ModSecurity/src/actions/ctl/rule_remove_by_id.cc at 14cf56fa96f2e9555afc625f8d6acf3894beb503 · owasp-modsecurity/ModSecurity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
/*
 * ModSecurity, http://www.modsecurity.org/
 * Copyright (c) 2015 - 2023 Trustwave Holdings, Inc. (http://www.trustwave.com/)
 *
 * You may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * If any of the files related to licensing are missing or if you have any
 * other questions related to licensing please contact Trustwave Holdings, Inc.
 * directly using the email address security@modsecurity.org.
 *
 */

#include "src/actions/ctl/rule_remove_by_id.h"

#include <iostream>
#include <string>

#include "modsecurity/transaction.h"
#include "src/utils/string.h"

namespace modsecurity {
namespace actions {
namespace ctl {


bool RuleRemoveById::init(std::string *error) {
    size_t pos = m_parser_payload.find("=");
    if (pos == std::string::npos) {
        error->assign(m_parser_payload + " is not a valid ID or range");
        return false;
    }
    std::string what = m_parser_payload.substr(pos + 1);
    bool added = false;
    std::vector<std::string> toRemove = utils::string::ssplit(what, ' ');
    for (const std::string &a : toRemove) {
        std::string b = modsecurity::utils::string::parserSanitizer(a);
        if (b.size() == 0) {
            continue;
        }

        size_t dash = b.find('-');
        if (dash != std::string::npos) {
            std::string n1s = std::string(b, 0, dash);
            std::string n2s = std::string(b, dash + 1, b.size() - (dash + 1));
            int n1n = 0;
            int n2n = 0;
            try {
                n1n = std::stoi(n1s);
                added = true;
            } catch (...) {
                error->assign("Not a number: " + n1s);
                return false;
            }
            try {
                n2n = std::stoi(n2s);
                added = true;
            } catch (...) {
                error->assign("Not a number: " + n2s);
                return false;
            }

            if (n1n > n2n) {
                error->assign("Invalid range: " + b);
                return false;
            }
            m_ranges.push_back(std::make_pair(n1n, n2n));
            added = true;
        } else {
            try {
                int num = std::stoi(b);
                m_ids.push_back(num);
                added = true;
            } catch (...) {
                error->assign("Not a number or range: " + b);
                return false;
            }
        }
    }

    if (added) {
        return true;
    }

    error->assign("Not a number or range: " + what);
    return false;
}

bool RuleRemoveById::evaluate(RuleWithActions *rule, Transaction *transaction) {
    for (const auto &i : m_ids) {
        transaction->m_ruleRemoveById.push_back(i);
    }
    for (const auto &i : m_ranges) {
        transaction->m_ruleRemoveByIdRange.push_back(i);
    }

    return true;
}


}  // namespace ctl
}  // namespace actions
}  // namespace modsecurity