diff --git a/src/parser/seclang-scanner.cc b/src/parser/seclang-scanner.cc index 0771c7563..f31a789d0 100644 --- a/src/parser/seclang-scanner.cc +++ b/src/parser/seclang-scanner.cc @@ -4952,7 +4952,8 @@ static std::stack YY_PREVIOUS_STATE; static const char* find_separator(const char *s) { while (*s && *s != ' ' && *s != '\t') s++; - return (*s) ? s + 1 : s; + while (*s == ' ' || *s == '\t') s++; + return s; } // Work around an incompatibility in flex (at least versions @@ -6240,19 +6241,19 @@ case 150: /* rule 150 can match eol */ YY_RULE_SETUP #line 751 "seclang-scanner.ll" -{ return p::make_CONFIG_COMPONENT_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); } +{ return p::make_CONFIG_COMPONENT_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } YY_BREAK case 151: /* rule 151 can match eol */ YY_RULE_SETUP #line 752 "seclang-scanner.ll" -{ return p::make_CONFIG_SEC_SERVER_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); } +{ return p::make_CONFIG_SEC_SERVER_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } YY_BREAK case 152: /* rule 152 can match eol */ YY_RULE_SETUP #line 753 "seclang-scanner.ll" -{ return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(strchr(yytext, ' ') + 2), *driver.loc.back()); } +{ return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } YY_BREAK case 153: YY_RULE_SETUP diff --git a/src/parser/seclang-scanner.ll b/src/parser/seclang-scanner.ll index efb54e8d6..2680f4aa4 100755 --- a/src/parser/seclang-scanner.ll +++ b/src/parser/seclang-scanner.ll @@ -19,7 +19,8 @@ static std::stack YY_PREVIOUS_STATE; static const char* find_separator(const char *s) { while (*s && *s != ' ' && *s != '\t') s++; - return (*s) ? s + 1 : s; + while (*s == ' ' || *s == '\t') s++; + return s; } // Work around an incompatibility in flex (at least versions @@ -747,9 +748,9 @@ EQUALS_MINUS (?i:=\-) . { BEGIN(INITIAL); } } -{CONFIG_COMPONENT_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_COMPONENT_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); } -{CONFIG_SEC_SERVER_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_SERVER_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); } -{CONFIG_SEC_WEB_APP_ID}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(strchr(yytext, ' ') + 2), *driver.loc.back()); } +{CONFIG_COMPONENT_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_COMPONENT_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } +{CONFIG_SEC_SERVER_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_SERVER_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } +{CONFIG_SEC_WEB_APP_ID}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } {CONFIG_SEC_WEB_APP_ID}[ \t]+{FREE_TEXT_NEW_LINE} { return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } {CONFIG_CONTENT_INJECTION} { return p::make_CONFIG_CONTENT_INJECTION(*driver.loc.back()); } {CONFIG_DIR_AUDIT_DIR_MOD}[ \t]+{CONFIG_VALUE_NUMBER} { return p::make_CONFIG_DIR_AUDIT_DIR_MOD(parserSanitizer(find_separator(yytext)), *driver.loc.back()); } diff --git a/test/test-cases/regression/auditlog.json b/test/test-cases/regression/auditlog.json index f4d660987..afd44a3d6 100644 --- a/test/test-cases/regression/auditlog.json +++ b/test/test-cases/regression/auditlog.json @@ -883,5 +883,85 @@ "SecAuditLogFileMode 0600", "SecAuditLogType Serial" ] + }, + { + "enabled": 1, + "version_min": 300000, + "version_max": 0, + "title": "auditlog : validate the SecComponentSignature value", + "client": { + "ip": "200.249.12.31", + "port": 2313 + }, + "server": { + "ip": "200.249.12.31", + "port": 80 + }, + "request": { + "headers": { + "Host": "www.modsecurity.org", + "Content-Length": "0" + }, + "uri": "/index.php", + "method": "GET", + "http_version": 1.1, + "body": [ + "" + ] + }, + "expected": { + "audit_log": "\\[\"OWASP_CRS/4.25.0\"\\]", + "http_code": 200 + }, + "rules": [ + "SecAuditEngine On", + "SecAuditLogFormat JSON", + "SecAuditLogParts ABCFHZ", + "SecComponentSignature \"OWASP_CRS/4.25.0\"", + "SecAuditLogDirMode 0766", + "SecAuditLogFileMode 0600", + "SecAuditLog /tmp/audit_component_signature.log", + "SecAuditLogType Serial" + ] + }, + { + "enabled": 1, + "version_min": 300000, + "version_max": 0, + "title": "auditlog : validate the SecComponentSignature value with tabs as separator", + "client": { + "ip": "200.249.12.31", + "port": 2313 + }, + "server": { + "ip": "200.249.12.31", + "port": 80 + }, + "request": { + "headers": { + "Host": "www.modsecurity.org", + "Content-Length": "0" + }, + "uri": "/index.php", + "method": "GET", + "http_version": 1.1, + "body": [ + "" + ] + }, + "expected": { + "audit_log": "\\[\"OWASP_CRS/4.25.1\"\\]", + "http_code": 200 + }, + "rules": [ + "SecAuditEngine On", + "SecAuditLogFormat JSON", + "SecAuditLogParts ABCFHZ", + "SecComponentSignature \t \t\"OWASP_CRS/4.25.1\"", + "SecAuditLogDirMode 0766", + "SecAuditLogFileMode 0600", + "SecAuditLog /tmp/audit_component_signature_tabs.log", + "SecAuditLogType Serial" + ] } ] diff --git a/test/test-cases/regression/variable-WEBAPPID.json b/test/test-cases/regression/variable-WEBAPPID.json index d757993b5..3af4a7fbe 100644 --- a/test/test-cases/regression/variable-WEBAPPID.json +++ b/test/test-cases/regression/variable-WEBAPPID.json @@ -93,5 +93,53 @@ "SecWebAppId bisteka", "SecRule WEBAPPID \"@contains test \" \"id:1,phase:3,pass,t:trim\"" ] + }, + { + "enabled": 1, + "version_min": 300000, + "title": "Testing Variables :: WEBAPPID quoted with tabs as separator", + "client": { + "ip": "200.249.12.31", + "port": 123 + }, + "server": { + "ip": "200.249.12.31", + "port": 80 + }, + "request": { + "headers": { + "Host": "localhost", + "User-Agent": "curl/7.38.0", + "Accept": "*/*", + "Content-Length": "27", + "Content-Type": "application/x-www-form-urlencoded", + "AuThOrIzAtIoN": "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" + }, + "uri": "/", + "method": "POST", + "body": [ + "param1=value1¶m2=value2" + ] + }, + "response": { + "headers": { + "Date": "Mon, 13 Jul 2015 20:02:41 GMT", + "Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT", + "Content-Type": "text/html", + "Content-Length": "8" + }, + "body": [ + "no need." + ] + }, + "expected": { + "debug_log": "Target value: \"bisteka tabs\"", + "http_code": 200 + }, + "rules": [ + "SecRuleEngine On", + "SecWebAppId\t\t\"bisteka tabs\"", + "SecRule WEBAPPID \"@contains test \" \"id:1,phase:3,pass,t:trim\"" + ] } ]