The database should be secured#1920

Closed

shivamk01 wants to merge 1164 commits intov2/masterfrom

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 27, 2017

Adds CHANGES info for #1562
Felipe Zimmerle
committed

Commits on Sep 29, 2017

Eliminate some reorder and sign warnings

majordaw
authored and
Felipe Zimmerle
committed
Adds CHANGES info for #1572
Felipe Zimmerle
committed
Store the connection and url parameters in std::string

majordaw
authored and
Felipe Zimmerle
committed
Adds CHANGES info for #1571
Felipe Zimmerle
committed

Commits on Oct 6, 2017

Consideres under quote variable while loading the rules
Felipe Zimmerle
committed
support macro expansion in @rx

asterite3
authored and
Felipe Zimmerle
committed
add a test for macro expansion in @rx

asterite3
authored and
Felipe Zimmerle
committed
add @rx macro expansion test to list in Makefile

asterite3
authored and
Felipe Zimmerle
committed
Removes a regex optimization added at #1536
Felipe Zimmerle
committed
CHANGES: add info about #1536
Felipe Zimmerle
committed

Commits on Oct 9, 2017

Support to JSON stuff on serial logging

victorhora
authored and
Felipe Zimmerle
committed
Add missing statements

victorhora
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about #1583
Felipe Zimmerle
committed

Commits on Oct 10, 2017

Makes auditlog more verbose on debug logs
Felipe Zimmerle
committed
Makes clear to the user when audit log is empty due to missing JSON sup.
Felipe Zimmerle
committed
Calls xml init and xml cleanup to avoid memory leak
Felipe Zimmerle
committed
Removes xml initialization from CURL if/def
Felipe Zimmerle
committed

Commits on Oct 11, 2017

Avoids unicode initialization on every rules block
Felipe Zimmerle
committed

Commits on Oct 12, 2017

Adds test case for issue #1565
Felipe Zimmerle
committed

Commits on Oct 17, 2017

Parser: Pipes are no longer welcomed inside regex dict element selection.
Felipe Zimmerle
committed
Having disruptive msgs as disruptive [instead of warnings] on audit log
Felipe Zimmerle
committed

Commits on Oct 20, 2017

Refactoring on RuleMessage class, now accepting http code as parameter
Felipe Zimmerle
committed
Setting http response code on the auditlog
Felipe Zimmerle
committed
Support pipes inside quoted variable selection
Felipe Zimmerle
committed

Commits on Oct 21, 2017

Fix log while displaying the name of a dict selection by regex
Felipe Zimmerle
committed
Adds missing info to the CHANGES file
Felipe Zimmerle
committed

Commits on Oct 24, 2017

Fix memory issue while changing rule target dynamic
Felipe Zimmerle
committed

Commits on Oct 25, 2017

Fix build on non x86 arch build failed on ppc64/ppc64le/arch64/armv7hl/s390x due to how this arch represent chars

omadjoudj
authored and
Felipe Zimmerle
committed
Adds CHANGES info about #1598
Felipe Zimmerle
committed

Commits on Oct 26, 2017

Adds support for @fuzzyHash
Felipe Zimmerle
committed
travis: Adds ssdeep option to our regression soup
Felipe Zimmerle
committed

Commits on Oct 27, 2017

Fix regression tests for fuzzyHash
Felipe Zimmerle
committed
Fix on ssdeep search script
Felipe Zimmerle
committed

Commits on Oct 30, 2017

Adds support to the collection RESOURCE
Felipe Zimmerle
committed

Commits on Oct 31, 2017

Adds support to LUA in configure scripts
Felipe Zimmerle
committed
Adds support for the @inspectFile operator
Felipe Zimmerle
committed

Commits on Nov 6, 2017

Initial support for Lua script engine
Felipe Zimmerle
committed
Adds support for transformations inside Lua engine
Felipe Zimmerle
committed
Adds support for the exec action
Felipe Zimmerle
committed
Adds support to SecRuleScript directive
Felipe Zimmerle
committed
Makes lua optional
Felipe Zimmerle
committed
Adds lua as a travis option
Felipe Zimmerle
committed

Commits on Nov 7, 2017

Adds missing SecRuleScript test case
Felipe Zimmerle
committed
Adds support for update target by message
Felipe Zimmerle
committed
Makes ssdeep enabled by default on the build scripts
Felipe Zimmerle
committed
Adds support for SecRuleRemoveByTag
Felipe Zimmerle
committed

Commits on Nov 8, 2017

Adds missing cflags for LUA and SSDEEP
Felipe Zimmerle
committed
Adds support to SecWebAppID
Felipe Zimmerle
committed
Adds support to WEBAPPID variable
Felipe Zimmerle
committed

Commits on Nov 10, 2017

Refactoring on the JSON parser
Felipe Zimmerle
committed

Commits on Nov 14, 2017

Coding style fixes
Felipe Zimmerle
committed
Adds test case for issue #1576
Felipe Zimmerle
committed
Fix memory leak in @fuzzyHash
Felipe Zimmerle
committed
Fix assorted minor memory management issues
Felipe Zimmerle
committed

Commits on Nov 17, 2017

Correction lua header

Minasu
authored and
Felipe Zimmerle
committed
Adds info about issue 1622 on the changes file
Felipe Zimmerle
committed
Improve benchmark tool

michaelgranzow-avi
authored and
Felipe Zimmerle
committed
Adds info about issue 1615 on the changes file
Felipe Zimmerle
committed

Commits on Dec 12, 2017

fixed compilation error with disable_debug_log flag

Izik Abramov
authored and
Felipe Zimmerle
committed
Adds info about 0xfd84e on the changes file
Felipe Zimmerle
committed
Improvements on LUA build scripts and support for LUA 5.2

victorhora
authored and
Felipe Zimmerle
committed

Commits on Dec 13, 2017

Fix issue related to Lua script load
Felipe Zimmerle
committed
Change release version to v3.0.0
Felipe Zimmerle
committed

Commits on Dec 26, 2017

Configure: actually disable Lua on systems with liblua5.1
defanator
committed

Commits on Feb 14, 2018

Merge pull request #1639 from defanator/v3/skip_lua51
victorhora
authored

Commits on Feb 20, 2018

Fix uri on the benchmark utility
Felipe Zimmerle
committed
Updates the CHANGES file to reflect the changes on bench utility
Felipe Zimmerle
committed
perf. improvement/rx: Only compute dynamic regex in case of macro
Felipe Zimmerle
committed
Updates CHANGES file
Felipe Zimmerle
committed
perf improvement: Checks debuglog level before format debug msg
Felipe Zimmerle
committed
Updates CHANGES file
Felipe Zimmerle
committed
Fix the debuglogs for the regression tests
Felipe Zimmerle
committed
Adds support for RunTimeString
Felipe Zimmerle
committed
Adds support for multipart vars on the parser
Felipe Zimmerle
committed
Removes useless state
Felipe Zimmerle
committed
Using stack to save parser state
Felipe Zimmerle
committed
Using run time string on the operators
Felipe Zimmerle
committed
parser refactoring: ops no longer carry a payload
Felipe Zimmerle
committed
Using RunTimeString on setvar action
Felipe Zimmerle
committed
Removes the depricated MacroExpansion class
Felipe Zimmerle
committed
Using direct variable access instead m_collections
Felipe Zimmerle
committed
Using shared var for variables names
Felipe Zimmerle
committed
Renames collection::Variable to VariableValue
Felipe Zimmerle
committed
Checking std::deque size before use it
Felipe Zimmerle
committed

Commits on Feb 21, 2018

Having LDADD and LDFLAGS organized on Makefile.am
Felipe Zimmerle
committed
Fix compilation issue while xml is disabled
Felipe Zimmerle
committed

Commits on Feb 22, 2018

Fix examples compilation while using disable-shared
Felipe Zimmerle
committed
Updates on CHANGES
Felipe Zimmerle
committed

Commits on Feb 23, 2018

Fix resource load on ip match from file
Felipe Zimmerle
committed
Add missing Base64 transformation statements to parser

victorhora
authored and
Felipe Zimmerle
committed
Adds regression for base64 transformation
Felipe Zimmerle
committed
Fix "include /foo/*.conf" for single matched object in directory

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about #1677
Felipe Zimmerle
committed
Fix "make dist" target to include necessary headers for Lua

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about #1678
Felipe Zimmerle
committed
Added some cosmetics to autoconf related code

Ervin Hegedüs
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about #1652
Felipe Zimmerle
committed
Fix msc_who_am_i() to return pointer to a valid C string

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about #1640
Felipe Zimmerle
committed

Commits on Feb 26, 2018

Fix on top of #1677
Felipe Zimmerle
committed

Commits on Feb 27, 2018

Fix gcc compilation issue
Felipe Zimmerle
committed

Commits on Feb 28, 2018

Fix LMDB compile error

Hegedüs Ervin
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about #1691
Felipe Zimmerle
committed
Correction remove_by_tag and remove_by_msg

Minasu
authored and
Felipe Zimmerle
committed
Cosmetics on top of: #1636
Felipe Zimmerle
committed
CHANGES: Adds info about #1636
Felipe Zimmerle
committed
Fix block-block infinite loop.
Felipe Zimmerle
committed
Check for disruptive action on SecDefaultAction
Felipe Zimmerle
committed

Commits on Mar 1, 2018

Fix a set of compilation warnings
Felipe Zimmerle
committed
Code cosmetics: removes an unused piece of code
Felipe Zimmerle
committed

Commits on Mar 5, 2018

Add missing verify*** transformation statements to parser

victorhora
authored and
Felipe Zimmerle
committed

Commits on Mar 7, 2018

Prettier error messages for unsupported configurations (UX)

victorhora
authored and
Felipe Zimmerle
committed

Commits on Mar 8, 2018

Adds capture action to verifyCPF
Felipe Zimmerle
committed
Updates bison parser
Felipe Zimmerle
committed

Commits on Mar 9, 2018

Adds capture action to verifySSN
Felipe Zimmerle
committed
Adds capture action to verifyCC
Felipe Zimmerle
committed
Adds capture action to RBL
Felipe Zimmerle
committed
Adds capture action to detectSQLi
Felipe Zimmerle
committed

Commits on Mar 12, 2018

Temporarily accept invalid MULTIPART_SEMICOLON_MISSING operator

victorhora
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about #1701
Felipe Zimmerle
committed

Commits on Mar 13, 2018

Adds capture action to detectXSS

victorhora
authored and
Felipe Zimmerle
committed
Disable SecCollectionTimeout parser error

victorhora
authored and
Felipe Zimmerle
committed

Commits on Mar 21, 2018

Parser: Updates the generated parser files
Felipe Zimmerle
committed

Commits on Mar 22, 2018

Adds support for libMaxMind
Felipe Zimmerle
committed
Travis: adds --without-maxmind option
Felipe Zimmerle
committed

Commits on Mar 23, 2018

Adds support to libMaxMind
Felipe Zimmerle
committed
Reverse logic of checking output in @inspectFile

defanator
authored and
Felipe Zimmerle
committed
Adjust tests for @inspectFile operator

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1715
Felipe Zimmerle
committed
Include all prerequisites for "make check" into dist archive

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1716
Felipe Zimmerle
committed
Fix SecUploadDir configuration merge
Felipe Zimmerle
committed

Commits on Mar 26, 2018

Adds support for ctl:ruleRemoveByTag action
Felipe Zimmerle
committed

Commits on Mar 29, 2018

Fix maxmind test case
Felipe Zimmerle
committed
CHANGES: The correct is: ruleRemoveByTag not ruleRemoveById
Felipe Zimmerle
committed

Commits on Apr 2, 2018

Change release version to v3.0.1
Felipe Zimmerle
committed

Commits on Apr 3, 2018

Fix version number on libtool
Felipe Zimmerle
committed
CHANGES: Adds info about version issue
Felipe Zimmerle
committed
Change release version to v3.0.2
Felipe Zimmerle
committed

Commits on Apr 5, 2018

CHANGES: Adds to be released marking
Felipe Zimmerle
committed
Fix memory leak in Collections

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1729, #1730
Felipe Zimmerle
committed

Commits on Apr 22, 2018

Fix variable FILES_TMPNAMES

victorhora
authored and
Felipe Zimmerle
committed
Fix utils::string::ssplit() to handle delimiter in the end of string

defanator
authored and
Felipe Zimmerle
committed

Commits on Apr 24, 2018

Fix github_issue reference in regression test

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1743, #1744
Felipe Zimmerle
committed
Fix broken @detectxss operator regression test

p0pr0ck5
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1739
Felipe Zimmerle
committed
Initialize m_dtd member in ValidateDTD class as NULL

airween
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1751
Felipe Zimmerle
committed
Fix memory leak in modsecurity::utils::expandEnv()

defanator
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1750
Felipe Zimmerle
committed
Fix STATUS var parsing and accept STATUS_LINE var for v2 backward compatibility

victorhora
authored and
Felipe Zimmerle
committed
Normalizes Bison version
Felipe Zimmerle
committed
CHANGES: Adds info about: #1738
Felipe Zimmerle
committed
Add missing escapeSeqDecode, urlEncode and trimLeft/Right tfns to parser

victorhora
authored and
Felipe Zimmerle
committed
Define m_secmarker_skipped as an integer type

p0pr0ck5
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1737
Felipe Zimmerle
committed
Disables skip counter if debug log is disabled
Felipe Zimmerle
committed

Commits on May 3, 2018

Adds time stamp back to the audit logs
Felipe Zimmerle
committed
Code cosmetics: Clean up MD5 hexdigest

p0pr0ck5
authored and
Felipe Zimmerle
committed
HANGES: Adds info about: #1761
Felipe Zimmerle
committed
Fix LDFLAGS for unit tests.

smlx
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1758
Felipe Zimmerle
committed
Fix setvar parsing of quoted data

victorhora
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1759 and #1733
Felipe Zimmerle
committed
Remove an unused variable

p0pr0ck5
authored and
Felipe Zimmerle
committed
Fix memory leak in processContentOffset

p0pr0ck5
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1757
Felipe Zimmerle
committed

Commits on May 8, 2018

Check if response body inspection is enabled before process it
Felipe Zimmerle
committed

Commits on May 10, 2018

fix when multiple lines for curl version

Charles Peterson
authored and
Felipe Zimmerle
committed
CHANGES: Fix info about: #1771
Felipe Zimmerle
committed

Commits on May 11, 2018

Build in parallel.

smlx
authored and
Felipe Zimmerle
committed
Testing travis with parallel build
Felipe Zimmerle
committed

Commits on May 13, 2018

Code cleanup: Initialize variables and others good practice

p0pr0ck5
authored and
Felipe Zimmerle
committed

Commits on May 17, 2018

Actually fix setvar parsing of quoted data

victorhora
authored and
Felipe Zimmerle
committed

Commits on May 22, 2018

travis: Temporarily disables -jN
Felipe Zimmerle
committed

Commits on May 23, 2018

Use rvalue reference in ModSecurity::serverLog to avoid string copy

Wenfeng Liu
authored and
Felipe Zimmerle
committed

Commits on May 24, 2018

CHANGES: Adds info about: #1769
Felipe Zimmerle
committed
Return false in SharedFiles::open() when an error happens

Wenfeng Liu
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1783
Felipe Zimmerle
committed
Fix memory leak in msc_rules_* C APIs

Wenfeng Liu
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1765
Felipe Zimmerle
committed
Experimenting with SonarQube/SonarCloud
victorhora
authored
Cosmetics on README
victorhora
authored

Commits on May 28, 2018

Fix race condition in UniqueId::uniqueId()

Wenfeng Liu
authored and
Felipe Zimmerle
committed
Revert "Fix memory leak in msc_rules_* C APIs"
Felipe Zimmerle
committed
CHANGES: Adds info about: #1786
Felipe Zimmerle
committed

Commits on May 30, 2018

Refactoring on {global,ip,resources,session,tx,user} collections
Felipe Zimmerle
committed
CHANGES: Adds info about: #1754 & #1778
Felipe Zimmerle
committed

Commits on May 31, 2018

Changes the behavior of the default sec actions
Felipe Zimmerle
committed

Commits on Jun 7, 2018

Fix ip tree lookup on netmask content

Reed Morrison
authored and
Felipe Zimmerle
committed

Commits on Jun 12, 2018

Fixed false positive MULTIPART_UNMATCHED_BOUNDARY errors

airween
authored and
Felipe Zimmerle
committed
Modified the false pos. UNMATCHED_BOUNDARY error flag

airween
authored and
Felipe Zimmerle
committed
Added new tests, aligned to new UNMATCHED_BOUNDARY flag value

airween
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1747
Felipe Zimmerle
committed
Updates the test cases described on Makefile.am
Felipe Zimmerle
committed
Fixed LMDB collection errors

airween
authored and
Felipe Zimmerle
committed
Improvements on top of #1787
Felipe Zimmerle
committed
CHANGES: Adds info about: #1787
Felipe Zimmerle
committed
Add basic pkg-config info

Guillaume Quintard
authored and
Felipe Zimmerle
committed

Commits on Jun 13, 2018

Adjustments on top of #1790
Felipe Zimmerle
committed
CHANGES: Adds info about: #1790
Felipe Zimmerle
committed

Commits on Jun 18, 2018

Added some documentation for multipart boundary check

airween
authored and
Felipe Zimmerle
committed

Commits on Jun 19, 2018

Allow empty strings to be evaluated by regex::searchAll

victorhora
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1785
Felipe Zimmerle
committed

Commits on Jun 22, 2018

Improves the performance while loading the rules
Felipe Zimmerle
committed

Commits on Jun 26, 2018

#1818: Variable names must match fully, not partially; also revert to hash table lookup instead of linear search; add test case

michaelgranzow-avi
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1818, #1820, #1810, #1808
Felipe Zimmerle
committed

Commits on Jul 27, 2018

Implement support for Lua 5.1

p0pr0ck5
authored and
victorhora
committed
CHANGES: Adds info about: #1814
victorhora
committed

Commits on Aug 22, 2018

Commits on Aug 23, 2018

CHANGES: fix contributor list on: #1818, #1820, #1810, #1808
Felipe Zimmerle
committed
Adds support for ctl:requestBodyProcessor=URLENCODED

victorhora
authored and
Felipe Zimmerle
committed
Set the correct variable (m_requestBodyType) and add test case

victorhora
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1807
victorhora
committed

Commits on Sep 5, 2018

Fix utf-8 character encoding conversion
Felipe Zimmerle
committed
Adds more tests to REQUEST_BASENAME
Felipe Zimmerle
committed
Adds test case for: #1812
Felipe Zimmerle
committed

Commits on Sep 6, 2018

good practices: Initialize variables before use it
Felipe Zimmerle
committed
modsec_rules_check: uses the gnu `.la' instead of `.a' file
Felipe Zimmerle
committed
Fix pc file

Guillaume Quintard
authored and
Felipe Zimmerle
committed
CHANGES: Adds info about: #1847
Felipe Zimmerle
committed

Commits on Sep 11, 2018

parser: Fix simple quote setvar in the end of the line.
Felipe Zimmerle
committed
test case: Adds test case related to #1831
Felipe Zimmerle
committed
Allow libMaxmind to work with Ubuntu PPA packages

victorhora
authored and
Felipe Zimmerle
committed
Fix parser to support GeoLookup with MaxMind

victorhora
authored and
Felipe Zimmerle
committed
Use glob.h when using OpenBSD

victorhora
authored and
Felipe Zimmerle
committed
Add exception to linker as OpenBSD doesn't like static

victorhora
authored and
Felipe Zimmerle
committed
Explicitly include time.h to fix building the examples

victorhora
authored and
Felipe Zimmerle
committed
Fix SecResponseBodyAccess and ctl:requestBodyAccess directives

victorhora
authored and
Felipe Zimmerle
committed
Fix matching condition and adjust test case

victorhora
authored and
Felipe Zimmerle
committed

Commits on Sep 12, 2018

parser: Updates the generated parser file
Felipe Zimmerle
committed
parser: Fix typo on SanitiseArgs
Felipe Zimmerle
committed

Commits on Sep 24, 2018

Handling key exceptions on the variable itself
Felipe Zimmerle
committed
Having a better organization for Variables::
Felipe Zimmerle
committed
Adds test case related to issue #1725
Felipe Zimmerle
committed
CHANGES: Adds info about: 0x028e0 and 0x275a1
Felipe Zimmerle
committed

Commits on Sep 25, 2018

Adds request IDs and URIs to the debug log
Felipe Zimmerle
committed
Adds new transaction constructor that accepts the transaction id as parameter.
Felipe Zimmerle
committed
Adds support to setenv action
Felipe Zimmerle
committed

Commits on Sep 26, 2018

Adds partial support to UpdateActionById
Felipe Zimmerle
committed

Commits on Sep 28, 2018

Refactoring on the Rule class
Felipe Zimmerle
committed

Commits on Sep 29, 2018

Refactoring on the RULE variable
Felipe Zimmerle
committed