mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-14 13:56:01 +03:00
74 lines
1.8 KiB
C++
74 lines
1.8 KiB
C++
/*
|
|
* ModSecurity, http://www.modsecurity.org/
|
|
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
|
|
*
|
|
* You may not use this file except in compliance with
|
|
* the License. You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* If any of the files related to licensing are missing or if you have any
|
|
* other questions related to licensing please contact Trustwave Holdings, Inc.
|
|
* directly using the email address security@modsecurity.org.
|
|
*
|
|
*/
|
|
|
|
#include "actions/capture.h"
|
|
|
|
#include <iostream>
|
|
#include <string>
|
|
#include <list>
|
|
|
|
#include "modsecurity/assay.h"
|
|
|
|
#include "src/rule.h"
|
|
#include "operators/operator.h"
|
|
#include "operators/pm.h"
|
|
#include "operators/rx.h"
|
|
#include "operators/contains.h"
|
|
#include "operators/detect_sqli.h"
|
|
|
|
namespace modsecurity {
|
|
namespace actions {
|
|
|
|
bool Capture::evaluate(Rule *rule, Assay *assay) {
|
|
operators::Operator *op = rule->op;
|
|
std::list<std::string> *match;
|
|
|
|
operators::Pm *pm = dynamic_cast<operators::Pm *>(op);
|
|
if (pm != NULL) {
|
|
match = &pm->matched;
|
|
}
|
|
|
|
operators::Rx *rx = dynamic_cast<operators::Rx *>(op);
|
|
if (rx != NULL) {
|
|
match = &rx->matched;
|
|
}
|
|
|
|
operators::Contains *contains = dynamic_cast<operators::Contains *>(op);
|
|
if (contains != NULL) {
|
|
match = &contains->matched;
|
|
}
|
|
|
|
operators::DetectSQLi *dsqli = dynamic_cast<operators::DetectSQLi *>(op);
|
|
if (dsqli != NULL) {
|
|
match = &dsqli->matched;
|
|
}
|
|
|
|
if (match->empty()) {
|
|
return false;
|
|
}
|
|
|
|
int i = 0;
|
|
while (match->empty() == false) {
|
|
assay->m_collections.storeOrUpdateFirst("TX",
|
|
std::to_string(i), match->back());
|
|
match->pop_back();
|
|
i++;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
} // namespace actions
|
|
} // namespace modsecurity
|