3539 Commits

Author SHA1 Message Date
Eduardo Arias
c2b86ddc49 Suppress warnings on seclang-parser.hh
warning: seclang-parser.hh,2116,warning,duplInheritedMember,The struct 'basic_symbol < by_kind >' defines member function with name 'clear' also defined in its parent struct 'by_kind'.
warning: seclang-parser.hh,2376,warning,duplInheritedMember,The struct 'basic_symbol < by_kind >' defines member function with name 'type_get' also defined in its parent struct 'by_kind'.
warning: seclang-parser.hh,2116,warning,duplInheritedMember,The struct 'basic_symbol < by_state >' defines member function with name 'clear' also defined in its parent struct 'by_state'.
warning: seclang-parser.hh,2120,style,constVariableReference,Variable 'yysym' can be declared as reference to const
2024-10-19 11:48:05 -03:00
Eduardo Arias
7d9c80dede Address cppcheck warnings: uselessOverride (The function '...' overrides a function in a base class but is identical to the overridden function) 2024-10-19 11:48:05 -03:00
Eduardo Arias
da38f20e19 Added missing override keyword as reported by cppcheck 2.14 2024-10-19 11:48:05 -03:00
Eduardo Arias
1eed8b9288 Ignore cppcheck warnings: normalCheckLevelMaxBranches (Limiting analysis of branches. Use --check-level=exhaustive to analyze all branches.) 2024-10-19 10:32:33 -03:00
Eduardo Arias
193a0002e4 Updated cppcheck config
- Do not scan third-party libraries (others dir)
- Use standard C++17 for checks (defaults to C++20)
2024-10-19 10:32:33 -03:00
Eduardo Arias
e0c58233ad Use latest version of cppcheck (2.14.2)
- Run cppcheck on MacOS to use a newer version of cppcheck
2024-10-19 10:32:33 -03:00
Ervin Hegedus
ec506daaef
Merge pull request #3280 from eduar-hte/range-checked-at
Replace usage of range-checked 'at' method when vector/string has already been size checked
2024-10-19 11:06:37 +02:00
Eduardo Arias
0613ceeb75 Replace usage of range-checked 'at' method when vector/string has already been size checked 2024-10-15 15:12:10 -03:00
Ervin Hegedus
99ce9779e6
Merge pull request #3253 from eduar-hte/rule-message
Simplified handling of RuleMessage by removing usage of std::shared_ptr
2024-10-15 18:13:31 +02:00
Eduardo Arias
75d31a4d1e Simplified lifetime management of tests
- Addresses Sonarcloud issues:
  - Rewrite the code so that you no longer need this "delete".
  - Make the type of this variable a reference-to-const.
2024-10-07 11:45:10 -03:00
Eduardo Arias
b7b2d9a40d Minor codebase improvements suggested by Sonarcloud
- src/modsecurity.cc
  - Replace the redundant type with "auto".
- src/transaction.cc
  - Avoid this unnecessary copy by using a "const" reference.
- test/common/custom_debug_log.cc
  - Use "=default" instead of the default implementation of this special
    member functions.
    - Removed the unnecessary destructor override instead.
  - Annotate this function with "override" or "final".
    - Removed the unnecessary destructor override instead.
  - Remove this "const" qualifier from the return type in all
    declarations.
- test/common/modsecurity_test_context.h
  - Replace the redundant type with "auto".
- test/regression/regression.cc
  - Use the "nullptr" literal.
  - Replace this declaration by a structured binding declaration.
  - Replace "reinterpret_cast" with a safer operation.
2024-10-07 11:45:10 -03:00
eduar-hte
4df297b596 Avoid passing RuleMessage by std::shared_ptr and use a reference instead.
- Avoids copying std::shared_ptr when lifetime of the RuleMessage
  is controlled by the caller.
  - The RuleMessage instance is created in RuleWithActions::evaluate and
    then used to call the overloaded version of this method that is
    specialized by subclasses.
  - Once the call to the overloaded method returns, the std::shared_ptr
    is destroyed as it's not stored by any of the callers, so it can
    be replaced with a stack variable and avoid paying the cost of
    copying the std::shared_ptr (and its control block that is
    guaranteed to be thread-safe and thus is not a straightforward
    pointer copy)
- Introduced RuleMessage::reset because this is required by
  RuleWithActions::performLogging when it's not the 'last log', the rule
  has multimatch and it's to be logged.
  - The current version is creating allocating another instance of
    RuleMessage on the heap to copy the Rule & Transaction related state
    while all the other members in the RuleMessage are set to their
    default values.
  - The new version leverages the existent, unused and incomplete
    function 'clean' (renamed as 'reset') to do this on the current
    instance.
    - Notice that the current code preserves the value of m_saveMessage,
      so 'reset' provides an argument for the caller to control whether
      this member should be reinitialized.
2024-10-07 11:45:00 -03:00
eduar-hte
e313ac7de7 Introduce ModSecurityTestContext to encapsulate setup of objects required to execute transactions
- Simplifies memory management on error conditions
- Context will be used in unit tests too, in order to provide
  Transaction related instances.
2024-10-07 11:45:00 -03:00
Ervin Hegedus
9a1155ca26
Merge pull request #3254 from eduar-hte/make_shared
Leverage std::make_unique & std::make_shared to create objects in the heap
2024-10-02 17:23:48 +02:00
Ervin Hegedus
373ddb8925
Merge pull request #3266 from airween/v3/modsecdefconf
chore: add 'log' action to rule 200005
2024-10-02 17:09:31 +02:00
Ervin Hegedus
63201ae39f
chore: add 'log' action to rule 200005 2024-10-02 16:33:56 +02:00
Ervin Hegedus
7737594edf
Merge pull request #3264 from xuruidong/logo2
docs: add a logo picture for github dark theme
2024-10-02 09:08:58 +02:00
xuruidong
9238b0ced0 docs: add a logo picture for github dark theme 2024-09-29 19:42:58 +08:00
Eduardo Arias
c6c06c4f33 leverage std::make_unique & std::make_shared
- Simpler code & more efficient because control block can be allocated
  with object.
2024-09-10 09:45:13 -03:00
Ervin Hegedus
9e02b3cf01
Merge pull request #3248 from eduar-hte/simplified-constructors
Simplified constructors, copy constructors & assignment operators
2024-09-09 16:14:09 +02:00
Eduardo Arias
6ecfee7ab7 Simplify and reduce code duplication in Transaction constructors
- Leverage delegating constructor to avoid code duplication between the
  two available Transaction constructors.
  - The constructor without 'id' argument delegates to the one that
    receives it by providing `nullptr` as a value, which is used to
    flag that an id needs to be generated.
- Simplified constructor by removing member initialization where the
  default constructor will be invoked.
2024-09-04 11:16:34 -03:00
Eduardo Arias
2c613fb77c Simplify initialization of fileName member of Rule instances 2024-09-04 10:51:21 -03:00
Eduardo Arias
2ad87f640f Reference RuleWithActions & Transaction object instead of copying values in RuleMessage
- Because the lifetime of the RuleMessage instances do not extend beyond
  the lifetime of the enclosing RuleWithActions & Transaction,
  RuleMessage can just reference it and simplify its definition.
- Additionally, make the references const to show that it doesn't modify it.
- Replace RuleMessage copy constructor with default implementations.
- Removed unused RuleMessage assignment operator (which cannot be implemented
  now that it has reference members).
- Removed constructor from RuleMessage pointer.
- Addressed Sonarcloud suggestions: Do not use the constructor's
  initializer list for data member "xxx". Use the in-class initializer
  instead.
2024-09-04 10:48:07 -03:00
Eduardo Arias
2ec640fd76 Delete unused copy constructor & assignment operator in Rule, RuleMarker & Action
- Declare other unsupported copy constructor & assignment operators as
  deleted too (RuleWithActions, RuleUnconditional & RuleScript)
2024-09-04 10:48:05 -03:00
Ervin Hegedus
580fe192df
Merge pull request #3247 from airween/v3/master
Release v3 version 3.0.13
v3.0.13
2024-09-03 15:44:47 +02:00
Ervin Hegedus
24dbcfe637
Change release version to v3.0.13 2024-09-03 15:24:29 +02:00
Ervin Hegedus
1a8c96a1cd
Merge pull request #3206 from airween/v3/release2408
Add PR's to CHANGES
2024-09-03 15:20:34 +02:00
Ervin Hegedus
b489fd3562
Format fix
Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com>
2024-09-03 07:45:09 +02:00
Ervin Hegedus
2ab970be2e
Finalize CHANGES 2024-09-02 22:23:19 +02:00
Ervin Hegedus
865b75b8fa
Merge branch 'owasp-modsecurity:v3/master' into v3/release2408 2024-08-28 16:37:12 +02:00
Ervin Hegedus
542a5ea35c
Added PR #3243 2024-08-28 16:08:23 +02:00
Ervin Hegedus
f180e647a1
Merge pull request #3243 from eduar-hte/valid-hex-fix
Adjust reference to modsecurity::utils::string::VALID_HEX
2024-08-28 16:07:44 +02:00
Ervin Hegedus
a4604b66f7 Added new tests to op @pm 2024-08-28 10:45:59 -03:00
Eduardo Arias
27cc8edbfe Adjust reference to modsecurity::utils::string::VALID_HEX
- This function (previously a #define) was previously in the global
  namespace and was moved into modsecurity::utils::string in commit
  a6d64bf.
2024-08-28 10:14:53 -03:00
Ervin Hegedus
358618951a
Added PR #3240 2024-08-28 14:37:56 +02:00
Ervin Hegedus
9403cf6f5d
Merge pull request #3240 from frozenice/patch-1
Lua::run: Move logging of `str` parameter to higher log level.
2024-08-28 14:36:36 +02:00
Ervin Hegedus
07fb580415
Added PR's #3233 and #3231 2024-08-28 14:34:58 +02:00
Ervin Hegedus
9148668571
Merge pull request #3231 from eduar-hte/remove-copies-transformations
Remove unnecessary heap allocated copies in Transformation actions
2024-08-28 14:33:59 +02:00
Ervin Hegedus
4951702d45
Merge pull request #3233 from eduar-hte/remove-copies-pm-operator
Removed multiple heap-allocated copies in Pm::init & parse_pm_content
2024-08-28 13:31:02 +02:00
Eduardo Arias
3e9d8107a8 Removed multiple heap-allocated copies in parse_pm_content
- The previous version of this function was doing three strdup copies
  to parse the pm content. The updated version only copies the value
  once (in order not to modify the Operator's m_param member variable),
  and then performs the updates inline.
- Binary parsing was broken because digits were not compared as
  characters.
  - Fail parsing when an invalid hex character is found.
- Error message in parse_pm_content would reference freed memory if
  accessed by caller. Removed anyway because it was unused.
2024-08-27 10:43:07 -03:00
Eduardo Arias
a6d64bf615 Replaced VALID_HEX, ISODIGIT & NBSP macros in string.h
- Moved them into modsecurity::utils::string to avoid polluting the
  global namespace.
2024-08-27 10:00:54 -03:00
Eduardo Arias
2f5dac5c4c Simplified initialization of Transformation's action_kind
- Some of the Transformation classes would initialize their Action's
  action_kind using the default (using Transformation constructor
  without an action_kind parameter).
- Others, however, would use that constructor and initialize action_kind
  manually in their constructor, but setting the default value
  (RunTimeBeforeMatchAttemptKind = 1), which was redundant.
- Removed unused Transformation constructor to specify action_kind.
- Converted Action::Kind into an 'enum class' to require using the enum
  constants (instead of integer values, which are difficult to track in
  the codebase and change)
2024-08-27 10:00:54 -03:00
Eduardo Arias
7023c0a8b4 Refactored sha1 & md5 utils to share implementation and reduce code duplication. 2024-08-27 10:00:54 -03:00
Eduardo Arias
fedec96a7e Refactored base64 utils to share implementation and reduce code duplication. 2024-08-27 10:00:38 -03:00
Eduardo Arias
34da8eeeee Pass RuleWithActions::executeTransformation arguments by reference
- This function already expects these arguments not to be null pointers,
  doesn't validate them and just dereference them.
- In order to make this explicit and enforced by the compiler, they're
  now passed as references.
2024-08-27 10:00:38 -03:00
Eduardo Arias
b647dbd905 Remove unnecessary heap-allocation & copy in Transaction::extractArguments
- utils::urldecode_nonstrict_inplace decodes inplace so key & value,
  which are values returned by utils::string::ssplit_pair can be
  just be modified and do not need to be copied.
- Updated signature of utils::urldecode_nonstrict_inplace, as its
  two callers already have std::string values.
2024-08-27 10:00:18 -03:00
Eduardo Arias
021d0caa33 Perform NormalisePath & NormalisePathWin transformations in-place 2024-08-27 10:00:18 -03:00
Eduardo Arias
2c3c228725 Perform Utf8ToUnicode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
17a2cbd164 Perform UrlDecodeUni & UrlDecode transformations in-place
- Use std::string in UrlEncode transformation, instead of manually
  memory management. This avoids an additional copy after completing
  encoding by just swapping the encoded value and the input.
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00
Eduardo Arias
8bf4d96e6b Perform HtmlEntityDecode transformation in-place
- Removed inplace helper function from the class, as it's only
  referenced by the implementation.
2024-08-27 10:00:18 -03:00