New operator verifySVNR that finds Austrian social security numbers #2063
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -55,6 +55,7 @@ script: | |
| # | ||
| - make check | ||
| - make check-static | ||
| - make check-TESTS | ||
|
|
||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
|
|
||
| #include "src/operators/verify_svnr.h" | ||
|
|
||
| #include <string> | ||
|
|
||
| #include "src/operators/operator.h" | ||
|
|
||
| #include "modsecurity/rule.h" | ||
| #include "modsecurity/rule_message.h" | ||
| #include "modsecurity/rules_properties.h" | ||
| namespace modsecurity { | ||
| namespace operators { | ||
|
|
||
| int VerifySVNR::convert_to_int(const char c) | ||
| { | ||
| int n; | ||
| if ((c>='0') && (c<='9')) | ||
| n = c - '0'; | ||
| else | ||
| n = 0; | ||
| return n; | ||
| } | ||
|
|
||
| bool VerifySVNR::verify(const char *svnrnumber, int len) { | ||
| int var_len = len; | ||
| int sum = 0; | ||
| unsigned int i = 0, svnr_len = 10; | ||
| int svnr[11]; | ||
| char s_svnr[11]; | ||
| char bad_svnr[12][11] = { "0000000000", | ||
| "0123456789", | ||
| "1234567890", | ||
| "1111111111", | ||
| "2222222222", | ||
| "3333333333", | ||
| "4444444444", | ||
| "5555555555", | ||
| "6666666666", | ||
| "7777777777", | ||
| "8888888888", | ||
| "9999999999"}; | ||
|
|
||
| while ((*svnrnumber != '\0') && ( var_len > 0)) | ||
| { | ||
| if (*svnrnumber != '-' || *svnrnumber != '.') | ||
| { | ||
| if (i < svnr_len && isdigit(*svnrnumber)) | ||
| { | ||
| s_svnr[i] = *svnrnumber; | ||
| svnr[i] = convert_to_int(*svnrnumber); | ||
| i++; | ||
| } | ||
| } | ||
| svnrnumber++; | ||
| var_len--; | ||
| } | ||
|
|
||
|
|
||
| if (i != svnr_len) | ||
| { | ||
| return 0; | ||
| } | ||
| else | ||
| { | ||
| for (i = 0; i< svnr_len; i++) | ||
| { | ||
| if (strncmp(s_svnr,bad_svnr[i],svnr_len) == 0) | ||
| { | ||
| return 0; | ||
| } | ||
| } | ||
| } | ||
| //Laufnummer mit 3, 7, 9 | ||
| //Geburtsdatum mit 5, 8, 4, 2, 1, 6 | ||
| sum = svnr[0] * 3 + svnr[1] * 7 + svnr[2] * 9 + svnr[4] * 5 + svnr[5] * 8 + svnr[6] * 4 + svnr[7] * 2 + svnr[8] * 1 + svnr[9] * 6; | ||
| sum %= 11; | ||
| if(sum == 10){ | ||
| sum = 0; | ||
| } | ||
| if (sum == svnr[3]) | ||
| { | ||
| return true; | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
|
|
||
| bool VerifySVNR::evaluate(Transaction *t, Rule *rule, | ||
| const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) { | ||
| std::list<SMatch> matches; | ||
| bool is_svnr = false; | ||
| int i; | ||
|
|
||
| if (m_param.empty()) { | ||
| return is_svnr; | ||
| } | ||
|
|
||
| for (i = 0; i < input.size() - 1 && is_svnr == false; i++) { | ||
| matches = m_re->searchAll(input.substr(i, input.size())); | ||
|
|
||
| for (const auto & i : matches) { | ||
| is_svnr = verify(i.str().c_str(), i.str().size()); | ||
| if (is_svnr) { | ||
| logOffset(ruleMessage, i.offset(), i.str().size()); | ||
| if (rule && t && rule->m_containsCaptureAction) { | ||
| t->m_collections.m_tx_collection->storeOrUpdateFirst( | ||
| "0", i.str()); | ||
| ms_dbg_a(t, 7, "Added VerifySVNR match TX.0: " + \ | ||
| i.str()); | ||
| } | ||
|
|
||
| goto out; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| out: | ||
| return is_svnr; | ||
| } | ||
|
|
||
|
|
||
| } // namespace operators | ||
| } // namespace modsecurity | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
|
|
||
| #ifndef SRC_OPERATORS_VERIFY_SVNR_H_ | ||
| #define SRC_OPERATORS_VERIFY_SVNR_H_ | ||
|
|
||
| #include <string> | ||
| #include <memory> | ||
| #include <utility> | ||
|
|
||
| #include "src/operators/operator.h" | ||
| #include "src/utils/regex.h" | ||
|
|
||
|
|
||
| namespace modsecurity { | ||
| using Utils::SMatch; | ||
| using Utils::regex_search; | ||
| using Utils::Regex; | ||
|
|
||
| namespace operators { | ||
|
|
||
| class VerifySVNR : public Operator { | ||
| public: | ||
| /** @ingroup ModSecurity_Operator */ | ||
| explicit VerifySVNR(std::unique_ptr<RunTimeString> param) | ||
| : Operator("VerifySVNR", std::move(param)) { | ||
| m_re = new Regex(m_param); | ||
| } | ||
|
|
||
| ~VerifySVNR() { | ||
| delete m_re; | ||
| } | ||
| bool evaluate(Transaction *transaction, Rule *rule, | ||
|
There was a problem hiding this comment. You do not need to specify those here. VerifySVNR inherit from Operator which already contains code to do exactly the same - It is safe to remove this evaluate declaration. It is better to remove, so we will have a cleaner code in case of a refactoring or major change. |
||
| const std::string &input) override { | ||
| return evaluate(transaction, NULL, input, NULL); | ||
| } | ||
| bool evaluate(Transaction *transaction, | ||
|
There was a problem hiding this comment. Same for the evaluate above. No need to co-exist here. |
||
| const std::string &input) override { | ||
| return evaluate(transaction, NULL, input); | ||
| } | ||
| bool evaluate(Transaction *transaction, Rule *rule, | ||
| const std::string& input, | ||
| std::shared_ptr<RuleMessage> ruleMessage) override; | ||
|
|
||
| int convert_to_int(const char c); | ||
|
There was a problem hiding this comment. Those could be private. Their usage is restricted to the very own class. |
||
| bool verify(const char *ssnumber, int len); | ||
|
|
||
| private: | ||
| Regex *m_re; | ||
| }; | ||
|
|
||
| } // namespace operators | ||
| } // namespace modsecurity | ||
|
|
||
|
|
||
| #endif // SRC_OPERATORS_VERIFY_SVNR_H_ | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see that this function is also used in verify cpf. It seems to me that in a further step, we can move it to utils and make both to share the same base code.
Not need to be done now, that could be an optimization.