Skip to content

Add Regex::searchAllMatches method, remove searchAll #2394

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Add Regex::searchAllMatches method, remove searchAll #2394

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 14 additions & 20 deletions src/modsecurity.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,9 +229,9 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
const unsigned char *buf;
size_t jsonSize;

std::list<Utils::SMatch> vars = variables.searchAll(matchString);
std::list<Utils::SMatch> ops = operators.searchAll(matchString);
std::list<Utils::SMatch> trans = transformations.searchAll(matchString);
auto vars = variables.searchAllMatches(matchString);
auto ops = operators.searchAllMatches(matchString);
auto trans = transformations.searchAllMatches(matchString);

g = yajl_gen_alloc(NULL);
if (g == NULL) {
Expand All @@ -256,14 +256,11 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
strlen("highlight"));

yajl_gen_array_open(g);
while (vars.size() > 0) {
for (const auto &m : vars) {
std::string value;
yajl_gen_map_open(g);
vars.pop_back();
const std::string &startingAt = vars.back().str();
vars.pop_back();
const std::string &size = vars.back().str();
vars.pop_back();
auto startingAt = m[1].to_string(matchString);
auto size = m[2].to_string(matchString);
yajl_gen_string(g,
reinterpret_cast<const unsigned char*>("startingAt"),
strlen("startingAt"));
Expand Down Expand Up @@ -303,23 +300,23 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
varValue.size());
yajl_gen_map_close(g);

while (trans.size() > 0) {
for (const auto &m : trans) {
modsecurity::actions::transformations::Transformation *t;
std::string varValueRes;
yajl_gen_map_open(g);
yajl_gen_string(g,
reinterpret_cast<const unsigned char*>("transformation"),
strlen("transformation"));

auto transformation_name = m[0].to_string(matchString);
yajl_gen_string(g,
reinterpret_cast<const unsigned char*>(trans.back().str().c_str()),
trans.back().str().size());
reinterpret_cast<const unsigned char*>(transformation_name.c_str()),
transformation_name.size());

t = modsecurity::actions::transformations::Transformation::instantiate(
trans.back().str().c_str());
transformation_name.c_str());
varValueRes = t->evaluate(varValue, NULL);
varValue.assign(varValueRes);
trans.pop_back();

yajl_gen_string(g, reinterpret_cast<const unsigned char*>("value"),
strlen("value"));
Expand All @@ -338,16 +335,13 @@ int ModSecurity::processContentOffset(const char *content, size_t len,

yajl_gen_map_open(g);

while (ops.size() > 0) {
for (const auto &m : ops) {
std::string value;
yajl_gen_string(g, reinterpret_cast<const unsigned char*>("highlight"),
strlen("highlight"));
yajl_gen_map_open(g);
ops.pop_back();
std::string startingAt = ops.back().str();
ops.pop_back();
std::string size = ops.back().str();
ops.pop_back();
auto startingAt = m[1].to_string(matchString);
auto size = m[2].to_string(matchString);
yajl_gen_string(g,
reinterpret_cast<const unsigned char*>("startingAt"),
strlen("startingAt"));
Expand Down
2 changes: 1 addition & 1 deletion src/operators/rx.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ bool Rx::evaluate(Transaction *transaction, RuleWithActions *rule,
re = m_re;
}

std::vector<Utils::SMatchCapture> captures;
Regex::match_type captures;
re->searchOneMatch(input, captures);

if (rule && rule->hasCaptureAction() && transaction) {
Expand Down
14 changes: 8 additions & 6 deletions src/operators/verify_cpf.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,6 @@ bool VerifyCPF::verify(const char *cpfnumber, int len) {

bool VerifyCPF::evaluate(Transaction *t, RuleWithActions *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
std::list<SMatch> matches;
bool is_cpf = false;
int i;

Expand All @@ -119,16 +118,19 @@ bool VerifyCPF::evaluate(Transaction *t, RuleWithActions *rule,
}

for (i = 0; i < input.size() - 1 && is_cpf == false; i++) {
matches = m_re->searchAll(input.substr(i, input.size()));
std::string val = input.substr(i);
auto matches = m_re->searchAllMatches(val);
for (const auto & m : matches) {
is_cpf = verify(m.str().c_str(), m.str().size());
const auto &g = m[0];
is_cpf = verify(&val[g.m_offset], g.m_length);
if (is_cpf) {
logOffset(ruleMessage, m.offset(), m.str().size());
logOffset(ruleMessage, g.m_offset, g.m_length);
if (rule && t && rule->hasCaptureAction()) {
std::string str = g.to_string(val);
t->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", m.str());
"0", str);
ms_dbg_a(t, 7, "Added VerifyCPF match TX.0: " + \
m.str());
str);
}

goto out;
Expand Down
15 changes: 9 additions & 6 deletions src/operators/verify_ssn.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,16 +121,19 @@ bool VerifySSN::evaluate(Transaction *t, RuleWithActions *rule,
}

for (i = 0; i < input.size() - 1 && is_ssn == false; i++) {
matches = m_re->searchAll(input.substr(i, input.size()));
for (const auto & j : matches) {
is_ssn = verify(j.str().c_str(), j.str().size());
std::string val = input.substr(i);
auto matches = m_re->searchAllMatches(val);
for (const auto & m : matches) {
const auto &g = m[0];
is_ssn = verify(&val[g.m_offset], g.m_length);
if (is_ssn) {
logOffset(ruleMessage, j.offset(), j.str().size());
logOffset(ruleMessage, g.m_offset, g.m_length);
if (rule && t && rule->hasCaptureAction()) {
std::string str = g.to_string(val);
t->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", j.str());
"0", str);
ms_dbg_a(t, 7, "Added VerifySSN match TX.0: " + \
j.str());
str);
}

goto out;
Expand Down
15 changes: 9 additions & 6 deletions src/operators/verify_svnr.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,17 +88,20 @@ bool VerifySVNR::evaluate(Transaction *t, RuleWithActions *rule,
}

for (i = 0; i < input.size() - 1 && is_svnr == false; i++) {
matches = m_re->searchAll(input.substr(i, input.size()));
std::string val = input.substr(i);
auto matches = m_re->searchAllMatches(val);

for (const auto & j : matches) {
is_svnr = verify(j.str().c_str(), j.str().size());
for (const auto & m : matches) {
const auto &g = m[0];
is_svnr = verify(&val[g.m_offset], g.m_length);
if (is_svnr) {
logOffset(ruleMessage, j.offset(), j.str().size());
logOffset(ruleMessage, g.m_offset, g.m_length);
if (rule && t && rule->hasCaptureAction()) {
std::string str = g.to_string(val);
t->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", j.str());
"0", str);
ms_dbg_a(t, 7, "Added VerifySVNR match TX.0: " + \
j.str());
str);
}

goto out;
Expand Down
68 changes: 33 additions & 35 deletions src/utils/regex.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,41 +61,7 @@ Regex::~Regex() {
}
}


std::list<SMatch> Regex::searchAll(const std::string& s) const {
const char *subject = s.c_str();
const std::string tmpString = std::string(s.c_str(), s.size());
int ovector[OVECCOUNT];
int rc, i, offset = 0;
std::list<SMatch> retList;

do {
rc = pcre_exec(m_pc, m_pce, subject,
s.size(), offset, 0, ovector, OVECCOUNT);

for (i = 0; i < rc; i++) {
size_t start = ovector[2*i];
size_t end = ovector[2*i+1];
size_t len = end - start;
if (end > s.size()) {
rc = 0;
break;
}
std::string match = std::string(tmpString, start, len);
offset = start + len;
retList.push_front(SMatch(match, start));

if (len == 0) {
rc = 0;
break;
}
}
} while (rc > 0);

return retList;
}

bool Regex::searchOneMatch(const std::string& s, std::vector<SMatchCapture>& captures) const {
bool Regex::searchOneMatch(const std::string& s, match_type& captures) const {
const char *subject = s.c_str();
int ovector[OVECCOUNT];

Expand All @@ -115,6 +81,38 @@ bool Regex::searchOneMatch(const std::string& s, std::vector<SMatchCapture>& cap
return (rc > 0);
}

std::vector<Regex::match_type> Regex::searchAllMatches(const std::string& s) const {
int ovector[OVECCOUNT];
int offset = 0;
std::vector<Regex::match_type> matches;

while (int rc = pcre_exec(m_pc, m_pce, s.data(), s.size(), offset, 0, ovector, OVECCOUNT) > 0) {
Regex::match_type match;

for (int i = 0; i < rc; i++) {
int start = ovector[2*i];
int end = ovector[2*i+1];

// see man pcreapi for details when offsets are set to -1
if (start >= 0 && end >= 0) {
int len = end - start;
match.emplace_back(i, start, len);
}
}
matches.push_back(std::move(match));

// offsets for full match (group 0)
int start = ovector[0];
int end = ovector[1];
offset = end;
if (start == end) {
// skip zero-length match (otherwise, the loop won't terminate)
offset++;
}
}
return matches;
}

int Regex::search(const std::string& s, SMatch *match) const {
int ovector[OVECCOUNT];
int ret = pcre_exec(m_pc, m_pce, s.c_str(),
Expand Down
13 changes: 11 additions & 2 deletions src/utils/regex.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,19 +57,28 @@ struct SMatchCapture {
size_t m_group; // E.g. 0 = full match; 6 = capture group 6
size_t m_offset; // offset of match within the analyzed string
size_t m_length;

// to_string is convenience method for returning string for the match.
// You must supply the same string that was used to obtain the match,
// as offset would be invalid otherwise.
std::string to_string(const std::string &matched_string) const {
return matched_string.substr(m_offset, m_length);
}
};

class Regex {
public:
typedef std::vector<SMatchCapture> match_type;

explicit Regex(const std::string& pattern_);
~Regex();

// m_pc and m_pce can't be easily copied
Regex(const Regex&) = delete;
Regex& operator=(const Regex&) = delete;

std::list<SMatch> searchAll(const std::string& s) const;
bool searchOneMatch(const std::string& s, std::vector<SMatchCapture>& captures) const;
bool searchOneMatch(const std::string& s, match_type& captures) const;
std::vector<match_type> searchAllMatches(const std::string &s) const;
int search(const std::string &s, SMatch *match) const;
int search(const std::string &s) const;

Expand Down
4 changes: 2 additions & 2 deletions src/variables/variable.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ class KeyExclusionRegex : public KeyExclusion {
~KeyExclusionRegex() override { }

bool match(const std::string &a) override {
return m_re.searchAll(a).size() > 0;
return m_re.search(a);
}

Utils::Regex m_re;
Expand Down Expand Up @@ -615,7 +615,7 @@ class Variables : public std::vector<Variable *> {
[v](Variable *m) -> bool {
VariableRegex *r = dynamic_cast<VariableRegex *>(m);
if (r) {
return r->m_r.searchAll(v->getKey()).size() > 0;
return r->m_r.search(v->getKey());
}
return v->getKeyWithCollection() == *m->m_fullName.get();
}) != end();
Expand Down