github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-30 19:47:47 +03:00
Code Issues Packages Projects Releases Wiki Activity
2,899 Commits 55 Branches 109 Tags
b8160cce6b00727f871d85f11a418cbda37b7890
Commit Graph

923 Commits

Author SHA1 Message Date
martinhsv
b8160cce6b Fix Cookie header parsing issues 2019-11-20 08:51:06 -03:00
Ervin Hegedus
7ba77631f9 Replace Cookie parsing method 2019-11-20 08:51:05 -03:00
martinhsv
199a9db3e2 Fix nolog rules logging to part H 2019-11-11 13:50:44 -03:00
martinhsv
9cac167faf Fix argument key-value pair parsing cases 2019-11-05 13:06:29 -03:00
martinhsv
68c995ca98 Fix: audit log part for response body for JSON format to be E 2019-10-25 09:51:26 -03:00
martinhsv
01c7a2689b Fix test issue-1974 2019-10-24 09:57:49 -03:00
Victor Hora
d4dc3dbf2a Make sure m_rulesMessages is filled after successfull match 2019-10-16 09:40:04 -03:00
Andrei Belov
5929277938 Avoid using NULL string (match) in Pm::evaluate 
Closes #2178.
 2019-10-07 08:37:05 -03:00
Felipe Zimmerle
beedddd6c6 Fix @pm lookup for possible matches on offset zero 2019-10-02 08:05:14 -07:00
marduone
96d36afeca Add Missing throw in Operator::instantiate 2019-06-17 14:56:03 -03:00
Felipe Zimmerle
6ab464ab78 negative lookup on the key name instead of COLLECTION:key 2019-06-17 13:04:25 -03:00
Felipe Zimmerle
47dd9c5df4 Refactoring on the VariableValue class 2019-06-14 10:13:54 -03:00
Ervin Hegedus
c0142cf326 Changed compared variables of range id intervall in ruleRemoveById ctl action. #2111 
* changed the variables in clause
* added test case (@theMiddle)
* fixes #2111
 2019-06-04 10:28:30 -03:00
Felipe Zimmerle
50abc072c4 Make block action execution dependent of the SecEngine status 2019-06-03 19:55:02 -03:00
Felipe Zimmerle
a4e8484115 Having body limits to respect the rule engine state 2019-06-03 14:05:10 -03:00
Felipe Zimmerle
1b8d69da02 Fix dict element regular expression selection on SecRuleUpdateTargetByTag 2019-05-31 01:42:51 -03:00
Felipe Zimmerle
5472362313 Fix SecRuleUpdateTargetByTag with regular expressions 2019-05-31 01:42:47 -03:00
Ervin Hegedus
db298696fa Adds missing check for runtime ctl:ruleRemoveByTag 2019-05-30 09:50:56 -03:00
Rufus125
86ce479b59 Adds new operator to check for data leakage of Austrian social security number 2019-05-29 20:57:08 -03:00
Julien Leproust
49900eec97 Fix variables output in debug logs 2019-05-27 17:39:04 -03:00
Tim Herren
75a5c8d334 correct typo validade in log output 2019-05-27 17:13:29 -03:00
Thierry Fournier
4a3e9734ef fix/minor: Error encoding hexa decimal 
String is defined as an array of char. The char can be negative. The
cast "reinterpret_cast" from char to int keep the negative side, so
the "unsigned char" number 0x91 is negative as "char". When it is
"reinterpret_cast" as integer, it becomes 0xffffff91, so the hexadecimal
display is broken:

   [155493246391.747672] [/absolute?what=badarg2] [9]  T (0) t:hexEncode: "ffffff91ffffffecffffffe6334bffffffebffffff87ffffff9affffff824a06ffffffc33b4cffff (14 characters omitted)"

This patch fix this behavior using classic cast without reinterpret_cast:

   [155493251286.221115] [/absolute?what=badarg2] [9]  T (0) t:hexEncode: "91ece6334beb879a824a06c33b4cb4240e4c6f56"
 2019-05-27 17:06:51 -03:00
Julien Leproust
1acd87a803 Limit log variables to 200 characters 
To avoid generating too long log lines which end up truncated (like in
nginx's error log), and missing important bits.
 2019-05-27 17:04:32 -03:00
Felipe Zimmerle
61c11251b6 parser: Fix filename 2019-04-23 13:17:23 -03:00
Felipe Zimmerle
0669c2e64d parser: new bison version 2019-04-22 10:46:27 -03:00
Felipe Zimmerle
4e76c6adf0 Renames namespace Variables to variables 2019-03-06 15:53:20 -03:00
Felipe Zimmerle
b9ed150224 Fix namespace utilization on seclang-parser.yy 2019-03-06 15:12:44 -03:00
Ervin Hegedus
ccd90c51c5 Increment OVECCOUNT value for bigger regex's 2019-02-12 10:08:47 -03:00
Ervin Hegedus
a6e6bc2b5f Allow empty anchored variable to use 2019-02-12 09:31:19 -03:00
Ervin Hegedus
17d79ed7ba Fixed data collecting in multipart parsing 2019-02-12 09:16:07 -03:00
Ervin Hegedus
4b3e6328e3 Fixed validateByteRange parsing method 2019-02-12 09:10:36 -03:00
Felipe Zimmerle
2dff768262 Removes a memory leak on the JSON parser 2019-02-11 10:17:02 -03:00
WGH
37cf60b8d2 Fix use of deleted Regex copy constructor in LMDB code 
Bug introduced in ad28de4f. Fixes #2008.
 2019-01-28 16:20:02 -03:00
Felipe Zimmerle
dc78c0e180 Fix: Extra whitespace in some configuration directives causing error 
Issue #2006
 2019-01-21 14:44:31 -03:00
Felipe Zimmerle
df3c3f62b7 Cosmetics: coding style 2019-01-18 11:02:22 -03:00
WGH
ad28de4f14 Refactor regex code 
This commit fixes quite a few odd things in regex code:
 * Lack of encapsulation.
 * Non-method functions for matching without retrieving all groups.
 * Regex class being copyable without proper copy-constructor (potential UAF
   and double free due to pointer members m_pc and m_pce).
 * Redundant SMatch::m_length, which always equals to match.size() anyway.
 * Weird SMatch::size_ member which is initialized only by one of the three matching
   functions, and equals to the return value of that function anyways.
 * Several places in code having std::string value instead of reference.
 2019-01-18 10:34:01 -03:00
Andrei Belov
ae02076340 Fixed buffer overflow in Utils::Md5::hexdigest() 
Found via failed test (auditlog.json) on Alpine Linux 3.8.2.
 2019-01-14 16:29:07 -03:00
Felipe Zimmerle
78b7fa4e2c Adds missing drop.h 2018-12-26 11:05:54 -03:00
Felipe Zimmerle
d00ea5111d Adds initial support to drop action 2018-12-24 16:35:41 -03:00
Ervin Hegedus
77854ed1b5 Fix inet addr handling on 64 bit big endian systems 2018-12-10 15:03:09 -03:00
Felipe Zimmerle
407b6c0f4b Fix setenv action to strdup key=variable 2018-11-29 15:18:15 -03:00
Felipe Zimmerle
d2b14de268 Allow 0 length JSON requests 
As discussed at: #1822
 2018-11-29 10:39:46 -03:00
Fred Nicolson
3d2030426c Replaced log locking using mutex with fcntl lock 
When reloading Nginx, there is a race condition which is visible under high
load. As the logging mutex is shared between multiple workers, when a worker
is sent a stop signal during a reload, and the log mutex is held, write()
will never return, which means that the mutex will never unlock. As other
workers share this mutex, they will deadlock.

fcntl does not suffer from this issue.
 2018-11-27 10:09:29 -03:00
Wenfeng Liu
3b3004d24d Correct the usage of modsecurity::Phases::NUMBER_OF_PHASES 2018-11-27 09:23:00 -03:00
Felipe Zimmerle
ce3abf2626 Adds support to multiple ranges in ctl:ruleRemoveById 
Issue #1956
 2018-11-26 20:48:18 -03:00
Felipe Zimmerle
e712d30c56 Fix setvar to understand Rule variable in collections 
Issue #1961
 2018-11-26 19:49:44 -03:00
Victor Hora
b638e523af Make the boundary check less strict as per RFC2046 2018-11-20 22:17:22 -03:00
Victor Hora
ecad8c6c7e Fix buffer size for utf8toUnicode transformation 2018-11-16 14:58:40 -05:00
Felipe Zimmerle
9d80983e55 Fix on top of #1943 + adding test cases 2018-11-01 16:11:39 -03:00
supplient
39f4a5d7d2 Fix double macros bug 
Macro run strangely if I input double macros like "%{ARGS_COMBINED_SIZE}%{ARGS_COMBINED_SIZE}".
 2018-11-01 15:56:54 -03:00