Fix leak of the ARGS XML parser context on malformed documents

[tomsommer]

what

• Free xml_data::parsing_ctx_arg in ~XML(), following the existing pattern for parsing_ctx.
• Free and clear parsing_ctx_arg before the early return false in XML::complete() when the document is not well formed.
• Adds test/test-cases/regression/request-body-parser-xml-into-args.json (mismatched end tag, truncated document) with SecParseXmlIntoArgs On.

why

• With SecParseXmlIntoArgs On, XML::processChunk() creates a second libxml2 push parser context (parsing_ctx_arg) for the ARGS extraction. It was only released in the second block of XML::complete().
• complete() finishes the main context first and returns early with "XML: Failed to parse document." when the document is not well formed, before reaching that block. ~XML() released parsing_ctx and doc but not parsing_ctx_arg, so nothing ever freed it.
• Every request with a malformed XML body therefore leaked the ARGS parser context including its body-sized input buffer (the whole body is pushed in one chunk from Transaction::processRequestBody()).
• The pointer copy kept in xml_data::xml_parser_state is a non-owning alias only dereferenced from SAX callbacks while parsing is in progress, so freeing in ~XML() cannot double free. Both edits are inside the existing WITH_LIBXML2 guard.

Evidence, unfixed tree, libtool --mode=execute valgrind --leak-check=full ./regression_tests test-cases/regression/request-body-parser-xml-into-args.json:

==2== 27,666 (1,504 direct, 26,162 indirect) bytes in 2 blocks are definitely lost in loss record 12 of 12
==2==    by 0x509C712: xmlNewParserCtxt (libxml2.so.2.9.14)
==2==    by 0x50B587E: xmlCreatePushParserCtxt (libxml2.so.2.9.14)
==2==    by 0x49BCC3D: modsecurity::RequestBodyProcessor::XML::processChunk(...) (xml.cc:260)
==2==    by 0x497B1EF: modsecurity::Transaction::processRequestBody() (transaction.cc:718)

With the fix: All heap blocks were freed -- no leaks are possible. make check: TOTAL 5045, PASS 5029, SKIP 16, FAIL 0.

references

• Found while auditing libmodsecurity + ModSecurity-nginx for memory growth in long-running workers; related reports: Memory Leak with nginx 1.26 #3303, Memory leaks with nginx reload (without restart) #2848.

Summary by CodeRabbit

• Bug Fixes

  • Fixed a memory leak when malformed or incomplete XML request bodies fail to parse.
  • XML parsing resources are now properly released after parsing errors and when request processing completes, improving reliability for XML request handling.

• Tests

  • Added regression coverage for malformed and truncated XML requests when XML parsing into arguments is enabled.
  • Added checks confirming failed XML parsing is reported correctly in debug logs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 705ace1d-c869-4bbf-b2f6-c25af7cbd7f3

📥 Commits

Reviewing files that changed from the base of the PR and between 370210c and 030d382.

📒 Files selected for processing (2)

• src/request_body_processor/xml.cc
• src/request_body_processor/xml.h

Included review availability: Your plan provides up to 8 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The XML request body parser now releases the ARGS parsing context during destruction and malformed-document handling. Two regression cases cover malformed XML with XML-to-ARGS parsing enabled.

Changes

XML parser cleanup

Layer / File(s)	Summary
Parser context cleanup src/request_body_processor/xml.h, src/request_body_processor/xml.cc	The XML class declares and uses freeArgsParserCtx(). The helper frees m_data.parsing_ctx_arg with xmlFreeParserCtxt() and resets it to NULL during destruction and malformed-document failure handling.
Malformed XML regression coverage test/test-cases/regression/request-body-parser-xml-into-args.json, test/test-suite.in	Two malformed XML cases verify the failure log, HTTP 200 response, and empty body. The test suite manifest registers the new test file.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: fixing the ARGS XML parser context memory leak on malformed documents.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud