beenull/crowdsec
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

[appsec] implement count transformation (#2698)

Browse source 
* implement count transfo
This commit is contained in:
Thibault "bui" Koechlin 2024-01-12 14:30:08 +01:00 committed by GitHub
parent 6960419a2e
commit 896dfefcdf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
pkg/appsec/appsec_rule/modsec_rule_test.go
View file

@ -8,6 +8,16 @@ func TestVPatchRuleString(t *testing.T) {
rule CustomRule
expected string
}{
{
name: "Collection count",
rule: CustomRule{
Zones: []string{"ARGS"},
Variables: []string{"foo"},
Match: match{Type: "eq", Value: "1"},
Transform: []string{"count"},
},
expected: `SecRule &ARGS_GET:foo "@eq 1" "id:853070236,phase:2,deny,log,msg:'Collection count',tag:'crowdsec-Collection count'"`,
},
{
name: "Base Rule",
rule: CustomRule{

15
pkg/appsec/appsec_rule/modsecurity.go
View file

@ -122,6 +122,16 @@ func (m *ModsecurityRule) buildRules(rule *CustomRule, appsecRuleName string, an
return ret, nil
}
zone_prefix := ""
variable_prefix := ""
if rule.Transform != nil {
for tidx, transform := range rule.Transform {
if transform == "count" {
zone_prefix = "&"
rule.Transform[tidx] = ""
}
}
}
for idx, zone := range rule.Zones {
if idx > 0 {
r.WriteByte('|')
@ -137,7 +147,7 @@ func (m *ModsecurityRule) buildRules(rule *CustomRule, appsecRuleName string, an
if j > 0 {
r.WriteByte('|')
}
r.WriteString(fmt.Sprintf("%s:%s", mappedZone, variable))
r.WriteString(fmt.Sprintf("%s%s:%s%s", zone_prefix, mappedZone, variable_prefix, variable))
}
}
}
@ -160,6 +170,9 @@ func (m *ModsecurityRule) buildRules(rule *CustomRule, appsecRuleName string, an
if rule.Transform != nil {
for _, transform := range rule.Transform {
if transform == "" {
continue
}
r.WriteByte(',')
if mappedTransform, ok := transformMap[transform]; ok {
r.WriteString(mappedTransform)