libddwaf-src 2.1.0

Source distribution and build integration for DataDog/libddwaf
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

// Unless explicitly stated otherwise all files in this repository are
// dual-licensed under the Apache-2.0 License or BSD-3-Clause License.
//
// This product includes software developed at Datadog (https://www.datadoghq.com/).
// Copyright 2021 Datadog, Inc.

#include <cstddef>
#include <memory>
#include <string>
#include <string_view>
#include <utility>

#include "checksum/base.hpp"
#include "configuration/common/parser_exception.hpp"
#include "dynamic_string.hpp"
#include "matcher/regex_match_with_checksum.hpp"
#include "re2.h"

namespace ddwaf::matcher {

regex_match_with_checksum::regex_match_with_checksum(const std::string &regex_str,
    std::size_t minLength, bool case_sensitive, std::unique_ptr<base_checksum> &&algo)
    : min_length(minLength), algo_(std::move(algo))
{
    constexpr unsigned regex_max_mem = 512 * 1024;

    if (!algo_) {
        throw parsing_error("invalid checksum algorithm");
    }

    re2::RE2::Options options;
    options.set_max_mem(regex_max_mem);
    options.set_log_errors(false);
    options.set_case_sensitive(case_sensitive);

    regex = std::make_unique<re2::RE2>(regex_str, options);
    if (!regex->ok()) {
        throw parsing_error("invalid regular expression: " + regex->error_arg());
    }
}

std::pair<bool, dynamic_string> regex_match_with_checksum::match_impl(
    std::string_view pattern) const
{
    while (!pattern.empty() && pattern.size() >= min_length) {
        std::string_view match;
        auto res = regex->Match(pattern, 0, pattern.size(), RE2::UNANCHORED, &match, 1);
        if (!res || match.empty()) {
            break;
        }

        if (algo_->validate(match)) {
            return {true, match};
        }

        pattern.remove_prefix(match.data() - pattern.data() + match.size());
    }

    return {false, {}};
}

} // namespace ddwaf::matcher