diff --git a/src/secrules_parsing/model/secrules.tx b/src/secrules_parsing/model/secrules.tx index 1650c16..da30de8 100644 --- a/src/secrules_parsing/model/secrules.tx +++ b/src/secrules_parsing/model/secrules.tx @@ -47,15 +47,14 @@ IDRangeList: /* There is no check against collections existance, or typying between variables and value (e.g: TIME_DAY and its referred value must be equal to some integer) -FILES is a collection, so it doesn't belong here */ Variable: '!'? '&'? ('ARGS_COMBINED_SIZE' | 'ARGS_GET_NAMES' | 'ARGS_NAMES' | 'ARGS_POST_NAMES' | - 'AUTH_TYPE' | 'DURATION' | 'FILES_COMBINED_SIZE' | 'FILES_NAMES' | 'FILES' | - 'FULL_REQUEST' | 'FULL_REQUEST_LENGTH' | 'FILES_SIZES' | 'FILES_TMPNAMES' | + 'AUTH_TYPE' | 'DURATION' | 'FILES_COMBINED_SIZE' | 'FILES_NAMES' | + 'FULL_REQUEST' | 'FULL_REQUEST_LENGTH' | 'FILES_SIZES' | 'FILES_TMPNAMES' | 'FILES_TMP_CONTENT' | 'HIGHEST_SEVERITY' | 'INBOUND_DATA_ERROR' | 'MATCHED_VAR_NAME' | 'MODSEC_BUILD' | 'MULTIPART_CRLF_LF_LINES' | 'MULTIPART_FILENAME' | 'MULTIPART_NAME' | - 'MULTIPART_STRICT_ERROR' | 'MULTIPART_UNMATCHED_BOUNDARY' | 'OUTBOUND_DATA_ERROR' | + 'MULTIPART_STRICT_ERROR' | 'MULTIPART_UNMATCHED_BOUNDARY' | 'OUTBOUND_DATA_ERROR' | 'PATH_INFO' | 'PERF_ALL' | 'PERF_COMBINED' | 'PERF_GC' | 'PERF_LOGGING' | 'PERF_PHASE1' | 'PERF_PHASE2' | 'PERF_PHASE3' | 'PERF_PHASE4' | 'PERF_PHASE5' | 'PERF_SREAD' | 'PERF_SWRITE' | 'QUERY_STRING' | 'REMOTE_ADDR' | 'REMOTE_HOST' | 'REMOTE_PORT' | 'REMOTE_USER' | @@ -79,7 +78,7 @@ CollectionArgument: AnythingBetweenSingleQuotes | '/' SlashedRegExp '/' | Variab /* Collections */ CollectionName: - ('ARGS_GET' | 'ARGS_POST' | 'ARGS' | 'ENV' | 'GEO' | 'GLOBAL' | 'IP' | 'MATCHED_VARS_NAMES' | + ('ARGS_GET' | 'ARGS_POST' | 'ARGS' | 'ENV' | 'FILES' | 'GEO' | 'GLOBAL' | 'IP' | 'MATCHED_VARS_NAMES' | 'MATCHED_VARS' | 'MULTIPART_PART_HEADERS' | 'PERF_RULES' | 'REQUEST_COOKIES_NAMES' | 'REQUEST_COOKIES' | 'REQUEST_HEADERS_NAMES' | 'REQUEST_HEADERS' | 'RESPONSE_HEADERS_NAMES' | 'RESPONSE_HEADERS' | 'RULE' | 'SESSION' | 'TX') diff --git a/tests/test_api.py b/tests/test_api.py index 254eed2..49f3563 100644 --- a/tests/test_api.py +++ b/tests/test_api.py @@ -19,13 +19,14 @@ def test_model_parse() -> None: """Test that we can parse the model correctly""" rule_text = """ SecRule ARGS "@rx found" "id:1,log,noauditlog,t:lowercase,block" + SecRule FILES:pluginzip "@endsWith .zip" "id:2,phase:2,pass,t:none,ctl:ruleRemoveTargetById=944110;REQUEST_BODY,ctl:ruleRemoveTargetById=944250;REQUEST_BODY" """ parsed_rule = parser.process_from_str(rule_text) # print(ppretty(parsed_rule, depth=10)) for rule in parsed_rule.rules: assert (rule.__class__.__name__) == "SecRule" for var in rule.variables: - assert var.collection == "ARGS" + assert var.collection in ["ARGS", "FILES"] def test_operator_contains_works_with_greater_than() -> None: