Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Replace Cookie parsing method #2201

Closed
wants to merge 1 commit into from
Closed

Replace Cookie parsing method #2201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
55 changes: 44 additions & 11 deletions src/transaction.cc
View file
Open in desktop
Expand Up @@ -548,20 +548,53 @@ int Transaction::addRequestHeader(const std::string& key,

if (keyl == "cookie") {
size_t localOffset = m_variableOffset;
size_t pos;
std::vector<std::string> cookies = utils::string::ssplit(value, ';');
for (const std::string &c : cookies) {
std::vector<std::string> s = utils::string::split(c,
'=');
if (s.size() > 1) {
if (s[0].at(0) == ' ') {
s[0].erase(0, 1);
}
m_variableRequestCookiesNames.set(s[0],
s[0], localOffset);
// skip empty substring, eg "Cookie: ;;foo=bar"
if (c.empty() == true) {
localOffset++; // add length of ';'
continue;
}

// find the first '='
pos = c.find_first_of("=", 0);
std::string ckey = "";
std::string cval = "";

localOffset = localOffset + s[0].size() + 1;
m_variableRequestCookies.set(s[0], s[1], localOffset);
localOffset = localOffset + s[1].size() + 2;
// if the cookie doesn't contains '=', its just a key
if (pos == std::string::npos) {
ckey = c;
}
// else split to two substrings by first =
else {
ckey = c.substr(0, pos);
// value will contains the next '=' chars if exists
// eg. foo=bar=baz -> key: foo, value: bar=baz
cval = c.substr(pos+1);
}

// ltrim the key - following the modsec v2 way
while (ckey.empty() == false && ckey.at(0) == ' ') {
ckey.erase(0, 1);
localOffset++;
}

// if the key is empty (eg: "Cookie: =bar;") skip it
if (ckey.empty() == true) {
localOffset = localOffset + c.length() + 1;
continue;
}
else {
// handle cookie only if the key is not empty
// set cookie name
m_variableRequestCookiesNames.set(ckey,
ckey, localOffset);
localOffset = localOffset + ckey.size() + 1;
// set cookie value
m_variableRequestCookies.set(ckey, cval,
localOffset);
localOffset = localOffset + cval.size() + 1;
}
}
}
Expand Down
86 changes: 83 additions & 3 deletions test/test-cases/regression/variable-REQUEST_COOKIES.json
View file
Open in desktop
Expand Up @@ -2,7 +2,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES (1/3)",
"title":"Testing Variables :: REQUEST_COOKIES (1/5)",
"client":{
"ip":"200.249.12.31",
"port":123
Expand Down Expand Up @@ -42,7 +42,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES (2/3)",
"title":"Testing Variables :: REQUEST_COOKIES (2/5)",
"client":{
"ip":"200.249.12.31",
"port":123
Expand Down Expand Up @@ -82,7 +82,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES (3/3)",
"title":"Testing Variables :: REQUEST_COOKIES (3/5)",
"client":{
"ip":"200.249.12.31",
"port":123
Expand Down Expand Up @@ -118,6 +118,86 @@
"SecRuleEngine On",
"SecRule REQUEST_COOKIES \"@contains test \" \"id:1,pass,t:trim\""
]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES (4/5)",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie":"USER_TOKEN=Yes; a=z; t=b; foo= bar"
},
"uri":"/?key=value&key=other_value",
"method":"GET"
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"bar\""
},
"rules":[
"SecRuleEngine On",
"SecRule REQUEST_COOKIES \"@contains test \" \"id:1,pass,t:trim\""
]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES (5/5)",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie":"USER_TOKEN=Yes; a=z; t=b; foo= bar; = ; = = ; baz=value1=insert here something"
},
"uri":"/?key=value&key=other_value",
"method":"GET"
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"value1=insert here something\""
},
"rules":[
"SecRuleEngine On",
"SecRule REQUEST_COOKIES \"@contains test \" \"id:1,pass,t:trim\""
]
}
]

46 changes: 43 additions & 3 deletions test/test-cases/regression/variable-REQUEST_COOKIES_NAMES.json
View file
Open in desktop
Expand Up @@ -2,7 +2,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES_NAMES (1/3)",
"title":"Testing Variables :: REQUEST_COOKIES_NAMES (1/4)",
"client":{
"ip":"200.249.12.31",
"port":123
Expand Down Expand Up @@ -42,7 +42,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES_NAMES (2/3)",
"title":"Testing Variables :: REQUEST_COOKIES_NAMES (2/4)",
"client":{
"ip":"200.249.12.31",
"port":123
Expand Down Expand Up @@ -82,7 +82,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES_NAMES (3/3)",
"title":"Testing Variables :: REQUEST_COOKIES_NAMES (3/4)",
"client":{
"ip":"200.249.12.31",
"port":123
Expand Down Expand Up @@ -118,6 +118,46 @@
"SecRuleEngine On",
"SecRule REQUEST_COOKIES_NAMES \"@contains test \" \"id:1,pass,t:trim\""
]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: REQUEST_COOKIES_NAMES (4/4)",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie":"USER_TOKEN=Yes; a=z; t=b; foobar"
},
"uri":"/?key=value&key=other_value",
"method":"GET"
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"foobar\""
},
"rules":[
"SecRuleEngine On",
"SecRule REQUEST_COOKIES_NAMES \"@contains foobar \" \"id:1,pass,t:trim\""
]
}
]