Skip to content

Commit 88f1414

Browse files
airweenairween
committed
Clean matched vars after chained rule (too)
1 parent cf24aea commit 88f1414

File tree

5 files changed

+586
-10
lines changed

5 files changed

+586
-10
lines changed

‎src/rule_with_operator.cc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,9 @@ bool RuleWithOperator::evaluate(Transaction *trans,
355355

356356
/* last rule in the chain. */
357357
performLogging(trans, ruleMessage, true, true);
358+
if (m_ruleId > 0) {
359+
cleanMatchedVars(trans);
360+
}
358361
return true;
359362
}
360363

‎test/test-cases/regression/variable-MATCHED_VAR.json‎

Lines changed: 125 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{
33
"enabled":1,
44
"version_min":300000,
5-
"title":"Testing Variables :: MATCHED_VAR (1/2)",
5+
"title":"Testing Variables :: MATCHED_VAR (1/5)",
66
"client":{
77
"ip":"200.249.12.31",
88
"port":123
@@ -42,7 +42,7 @@
4242
{
4343
"enabled":1,
4444
"version_min":300000,
45-
"title":"Testing Variables :: MATCHED_VAR (2/2)",
45+
"title":"Testing Variables :: MATCHED_VAR (2/5)",
4646
"client":{
4747
"ip":"200.249.12.31",
4848
"port":123
@@ -81,6 +81,129 @@
8181
"SecRule MATCHED_VAR \"@contains other_value\" \"id:29,pass\"",
8282
"SecRule MATCHED_VAR \"@contains other_value\" \"id:30,pass\""
8383
]
84+
},
85+
{
86+
"enabled":1,
87+
"version_min":300000,
88+
"title":"Testing Variables :: MATCHED_VAR (3/5)",
89+
"client":{
90+
"ip":"200.249.12.31",
91+
"port":123
92+
},
93+
"server":{
94+
"ip":"200.249.12.31",
95+
"port":80
96+
},
97+
"request":{
98+
"headers":{
99+
"Host":"localhost",
100+
"User-Agent":"curl/7.38.0",
101+
"Accept":"*/*"
102+
},
103+
"uri":"/?foo=1&bar=2&baz=2",
104+
"method":"GET"
105+
},
106+
"response":{
107+
"headers":{
108+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
109+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
110+
"Content-Type":"text/html"
111+
},
112+
"body":[
113+
"no need."
114+
]
115+
},
116+
"expected":{
117+
"http_code": 200
118+
},
119+
"rules":[
120+
"SecRuleEngine On",
121+
"SecRule ARGS \"@rx 1\" \"id:1,phase:1,pass\"",
122+
"SecRule ARGS \"@rx 2\" \"id:2,phase:1,pass\"",
123+
"SecRule MATCHED_VAR \"@eq 1\" \"id:3,phase:1,deny,status:403\""
124+
]
125+
},
126+
{
127+
"enabled":1,
128+
"version_min":300000,
129+
"title":"Testing Variables :: MATCHED_VAR (4/5)",
130+
"client":{
131+
"ip":"200.249.12.31",
132+
"port":123
133+
},
134+
"server":{
135+
"ip":"200.249.12.31",
136+
"port":80
137+
},
138+
"request":{
139+
"headers":{
140+
"Host":"localhost",
141+
"User-Agent":"curl/7.38.0",
142+
"Accept":"*/*"
143+
},
144+
"uri":"/?foo=1&bar=2&baz=2",
145+
"method":"GET"
146+
},
147+
"response":{
148+
"headers":{
149+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
150+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
151+
"Content-Type":"text/html"
152+
},
153+
"body":[
154+
"no need."
155+
]
156+
},
157+
"expected":{
158+
"http_code": 200
159+
},
160+
"rules":[
161+
"SecRuleEngine On",
162+
"SecRule ARGS \"@rx 1\" \"id:1,phase:1,pass\"",
163+
"SecRule ARGS \"@rx 2\" \"id:2,phase:1,pass\"",
164+
"SecRule MATCHED_VAR \"@eq 2\" \"id:3,phase:1,deny,status:403\""
165+
]
166+
},
167+
{
168+
"enabled":1,
169+
"version_min":300000,
170+
"title":"Testing Variables :: MATCHED_VAR (5/5)",
171+
"client":{
172+
"ip":"200.249.12.31",
173+
"port":123
174+
},
175+
"server":{
176+
"ip":"200.249.12.31",
177+
"port":80
178+
},
179+
"request":{
180+
"headers":{
181+
"Host":"localhost",
182+
"User-Agent":"curl/7.38.0",
183+
"Accept":"*/*"
184+
},
185+
"uri":"/?foo=1&bar=2&baz=2",
186+
"method":"GET"
187+
},
188+
"response":{
189+
"headers":{
190+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
191+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
192+
"Content-Type":"text/html"
193+
},
194+
"body":[
195+
"no need."
196+
]
197+
},
198+
"expected":{
199+
"http_code": 403
200+
},
201+
"rules":[
202+
"SecRuleEngine On",
203+
"SecRule ARGS \"@rx 1\" \"id:1,phase:1,pass\"",
204+
"SecRule ARGS \"@rx 2\" \"id:2,phase:1,deny,status:403,chain\"",
205+
"SecRule MATCHED_VAR \"@eq 2\""
206+
]
84207
}
85208
]
86209

‎test/test-cases/regression/variable-MATCHED_VARS.json‎

Lines changed: 166 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
{
33
"enabled":1,
44
"version_min":300000,
5-
"title":"Testing Variables :: MATCHED_VARS (1/2)",
5+
"title":"Testing Variables :: MATCHED_VARS (1/6)",
66
"client":{
77
"ip":"200.249.12.31",
88
"port":123
@@ -43,7 +43,7 @@
4343
{
4444
"enabled":1,
4545
"version_min":300000,
46-
"title":"Testing Variables :: MATCHED_VARS (2/2)",
46+
"title":"Testing Variables :: MATCHED_VARS (2/6)",
4747
"client":{
4848
"ip":"200.249.12.31",
4949
"port":123
@@ -81,6 +81,170 @@
8181
"SecRule MATCHED_VARS \"@contains asdf\" \"\"",
8282
"SecRule MATCHED_VARS \"@contains value\" \"id:29\""
8383
]
84+
},
85+
{
86+
"enabled":1,
87+
"version_min":300000,
88+
"title":"Testing Variables :: MATCHED_VARS (3/6)",
89+
"client":{
90+
"ip":"200.249.12.31",
91+
"port":123
92+
},
93+
"server":{
94+
"ip":"200.249.12.31",
95+
"port":80
96+
},
97+
"request":{
98+
"headers":{
99+
"Host":"localhost",
100+
"User-Agent":"curl/7.38.0",
101+
"Accept":"*/*"
102+
},
103+
"uri":"/?foo=1&bar=2&baz=2",
104+
"method":"GET"
105+
},
106+
"response":{
107+
"headers":{
108+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
109+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
110+
"Content-Type":"text/html"
111+
},
112+
"body":[
113+
"no need."
114+
]
115+
},
116+
"expected":{
117+
"http_code": 200
118+
},
119+
"rules":[
120+
"SecRuleEngine On",
121+
"SecRule ARGS \"@rx 1\" \"id:1,phase:1,pass\"",
122+
"SecRule ARGS \"@rx 2\" \"id:2,phase:1,pass\"",
123+
"SecRule MATCHED_VARS \"@contains 1\" \"id:3,phase:1,deny,status:403\""
124+
]
125+
},
126+
{
127+
"enabled":1,
128+
"version_min":300000,
129+
"title":"Testing Variables :: MATCHED_VARS (4/6)",
130+
"client":{
131+
"ip":"200.249.12.31",
132+
"port":123
133+
},
134+
"server":{
135+
"ip":"200.249.12.31",
136+
"port":80
137+
},
138+
"request":{
139+
"headers":{
140+
"Host":"localhost",
141+
"User-Agent":"curl/7.38.0",
142+
"Accept":"*/*"
143+
},
144+
"uri":"/?foo=1&bar=2&baz=2",
145+
"method":"GET"
146+
},
147+
"response":{
148+
"headers":{
149+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
150+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
151+
"Content-Type":"text/html"
152+
},
153+
"body":[
154+
"no need."
155+
]
156+
},
157+
"expected":{
158+
"http_code": 200
159+
},
160+
"rules":[
161+
"SecRuleEngine On",
162+
"SecRule ARGS \"@rx 1\" \"id:1,phase:1,pass\"",
163+
"SecRule ARGS \"@rx 2\" \"id:2,phase:1,pass\"",
164+
"SecRule MATCHED_VARS \"@contains 2\" \"id:3,phase:1,deny,status:403\""
165+
]
166+
},
167+
{
168+
"enabled":1,
169+
"version_min":300000,
170+
"title":"Testing Variables :: MATCHED_VARS (5/6)",
171+
"client":{
172+
"ip":"200.249.12.31",
173+
"port":123
174+
},
175+
"server":{
176+
"ip":"200.249.12.31",
177+
"port":80
178+
},
179+
"request":{
180+
"headers":{
181+
"Host":"localhost",
182+
"User-Agent":"curl/7.38.0",
183+
"Accept":"*/*"
184+
},
185+
"uri":"/?foo=1&bar=2&baz=2",
186+
"method":"GET"
187+
},
188+
"response":{
189+
"headers":{
190+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
191+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
192+
"Content-Type":"text/html"
193+
},
194+
"body":[
195+
"no need."
196+
]
197+
},
198+
"expected":{
199+
"http_code": 200
200+
},
201+
"rules":[
202+
"SecRuleEngine On",
203+
"SecRule ARGS \"@rx 1\" \"id:1,phase:1,pass\"",
204+
"SecRule ARGS \"@rx 2\" \"id:2,phase:1,pass\"",
205+
"SecRule MATCHED_VARS \"@within 1 2\" \"id:3,phase:1,deny,status:403\""
206+
]
207+
},
208+
{
209+
"enabled":1,
210+
"version_min":300000,
211+
"title":"Testing Variables :: MATCHED_VARS (6/6)",
212+
"client":{
213+
"ip":"200.249.12.31",
214+
"port":123
215+
},
216+
"server":{
217+
"ip":"200.249.12.31",
218+
"port":80
219+
},
220+
"request":{
221+
"headers":{
222+
"Host":"localhost",
223+
"User-Agent":"curl/7.38.0",
224+
"Accept":"*/*"
225+
},
226+
"uri":"/?foo=1&bar=2&baz=2",
227+
"method":"GET"
228+
},
229+
"response":{
230+
"headers":{
231+
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
232+
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
233+
"Content-Type":"text/html"
234+
},
235+
"body":[
236+
"no need."
237+
]
238+
},
239+
"expected":{
240+
"http_code": 403
241+
},
242+
"rules":[
243+
"SecRuleEngine On",
244+
"SecRule ARGS \"@rx 1\" \"id:1,phase:1,pass\"",
245+
"SecRule ARGS \"@rx 2\" \"id:2,phase:1,deny,status:403,chain\"",
246+
"SecRule MATCHED_VARS \"@eq 2\""
247+
]
84248
}
85249
]
86250

0 commit comments

Comments
 (0)