Skip to content

Commit 84606eb

Browse files
blotusblotus
authored
Appsec hooks fixes (#2769)
1 parent dc698ec commit 84606eb

File tree

2 files changed

+53
-22
lines changed

2 files changed

+53
-22
lines changed

‎pkg/appsec/appsec.go

Lines changed: 45 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -130,9 +130,9 @@ type AppsecConfig struct {
130130
}
131131

132132
func (w *AppsecRuntimeConfig) ClearResponse() {
133-
log.Debugf("#-> %p", w)
133+
w.Logger.Debugf("#-> %p", w)
134134
w.Response = AppsecTempResponse{}
135-
log.Debugf("-> %p", w.Config)
135+
w.Logger.Debugf("-> %p", w.Config)
136136
w.Response.Action = w.Config.DefaultPassAction
137137
w.Response.HTTPResponseCode = w.Config.PassedHTTPCode
138138
w.Response.SendEvent = true
@@ -290,20 +290,26 @@ func (w *AppsecRuntimeConfig) ProcessOnLoadRules() error {
290290
switch t := output.(type) {
291291
case bool:
292292
if !t {
293-
log.Debugf("filter didnt match")
293+
w.Logger.Debugf("filter didnt match")
294294
continue
295295
}
296296
default:
297-
log.Errorf("Filter must return a boolean, can't filter")
297+
w.Logger.Errorf("Filter must return a boolean, can't filter")
298298
continue
299299
}
300300
}
301301
for _, applyExpr := range rule.ApplyExpr {
302-
_, err := exprhelpers.Run(applyExpr, GetOnLoadEnv(w), w.Logger, w.Logger.Level >= log.DebugLevel)
302+
o, err := exprhelpers.Run(applyExpr, GetOnLoadEnv(w), w.Logger, w.Logger.Level >= log.DebugLevel)
303303
if err != nil {
304-
log.Errorf("unable to apply appsec on_load expr: %s", err)
304+
w.Logger.Errorf("unable to apply appsec on_load expr: %s", err)
305305
continue
306306
}
307+
switch t := o.(type) {
308+
case error:
309+
w.Logger.Errorf("unable to apply appsec on_load expr: %s", t)
310+
continue
311+
default:
312+
}
307313
}
308314
}
309315
return nil
@@ -320,27 +326,33 @@ func (w *AppsecRuntimeConfig) ProcessOnMatchRules(request *ParsedRequest, evt ty
320326
switch t := output.(type) {
321327
case bool:
322328
if !t {
323-
log.Debugf("filter didnt match")
329+
w.Logger.Debugf("filter didnt match")
324330
continue
325331
}
326332
default:
327-
log.Errorf("Filter must return a boolean, can't filter")
333+
w.Logger.Errorf("Filter must return a boolean, can't filter")
328334
continue
329335
}
330336
}
331337
for _, applyExpr := range rule.ApplyExpr {
332-
_, err := exprhelpers.Run(applyExpr, GetOnMatchEnv(w, request, evt), w.Logger, w.Logger.Level >= log.DebugLevel)
338+
o, err := exprhelpers.Run(applyExpr, GetOnMatchEnv(w, request, evt), w.Logger, w.Logger.Level >= log.DebugLevel)
333339
if err != nil {
334-
log.Errorf("unable to apply appsec on_match expr: %s", err)
340+
w.Logger.Errorf("unable to apply appsec on_match expr: %s", err)
335341
continue
336342
}
343+
switch t := o.(type) {
344+
case error:
345+
w.Logger.Errorf("unable to apply appsec on_match expr: %s", t)
346+
continue
347+
default:
348+
}
337349
}
338350
}
339351
return nil
340352
}
341353

342354
func (w *AppsecRuntimeConfig) ProcessPreEvalRules(request *ParsedRequest) error {
343-
log.Debugf("processing %d pre_eval rules", len(w.CompiledPreEval))
355+
w.Logger.Debugf("processing %d pre_eval rules", len(w.CompiledPreEval))
344356
for _, rule := range w.CompiledPreEval {
345357
if rule.FilterExpr != nil {
346358
output, err := exprhelpers.Run(rule.FilterExpr, GetPreEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
@@ -350,20 +362,26 @@ func (w *AppsecRuntimeConfig) ProcessPreEvalRules(request *ParsedRequest) error
350362
switch t := output.(type) {
351363
case bool:
352364
if !t {
353-
log.Debugf("filter didnt match")
365+
w.Logger.Debugf("filter didnt match")
354366
continue
355367
}
356368
default:
357-
log.Errorf("Filter must return a boolean, can't filter")
369+
w.Logger.Errorf("Filter must return a boolean, can't filter")
358370
continue
359371
}
360372
}
361373
// here means there is no filter or the filter matched
362374
for _, applyExpr := range rule.ApplyExpr {
363-
_, err := exprhelpers.Run(applyExpr, GetPreEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
375+
o, err := exprhelpers.Run(applyExpr, GetPreEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
364376
if err != nil {
365-
log.Errorf("unable to apply appsec pre_eval expr: %s", err)
377+
w.Logger.Errorf("unable to apply appsec pre_eval expr: %s", err)
378+
continue
379+
}
380+
switch t := o.(type) {
381+
case error:
382+
w.Logger.Errorf("unable to apply appsec pre_eval expr: %s", t)
366383
continue
384+
default:
367385
}
368386
}
369387
}
@@ -381,21 +399,29 @@ func (w *AppsecRuntimeConfig) ProcessPostEvalRules(request *ParsedRequest) error
381399
switch t := output.(type) {
382400
case bool:
383401
if !t {
384-
log.Debugf("filter didnt match")
402+
w.Logger.Debugf("filter didnt match")
385403
continue
386404
}
387405
default:
388-
log.Errorf("Filter must return a boolean, can't filter")
406+
w.Logger.Errorf("Filter must return a boolean, can't filter")
389407
continue
390408
}
391409
}
392410
// here means there is no filter or the filter matched
393411
for _, applyExpr := range rule.ApplyExpr {
394-
_, err := exprhelpers.Run(applyExpr, GetPostEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
412+
o, err := exprhelpers.Run(applyExpr, GetPostEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
413+
395414
if err != nil {
396-
log.Errorf("unable to apply appsec post_eval expr: %s", err)
415+
w.Logger.Errorf("unable to apply appsec post_eval expr: %s", err)
397416
continue
398417
}
418+
419+
switch t := o.(type) {
420+
case error:
421+
w.Logger.Errorf("unable to apply appsec post_eval expr: %s", t)
422+
continue
423+
default:
424+
}
399425
}
400426
}
401427

‎pkg/appsec/request.go

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ type ParsedRequest struct {
3838
Body []byte `json:"body,omitempty"`
3939
TransferEncoding []string `json:"transfer_encoding,omitempty"`
4040
UUID string `json:"uuid,omitempty"`
41-
Tx ExtendedTransaction `json:"transaction,omitempty"`
41+
Tx ExtendedTransaction `json:"-"`
4242
ResponseChannel chan AppsecTempResponse `json:"-"`
4343
IsInBand bool `json:"-"`
4444
IsOutBand bool `json:"-"`
@@ -260,12 +260,17 @@ func (r *ReqDumpFilter) ToJSON() error {
260260

261261
req := r.GetFilteredRequest()
262262

263-
log.Warningf("dumping : %+v", req)
263+
log.Tracef("dumping : %+v", req)
264264

265265
if err := enc.Encode(req); err != nil {
266+
//Don't clobber the temp directory with empty files
267+
err2 := os.Remove(fd.Name())
268+
if err2 != nil {
269+
log.Errorf("while removing temp file %s: %s", fd.Name(), err)
270+
}
266271
return fmt.Errorf("while encoding request: %w", err)
267272
}
268-
log.Warningf("request dumped to %s", fd.Name())
273+
log.Infof("request dumped to %s", fd.Name())
269274
return nil
270275
}
271276

0 commit comments

Comments
 (0)