ModSecurity/src/request_body_processor/xml.h at 5576ba12a91830c6277bf164e06a12635501c257 · owasp-modsecurity/ModSecurity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
/*
 * ModSecurity, http://www.modsecurity.org/
 * Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
 *
 * You may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * If any of the files related to licensing are missing or if you have any
 * other questions related to licensing please contact Trustwave Holdings, Inc.
 * directly using the email address [email protected].
 *
 */

#ifdef WITH_LIBXML2
#include <libxml/xmlschemas.h>
#include <libxml/xpath.h>
#include <libxml/SAX2.h>
#endif

#include <string>
#include <iostream>

#include "modsecurity/transaction.h"
#include "modsecurity/rules_set.h"

#ifndef SRC_REQUEST_BODY_PROCESSOR_XML_H_
#define SRC_REQUEST_BODY_PROCESSOR_XML_H_


namespace modsecurity {
namespace RequestBodyProcessor {

#ifdef WITH_LIBXML2

/*
* NodeData for parsing XML into args
*/
class NodeData {
    public:
        explicit NodeData();
        ~NodeData();

        bool has_child;
};

/*
* XMLNodes for parsing XML into args
*/
class XMLNodes {
    public:
        std::vector<std::shared_ptr<NodeData>> nodes;
        unsigned long int node_depth;
        std::string       currpath;
        std::string       currval;
        bool              currval_is_set;
        Transaction      *m_transaction;
        // need to store context - this is the same as in xml_data
        // need to stop parsing if the number of arguments reached the limit
        xmlParserCtxtPtr  parsing_ctx_arg;

        explicit XMLNodes (Transaction *);
        ~XMLNodes();
};

struct xml_data {
    std::unique_ptr<xmlSAXHandler> sax_handler;
    xmlParserCtxtPtr parsing_ctx;
    xmlDocPtr doc;

    unsigned int well_formed;

    /* error reporting and XML array flag */
    std::string               xml_error;

    /* additional parser context for arguments */
    xmlParserCtxtPtr          parsing_ctx_arg;

    /* parser state for SAX parser */
    std::unique_ptr<XMLNodes> xml_parser_state;
};

typedef struct xml_data xml_data;

class XML {
 public:
    explicit XML(Transaction *transaction);
    ~XML();
    bool init(bool require_well_formed = true);
    bool processChunk(const char *buf, unsigned int size, std::string *err);
    bool complete(std::string *err);
    static xmlParserInputBufferPtr unloadExternalEntity(const char *URI,
        xmlCharEncoding enc);

    xml_data m_data;

 private:
    Transaction *m_transaction;
    std::string m_header;
    bool m_require_well_formed;
};

#endif

}  // namespace RequestBodyProcessor
}  // namespace modsecurity

#endif  // SRC_REQUEST_BODY_PROCESSOR_XML_H_