Reorganize injection checks & hca population
Instead of doing two things at once, the actions are now properly
sequenced:
* build the map of inspected arguments
* only then run injection checks
@@ -171,21 +171,16 @@ pub fn content_filter_check(
let mut hca_keys: HashMap<String, (SectionIdx, String)> = HashMap::new();
- // run libinjection on non-whitelisted sections, and populate the hca_keys table
+ // list of non whitelisted entries
for idx in &[Path, Headers, Cookies, Args] {
- // note that there is no risk check with injection, every match triggers a block.
- injection_check(
- tags,
- *idx,
- get_section(*idx, rinfo),
- &omit,
- &mut hca_keys,
- test_xss,
- test_sqli,
- );
+ let section_content = get_section(*idx, rinfo)
+ .iter()
+ .filter(|(name, _)| !omit.entries.get(*idx).contains(*name))
+ .map(|(name, value)| (value.to_string(), (*idx, name.to_string())));
+ hca_keys.extend(section_content);
}
- logs.info(format!("TO TEST: {:?}", hca_keys));
+ injection_check(tags, &hca_keys, &omit, test_xss, test_sqli);
let mut specific_tags = Tags::default();
// finally, hyperscan check
@@ -299,16 +294,13 @@ fn section_check(
/// this is stupid and needs to be changed
fn injection_check(
tags: &mut Tags,
- idx: SectionIdx,
- params: &RequestField,
+ hca_keys: &HashMap<String, (SectionIdx, String)>,
omit: &Omitted,
- hca_keys: &mut HashMap<String, (SectionIdx, String)>,
test_xss: bool,
test_sqli: bool,
) {
- for (name, value) in params.iter() {
- if !omit.entries.get(idx).contains(name) {
- let omit_tags = omit.exclusions.get(idx).get(name);
+ for (value, (idx, name)) in hca_keys.iter() {
+ let omit_tags = omit.exclusions.get(*idx).get(name);
let rtest_xss = test_xss
&& !omit_tags
.map(|tgs| LIBINJECTION_XSS_TAGS.intersection(tgs).next().is_some())
@@ -337,9 +329,6 @@ fn injection_check(
}
}
}
-
- hca_keys.insert(value.to_string(), (idx, name.to_string()));
- }
}
}
