Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

make parsing GET url more robust

Browse source
This commit is contained in:
Liang Zhu 2015-07-16 19:07:13 -07:00
parent cb0aa7725e
commit d20925f230
1 changed files with 14 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

32
scripts/base/files/ocsp/main.bro
View file

@ -232,6 +232,15 @@ event ocsp_request(f: fa_file, req_ref: opaque of ocsp_req, req: OCSP::Request)
enq_request(f$http, req, f$id, network_time()); enq_request(f$http, req, f$id, network_time());
} }
function get_first_slash(s: string): string
{
local s_len = |s|;
if (s[0] == "/")
return "/" + get_first_slash(s[1:s_len]);
else
return "";
}
function remove_first_slash(s: string): string function remove_first_slash(s: string): string
{ {
local s_len = |s|; local s_len = |s|;
@ -243,12 +252,11 @@ function remove_first_slash(s: string): string
function get_uri_prefix(s: string): string function get_uri_prefix(s: string): string
{ {
s = remove_first_slash(s); local uri_prefix = get_first_slash(s);
local w = split_string(s, /\//); local w = split_string(s[|uri_prefix|:], /\//);
if (|w| > 1) if (|w| > 1)
return w[0]; uri_prefix += w[0] + "/";
else return uri_prefix;
return "";
} }
function check_ocsp_request_uri(http: HTTP::Info): OCSP::Request function check_ocsp_request_uri(http: HTTP::Info): OCSP::Request
@ -256,20 +264,8 @@ function check_ocsp_request_uri(http: HTTP::Info): OCSP::Request
local parsed_req: OCSP::Request; local parsed_req: OCSP::Request;
if ( ! http?$original_uri ) if ( ! http?$original_uri )
return parsed_req;; return parsed_req;;
local uri: string = remove_first_slash(http$uri);
local uri_prefix: string = get_uri_prefix(http$original_uri); local uri_prefix: string = get_uri_prefix(http$original_uri);
local ocsp_req_str: string; local ocsp_req_str: string = http$uri[|uri_prefix|:];
if ( |uri_prefix| == 0 )
{
ocsp_req_str = uri;
}
else if (|uri_prefix| > 0)
{
uri_prefix += "/";
ocsp_req_str = uri[|uri_prefix|:];
}
parsed_req = ocsp_parse_request(decode_base64(ocsp_req_str)); parsed_req = ocsp_parse_request(decode_base64(ocsp_req_str));
return parsed_req; return parsed_req;
} }