Skip to content

Commit 9369efc

Browse files
author
Felipe Zimmerle
committed
Adds support to the collection RESOURCE
1 parent a9d54c3 commit 9369efc

File tree

9 files changed

+3471
-3341
lines changed

9 files changed

+3471
-3341
lines changed

CHANGES

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
v3.0.????? - ?
33
---------------------------
44

5+
- Adds support for RESOURCE variable collection.
6+
[Issue #1014 - @zimmerle, @victorhora]
57
- Adds support for @fuzzyHash operator.
68
[Issue #997 - @zimmerle]
79
- Fix build on non x86 arch build

Makefile.am

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,4 +285,5 @@ TESTS+=test/test-cases/regression/config-update-target-by-tag.json
285285
TESTS+=test/test-cases/regression/config-update-target-by-id.json
286286
TESTS+=test/test-cases/regression/misc-variable-under-quotes.json
287287
TESTS+=test/test-cases/regression/operator-fuzzyhash.json
288+
TESTS+=test/test-cases/regression/collection-resource.json
288289

src/parser/seclang-parser.cc

Lines changed: 440 additions & 424 deletions
Large diffs are not rendered by default.

src/parser/seclang-parser.yy

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1760,6 +1760,18 @@ var:
17601760
{
17611761
VARIABLE_CONTAINER($$, new Variables::FilesTmpNames_NoDictElement());
17621762
}
1763+
| VARIABLE_RESOURCE DICT_ELEMENT
1764+
{
1765+
VARIABLE_CONTAINER($$, new Variables::Resource_DictElement($2));
1766+
}
1767+
| VARIABLE_RESOURCE DICT_ELEMENT_REGEXP
1768+
{
1769+
VARIABLE_CONTAINER($$, new Variables::Resource_DictElementRegexp($2));
1770+
}
1771+
| VARIABLE_RESOURCE
1772+
{
1773+
VARIABLE_CONTAINER($$, new Variables::Resource_NoDictElement());
1774+
}
17631775

17641776
| VARIABLE_IP DICT_ELEMENT
17651777
{
@@ -2025,10 +2037,6 @@ var:
20252037
{
20262038
VARIABLE_CONTAINER($$, new Variables::RequestURIRaw());
20272039
}
2028-
| VARIABLE_RESOURCE
2029-
{
2030-
VARIABLE_CONTAINER($$, new Variables::Resource());
2031-
}
20322040
| VARIABLE_RESPONSE_BODY
20332041
{
20342042
VARIABLE_CONTAINER($$, new Variables::ResponseBody());

src/parser/seclang-scanner.cc

Lines changed: 2918 additions & 2908 deletions
Large diffs are not rendered by default.

src/parser/seclang-scanner.ll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -809,6 +809,8 @@ EQUALS_MINUS (?i:=\-)
809809
810810
{VARIABLE_IP} { return p::make_VARIABLE_IP(*driver.loc.back()); }
811811
{VARIABLE_IP}[:] { BEGIN(EXPECTING_VAR_PARAMETER); return p::make_VARIABLE_IP(*driver.loc.back()); }
812+
{VARIABLE_RESOURCE} { return p::make_VARIABLE_RESOURCE(*driver.loc.back()); }
813+
{VARIABLE_RESOURCE}[:] { BEGIN(EXPECTING_VAR_PARAMETER); return p::make_VARIABLE_RESOURCE(*driver.loc.back()); }
812814
{VARIABLE_GLOBAL} { return p::make_VARIABLE_GLOBAL(*driver.loc.back()); }
813815
{VARIABLE_GLOBAL}[:] { BEGIN(EXPECTING_VAR_PARAMETER); return p::make_VARIABLE_GLOBAL(*driver.loc.back()); }
814816
{VARIABLE_SESSION} { return p::make_VARIABLE_SESSION(*driver.loc.back()); }

src/variables/ip.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ namespace Variables {
3333
class Ip_DictElement : public Variable {
3434
public:
3535
explicit Ip_DictElement(std::string dictElement)
36-
: Variable("IP"),
36+
: Variable("IP:" + dictElement),
3737
m_dictElement("IP:" + dictElement) { }
3838

3939
void evaluate(Transaction *transaction,

src/variables/resource.h

Lines changed: 41 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,55 @@ namespace modsecurity {
2929
class Transaction;
3030
namespace Variables {
3131

32-
class Resource : public Variable {
32+
33+
class Resource_DictElement : public Variable {
34+
public:
35+
explicit Resource_DictElement(std::string dictElement)
36+
: Variable("RESOURCE:" + dictElement),
37+
m_dictElement("RESOURCE:" + dictElement) { }
38+
39+
void evaluate(Transaction *transaction,
40+
Rule *rule,
41+
std::vector<const collection::Variable *> *l) override {
42+
transaction->m_collections.resolveMultiMatches(m_dictElement, "RESOURCE", l);
43+
}
44+
45+
std::string m_dictElement;
46+
};
47+
48+
49+
class Resource_NoDictElement : public Variable {
3350
public:
34-
Resource()
51+
Resource_NoDictElement()
3552
: Variable("RESOURCE") { }
3653

3754
void evaluate(Transaction *transaction,
3855
Rule *rule,
39-
std::vector<const collection::Variable *> *l) {
40-
transaction->m_variableResource.evaluate(l);
56+
std::vector<const collection::Variable *> *l) override {
57+
transaction->m_collections.resolveMultiMatches(m_name, "RESOURCE", l);
4158
}
4259
};
4360

61+
62+
class Resource_DictElementRegexp : public Variable {
63+
public:
64+
explicit Resource_DictElementRegexp(std::string dictElement)
65+
: Variable("RESOURCE:regex(" + dictElement + ")"),
66+
m_r(dictElement),
67+
m_dictElement("RESOURCE:" + dictElement) { }
68+
69+
void evaluate(Transaction *transaction,
70+
Rule *rule,
71+
std::vector<const collection::Variable *> *l) override {
72+
transaction->m_collections.resolveRegularExpression(m_dictElement,
73+
"RESOURCE", l);
74+
}
75+
76+
Utils::Regex m_r;
77+
std::string m_dictElement;
78+
};
79+
80+
4481
} // namespace Variables
4582
} // namespace modsecurity
4683

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
[
2+
{
3+
"enabled":1,
4+
"version_min":300000,
5+
"version_max":0,
6+
"title":"Testing collection :: RESOURCE (1/2)",
7+
"client":{
8+
"ip":"200.249.12.31",
9+
"port":2313
10+
},
11+
"server":{
12+
"ip":"200.249.12.31",
13+
"port":80
14+
},
15+
"request":{
16+
"headers":{
17+
"User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
18+
"Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
19+
"Accept-Language":"en-us,en;q=0.5",
20+
"Accept-Encoding":"gzip,deflate",
21+
"Accept-Charset":"ISO-8859-1,utf-8;q=0.7,*;q=0.7",
22+
"Keep-Alive":"300",
23+
"Connection":"keep-alive",
24+
"Cookie":"PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
25+
"Pragma":"no-cache",
26+
"Cache-Control":"no-cache"
27+
},
28+
"uri":"\/test.pl?resource=whee",
29+
"method":"GET",
30+
"http_version":1.1,
31+
"body":""
32+
},
33+
"response":{
34+
"headers":{
35+
"Content-Type":"text\/xml; charset=utf-8\n\r",
36+
"Content-Length":"length\n\r"
37+
},
38+
"body":[
39+
]
40+
},
41+
"expected":{
42+
"audit_log":"",
43+
"debug_log":"Target value: \"123\" \\(Variable: whee::RESOURCE:test\\)",
44+
"error_log":""
45+
},
46+
"rules":[
47+
"SecRuleEngine On",
48+
"SecRule ARGS:resource \"@unconditionalmatch \" \"phase:2,pass,initcol:resource=%{ARGS.resource},id:900003\"",
49+
"SecRule ARGS:resource \"@unconditionalmatch \" \"phase:2,pass,setvar:resource.test=123,id:900000\"",
50+
"SecRule ARGS:resource \"@unconditionalmatch \" \"phase:2,pass,expirevar:resource.timeout=3600,id:9000033\"",
51+
"SecRule RESOURCE:test \"@unconditionalmatch \" \"phase:2,pass,expirevar:resource.timeout=3600,id:9000034\""
52+
]
53+
}
54+
]

0 commit comments

Comments
 (0)