Skip to content

Fix parsing of SecComponentSignature, SecServerSignature and SecWebAppId #3558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
meirdev wants to merge 3 commits into
base: v3/master
Choose a base branch
from
Open

Fix parsing of SecComponentSignature, SecServerSignature and SecWebAppId #3558

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
761e225
Fix parsing of SecComponentSignature, SecServerSignature and SecWebAppId
meirdev May 5, 2026
506a379
Merge branch 'v3/master' into v3/fix-directive-parsing
meirdev Sep 17, 2026
ed8d7ed
find_separator whitespace fix + tests
meirdev Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions src/parser/seclang-scanner.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -915,7 +915,7 @@
1, 1, 1, 1, 1
} ;

static const YY_CHAR yy_meta[88] =

Check warning on line 918 in src/parser/seclang-scanner.cc

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace this C-style array with "std::vector" (for dynamic size), or "std::array" (for static size) 


See more on https://sonarcloud.io/project/issues?id=owasp-modsecurity_ModSecurity&issues=AaCukQ7nGIKNm45f5ksk&open=AaCukQ7nGIKNm45f5ksk&pullRequest=3558
{ 0,
1, 2, 3, 4, 5, 1, 6, 1, 7, 1,
1, 8, 9, 1, 10, 9, 9, 9, 11, 11,
Expand Down Expand Up @@ -1862,7 +1862,7 @@
3972, 3972, 3972, 3972, 3972, 3972, 3972, 3972
} ;

static const flex_int16_t yy_nxt[13560] =

Check warning on line 1865 in src/parser/seclang-scanner.cc

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace this C-style array with "std::vector" (for dynamic size), or "std::array" (for static size) 


See more on https://sonarcloud.io/project/issues?id=owasp-modsecurity_ModSecurity&issues=AaCukQ7nGIKNm45f5ksl&open=AaCukQ7nGIKNm45f5ksl&pullRequest=3558
{ 0,
3972, 77, 78, 79, 77, 118, 80, 81, 118, 118,
283, 284, 118, 3972, 82, 119, 120, 121, 119, 122,
Expand Down Expand Up @@ -4952,7 +4952,8 @@

static const char* find_separator(const char *s) {
while (*s && *s != ' ' && *s != '\t') s++;
return (*s) ? s + 1 : s;
while (*s == ' ' || *s == '\t') s++;
return s;
}

// Work around an incompatibility in flex (at least versions
Expand Down Expand Up @@ -6240,19 +6241,19 @@
/* rule 150 can match eol */
YY_RULE_SETUP
#line 751 "seclang-scanner.ll"
{ return p::make_CONFIG_COMPONENT_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); }
{ return p::make_CONFIG_COMPONENT_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
YY_BREAK
case 151:
/* rule 151 can match eol */
YY_RULE_SETUP
#line 752 "seclang-scanner.ll"
{ return p::make_CONFIG_SEC_SERVER_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); }
{ return p::make_CONFIG_SEC_SERVER_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
YY_BREAK
case 152:
/* rule 152 can match eol */
YY_RULE_SETUP
#line 753 "seclang-scanner.ll"
{ return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(strchr(yytext, ' ') + 2), *driver.loc.back()); }
{ return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
YY_BREAK
case 153:
YY_RULE_SETUP
Expand Down Expand Up @@ -8290,9 +8291,9 @@
YY_BREAK
case 541:
/* rule 541 can match eol */
YY_RULE_SETUP
#line 1231 "seclang-scanner.ll"
{ BEGIN(INITIAL); driver.loc.back()->lines(1); driver.loc.back()->step(); }

Check warning on line 8296 in src/parser/seclang-scanner.cc

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

The code of this "case" is a duplicate; join the "case" blocks or refactor so that all "case" blocks are unique. 


See more on https://sonarcloud.io/project/issues?id=owasp-modsecurity_ModSecurity&issues=AaCukQ7nGIKNm45f5ksm&open=AaCukQ7nGIKNm45f5ksm&pullRequest=3558
YY_BREAK

case 542:
Expand Down
9 changes: 5 additions & 4 deletions src/parser/seclang-scanner.ll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,8 @@ static std::stack<int> YY_PREVIOUS_STATE;

static const char* find_separator(const char *s) {
while (*s && *s != ' ' && *s != '\t') s++;
return (*s) ? s + 1 : s;
while (*s == ' ' || *s == '\t') s++;
return s;
}

// Work around an incompatibility in flex (at least versions
Expand Down Expand Up @@ -747,9 +748,9 @@ EQUALS_MINUS (?i:=\-)
. { BEGIN(INITIAL); }
}

{CONFIG_COMPONENT_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_COMPONENT_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); }
{CONFIG_SEC_SERVER_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_SERVER_SIG(strchr(yytext, ' ') + 2, *driver.loc.back()); }
{CONFIG_SEC_WEB_APP_ID}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(strchr(yytext, ' ') + 2), *driver.loc.back()); }
{CONFIG_COMPONENT_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_COMPONENT_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
{CONFIG_SEC_SERVER_SIG}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_SERVER_SIG(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
{CONFIG_SEC_WEB_APP_ID}[ \t]+["]{FREE_TEXT}["] { return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
Comment thread
meirdev marked this conversation as resolved.
{CONFIG_SEC_WEB_APP_ID}[ \t]+{FREE_TEXT_NEW_LINE} { return p::make_CONFIG_SEC_WEB_APP_ID(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
{CONFIG_CONTENT_INJECTION} { return p::make_CONFIG_CONTENT_INJECTION(*driver.loc.back()); }
{CONFIG_DIR_AUDIT_DIR_MOD}[ \t]+{CONFIG_VALUE_NUMBER} { return p::make_CONFIG_DIR_AUDIT_DIR_MOD(parserSanitizer(find_separator(yytext)), *driver.loc.back()); }
Expand Down
80 changes: 80 additions & 0 deletions test/test-cases/regression/auditlog.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -883,5 +883,85 @@
"SecAuditLogFileMode 0600",
"SecAuditLogType Serial"
]
},
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "auditlog : validate the SecComponentSignature value",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.modsecurity.org",
"Content-Length": "0"
},
"uri": "/index.php",
"method": "GET",
"http_version": 1.1,
"body": [
""
]
},
"expected": {
"audit_log": "\\[\"OWASP_CRS/4.25.0\"\\]",
"http_code": 200
},
"rules": [
"SecAuditEngine On",
"SecAuditLogFormat JSON",
"SecAuditLogParts ABCFHZ",
"SecComponentSignature \"OWASP_CRS/4.25.0\"",
"SecAuditLogDirMode 0766",
"SecAuditLogFileMode 0600",
"SecAuditLog /tmp/audit_component_signature.log",
"SecAuditLogType Serial"
]
},
{
"enabled": 1,
"version_min": 300000,
"version_max": 0,
"title": "auditlog : validate the SecComponentSignature value with tabs as separator",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.modsecurity.org",
"Content-Length": "0"
},
"uri": "/index.php",
"method": "GET",
"http_version": 1.1,
"body": [
""
]
},
"expected": {
"audit_log": "\\[\"OWASP_CRS/4.25.1\"\\]",
"http_code": 200
},
"rules": [
"SecAuditEngine On",
"SecAuditLogFormat JSON",
"SecAuditLogParts ABCFHZ",
"SecComponentSignature \t \t\"OWASP_CRS/4.25.1\"",
"SecAuditLogDirMode 0766",
"SecAuditLogFileMode 0600",
"SecAuditLog /tmp/audit_component_signature_tabs.log",
"SecAuditLogType Serial"
]
}
]
48 changes: 48 additions & 0 deletions test/test-cases/regression/variable-WEBAPPID.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,5 +93,53 @@
"SecWebAppId bisteka",
"SecRule WEBAPPID \"@contains test \" \"id:1,phase:3,pass,t:trim\""
]
},
{
"enabled": 1,
"version_min": 300000,
"title": "Testing Variables :: WEBAPPID quoted with tabs as separator",
"client": {
"ip": "200.249.12.31",
"port": 123
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "localhost",
"User-Agent": "curl/7.38.0",
"Accept": "*/*",
"Content-Length": "27",
"Content-Type": "application/x-www-form-urlencoded",
"AuThOrIzAtIoN": "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=="
},
"uri": "/",
"method": "POST",
"body": [
"param1=value1&param2=value2"
]
},
"response": {
"headers": {
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type": "text/html",
"Content-Length": "8"
},
"body": [
"no need."
]
},
"expected": {
"debug_log": "Target value: \"bisteka tabs\"",
"http_code": 200
},
"rules": [
"SecRuleEngine On",
"SecWebAppId\t\t\"bisteka tabs\"",
"SecRule WEBAPPID \"@contains test \" \"id:1,phase:3,pass,t:trim\""
]
}
]
Loading