Felipe Zimmerle f18595f428

Makes regular expression selection on collections key case insensitive ...

This issue was initially reported by @michaelgranzow-avi on #2296.

@airween made an initial attempt to provide a fixed at #2107; As a
consequence of the pull request review - provided by @victorhora,
@zimmerle, and @michaelgranzow-avi - @airween made a second attempt
at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed
the essential pieces from @airween patch into this one.

This patch differs from @airween's because @airween's patches were
partially working: Key exclusions with regex weren't covered, same
for anchored variables (e.g. ARGS). During the review, I have
highlighted the importance of having elementary test cases. A simple
test case on ARGS could spot the issue. Since that is an important
fix, I don't want to hold this for one more review cycle; therefore,
I am committing the fix myself.

Thank you all involved in the solution of this very own issue.

2020-12-10 10:05:07 -03:00

..

action-allow.json

Creates RuleUnconditional

2020-03-31 14:44:19 -03:00

action-block.json

Check for disruptive action on SecDefaultAction

2018-02-28 14:02:47 -03:00

action-ctl_request_body_access.json

Fix matching condition and adjust test case

2018-09-11 20:53:17 -03:00

action-ctl_request_body_processor_urlencoded.json

Set the correct variable (m_requestBodyType) and add test case

2018-08-22 22:46:37 -03:00

action-ctl_request_body_processor.json

XML Parser: removes unnecessary message from debug logs

2017-04-05 09:40:05 -03:00

action-ctl_rule_engine.json

Adds test case for the ctl:ruleEngine action

2017-07-27 22:10:58 -03:00

action-ctl_rule_remove_by_id.json

Adds support for ctl:ruleRemoveByTag action

2018-03-26 17:01:53 -03:00

action-ctl_rule_remove_by_tag.json

Adds support for ctl:ruleRemoveByTag action

2018-03-26 17:01:53 -03:00

action-ctl_rule_remove_target_by_id.json

Refactoring on the Rule class

2018-10-23 16:26:10 -03:00

action-ctl_rule_remove_target_by_tag.json

Refactoring on the Rule class

2018-10-23 16:26:10 -03:00

action-disruptive.json

Adds initial support to drop action

2018-12-24 16:35:41 -03:00

action-exec.json

Makes lua optional

2017-11-06 00:44:54 -03:00

action-id.json

Using run time string on the operators

2018-02-20 13:40:00 -03:00

action-initcol.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

action-msg.json

setvar: needs review

2016-11-28 12:12:04 -03:00

action-setenv.json

Adds support to setenv action

2018-09-25 10:19:52 -03:00

action-setrsc.json

Adds support to setrsc action

2017-06-09 16:59:04 -03:00

action-setsid.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

action-setuid.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

action-skip.json

Using run time string on the operators

2018-02-20 13:40:00 -03:00

action-tag.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

action-tnf-base64.json

Fix utils::string::ssplit() to handle delimiter in the end of string

2018-04-22 11:37:30 -03:00

action-xmlns.json

Fix some improperly formatted test cases

2016-06-14 15:32:37 -03:00

actions.json

Adds test case for #1850

2018-10-30 18:25:46 -03:00

auditlog.json

Fix: audit log data omitted when nolog,auditlog

2020-01-07 11:16:07 -03:00

collection-case-insensitive.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

collection-lua.json

Add test cases for m.setvar in Lua scripts

2018-09-19 19:47:05 -04:00

collection-regular_expression_selection.json

Fix regular expression test case and updates the test list

2017-03-06 15:01:52 -03:00

collection-resource.json

Using shared var for variables names

2018-02-20 13:40:01 -03:00

collection-tx-with-macro.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

collection-tx.json

Changes debuglogs schema to avoid unecessary str allocation

2018-10-23 17:00:16 -03:00

config-body_limits.json

Having body limits to respect the rule engine state

2019-06-03 14:05:10 -03:00

config-calling_phases_by_name.json

Check if response body inspection is enabled before process it

2018-05-08 10:59:30 -03:00

config-include-bad.json

Using run time string on the operators

2018-02-20 13:40:00 -03:00

config-include.json

Adds verbose message when a resource is not found.

2017-05-02 13:39:37 -03:00

config-remove_by_id.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

config-remove_by_msg.json

Adds support for SecRuleRemoveByTag

2017-11-07 14:52:50 -03:00

config-remove_by_tag.json

Adds support for SecRuleRemoveByTag

2017-11-07 14:52:50 -03:00

config-response_type.json

Check if response body inspection is enabled before process it

2018-05-08 10:59:30 -03:00

config-secdefaultaction.json

Changes the behavior of the default sec actions

2018-05-31 14:52:53 -03:00

config-secremoterules.json

regression: Using github instead of modsecurity.org for SecRemoteRules

2019-04-05 12:59:34 -03:00

config-update-action-by-id.json

Adds test case to cover issue #2005

2019-06-18 15:10:43 -03:00

config-update-target-by-id.json

Fix rule-update-target exclusions for plain (non-regex) variables

2020-02-11 09:42:37 -03:00

config-update-target-by-msg.json

Refactoring on the Rule class

2018-10-23 16:26:10 -03:00

config-update-target-by-tag.json

Fix rule-update-target exclusions for plain (non-regex) variables

2020-02-11 09:42:37 -03:00

config-xml_external_entity.json

Adds support to SecXMLExternalEntity

2016-05-18 17:02:15 -03:00

debug_log.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

directive-sec_rule_script.json

Adds missing SecRuleScript test case

2017-11-06 23:27:00 -03:00

issue-394.json

Refactoring on the audit logs implementation

2016-12-14 23:17:28 -03:00

issue-849.json

Adds support for /32 in @ipMatch cidr notation.

2018-10-23 16:37:53 -03:00

issue-960.json

Make block action execution dependent of the SecEngine status

2019-06-03 19:55:02 -03:00

issue-1152.json

Fix pass action behaviour: now only ingore actions within the same rule

2016-07-01 11:01:51 -03:00

issue-1528.json

Changes the timing to save the rule message

2018-10-23 16:58:42 -03:00

issue-1565.json

Adds test case for issue #1565

2017-10-11 23:19:20 -03:00

issue-1576.json

Adds test case for issue #1576

2017-11-13 22:32:55 -03:00

issue-1591.json

Support pipes inside quoted variable selection

2017-10-20 11:02:42 -03:00

issue-1725.json

Adds test case related to issue #1725

2018-09-24 16:39:57 -03:00

issue-1743.json

Fix github_issue reference in regression test

2018-04-23 22:09:03 -03:00

issue-1785.json

Allow empty strings to be evaluated by regex::searchAll

2018-06-18 22:11:48 -03:00

issue-1812.json

Adds test case for: #1812

2018-09-05 16:00:42 -03:00

issue-1825.json

Multipart Content-Disposition should allow filename* field

2020-02-11 10:29:38 -03:00

issue-1831.json

Makes Rule a shared pointer

2020-03-25 16:11:23 -03:00

issue-1844.json

Fix rule line number

2018-10-24 21:02:35 -03:00

issue-1850.json

Adds test case for #1850

2018-10-30 18:25:46 -03:00

issue-1941.json

Fix SecUnicodeMapFile support

2018-10-31 22:57:39 -03:00

issue-1943.json

Fix on top of #1943 + adding test cases

2018-11-01 16:11:39 -03:00

issue-1956.json

Adds support to multiple ranges in ctl:ruleRemoveById

2018-11-26 20:48:18 -03:00

issue-1960.json

Fix test case 1960

2019-06-04 08:38:45 -03:00

issue-2000.json

Regression tests: audit log compare support and test cases

2020-03-31 15:01:26 -03:00

issue-2099.json

Added some test cases related to #2099

2019-05-30 09:52:27 -03:00

issue-2111.json

Changed compared variables of range id intervall in ruleRemoveById ctl action. #2111

2019-06-04 10:28:30 -03:00

issue-2196.json

Regression tests: audit log compare support and test cases

2020-03-31 15:01:26 -03:00

issue-2296.json

Makes regular expression selection on collections key case insensitive

2020-12-10 10:05:07 -03:00

issue-2423-msg-in-chain.json

Issue-2423: Meta-actions like 'msg' should be applied at end of chain

2020-10-29 10:33:02 -03:00

issue-2427.json

Fix: Only delete Multipart tmp files after rules have run

2020-11-04 13:50:07 -03:00

misc-variable-under-quotes.json

Consideres under quote variable while loading the rules

2017-10-06 20:25:20 +00:00

misc.json

Refactoring on the operators parsers (2/2)

2017-03-06 15:01:50 -03:00

offset-variable.json

Modified affected test cases, which checked wrong variables

2019-02-12 09:16:07 -03:00

operator-detectsqli.json

Adds capture action to detectSQLi

2018-03-09 12:58:00 -03:00

operator-detectxss.json

Small fix on @detectXSS test case

2018-10-23 16:26:11 -03:00

operator-fuzzyhash.json

Fix regression tests for fuzzyHash

2017-10-27 14:47:04 -03:00

operator-inpectFile.json

Adjust tests for @inspectFile operator

2018-03-22 23:06:42 -03:00

operator-ipMatchFromFile.json

Fix resource load on ip match from file

2018-02-22 21:23:20 -03:00

operator-pm.json

Fix @pm lookup for possible matches on offset zero

2019-10-02 08:05:14 -07:00

operator-rx.json

Changes the timing to save the rule message

2018-10-23 16:58:42 -03:00

operator-rxGlobal.json

Add support for new operator rxGlobal

2020-10-26 08:55:07 -03:00

operator-UnconditionalMatch.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

operator-validate-byte-range.json

adds a test for validateByteRange with bytes > 127

2017-08-20 20:07:54 -03:00

operator-verifycc.json

Adds capture action to verifyCC

2018-03-09 11:26:24 -03:00

operator-verifycpf.json

Adds capture action to verifyCPF

2018-03-08 19:05:31 -03:00

operator-verifyssn.json

Adds capture action to verifySSN

2018-03-09 09:42:05 -03:00

operator-verifysvnr.json

Adds new operator to check for data leakage of Austrian social security number

2019-05-29 20:57:08 -03:00

request-body-parser-json.json

Allow 0 length JSON requests

2018-11-29 10:39:46 -03:00

request-body-parser-multipart-crlf.json

Fix some improperly formatted test cases

2016-06-14 15:32:37 -03:00

request-body-parser-multipart.json

Adjust boundary test cases for the less strict parsing

2018-11-20 22:17:53 -03:00

request-body-parser-xml-validade-dtd.json

Adds support to SecXMLExternalEntity

2016-05-18 17:02:15 -03:00

request-body-parser-xml.json

Adds support to SecXMLExternalEntity

2016-05-18 17:02:15 -03:00

rule-920120.json

Fixed data collecting in multipart parsing

2019-02-12 09:16:07 -03:00

rule-920200.json

Allow empty anchored variable to use

2019-02-12 09:31:19 -03:00

rule-920274.json

Fixed validateByteRange parsing method

2019-02-12 09:10:36 -03:00

sec_component_signature.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

secaction.json

Refactoring: Rule class

2016-11-28 13:07:25 -03:00

secargumentslimit.json

Support configurable limit on number of arguments processed

2020-02-14 11:00:01 -03:00

secmarker.json

Splits Rule class into: Rule, RuleBase, RuleMarker

2020-03-30 20:21:36 -03:00

secruleengine.json

Make block action execution dependent of the SecEngine status

2019-06-03 19:55:02 -03:00

transformation-none.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

transformations.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-ARGS_COMBINED_SIZE.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-ARGS_GET_NAMES.json

Revert "Treating ARGS_NAMES as an array instead of scalar"

2017-08-24 00:10:42 -03:00

variable-ARGS_GET.json

Fix argument key-value pair parsing cases

2019-11-05 13:06:29 -03:00

variable-ARGS_NAMES.json

Revert "Treating ARGS_NAMES as an array instead of scalar"

2017-08-24 00:10:42 -03:00

variable-ARGS_POST_NAMES.json

Revert "Treating ARGS_NAMES as an array instead of scalar"

2017-08-24 00:10:42 -03:00

variable-ARGS_POST.json

Fix argument key-value pair parsing cases

2019-11-05 13:06:29 -03:00

variable-ARGS.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-AUTH_TYPE.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-DURATION.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-ENV.json

Changes ENV test case to read the default MODSECURTIY env var

2018-11-29 15:21:28 -03:00

variable-FILES_COMBINED_SIZE.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-FILES_NAMES.json

Modified affected test cases, which checked wrong variables

2019-02-12 09:16:07 -03:00

variable-FILES_SIZES.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-FILES.json

Refactoring: Rule class

2016-11-28 13:07:25 -03:00

variable-FULL_REQUEST_LENGTH.json

dds support to CtlRequestBodyAccess

2016-10-28 09:48:10 -03:00

variable-FULL_REQUEST.json

Adds offset regression tests and assorted fixes on var's offsets

2017-03-06 15:02:02 -03:00

variable-GEO.json

Fix maxmind test case

2018-03-29 17:24:32 -03:00

variable-HIGHEST_SEVERITY.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-INBOUND_DATA_ERROR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-MATCHED_VAR_NAME.json

Forces disruptive to be first-rule-only

2017-04-24 21:06:35 -03:00

variable-MATCHED_VAR.json

Forces disruptive to be first-rule-only

2017-04-24 21:06:35 -03:00

variable-MATCHED_VARS_NAMES.json

Forces disruptive to be first-rule-only

2017-04-24 21:06:35 -03:00

variable-MATCHED_VARS.json

Forces disruptive to be first-rule-only

2017-04-24 21:06:35 -03:00

variable-MODSEC_BUILD.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-MULTIPART_CRLF_LF_LINES.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-MULTIPART_FILENAME.json

Extends the direct access model to other collections

2017-03-06 15:02:00 -03:00

variable-MULTIPART_INVALID_HEADER_FOLDING.json

Better support for multipart

2016-06-10 09:40:08 -03:00

variable-MULTIPART_NAME.json

Extends the direct access model to other collections

2017-03-06 15:02:00 -03:00

variable-MULTIPART_STRICT_ERROR.json

Make the boundary check less strict as per RFC2046

2018-11-20 22:17:22 -03:00

variable-MULTIPART_UNMATCHED_BOUNDARY.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-OUTBOUND_DATA_ERROR.json

Check if response body inspection is enabled before process it

2018-05-08 10:59:30 -03:00

variable-PATH_INFO.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-QUERY_STRING.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REMOTE_ADDR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REMOTE_HOST.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REMOTE_PORT.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REMOTE_USER.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQBODY_PROCESSOR_ERROR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQBODY_PROCESSOR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQUEST_BASENAME.json

Adds more tests to REQUEST_BASENAME

2018-09-04 22:02:56 -03:00

variable-REQUEST_BODY_LENGTH.json

dds support to CtlRequestBodyAccess

2016-10-28 09:48:10 -03:00

variable-REQUEST_BODY.json

dds support to CtlRequestBodyAccess

2016-10-28 09:48:10 -03:00

variable-REQUEST_COOKIES_NAMES.json

Replace Cookie parsing method

2019-11-20 08:51:05 -03:00

variable-REQUEST_COOKIES.json

Fix Cookie header parsing issues

2019-11-20 08:51:06 -03:00

variable-REQUEST_FILENAME.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQUEST_HEADERS_NAMES.json

Revert "Treating ARGS_NAMES as an array instead of scalar"

2017-08-24 00:10:42 -03:00

variable-REQUEST_HEADERS.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQUEST_LINE.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQUEST_METHOD.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQUEST_PROTOCOL.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQUEST_URI_RAW.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-REQUEST_URI.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-RESPONSE_BODY.json

Check if response body inspection is enabled before process it

2018-05-08 10:59:30 -03:00

variable-RESPONSE_CONTENT_LENGTH.json

Check if response body inspection is enabled before process it

2018-05-08 10:59:30 -03:00

variable-RESPONSE_CONTENT_TYPE.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-RESPONSE_HEADERS_NAMES.json

Revert "Treating ARGS_NAMES as an array instead of scalar"

2017-08-24 00:10:42 -03:00

variable-RESPONSE_HEADERS.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-RESPONSE_PROTOCOL.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-RULE.json

Avoids string copy by working with pointers while resolving variables

2016-12-28 20:00:14 -03:00

variable-SERVER_ADDR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-SERVER_NAME.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-SERVER_PORT.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-SESSIONID.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-STATUS.json

SecLang uses RESPONSE_STATUS as variable, not STATUS

2016-10-18 21:30:06 -03:00

variable-TIME_DAY.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME_EPOCH.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME_HOUR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME_MIN.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME_MON.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME_SEC.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME_WDAY.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME_YEAR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TIME.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-TX.json

rx:exit after full match; fix TX population after unused group

2020-06-29 06:13:45 -07:00

variable-UNIQUE_ID.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-URLENCODED_ERROR.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-USERID.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-variation-count.json

Removes SecDebugLog directive from the test cases

2016-10-18 18:23:35 -03:00

variable-variation-exclusion.json

Handling key exceptions on the variable itself

2018-09-24 16:16:30 -03:00

variable-WEBAPPID.json

Adds support to WEBAPPID variable

2017-11-08 10:28:56 -03:00

variable-WEBSERVER_ERROR_LOG.json

Adds a test case for WEBSERVER_ERROR_LOG

2016-07-08 11:05:09 -03:00