Adds capture action to verifySSN

owasp-modsecurity · Mar 9, 2018 · 77a885d · 77a885d
1 parent 60b2469
commit 77a885d
Show file tree

Hide file tree

Showing 4 changed files with 61 additions and 3 deletions.
diff --git a/CHANGES b/CHANGES
@@ -1,6 +1,8 @@
 v3.0.x - YYYY-MMM-DD (To be released)
 -------------------------------------
 
+ - Adds capture action to verifySSN
+   [Issue #1698 - @zimmerle]
  - Adds capture action to verifyCPF
    [Issue #1698 - @zimmerle]
  - Prettier error messages for unsupported configurations (UX)

diff --git a/Makefile.am b/Makefile.am
@@ -145,6 +145,7 @@ TESTS+=test/test-cases/regression/operator-rx.json
 TESTS+=test/test-cases/regression/operator-UnconditionalMatch.json
 TESTS+=test/test-cases/regression/operator-validate-byte-range.json
 TESTS+=test/test-cases/regression/operator-verifycpf.json
+TESTS+=test/test-cases/regression/operator-verifyssn.json
 TESTS+=test/test-cases/regression/request-body-parser-json.json
 TESTS+=test/test-cases/regression/request-body-parser-multipart-crlf.json
 TESTS+=test/test-cases/regression/request-body-parser-multipart.json

diff --git a/src/operators/verify_ssn.cc b/src/operators/verify_ssn.cc
@@ -108,7 +108,7 @@ bool VerifySSN::verify(const char *ssnumber, int len) {
 }
 
 
-bool VerifySSN::evaluate(Transaction *transaction, Rule *rule,
+bool VerifySSN::evaluate(Transaction *t, Rule *rule,
     const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
     std::list<SMatch> matches;
     bool is_ssn = false;
@@ -120,11 +120,20 @@ bool VerifySSN::evaluate(Transaction *transaction, Rule *rule,
 
     for (i = 0; i < input.size() - 1 && is_ssn == false; i++) {
         matches = m_re->searchAll(input.substr(i, input.size()));
-
         for (const auto & i : matches) {
             is_ssn = verify(i.match.c_str(), i.match.size());
-            logOffset(ruleMessage, i.m_offset, i.m_length);
             if (is_ssn) {
+                logOffset(ruleMessage, i.m_offset, i.m_length);
+                if (rule && t
+                    && rule->getActionsByName("capture").size() > 0) {
+                    t->m_collections.m_tx_collection->storeOrUpdateFirst(
+                        "0", std::string(i.match));
+#ifndef NO_LOGS
+                    t->debug(7, "Added VerifySSN match TX.0: " + \
+                        std::string(i.match));
+#endif
+                }
+
                 goto out;
             }
         }

diff --git a/test/test-cases/regression/operator-verifyssn.json b/test/test-cases/regression/operator-verifyssn.json
@@ -0,0 +1,46 @@
+[
+  {
+    "enabled":1,
+    "version_min":300000,
+    "title":"Testing Operator :: @verifycpf (1/2)",
+    "client":{
+      "ip":"200.249.12.31",
+      "port":123
+    },
+    "server":{
+      "ip":"200.249.12.31",
+      "port":80
+    },
+    "request":{
+      "headers":{
+        "Host":"localhost",
+        "User-Agent":"curl/7.38.0",
+        "Accept":"*/*",
+        "Content-Length": "27",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      "uri":"/",
+      "method":"POST",
+      "body": [
+        "param1=224-88-2046&param2=value2"
+      ]
+    },
+    "response":{
+      "headers":{
+        "Date":"Mon, 13 Jul 2015 20:02:41 GMT",
+        "Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
+        "Content-Type":"text/html"
+      },
+      "body":[
+        "no need."
+      ]
+    },
+    "expected":{
+      "debug_log":"Added VerifySSN match TX.0: 224-88-2046"
+    },
+    "rules":[
+      "SecRuleEngine On",
+      "SecRule ARGS \"@verifyssn \\d{3}-?\\d{2}-?\\d{4}\" \"id:1,phase:2,capture,pass,t:trim\""
+    ]
+  }
+]