Skip to content
This repository has been archived by the owner on May 14, 2020. It is now read-only.

Perf issue with regexes that start with repeating digits #1708

Open
wants to merge 6 commits into
base: v3.3/dev
Choose a base branch
from
Open

Perf issue with regexes that start with repeating digits #1708

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
dd63bd0
Anchor regexes that start with repeating digits
allanrbo Mar 3, 2020
5ca01e6
Remove quantifier (Mirkos suggestion)
allanrbo Mar 3, 2020
08a567c
updated unassembled regexes
allanrbo Mar 4, 2020
41cc6a0
mend
allanrbo Mar 4, 2020
dfc810b
mend
allanrbo Mar 4, 2020
1c1ca6a
mend
allanrbo Mar 4, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F
# -=[ XSS Filters - Category 2 ]=-
# XSS vectors making use of event handlers like onerror, onload etc, e.g., <body onload="alert(1)">
#
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\"'`;\/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]+on[a-zA-Z]+[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=" \
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\"'`;\/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]on[a-zA-Z]+[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=" \
"id:941120,\
phase:2,\
block,\
Expand Down
4 changes: 2 additions & 2 deletions rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -762,7 +762,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
# to the Regexp::Assemble output:
# (?i:ASSEMBLE_OUTPUT)
#
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||like|and|div|&&)[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]|\/\w+;?\s+(?:between|having|select|like|x?or|and|div)\W|\d+\s*?(?:between|like|x?or|and|div)\s*?\d+\s*?[\-+]|--\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|#\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|;\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|\@.+=\s*?\(\s*?select|\d\s+group\s+by.+\(|[^\w]SET\s*?\@\w+))" \
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||like|and|div|&&)[\s(]+\w+[\s)]*?[!=+]+[\s\d]*?[\"'`=()]|\d(?:\s*?(?:between|like|x?or|and|div)\s*?\d+\s*?[\-+]|\s+group\s+by.+\()|\/\w+;?\s+(?:between|having|select|like|x?or|and|div)\W|--\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|#\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|;\s*?(?:(?:insert|update)\s*?\w{2,}|alter|drop)|\@.+=\s*?\(\s*?select|[^\w]SET\s*?\@\w+))" \
"id:942210,\
phase:2,\
block,\
Expand Down Expand Up @@ -794,7 +794,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
# to the Regexp::Assemble output:
# ASSEMBLE_OUTPUT | s/^(?:/(?i:/
#
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'`]\s*?(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||and|div|&&)\s+[\s\w]+=\s*?\w+\s*?having\s+|like(?:\s+[\s\w]+=\s*?\w+\s*?having\s+|\W*?[\"'`\d])|[^?\w\s=.,;)(]++\s*?[(@\"'`]*?\s*?\w+\W+\w|\*\s*?\w+\W+[\"'`])|(?:union\s*?(?:distinct|[(!@]*?|all)?\s*?[([]*?\s*?select|select\s+?[\[\]()\s\w\.,\"'`-]+from)\s+|\w+\s+like\s+[\"'`]|find_in_set\s*?\(|like\s*?[\"'`]%)" \
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'`]\s*?(?:(?:n(?:and|ot)|(?:x?x)?or|between|\|\||and|div|&&)\s+[\s\w]+=\s*?\w+\s*?having\s+|like(?:\s+[\s\w]+=\s*?\w+\s*?having\s+|\W*?[\"'`\d])|[^?\w\s=.,;)(]+\+\s*?[(@\"'`]*?\s*?\w+\W+\w|\*\s*?\w+\W+[\"'`])|(?:union\s*?(?:distinct|[(!@]*?|all)?\s*?[([]*?\s*?select|select\s+?[\[\]()\s\w\.,\"'`-]+from)\s+|\w\s+like\s+[\"'`]|find_in_set\s*?\(|like\s*?[\"'`]%)" \
"id:942260,\
phase:2,\
block,\
Expand Down
12 changes: 6 additions & 6 deletions util/regexp-assemble/regexp-942210.data
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
@.+=\s*?\(\s*?select
\d+\s*?or\s*?\d+\s*?[\-+]
\d+\s*?xor\s*?\d+\s*?[\-+]
\d+\s*?div\s*?\d+\s*?[\-+]
\d+\s*?like\s*?\d+\s*?[\-+]
\d+\s*?between\s*?\d+\s*?[\-+]
\d+\s*?and\s*?\d+\s*?[\-+]
\d\s*?or\s*?\d+\s*?[\-+]
\d\s*?xor\s*?\d+\s*?[\-+]
\d\s*?div\s*?\d+\s*?[\-+]
\d\s*?like\s*?\d+\s*?[\-+]
\d\s*?between\s*?\d+\s*?[\-+]
\d\s*?and\s*?\d+\s*?[\-+]
\/\w+;?\s+having\W
\/\w+;?\s+and\W
\/\w+;?\s+or\W
Expand Down
2 changes: 1 addition & 1 deletion util/regexp-assemble/regexp-942260.data
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ union\s*?\s*?[([]*?\s*?select\s+
union\s*?all\s*?[([]*?\s*?select\s+
union\s*?distinct\s*?[([]*?\s*?select\s+
union\s*?[(!@]*?\s*?[([]*?\s*?select\s+
\w+\s+like\s+[\"'`]
\w\s+like\s+[\"'`]
like\s*?[\"'`]\%
[\"'`]\s*?like\W*?[\"'`\d]
[\"'`]\s*?and\s+[\s\w]+=\s*?\w+\s*?having\s+
Expand Down