Merge pull request #2795 from martinhsv/v3/master

Multipart parsing fixes and new MULTIPART_PART_HEADERS collection
owasp-modsecurity · Sep 7, 2022 · d6c1088 · d6c1088
2 parents 648cad3 + fa6e418
commit d6c1088
Show file tree

Hide file tree

Showing 13 changed files with 6,605 additions and 6,187 deletions.
diff --git a/CHANGES b/CHANGES
@@ -1,6 +1,8 @@
 v3.x.y - YYYY-MMM-DD (to be released)
 -------------------------------------
 
+  - Multipart parsing fixes and new MULTIPART_PART_HEADERS collection
+    [Issue #2795 - @terjanq, @martinhsv]
   - Prevent LMDB related segfault
     [Issue #2755, #2761 - @dvershinin]
   - Fix msc_transaction_cleanup function comment typo

diff --git a/Makefile.am b/Makefile.am
@@ -225,6 +225,7 @@ TESTS+=test/test-cases/regression/variable-MULTIPART_CRLF_LF_LINES.json
 TESTS+=test/test-cases/regression/variable-MULTIPART_FILENAME.json
 TESTS+=test/test-cases/regression/variable-MULTIPART_INVALID_HEADER_FOLDING.json
 TESTS+=test/test-cases/regression/variable-MULTIPART_NAME.json
+TESTS+=test/test-cases/regression/variable-MULTIPART_PART_HEADERS.json
 TESTS+=test/test-cases/regression/variable-MULTIPART_STRICT_ERROR.json
 TESTS+=test/test-cases/regression/variable-MULTIPART_UNMATCHED_BOUNDARY.json
 TESTS+=test/test-cases/regression/variable-OUTBOUND_DATA_ERROR.json

diff --git a/headers/modsecurity/transaction.h b/headers/modsecurity/transaction.h
@@ -201,6 +201,7 @@ class TransactionAnchoredVariables {
         m_variableGeo(t, "GEO"),
         m_variableRequestCookiesNames(t, "REQUEST_COOKIES_NAMES"),
         m_variableFilesTmpNames(t, "FILES_TMPNAMES"),
+        m_variableMultipartPartHeaders(t, "MULTIPART_PART_HEADERS"),
         m_variableOffset(0),
         m_variableArgsNames("ARGS_NAMES", &m_variableArgs),
         m_variableArgsGetNames("ARGS_GET_NAMES", &m_variableArgsGet),
@@ -282,6 +283,7 @@ class TransactionAnchoredVariables {
     AnchoredSetVariable m_variableGeo;
     AnchoredSetVariable m_variableRequestCookiesNames;
     AnchoredSetVariable m_variableFilesTmpNames;
+    AnchoredSetVariable m_variableMultipartPartHeaders;
 
     int m_variableOffset;