Skip to content

Commit ab5658f

Browse files
martinhsvmartinhsv
committed
Fix: worst-case time in implementation of four transformations
1 parent 3f09716 commit ab5658f

File tree

5 files changed

+56
-74
lines changed

5 files changed

+56
-74
lines changed

‎CHANGES‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
v3.x.y - YYYY-MMM-DD (to be released)
22
-------------------------------------
33

4+
- Fix: worst-case time in implementation of four transformations
5+
[Issue #2934 - @martinhsv]
46
- Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED
57
[Issue #2901 - @airween]
68
- Make MULTIPART_PART_HEADERS accessible to lua

‎src/actions/transformations/remove_comments_char.cc‎

Lines changed: 30 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* ModSecurity, http://www.modsecurity.org/
3-
* Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
3+
* Copyright (c) 2015 - 2023 Trustwave Holdings, Inc. (http://www.trustwave.com/)
44
*
55
* You may not use this file except in compliance with
66
* the License. You may obtain a copy of the License at
@@ -15,12 +15,7 @@
1515

1616
#include "src/actions/transformations/remove_comments_char.h"
1717

18-
#include <iostream>
1918
#include <string>
20-
#include <algorithm>
21-
#include <functional>
22-
#include <cctype>
23-
#include <locale>
2419

2520
#include "modsecurity/transaction.h"
2621
#include "src/actions/transformations/transformation.h"
@@ -37,39 +32,40 @@ RemoveCommentsChar::RemoveCommentsChar(const std::string &action)
3732

3833
std::string RemoveCommentsChar::evaluate(const std::string &val,
3934
Transaction *transaction) {
40-
int64_t i;
41-
std::string value(val);
35+
size_t i = 0;
36+
std::string transformed_value;
37+
transformed_value.reserve(val.size());
4238

43-
i = 0;
44-
while (i < value.size()) {
45-
if (value.at(i) == '/'
46-
&& (i+1 < value.size()) && value.at(i+1) == '*') {
47-
value.erase(i, 2);
48-
} else if (value.at(i) == '*'
49-
&& (i+1 < value.size()) && value.at(i+1) == '/') {
50-
value.erase(i, 2);
51-
} else if (value.at(i) == '<'
52-
&& (i+1 < value.size())
53-
&& value.at(i+1) == '!'
54-
&& (i+2 < value.size())
55-
&& value.at(i+2) == '-'
56-
&& (i+3 < value.size())
57-
&& value.at(i+3) == '-') {
58-
value.erase(i, 4);
59-
} else if (value.at(i) == '-'
60-
&& (i+1 < value.size()) && value.at(i+1) == '-'
61-
&& (i+2 < value.size()) && value.at(i+2) == '>') {
62-
value.erase(i, 3);
63-
} else if (value.at(i) == '-'
64-
&& (i+1 < value.size()) && value.at(i+1) == '-') {
65-
value.erase(i, 2);
66-
} else if (value.at(i) == '#') {
67-
value.erase(i, 1);
39+
while (i < val.size()) {
40+
if (val.at(i) == '/'
41+
&& (i+1 < val.size()) && val.at(i+1) == '*') {
42+
i += 2;
43+
} else if (val.at(i) == '*'
44+
&& (i+1 < val.size()) && val.at(i+1) == '/') {
45+
i += 2;
46+
} else if (val.at(i) == '<'
47+
&& (i+1 < val.size())
48+
&& val.at(i+1) == '!'
49+
&& (i+2 < val.size())
50+
&& val.at(i+2) == '-'
51+
&& (i+3 < val.size())
52+
&& val.at(i+3) == '-') {
53+
i += 4;
54+
} else if (val.at(i) == '-'
55+
&& (i+1 < val.size()) && val.at(i+1) == '-'
56+
&& (i+2 < val.size()) && val.at(i+2) == '>') {
57+
i += 3;
58+
} else if (val.at(i) == '-'
59+
&& (i+1 < val.size()) && val.at(i+1) == '-') {
60+
i += 2;
61+
} else if (val.at(i) == '#') {
62+
i += 1;
6863
} else {
64+
transformed_value += val.at(i);
6965
i++;
7066
}
7167
}
72-
return value;
68+
return transformed_value;
7369
}
7470

7571
} // namespace transformations

‎src/actions/transformations/remove_nulls.cc‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* ModSecurity, http://www.modsecurity.org/
3-
* Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
3+
* Copyright (c) 2015 - 2023 Trustwave Holdings, Inc. (http://www.trustwave.com/)
44
*
55
* You may not use this file except in compliance with
66
* the License. You may obtain a copy of the License at
@@ -17,12 +17,7 @@
1717

1818
#include <string.h>
1919

20-
#include <iostream>
2120
#include <string>
22-
#include <algorithm>
23-
#include <functional>
24-
#include <cctype>
25-
#include <locale>
2621

2722
#include "modsecurity/transaction.h"
2823
#include "src/actions/transformations/transformation.h"
@@ -35,19 +30,20 @@ namespace transformations {
3530

3631
std::string RemoveNulls::evaluate(const std::string &val,
3732
Transaction *transaction) {
38-
int64_t i;
39-
std::string value(val);
33+
size_t i = 0;
34+
std::string transformed_value;
35+
transformed_value.reserve(val.size());
4036

41-
i = 0;
42-
while (i < value.size()) {
43-
if (value.at(i) == '\0') {
44-
value.erase(i, 1);
37+
while (i < val.size()) {
38+
if (val.at(i) == '\0') {
39+
// do nothing; continue on to next char in original val
4540
} else {
46-
i++;
41+
transformed_value += val.at(i);
4742
}
43+
i++;
4844
}
4945

50-
return value;
46+
return transformed_value;
5147
}
5248

5349

‎src/actions/transformations/remove_whitespace.cc‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* ModSecurity, http://www.modsecurity.org/
3-
* Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
3+
* Copyright (c) 2015 - 2023 Trustwave Holdings, Inc. (http://www.trustwave.com/)
44
*
55
* You may not use this file except in compliance with
66
* the License. You may obtain a copy of the License at
@@ -15,12 +15,7 @@
1515

1616
#include "src/actions/transformations/remove_whitespace.h"
1717

18-
#include <iostream>
1918
#include <string>
20-
#include <algorithm>
21-
#include <functional>
22-
#include <cctype>
23-
#include <locale>
2419

2520
#include "modsecurity/transaction.h"
2621
#include "src/actions/transformations/transformation.h"
@@ -37,28 +32,27 @@ RemoveWhitespace::RemoveWhitespace(const std::string &action)
3732

3833
std::string RemoveWhitespace::evaluate(const std::string &val,
3934
Transaction *transaction) {
40-
std::string value(val);
35+
std::string transformed_value;
36+
transformed_value.reserve(val.size());
4137

42-
int64_t i = 0;
38+
size_t i = 0;
4339
const char nonBreakingSpaces = 0xa0;
4440
const char nonBreakingSpaces2 = 0xc2;
4541

4642
// loop through all the chars
47-
while (i < value.size()) {
43+
while (i < val.size()) {
4844
// remove whitespaces and non breaking spaces (NBSP)
49-
if (std::isspace(static_cast<unsigned char>(value[i]))
50-
|| (value[i] == nonBreakingSpaces)
51-
|| value[i] == nonBreakingSpaces2) {
52-
value.erase(i, 1);
45+
if (std::isspace(static_cast<unsigned char>(val[i]))
46+
|| (val[i] == nonBreakingSpaces)
47+
|| val[i] == nonBreakingSpaces2) {
48+
// don't copy; continue on to next char in original val
5349
} else {
54-
/* if the space is not a whitespace char, increment counter
55-
counter should not be incremented if a character is erased because
56-
the index erased will be replaced by the following character */
57-
i++;
50+
transformed_value += val.at(i);
5851
}
52+
i++;
5953
}
6054

61-
return value;
55+
return transformed_value;
6256
}
6357

6458
} // namespace transformations

‎src/actions/transformations/replace_nulls.cc‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* ModSecurity, http://www.modsecurity.org/
3-
* Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
3+
* Copyright (c) 2015 - 2023 Trustwave Holdings, Inc. (http://www.trustwave.com/)
44
*
55
* You may not use this file except in compliance with
66
* the License. You may obtain a copy of the License at
@@ -15,12 +15,7 @@
1515

1616
#include "src/actions/transformations/replace_nulls.h"
1717

18-
#include <iostream>
1918
#include <string>
20-
#include <algorithm>
21-
#include <functional>
22-
#include <cctype>
23-
#include <locale>
2419

2520
#include "modsecurity/transaction.h"
2621
#include "src/actions/transformations/transformation.h"
@@ -43,8 +38,7 @@ std::string ReplaceNulls::evaluate(const std::string &val,
4338
i = 0;
4439
while (i < value.size()) {
4540
if (value.at(i) == '\0') {
46-
value.erase(i, 1);
47-
value.insert(i, " ", 1);
41+
value[i] = ' ';
4842
} else {
4943
i++;
5044
}

0 commit comments

Comments
 (0)