Merge pull request #2901 from airween/v3/pcrelimittx

Set TX:MSC_PCRE_LIMITS_EXCEEDED variable is limits exceeded
owasp-modsecurity · Jul 7, 2023 · fea6e6d · fea6e6d
2 parents 2cb6344 + 4403a16
commit fea6e6d
Show file tree

Hide file tree

Showing 3 changed files with 49 additions and 0 deletions.
diff --git a/src/operators/rx.cc b/src/operators/rx.cc
@@ -74,6 +74,8 @@ bool Rx::evaluate(Transaction *transaction, RuleWithActions *rule,
         if (regex_result == Utils::RegexResult::ErrorMatchLimit) {
             regex_error_str = "MATCH_LIMIT";
             transaction->m_variableMscPcreLimitsExceeded.set("1", transaction->m_variableOffset);
+            transaction->m_collections.m_tx_collection->storeOrUpdateFirst("MSC_PCRE_LIMITS_EXCEEDED", "1");
+            ms_dbg_a(transaction, 7, "Set TX.MSC_PCRE_LIMITS_EXCEEDED to 1");
         }
 
         ms_dbg_a(transaction, 1, "rx: regex error '" + regex_error_str + "' for pattern '" + re->pattern + "'");

diff --git a/src/operators/rx_global.cc b/src/operators/rx_global.cc
@@ -68,6 +68,8 @@ bool RxGlobal::evaluate(Transaction *transaction, RuleWithActions *rule,
         if (regex_result == Utils::RegexResult::ErrorMatchLimit) {
             regex_error_str = "MATCH_LIMIT";
             transaction->m_variableMscPcreLimitsExceeded.set("1", transaction->m_variableOffset);
+            transaction->m_collections.m_tx_collection->storeOrUpdateFirst("MSC_PCRE_LIMITS_EXCEEDED", "1");
+            ms_dbg_a(transaction, 7, "Set TX.MSC_PCRE_LIMITS_EXCEEDED to 1");
         }
 
         ms_dbg_a(transaction, 1, "rxGlobal: regex error '" + regex_error_str + "' for pattern '" + re->pattern + "'");

diff --git a/test/test-cases/regression/operator-rx.json b/test/test-cases/regression/operator-rx.json
@@ -217,5 +217,50 @@
       "SecRule ARGS:rxtest \"@rx (w+)+$\" \"id:1,phase:1,pass,t:trim,block\"",
       "SecRule MSC_PCRE_LIMITS_EXCEEDED \"@streq 1\" \"id:2,phase:1,pass,t:trim,block\""
     ]
+  },
+  {
+    "enabled":1,
+    "version_min":300000,
+    "title":"Testing Operator :: @rx with PCRE match limits exceeded",
+    "client":{
+      "ip":"200.249.12.31",
+      "port":123
+    },
+    "server":{
+      "ip":"200.249.12.31",
+      "port":80
+    },
+    "request":{
+      "headers":{
+        "Host":"localhost",
+        "User-Agent":"curl/7.38.0",
+        "Accept":"*/*",
+        "Content-Length": "27",
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      "uri":"/?rxtest=wwwwwwwwwwwwwwwwwwwwwowwwwwwwwwww",
+      "method":"HEAD",
+      "body": [ ]
+    },
+    "response":{
+      "headers":{
+        "Date":"Mon, 13 Jul 2015 20:02:41 GMT",
+        "Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
+        "Content-Type":"text/html"
+      },
+      "body":[
+        "no need."
+      ]
+    },
+    "expected":{
+      "debug_log":"rx: regex error 'MATCH_LIMIT' for pattern",
+      "error_log":"Matched \"Operator `StrEq' with parameter `1' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED'"
+    },
+    "rules":[
+      "SecRuleEngine On",
+      "SecPcreMatchLimit 2",
+      "SecRule ARGS:rxtest \"@rx (w+)+$\" \"id:1,phase:1,pass,t:trim,block\"",
+      "SecRule TX:MSC_PCRE_LIMITS_EXCEEDED \"@streq 1\" \"id:2,phase:1,pass,t:trim,block\""
+    ]
   }
 ]