You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
v3: "General failure, action: 0x..." prints a pointer instead of the action name #3708
When SecRuleUpdateActionById is given an action that can't be updated (a configuration-time action such as chain, id, phase, rev, ver, maturity or accuracy), libModSecurity v3 prints a memory address instead of the action's name:
General failure, action: 0x932c545b8 has not expected to be used with UpdateActionByID.
This was reported before in #2625 and closed as completed in 2021, but the code that prints it hasn't changed.
Seen with test/regression_tests on v3/master (84b5996).
Expected behavior
The message should name the action, e.g. General failure, action: chain has not expected to be used with UpdateActionByID.
Cause
Action::m_name is a std::shared_ptr<std::string>, so std::cout << a->m_name prints the pointer. Writing *a->m_name instead fixes it. The same mistake appears three times:
src/rules_exceptions.cc:40 (the "has not expected to be used with UpdateActionByID" message)
src/rules_exceptions.cc:51 ("has an unknown type")
src/rule_with_actions.cc:127 ("has an unknown type")
Related
All three messages are written straight to std::cout rather than returned through the existing error out-parameter. A connector therefore never sees them in its error log, and the configuration still loads with the action silently dropped. Fixing the pointer is the minimal change. Reporting the problem through error, as a warning or as a load failure, needs a decision, because it would change behavior for configurations shared with v2 that repeat chain in an update. v2 requires repeating chain there; see the "Updating chained rules" note in owasp-modsecurity/documentation#2.
Activity