Skip to content

[pull] v3/master from SpiderLabs:v3/master #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 465 commits into
base: v3/master
Choose a base branch
from
Open
Changes from 1 commit
Commits
Show all changes
465 commits
Select commit Hold shift + click to select a range
f04dcc0
Merge pull request #3207 from gberkes/v3/remove_this_throw_call_trans…
airween Aug 5, 2024
2048730
Update CHANGES
airween Aug 5, 2024
8280175
Merge branch 'v3/master' into v3/sonarmemleakfix
airween Aug 5, 2024
6cffa8f
Add _putenv() in case of WIN32 port instead of setenv()
airween Aug 5, 2024
e31ff7e
Build on macOS 14 arm64
eduar-hte May 20, 2024
dab9bb6
Added methods to free buffers allocated by ModSecurity APIs
eduar-hte May 3, 2024
0dce460
Fixed potential memory leak when there is an intervention and log or …
eduar-hte Aug 5, 2024
4b5f719
Fixed shared files deadlock in a multi-threaded Windows application
eduar-hte Aug 5, 2024
8ec69be
Merge pull request #3208 from eduar-hte/macos-apple-silicon
airween Aug 6, 2024
630751e
Merge pull request #3209 from eduar-hte/cleanup_api
airween Aug 6, 2024
ff303c7
Add newest changes
airween Aug 6, 2024
68d551c
Merge pull request #3210 from eduar-hte/shared-files-deadlock
airween Aug 6, 2024
80dd457
Update CHANGES - added PR 3210
airween Aug 6, 2024
c947f5e
Do not assume ModSecurityIntervention argument to transaction::interv…
eduar-hte Aug 5, 2024
0b5493d
Minor performance improvements setting up intervention's log
eduar-hte Aug 6, 2024
c802b46
Simplify parser error detection in testcase
eduar-hte Aug 6, 2024
0feaeac
Merge pull request #3211 from eduar-hte/secremoterules-regression
airween Aug 7, 2024
c46f470
Refactor: moved 3 #include directives to the top of the file.
Aug 7, 2024
ab78d4a
Refactor: used the init-statement to declare "pos" inside the if stat…
Aug 7, 2024
a3ffc5a
Merge pull request #3213 from gberkes/v3/sonar_move_these_3_includes_…
airween Aug 7, 2024
e8db92e
Merge pull request #3214 from gberkes/v3/Use_the_init-statement_to_de…
airween Aug 7, 2024
5403b3d
Update CHANGES; added newest PR's
airween Aug 7, 2024
35e825d
Refactor: replaced 3 declarations with 3 structured binding declarati…
Aug 7, 2024
c50a397
Suppress cppcheck false positive unassignedVariable warning.
Aug 7, 2024
cf643d6
Avoid duplicate definition of --enable-assertions=yes configure flag …
eduar-hte Aug 8, 2024
1d6e72e
Merge pull request #3212 from eduar-hte/defensive-intervention
airween Aug 8, 2024
13cce62
Added PR #3212
airween Aug 8, 2024
a519c65
Merge pull request #3217 from gberkes/v3/sonarcloud_Replace_this_decl…
airween Aug 8, 2024
546ec8f
Added PR #3217
airween Aug 8, 2024
59254fe
Simplifiy configuration to build libModSecurity with std C++17
eduar-hte May 24, 2024
30a68de
Creating a std::string with a null pointer is undefined behaviour.
eduar-hte May 21, 2024
a23e88f
Merge pull request #3114 from airween/v3/sonarmemleakfix
airween Aug 8, 2024
0998032
Added PR #3114
airween Aug 8, 2024
18378c1
Removed unnecessary dynamic_casts
eduar-hte May 18, 2024
c917d6a
Initialize variable in if statement to avoid doing dynamic_cast twice
eduar-hte Aug 8, 2024
6f0e566
Merge pull request #3218 from eduar-hte/remove-dynamic-casts
airween Aug 9, 2024
3a83196
Merge pull request #3219 from eduar-hte/cpp17
airween Aug 9, 2024
7bdc3c8
Merge pull request #3220 from eduar-hte/string-null
airween Aug 9, 2024
c575dce
Added PR 3218, 3219, 3220
airween Aug 9, 2024
e2b3c95
Prevent concurrent access to data structure in resolve methods
eduar-hte Aug 7, 2024
4e15f9e
Turn off LMDB by default in Windows build to align with defaults for …
eduar-hte Aug 7, 2024
293cd21
Removed usage of pthreads and replaced with std C++ features
eduar-hte Aug 7, 2024
4bf9616
Adding multithreaded example from issue #3054 (by airween)
eduar-hte Aug 9, 2024
bb07de9
toupper/tolower is already receiving a copy, so it doesn't need to cr…
eduar-hte Apr 29, 2024
f8dd09f
Avoid creating a new std::string on the heap to create VariableValue
eduar-hte May 18, 2024
1534ee2
Removed unnecessary copies
eduar-hte May 30, 2024
8b17f36
Inline string functions
eduar-hte May 25, 2024
cc0f893
Removed unused overload of dash_if_empty that sonarcloud flags as pot…
eduar-hte Aug 9, 2024
eb26b79
Fix regression test result; Add test to main test-suite list
airween Aug 12, 2024
305f33f
Merge pull request #3224 from airween/v3/sethostnametestfix
airween Aug 12, 2024
77adb57
Avoid std::string copy in ssplit argument
eduar-hte Aug 12, 2024
6388d88
Check if the MP header contains invalid character
airween Aug 13, 2024
32f6f78
Merge pull request #3222 from eduar-hte/remove-copies
airween Aug 13, 2024
718d121
Merge pull request #3216 from eduar-hte/inmemory-collection-shared-mutex
airween Aug 13, 2024
f42bc38
Update CHANGES
airween Aug 13, 2024
8d6b185
Removed unnecessary lock to call acmp_process_quick in Pm::evaluate
eduar-hte Aug 9, 2024
5e6fcbc
Replace usage of std::ctime, which is not safe for use in multithread…
eduar-hte Aug 12, 2024
23a341e
Calculate sizes of strftime buffers based on format strings
eduar-hte Aug 12, 2024
ee5f95e
Added support to run unit tests in a multithreaded context
eduar-hte Aug 9, 2024
a6b287e
Merge pull request #3225 from airween/v3/mpinvcharreqbody
airween Aug 14, 2024
c4b2723
Added PR #3225
airween Aug 14, 2024
c9af0c7
Merge pull request #3221 from eduar-hte/unittest-multithreaded
airween Aug 14, 2024
554bd30
Merge pull request #3227 from eduar-hte/pm-operator-multithreading
airween Aug 14, 2024
746f4d7
Added PR #3227
airween Aug 14, 2024
b4f5232
Merge pull request #3228 from eduar-hte/asctime-multithread
airween Aug 14, 2024
71bea86
Added PR #3228
airween Aug 14, 2024
2cb1d03
Restore pthread LDFLAG.
eduar-hte Aug 14, 2024
752ab76
Merge pull request #3229 from eduar-hte/pthread-makefile
airween Aug 14, 2024
a5f223c
Individual test result should not be printed for automake output
eduar-hte Aug 17, 2024
df081af
Adjusted pthread LDFLAG in examples required for multithreading.
eduar-hte Aug 16, 2024
315b3d6
Lua::run: Move logging of `str` parameter to higher log level.
frozenice Aug 26, 2024
97c8766
Merge pull request #3232 from eduar-hte/failed-unit-tests-automake-ou…
airween Aug 26, 2024
0941438
Added PR #3232
airween Aug 26, 2024
5d39890
Updated Transformation::evaluate signature to allow for in-place upda…
eduar-hte May 14, 2024
3ff72fb
Perform ParityEven7bit, ParityOdd7bit & ParityZero7bit transformation…
eduar-hte Aug 19, 2024
13203ae
Perform CmdLine transformation in-place
eduar-hte Aug 19, 2024
1236d9a
Perform CompressWhitespace transformation in-place
eduar-hte Aug 19, 2024
1505025
Perform RemoveNulls & RemoveWhitespace transformations in-place
eduar-hte Aug 19, 2024
da775ec
Perform ReplaceNulls transformation in-place
eduar-hte Aug 19, 2024
74d150c
Perform RemoveCommentsChar, RemoveComments & ReplaceComments transfor…
eduar-hte Aug 19, 2024
2915ee6
Perform Trim, TrimLeft & TrimRight transformations in-place
eduar-hte Aug 19, 2024
fd8a979
Perform SqlHexDecode transformation in-place
eduar-hte Aug 19, 2024
4670710
Perform LowerCase & UpperCase transformations in-place
eduar-hte Aug 19, 2024
e687140
Perform HexDecode transformation in-place
eduar-hte Aug 19, 2024
727f2bf
Perform CssDecode transformation in-place
eduar-hte Aug 19, 2024
a520369
Perform EscapeSeqDecode transformation in-place
eduar-hte Aug 19, 2024
7d5c9fa
Perform JsDecode transformation in-place
eduar-hte Aug 19, 2024
8bf4d96
Perform HtmlEntityDecode transformation in-place
eduar-hte Aug 19, 2024
17a2cbd
Perform UrlDecodeUni & UrlDecode transformations in-place
eduar-hte Aug 19, 2024
2c3c228
Perform Utf8ToUnicode transformation in-place
eduar-hte Aug 19, 2024
021d0ca
Perform NormalisePath & NormalisePathWin transformations in-place
eduar-hte Aug 19, 2024
b647dbd
Remove unnecessary heap-allocation & copy in Transaction::extractArgu…
eduar-hte Jun 1, 2024
34da8ee
Pass RuleWithActions::executeTransformation arguments by reference
eduar-hte Aug 9, 2024
fedec96
Refactored base64 utils to share implementation and reduce code dupli…
eduar-hte Aug 19, 2024
7023c0a
Refactored sha1 & md5 utils to share implementation and reduce code d…
eduar-hte Aug 19, 2024
2f5dac5
Simplified initialization of Transformation's action_kind
eduar-hte Aug 19, 2024
a6d64bf
Replaced VALID_HEX, ISODIGIT & NBSP macros in string.h
eduar-hte Aug 17, 2024
3e9d810
Removed multiple heap-allocated copies in parse_pm_content
eduar-hte Aug 9, 2024
4951702
Merge pull request #3233 from eduar-hte/remove-copies-pm-operator
airween Aug 28, 2024
9148668
Merge pull request #3231 from eduar-hte/remove-copies-transformations
airween Aug 28, 2024
07fb580
Added PR's #3233 and #3231
airween Aug 28, 2024
9403cf6
Merge pull request #3240 from frozenice/patch-1
airween Aug 28, 2024
3586189
Added PR #3240
airween Aug 28, 2024
27cc8ed
Adjust reference to modsecurity::utils::string::VALID_HEX
eduar-hte Aug 28, 2024
a4604b6
Added new tests to op @pm
airween Aug 28, 2024
f180e64
Merge pull request #3243 from eduar-hte/valid-hex-fix
airween Aug 28, 2024
542a5ea
Added PR #3243
airween Aug 28, 2024
865b75b
Merge branch 'owasp-modsecurity:v3/master' into v3/release2408
airween Aug 28, 2024
2ab970b
Finalize CHANGES
airween Sep 2, 2024
b489fd3
Format fix
airween Sep 3, 2024
1a8c96a
Merge pull request #3206 from airween/v3/release2408
airween Sep 3, 2024
24dbcfe
Change release version to v3.0.13
airween Sep 3, 2024
580fe19
Merge pull request #3247 from airween/v3/master
airween Sep 3, 2024
2ec640f
Delete unused copy constructor & assignment operator in Rule, RuleMar…
eduar-hte Jun 2, 2024
2ad87f6
Reference RuleWithActions & Transaction object instead of copying val…
eduar-hte May 5, 2024
2c613fb
Simplify initialization of fileName member of Rule instances
eduar-hte May 6, 2024
6ecfee7
Simplify and reduce code duplication in Transaction constructors
eduar-hte Sep 3, 2024
9e02b3c
Merge pull request #3248 from eduar-hte/simplified-constructors
airween Sep 9, 2024
c6c06c4
leverage std::make_unique & std::make_shared
eduar-hte May 5, 2024
9238b0c
docs: add a logo picture for github dark theme
xuruidong Sep 29, 2024
7737594
Merge pull request #3264 from xuruidong/logo2
airween Oct 2, 2024
63201ae
chore: add 'log' action to rule 200005
airween Oct 2, 2024
373ddb8
Merge pull request #3266 from airween/v3/modsecdefconf
airween Oct 2, 2024
9a1155c
Merge pull request #3254 from eduar-hte/make_shared
airween Oct 2, 2024
e313ac7
Introduce ModSecurityTestContext to encapsulate setup of objects requ…
eduar-hte May 7, 2024
4df297b
Avoid passing RuleMessage by std::shared_ptr and use a reference inst…
eduar-hte May 6, 2024
b7b2d9a
Minor codebase improvements suggested by Sonarcloud
eduar-hte Sep 10, 2024
75d31a4
Simplified lifetime management of tests
eduar-hte Sep 10, 2024
99ce977
Merge pull request #3253 from eduar-hte/rule-message
airween Oct 15, 2024
0613cee
Replace usage of range-checked 'at' method when vector/string has alr…
eduar-hte Jun 2, 2024
ec506da
Merge pull request #3280 from eduar-hte/range-checked-at
airween Oct 19, 2024
e0c5823
Use latest version of cppcheck (2.14.2)
eduar-hte Apr 28, 2024
193a000
Updated cppcheck config
eduar-hte Aug 20, 2024
1eed8b9
Ignore cppcheck warnings: normalCheckLevelMaxBranches (Limiting analy…
eduar-hte Apr 29, 2024
da38f20
Added missing override keyword as reported by cppcheck 2.14
eduar-hte Apr 29, 2024
7d9c80d
Address cppcheck warnings: uselessOverride (The function '...' overri…
eduar-hte Apr 29, 2024
c2b86dd
Suppress warnings on seclang-parser.hh
eduar-hte Apr 29, 2024
d053ec6
Add cppcheck suppressions for false positives
eduar-hte Aug 21, 2024
bbef22b
Added const reported by cppcheck 2.14
eduar-hte Apr 29, 2024
2fb446a
Address cppcheck warnings generated after addressing Sonarcloud sugge…
eduar-hte Aug 28, 2024
d1e7e7b
Refactor to remove duplicate code in ValidateSchema & ValidateDTD
eduar-hte Oct 19, 2024
b0497d9
Avoid this unnecessary copy by using a "const" reference.
eduar-hte Oct 19, 2024
ce9a316
Use initialization list to initialize m_service
eduar-hte Oct 21, 2024
cdaf32f
Remove cppcheck suppression by replacing use of local variable to ali…
eduar-hte Oct 21, 2024
4e68edf
Replace usage of sscanf with strtol to remove cppcheck inline suppres…
eduar-hte Oct 21, 2024
7ec50eb
Make GeoLookup::debug function static (and non-member), as suggested …
eduar-hte Oct 21, 2024
aca93f5
Remove no longer needed cppcheck inline suppressions.
eduar-hte Oct 21, 2024
29a86b1
Merge pull request #3283 from eduar-hte/cppcheck2142
airween Oct 22, 2024
742f97c
Add regression rules for test
hnakamur Nov 1, 2024
5bec188
Merge pull request #3291 from hnakamur/add_test_regression_rules
airween Nov 5, 2024
42a4018
Fix modsecurity-regression-test-secremoterules.txt URL in example
hnakamur Oct 24, 2024
4a72000
Merge pull request #3287 from hnakamur/fix_modsecurity-regression-tes…
airween Nov 6, 2024
d422b36
Add condition before set hostname; move setRequestHostName() before p…
airween Nov 12, 2024
41fd21b
Merge pull request #3298 from airween/v3/sethostnamefix
airween Nov 19, 2024
5309194
Fix: Add false positive cppcheck-suppress for compatibility with upda…
Nov 22, 2024
fd45641
Merge pull request #3307 from gberkes/v3/cppcheck_v2_16_upgrade
airween Nov 23, 2024
db7e4cb
Align TIME_MON variable's behavior
airween Nov 22, 2024
daf550e
Fix regex for test
airween Nov 24, 2024
d9101a4
Merge pull request #3306 from airween/v3/time_mon_fix
airween Nov 24, 2024
4fb2246
Cleanup: Remove useless/nonfunctional AM_CONDITIONAL macros
Dec 10, 2024
c6433df
Refactor build system to use libpcre2 as the default
Dec 10, 2024
106ed22
Fix typo in pcre.m4: corrected PCRE_CFLAGS assignment
Dec 10, 2024
a07d0c7
Fix missing libpcre2 dependency on macOS GitHub runner
Dec 10, 2024
17700ec
Update README.md
ElevationsRPG Dec 11, 2024
7b4c3a2
Update Dockerfile
ElevationsRPG Dec 11, 2024
c0681b6
Update README.md
ElevationsRPG Dec 11, 2024
784cf0b
Debug: increase verbosity in pcre2.m4 for macOS GitHub Actions
Dec 11, 2024
e925078
Fix macOS GitHub Actions build: add PCRE2_CFLAGS/LDADD/LDFLAGS
Dec 11, 2024
10d1c2b
Refactor: improve PCRE settings output in configure.ac
Dec 20, 2024
900e7bc
Fix OSX build without GeoIP brew package
airween Jan 4, 2025
d76f3e7
Update .github/workflows/ci.yml
airween Jan 4, 2025
849131c
Change depth value to 1
airween Jan 4, 2025
72bb873
Use latest released version by commit id.
airween Jan 5, 2025
a332567
Set correct order of commands
airween Jan 5, 2025
eb7e2b8
Merge pull request #3319 from airween/v3/osxcifix
airween Jan 5, 2025
d9acf3d
Merge branch 'owasp-modsecurity:v3/master' into v3/master
ElevationsRPG Jan 6, 2025
6a2eee6
Merge branch 'owasp-modsecurity:v3/master' into refactor/default-pcre2
gberkes Jan 6, 2025
f260a75
Merge pull request #3314 from ElevationsRPG/v3/master
airween Jan 6, 2025
4c5bc45
Add value checking to @validateByteRange
airween Jan 6, 2025
9158477
Add check after intervall parsing, spell fix
airween Jan 6, 2025
9e685bf
Merge pull request #3322 from airween/v3/validatebyterange
airween Jan 6, 2025
199056b
Fix for issue #3334: build not finding YAJL
RooHTaylor Jan 30, 2025
40af573
Merge pull request #3335 from RooHTaylor/v3/master
airween Jan 30, 2025
b97b61b
Merge branch 'owasp-modsecurity:v3/master' into refactor/default-pcre2
gberkes Feb 20, 2025
d68aef3
refactor: improve maintainability for SonarCloud compliance
Feb 20, 2025
71037dc
fix: Added missing header to avoid build error with gcc-15
airween Feb 20, 2025
f96806c
Merge pull request #3342 from airween/v3/gcc15fix
airween Feb 21, 2025
c82e831
fix: fixed htmlEntityDecode methods
airween Feb 24, 2025
29c3cc3
doc: update CHANGES
airween Feb 24, 2025
6468810
Change release version to v3.0.14
airween Feb 25, 2025
a555e5a
Merge commit from fork
airween Feb 25, 2025
1a2b139
Merge pull request #3321 from gberkes/refactor/default-pcre2
airween Mar 12, 2025
dc40880
Fix cppcheck error in example multi.c
airween Mar 12, 2025
d3c1ad7
Make utf variable const pointer
airween Mar 12, 2025
dbdd631
Replace C pointers by shared pointer in fuzzy_hash op code
airween Mar 12, 2025
c3c2c6f
Make variable const pointer
airween Mar 12, 2025
42280d2
Make function argument const pointer
airween Mar 12, 2025
8f00f47
Make destructor default; remove impmelentation
airween Mar 12, 2025
7a986c7
Merge pull request #3350 from airween/v3/cppcheckfix
airween Mar 14, 2025
80019da
doc: update testing section of README
cjihrig Mar 23, 2025
01a0615
Merge pull request #3354 from cjihrig/patch-1
airween Mar 23, 2025
9e41a53
Finish XMLArgs processing in v3
airween Apr 20, 2025
f62de58
Added new cc and h files
airween Apr 20, 2025
8ae8374
Fix cppcheck errors
airween Apr 20, 2025
b42602f
Fix more cppcheck warning
airween Apr 20, 2025
3e95614
Add nullptr check conditions
airween Apr 20, 2025
029684c
Add nullptr check conditions
airween Apr 20, 2025
37c0de3
Simplify code for JSON audit log
JakubOnderka Apr 22, 2025
6408bf9
Test for JSON audit log
JakubOnderka Apr 22, 2025
797f7dc
Change http_version field in JSON audit log to string
JakubOnderka Apr 23, 2025
b82d600
Disable Expect when sending audit logs to remote HTTP server
JakubOnderka Apr 23, 2025
22fee12
Change owner in legal text
airween Apr 26, 2025
e367876
Update comment
airween Apr 27, 2025
3dc9fe9
Update comment
airween Apr 27, 2025
90be54e
Update error message
airween Apr 27, 2025
f0aa070
Update comment
airween Apr 27, 2025
eedfed8
Update error message
airween Apr 27, 2025
5b1c6fb
Update comment
airween Apr 27, 2025
fedc709
Update comment
airween Apr 27, 2025
0fcd257
Update comment
airween Apr 27, 2025
bbe7eda
Update explanation
airween Apr 27, 2025
159f612
Update comment
airween Apr 27, 2025
2000f4c
Update comment
airween Apr 27, 2025
0bf6020
Add explanation
airween Apr 27, 2025
72de7e8
Update comment
airween Apr 27, 2025
0c7ea21
Update comment
airween Apr 27, 2025
6742930
Update comment
airween Apr 27, 2025
8947346
Update comment
airween Apr 27, 2025
2135c89
Update comment
airween Apr 27, 2025
91a45e7
Update error message
airween Apr 27, 2025
0b62b7e
Align debug messages to fix regression tests
airween Apr 27, 2025
bf707de
Change directive format to strict camel case
airween Apr 28, 2025
e8dc60e
Change node value's parsing to concatenate instead of copy it every time
airween Apr 28, 2025
89442ed
Change directives in tests; add multibyte test case
airween Apr 28, 2025
d228ea6
Update comment
airween May 1, 2025
a3876e3
Avoid unvanted content parse (whitespaces between tags)
airween May 2, 2025
220caa5
Merge pull request #3363 from airween/v3/xmlargsfeat
airween May 4, 2025
990d99b
Merge pull request #3365 from JakubOnderka/disable-expect
airween May 11, 2025
aab4709
Merge pull request #3364 from JakubOnderka/json-logging
airween May 11, 2025
0bcabf3
buildfix for srcdir != builddir
May 22, 2025
0caf306
buildfix
May 22, 2025
7660125
buildfix for srcdir != builddir
May 22, 2025
de624f9
Attempt to fix bogus change.
May 23, 2025
a17193f
Fix memory/socket leak in `UniqueId::ethernetMacAddress()`
amezin May 27, 2025
8d3b2ca
Add hostname to JSON log
JakubOnderka May 28, 2025
1362479
Merge pull request #3393 from JakubOnderka/json-log-hostname
airween May 28, 2025
f64ea2a
Merge pull request #3390 from arvedarved/buildsystem-fixes
airween Jun 7, 2025
3150740
Merge pull request #3392 from amezin/macaddr-resource-leak
airween Jun 7, 2025
6089b6b
Fix @pmFromFile with multiple files issue
airween Jun 19, 2025
cf24aea
Merge pull request #3405 from airween/v3/pmfromffix
airween Jun 20, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update comment
Co-authored-by: Max Leske <[email protected]>
  • Loading branch information
airween and theseion authored Apr 27, 2025
commit 2135c8934ee934b30a29ef012a27091e379cd154
2 changes: 1 addition & 1 deletion src/request_body_processor/xml.cc
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,7 @@ bool XML::complete(std::string *error) {
if (m_data.parsing_ctx != NULL &&
m_transaction->m_secXMLParseXmlIntoArgs
!= RulesSetProperties::OnlyArgsConfigXMLParseXmlIntoArgs) {
/* This is how we signalise the end of parsing to libxml. */
/* This is how we signal the end of parsing to libxml. */
xmlParseChunk(m_data.parsing_ctx, NULL, 0, 1);

/* Preserve the results for our reference. */
Expand Down