owasp-modsecurity / owasp-modsecurity/ModSecurity
Segment error occurs after calling msc_set_log_cb set callback function
Open
Nobody has claimed this yet.
3.x
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "modsecurity/modsecurity.h"
#include "modsecurity/rules_set.h"
#include <modsecurity/transaction.h>
#include <modsecurity/intervention.h>
void log_callback(void *data, const void *ruleMessage) {
const ModSecurityIntervention *intervention = (const ModSecurityIntervention *)ruleMessage;
if (intervention->log != NULL) {
printf("Log: %s\n", intervention->log);
}
}
char main_rule_uri[] = "basic_rules.conf";
int main (int argc, char **argv)
{
int ret;
const char *error = NULL;
ModSecurity *modsec;
Transaction *transaction = NULL;
RulesSet *rules;
modsec = msc_init();
msc_set_connector_info(modsec, "ModSecurity-test v0.0.1-alpha (Simple " \
"example on how to use ModSecurity API");
rules = msc_create_rules_set();
ret = msc_rules_add_file(rules, main_rule_uri, &error);
if (ret < 0) {
fprintf(stderr, "Problems loading the rules --\n");
fprintf(stderr, "%s\n", error);
goto end;
}
// **Segment error**
msc_set_log_cb(modsec, log_callback);
// msc_rules_dump(rules);
// 打开日志文件
FILE *log_file = fopen("webalert.txt", "a");
if (log_file == NULL) {
fprintf(stderr, "Failed to open log file\n");
msc_rules_cleanup(rules);
msc_cleanup(modsec);
return 1;
}
transaction = msc_new_transaction(modsec, rules, NULL);
msc_process_connection(transaction, "127.0.0.1", 12345, "127.0.0.1", 80);
msc_process_uri(transaction,
"http://www.modsecurity.org/index.php?id=select../../../etc/passwd",
"GET", "1.1");
//msc_process_request_headers(transaction);
// 模拟请求参数
msc_add_request_header(transaction, "Host", "example.com");
msc_add_request_header(transaction, "User-Agent", "TestAgent");
msc_add_request_header(transaction, "Accept", "*/*");
msc_add_request_header(transaction, "Content-Type", "application/x-www-form-urlencoded");
// 处理请求头
msc_process_request_headers(transaction);
msc_process_request_body(transaction);
msc_process_logging(transaction);
end:
if(error != NULL)
msc_rules_error_cleanup(error);
msc_rules_cleanup(rules);
msc_cleanup(modsec);
return 0;
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the crash at msc_set_log_cb in the provided example, then inspect the msc_set_log_cb API and log_callback interaction. No source file or test is identified in the issue; done means determining why the callback registration segfaults and demonstrating a callback setup that completes without the crash.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100