Skip to content

Commit 938707d

Browse files
martinhsvmartinhsv
committed
Fix: quoted Include config with wildcard
1 parent 2121938 commit 938707d

File tree

4 files changed

+63
-23
lines changed

4 files changed

+63
-23
lines changed

‎CHANGES

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
v3.x.y - YYYY-MMM-DD (to be released)
22
-------------------------------------
33

4+
- Fix: quoted Include config with wildcard
5+
[Issue #2905 - @wiseelf, @airween, @martinhsv]
46
- Support isolated PCRE match limits
57
[Issue #2736 - @brandonpayton, @martinhsv]
68
- Fix: meta actions not applied if multiMatch in first rule of chain

‎src/parser/seclang-scanner.cc

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
#line 2 "seclang-scanner.cc"
2+
#line 3 "seclang-scanner.cc"
33

44
#define YY_INT_ALIGNED short int
55

@@ -5128,7 +5128,7 @@ static const flex_int16_t yy_rule_linenum[546] =
51285128
1174, 1179, 1181, 1182, 1183, 1184, 1186, 1187, 1188, 1189,
51295129
1191, 1192, 1193, 1194, 1196, 1198, 1199, 1201, 1202, 1203,
51305130
1204, 1206, 1211, 1212, 1213, 1217, 1218, 1219, 1224, 1226,
5131-
1227, 1228, 1247, 1276, 1307
5131+
1227, 1228, 1247, 1276, 1306
51325132
} ;
51335133

51345134
/* The intent behind this definition is that it'll catch
@@ -5214,15 +5214,15 @@ static std::stack<int> YY_PREVIOUS_STATE;
52145214
#define BEGIN_PREVIOUS() { BEGIN(YY_PREVIOUS_STATE.top()); YY_PREVIOUS_STATE.pop(); }
52155215

52165216
// The location of the current token.
5217-
#line 5217 "seclang-scanner.cc"
5217+
#line 5218 "seclang-scanner.cc"
52185218
#define YY_NO_INPUT 1
52195219

52205220
#line 494 "seclang-scanner.ll"
52215221
// Code run each time a pattern is matched.
52225222
# define YY_USER_ACTION driver.loc.back()->columns (yyleng);
52235223

5224-
#line 5224 "seclang-scanner.cc"
52255224
#line 5225 "seclang-scanner.cc"
5225+
#line 5226 "seclang-scanner.cc"
52265226

52275227
#define INITIAL 0
52285228
#define EXPECTING_ACTION_PREDICATE_VARIABLE 1
@@ -5544,7 +5544,7 @@ YY_DECL
55445544
// Code run each time yylex is called.
55455545
driver.loc.back()->step();
55465546

5547-
#line 5547 "seclang-scanner.cc"
5547+
#line 5548 "seclang-scanner.cc"
55485548

55495549
while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */
55505550
{
@@ -8597,9 +8597,9 @@ YY_RULE_SETUP
85978597
{
85988598
std::string err;
85998599
const char *tmpStr = yytext + strlen("include");
8600-
const char *file = tmpStr + strspn( tmpStr, " \t");
8601-
char *f = strdup(file);
8602-
std::string fi = modsecurity::utils::find_resource(f, *driver.loc.back()->end.filename, &err);
8600+
const char *afterWhitespace = tmpStr + strspn( tmpStr, " \t");
8601+
std::string file(afterWhitespace+1, strlen(afterWhitespace)-2);
8602+
std::string fi = modsecurity::utils::find_resource(file, *driver.loc.back()->end.filename, &err);
86038603
if (fi.empty() == true) {
86048604
BEGIN(INITIAL);
86058605
driver.error (*driver.loc.back(), "", file + std::string(": Not able to open file. ") + err);
@@ -8622,13 +8622,12 @@ YY_RULE_SETUP
86228622
}
86238623
yypush_buffer_state(yy_create_buffer( yyin, YY_BUF_SIZE ));
86248624
}
8625-
free(f);
86268625
}
86278626
YY_BREAK
86288627
case 545:
86298628
/* rule 545 can match eol */
86308629
YY_RULE_SETUP
8631-
#line 1307 "seclang-scanner.ll"
8630+
#line 1306 "seclang-scanner.ll"
86328631
{
86338632
HttpsClient c;
86348633
std::string key;
@@ -8667,7 +8666,7 @@ YY_RULE_SETUP
86678666
YY_BREAK
86688667
case 546:
86698668
YY_RULE_SETUP
8670-
#line 1344 "seclang-scanner.ll"
8669+
#line 1343 "seclang-scanner.ll"
86718670
ECHO;
86728671
YY_BREAK
86738672
#line 8673 "seclang-scanner.cc"
@@ -9775,7 +9774,7 @@ void yyfree (void * ptr )
97759774

97769775
/* %ok-for-header */
97779776

9778-
#line 1344 "seclang-scanner.ll"
9777+
#line 1343 "seclang-scanner.ll"
97799778

97809779

97819780
namespace modsecurity {

‎src/parser/seclang-scanner.ll

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1275,9 +1275,9 @@ EQUALS_MINUS (?i:=\-)
12751275
{CONFIG_INCLUDE}[ \t]+["]{CONFIG_VALUE_PATH}["] {
12761276
std::string err;
12771277
const char *tmpStr = yytext + strlen("include");
1278-
const char *file = tmpStr + strspn( tmpStr, " \t");
1279-
char *f = strdup(file);
1280-
std::string fi = modsecurity::utils::find_resource(f, *driver.loc.back()->end.filename, &err);
1278+
const char *afterWhitespace = tmpStr + strspn( tmpStr, " \t");
1279+
std::string file(afterWhitespace+1, strlen(afterWhitespace)-2);
1280+
std::string fi = modsecurity::utils::find_resource(file, *driver.loc.back()->end.filename, &err);
12811281
if (fi.empty() == true) {
12821282
BEGIN(INITIAL);
12831283
driver.error (*driver.loc.back(), "", file + std::string(": Not able to open file. ") + err);
@@ -1300,7 +1300,6 @@ EQUALS_MINUS (?i:=\-)
13001300
}
13011301
yypush_buffer_state(yy_create_buffer( yyin, YY_BUF_SIZE ));
13021302
}
1303-
free(f);
13041303
}
13051304
13061305
{CONFIG_SEC_REMOTE_RULES}[ ][^ ]+[ ][^\n\r ]+ {

‎test/test-cases/regression/config-include.json

Lines changed: 47 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{
33
"enabled":1,
44
"version_min":300000,
5-
"title":"Include (1/7)",
5+
"title":"Include (1/8)",
66
"client":{
77
"ip":"200.249.12.31",
88
"port":123
@@ -42,7 +42,7 @@
4242
{
4343
"enabled":1,
4444
"version_min":300000,
45-
"title":"Include (2/7)",
45+
"title":"Include (2/8)",
4646
"client":{
4747
"ip":"200.249.12.31",
4848
"port":123
@@ -82,7 +82,7 @@
8282
{
8383
"enabled":1,
8484
"version_min":300000,
85-
"title":"Include (3/7)",
85+
"title":"Include (3/8)",
8686
"client":{
8787
"ip":"200.249.12.31",
8888
"port":123
@@ -122,7 +122,7 @@
122122
{
123123
"enabled":1,
124124
"version_min":300000,
125-
"title":"Include (4/7)",
125+
"title":"Include (4/8)",
126126
"client":{
127127
"ip":"200.249.12.31",
128128
"port":123
@@ -162,7 +162,7 @@
162162
{
163163
"enabled":1,
164164
"version_min":300000,
165-
"title":"Include (5/7)",
165+
"title":"Include (5/8)",
166166
"client":{
167167
"ip":"200.249.12.31",
168168
"port":123
@@ -203,7 +203,7 @@
203203
{
204204
"enabled":1,
205205
"version_min":300000,
206-
"title":"Include (6/7)",
206+
"title":"Include (6/8)",
207207
"client":{
208208
"ip":"200.249.12.31",
209209
"port":123
@@ -243,7 +243,7 @@
243243
{
244244
"enabled":1,
245245
"version_min":300000,
246-
"title":"Include (7/7)",
246+
"title":"Include (7/8)",
247247
"client":{
248248
"ip":"200.249.12.31",
249249
"port":123
@@ -279,5 +279,45 @@
279279
"Include test-cases/data/conasdffig_example2.txt",
280280
"SecRule ARGS \"@contains test\" \"id:9,pass,t:trim\""
281281
]
282+
},
283+
{
284+
"enabled":1,
285+
"version_min":300000,
286+
"title":"Include (8/8) -- quoted with wildcard",
287+
"client":{
288+
"ip":"200.249.12.31",
289+
"port":123
290+
},
291+
"server":{
292+
"ip":"200.249.12.31",
293+
"port":80
294+
},
295+
"request":{
296+
"headers":{
297+
"Host":"localhost",
298+
"User-Agent":"curl/7.38.0",
299+
"Accept":"*/*"
300+
},
301+
"uri":"/?key=value&key=other_value",
302+
"method":"GET"
303+
},
304+
"response":{
305+
"headers":{
306+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
307+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
308+
"Content-Type":"text/html"
309+
},
310+
"body":[
311+
"no need."
312+
]
313+
},
314+
"expected":{
315+
"debug_log":"Executing operator \"Contains\" with param \"config_example2\" against ARGS."
316+
},
317+
"rules":[
318+
"SecRuleEngine On",
319+
"Include \"test-cases/data/config_ex*ple2.txt\"",
320+
"SecRule ARGS \"@contains test\" \"id:9,pass,t:trim\""
321+
]
282322
}
283323
]

0 commit comments

Comments
 (0)