beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

expose HasMatches bool in posteval hook

Browse source
This commit is contained in:
Sebastien Blot 2024-01-16 11:38:28 +01:00
parent a65223aa5b
commit 73d478f351
No known key found for this signature in database
GPG key ID: DFC2902F40449F6A
2 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkg/appsec/appsec.go
View file

@ -39,7 +39,7 @@ func (h *Hook) Build(hookStage int) error {
case hookPreEval:
ctx = GetPreEvalEnv(&AppsecRuntimeConfig{}, &ParsedRequest{})
case hookPostEval:
ctx = GetPostEvalEnv(&AppsecRuntimeConfig{}, &ParsedRequest{})
ctx = GetPostEvalEnv(&AppsecRuntimeConfig{}, &ParsedRequest{}, false)
case hookOnMatch:
ctx = GetOnMatchEnv(&AppsecRuntimeConfig{}, &ParsedRequest{}, types.Event{})
}
@ -370,10 +370,10 @@ func (w *AppsecRuntimeConfig) ProcessPreEvalRules(request *ParsedRequest) error
return nil
}
func (w *AppsecRuntimeConfig) ProcessPostEvalRules(request *ParsedRequest) error {
func (w *AppsecRuntimeConfig) ProcessPostEvalRules(request *ParsedRequest, hasMatches bool) error {
for _, rule := range w.CompiledPostEval {
if rule.FilterExpr != nil {
output, err := exprhelpers.Run(rule.FilterExpr, GetPostEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
output, err := exprhelpers.Run(rule.FilterExpr, GetPostEvalEnv(w, request, hasMatches), w.Logger, w.Logger.Level >= log.DebugLevel)
if err != nil {
return fmt.Errorf("unable to run appsec post_eval filter %s : %w", rule.Filter, err)
}
@ -390,7 +390,7 @@ func (w *AppsecRuntimeConfig) ProcessPostEvalRules(request *ParsedRequest) error
}
// here means there is no filter or the filter matched
for _, applyExpr := range rule.ApplyExpr {
_, err := exprhelpers.Run(applyExpr, GetPostEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
_, err := exprhelpers.Run(applyExpr, GetPostEvalEnv(w, request, hasMatches), w.Logger, w.Logger.Level >= log.DebugLevel)
if err != nil {
log.Errorf("unable to apply appsec post_eval expr: %s", err)
continue

3
pkg/appsec/waf_helpers.go
View file

@ -35,12 +35,13 @@ func GetPreEvalEnv(w *AppsecRuntimeConfig, request *ParsedRequest) map[string]in
}
}
func GetPostEvalEnv(w *AppsecRuntimeConfig, request *ParsedRequest) map[string]interface{} {
func GetPostEvalEnv(w *AppsecRuntimeConfig, request *ParsedRequest, hasMatches bool) map[string]interface{} {
return map[string]interface{}{
"IsInBand": request.IsInBand,
"IsOutBand": request.IsOutBand,
"DumpRequest": request.DumpRequest,
"req": request.HTTPRequest,
"HasMatches": hasMatches,
}
}