which is never called).
2024-08-27 10:00:17 -03:00
Ervin Hegedus
094143801a
Added PR #3232 2024-08-26 21:48:46 +02:00
Ervin Hegedus
97c8766ef1
Merge pull request #3232 from eduar-hte/failed-unit-tests-automake-output
Unit tests results should not be displayed in 'automake output' mode
2024-08-26 21:47:32 +02:00
David Kirstein
315b3d6e77
Lua::run: Move logging of str parameter to higher log level. 2024-08-26 08:38:48 +02:00
Eduardo Arias
df081af870 Adjusted pthread LDFLAG in examples required for multithreading.
- Some versions of gcc/libc require setting the pthread flag when using
  std::thread, which to implement it.
- This was found compiling the library in a Debian (bullseye) container.
2024-08-18 19:19:29 +00:00