V3/master3017

CHANGES

@@ -1,3 +1,30 @@
+v3.0.17 - 2026-Sep-29
+---------------------
+
+  - [fix: t:htmlEntityDecode does not decode all ASCII named HTML entities]
+    [PR from private repo - @marcstern, @fzipi, @airween; fixed GHSA-cxqf-vgrr-xxrv]
+  - [fix: use secure value for host verification in case of remote rules download]
+    [PR from private repo - @amitu314, @airween; fixed GHSA-2vqc-36qp-ccmw]
+  - [fix: uninitialized pointer dereference in XML request body processor]
+    [PR from private repo - Tobias Klein (www.trapkit.de), @airween; fixed GHSA-jx3r-phvx-2jmj]
+  - [fix: response body inspection bypass with mixed case Content-Type value]
+    [PR from private repo - @zuesdevil, @airween; fixed GHSA-vmg8-j66p-vgvw]
+  - [fix: nullptr dereference if @rx/@rxGlobal pattern is invalid (at startup or after macro expansion)]
+    [PR from private repo - @AnnoyingTechnology, @fzipi, @airween; fixed GHSA-5m93-4h75-3p2w]
+  - [fix: t:removeComments behavior in case of adjacent comments]
+    [PR from private repo - @HEXER365, @airween; fixed GHSA-qrch-pjfr-9g47]
+  - [fix: t:base64DecodeExt does not handle '-' and '_' characters (URL-safe alphabet)]
+    [PR from private repo - @fzipi, @airween; fixed GHSA-4j47-8qcr-jf59]
+  - [fix: handle 'filename*' and duplicated 'filename' parameters in multipart Content-Disposition header;
+     add new variables MULTIPART_DUPLICATE_PART_HEADER, MULTIPART_FILENAME_CHARSET, MULTIPART_FILENAME_LANGUAGE]
+    [PR from private repo - @hnakamur, @fzipi, @theseion, @airween; fixed GHSA-5pww-8rfg-9crf]
+  - fix: align cppcheck 2.22.0 warnings
+    [PR #3645 - @airween]
+  - fix: seclang scanner mis-parsing escaped quotes right after a macro
+    [PR #3641 - @fzipi]
+  - fix: drop MDB_WRITEMAP to avoid LMDB freelist assertion crash
+    [PR #3639 - @fzipi]
+
 v3.0.16 - 2026-Jun-29
 ---------------------
 

headers/modsecurity/modsecurity.h

@@ -190,15 +190,15 @@ namespace modsecurity {
 
 #define MODSECURITY_MAJOR "3"
 #define MODSECURITY_MINOR "0"
-#define MODSECURITY_PATCHLEVEL "16"
+#define MODSECURITY_PATCHLEVEL "17"
 #define MODSECURITY_TAG ""
 #define MODSECURITY_TAG_NUM "100"
 
 #define MODSECURITY_VERSION MODSECURITY_MAJOR "." \
     MODSECURITY_MINOR "." MODSECURITY_PATCHLEVEL \
     MODSECURITY_TAG
 
-#define MODSECURITY_VERSION_NUM 30160100
+#define MODSECURITY_VERSION_NUM 30170100
 
 #define MODSECURITY_CHECK_VERSION(a) (MODSECURITY_VERSION_NUM <= a)
 

headers/modsecurity/transaction.h

@@ -1,6 +1,7 @@
 /*
  * ModSecurity, http://www.modsecurity.org/
  * Copyright (c) 2015 - 2021 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *               2026 OWASP (https://owasp.org)
  *
  * You may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
@@ -143,6 +144,7 @@ class TransactionAnchoredVariables {
         m_variableMultipartCrlfLFLines(t, "MULTIPART_CRLF_LF_LINES"),
         m_variableMultipartDataAfter(t, "MULTIPART_DATA_AFTER"),
         m_variableMultipartDataBefore(t, "MULTIPART_DATA_BEFORE"),
+        m_variableMultipartDuplicatePartHeader(t, "MULTIPART_DUPLICATE_PART_HEADER"),
         m_variableMultipartFileLimitExceeded(t,
             "MULTIPART_FILE_LIMIT_EXCEEDED"),
         m_variableMultipartHeaderFolding(t, "MULTIPART_HEADER_FOLDING"),
@@ -194,6 +196,8 @@ class TransactionAnchoredVariables {
         m_variableFilesNames(t, "FILES_NAMES"),
         m_variableFilesTmpContent(t, "FILES_TMP_CONTENT"),
         m_variableMultipartFileName(t, "MULTIPART_FILENAME"),
+        m_variableMultipartFileNameCharset(t, "MULTIPART_FILENAME_CHARSET"),
+        m_variableMultipartFileNameLanguage(t, "MULTIPART_FILENAME_LANGUAGE"),
         m_variableMultipartName(t, "MULTIPART_NAME"),
         m_variableMatchedVarsNames(t, "MATCHED_VARS_NAMES"),
         m_variableMatchedVars(t, "MATCHED_VARS"),
@@ -229,6 +233,7 @@ class TransactionAnchoredVariables {
     AnchoredVariable m_variableMultipartCrlfLFLines;
     AnchoredVariable m_variableMultipartDataAfter;
     AnchoredVariable m_variableMultipartDataBefore;
+    AnchoredVariable m_variableMultipartDuplicatePartHeader;
     AnchoredVariable m_variableMultipartFileLimitExceeded;
     AnchoredVariable m_variableMultipartHeaderFolding;
     AnchoredVariable m_variableMultipartInvalidHeaderFolding;
@@ -278,6 +283,8 @@ class TransactionAnchoredVariables {
     AnchoredSetVariable m_variableFilesNames;
     AnchoredSetVariable m_variableFilesTmpContent;
     AnchoredSetVariable m_variableMultipartFileName;
+    AnchoredSetVariable m_variableMultipartFileNameCharset;
+    AnchoredSetVariable m_variableMultipartFileNameLanguage;
     AnchoredSetVariable m_variableMultipartName;
     AnchoredSetVariable m_variableMatchedVarsNames;
     AnchoredSetVariable m_variableMatchedVars;

modsecurity.conf-recommended

@@ -88,6 +88,7 @@ BQ %{MULTIPART_BOUNDARY_QUOTED}, \
 BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
 DB %{MULTIPART_DATA_BEFORE}, \
 DA %{MULTIPART_DATA_AFTER}, \
+DH %{MULTIPART_DUPLICATE_PART_HEADER}, \
 HF %{MULTIPART_HEADER_FOLDING}, \
 LF %{MULTIPART_LF_LINE}, \
 SM %{MULTIPART_MISSING_SEMICOLON}, \

src/actions/transformations/html_entity_decode.cc

@@ -28,6 +28,113 @@ using namespace modsecurity::utils::string;
 namespace modsecurity::actions::transformations {
 
 
+namespace {
+
+struct NamedEntity {
+    const char *name;
+    std::size_t len;
+    unsigned char ch;
+};
+
+/* Named-entity table for t:htmlEntityDecode.
+ *
+ * Compared case-insensitively against the full extracted token; the length
+ * must match exactly.  Prior implementations used strncasecmp() with the name
+ * length only, which caused prefix collisions (e.g. "&ltest;" decoded to "<"
+ * and dropped "est").  See GHSA-cxqf-vgrr-xxrv.
+ *
+ * The contents below are generated, not hand-curated: a hand-written list
+ * drifts from the specification (it is how &lcub;, &excl; and &Hat; came to
+ * be missing while &caret;, &hyphen; and &tilde; were mapped to ASCII
+ * characters the specification does not assign them).  Regenerate with:
+ *
+ *     curl -sSO https://html.spec.whatwg.org/entities.json
+ *     python3 tools/gen-html-entities.py entities.json
+ *
+ * NAMED_ENTITY derives the name length from the string literal at compile
+ * time so the two cannot drift out of sync.
+ */
+#define NAMED_ENTITY(name_lit, character) \
+    { (name_lit), sizeof(name_lit) - 1, static_cast<unsigned char>(character) }
+
+constexpr NamedEntity named_entities[] = {
+    /* Generated by tools/gen-html-entities.py from
+     * https://html.spec.whatwg.org/entities.json -- do not edit by hand.
+     *
+     * Every entity expanding to a single code point in U+0000..U+007F,
+     * plus NBSP (U+00A0) and SOFT HYPHEN (U+00AD).  44 entries.
+     *
+     * Case-insensitive matching collapses these spec distinctions:
+     *   &GT; = U+003E wins over &Gt; = U+226B
+     *   &LT; = U+003C wins over &Lt; = U+226A
+     *   &colon; = U+003A wins over &Colon; = U+2237
+     *   &verbar; = U+007C wins over &Verbar; = U+2016
+     *   &vert; = U+007C wins over &Vert; = U+2016
+     */
+    NAMED_ENTITY("amp",              '&'),
+    NAMED_ENTITY("apos",             '\''),
+    NAMED_ENTITY("ast",              '*'),
+    NAMED_ENTITY("bsol",             '\\'),
+    NAMED_ENTITY("colon",            ':'),
+    NAMED_ENTITY("comma",            ','),
+    NAMED_ENTITY("commat",           '@'),
+    NAMED_ENTITY("diacriticalgrave", '`'),
+    NAMED_ENTITY("dollar",           '$'),
+    NAMED_ENTITY("equals",           '='),
+    NAMED_ENTITY("excl",             '!'),
+    NAMED_ENTITY("grave",            '`'),
+    NAMED_ENTITY("gt",               '>'),
+    NAMED_ENTITY("hat",              '^'),
+    NAMED_ENTITY("lbrace",           '{'),
+    NAMED_ENTITY("lbrack",           '['),
+    NAMED_ENTITY("lcub",             '{'),
+    NAMED_ENTITY("lowbar",           '_'),
+    NAMED_ENTITY("lpar",             '('),
+    NAMED_ENTITY("lsqb",             '['),
+    NAMED_ENTITY("lt",               '<'),
+    NAMED_ENTITY("midast",           '*'),
+    NAMED_ENTITY("nbsp",             NBSP),
+    NAMED_ENTITY("newline",          '\n'),
+    NAMED_ENTITY("nonbreakingspace", NBSP),
+    NAMED_ENTITY("num",              '#'),
+    NAMED_ENTITY("percnt",           '%'),
+    NAMED_ENTITY("period",           '.'),
+    NAMED_ENTITY("plus",             '+'),
+    NAMED_ENTITY("quest",            '?'),
+    NAMED_ENTITY("quot",             '\"'),
+    NAMED_ENTITY("rbrace",           '}'),
+    NAMED_ENTITY("rbrack",           ']'),
+    NAMED_ENTITY("rcub",             '}'),
+    NAMED_ENTITY("rpar",             ')'),
+    NAMED_ENTITY("rsqb",             ']'),
+    NAMED_ENTITY("semi",             ';'),
+    NAMED_ENTITY("shy",              0xAD),
+    NAMED_ENTITY("sol",              '/'),
+    NAMED_ENTITY("tab",              '\t'),
+    NAMED_ENTITY("underbar",         '_'),
+    NAMED_ENTITY("verbar",           '|'),
+    NAMED_ENTITY("vert",             '|'),
+    NAMED_ENTITY("verticalline",     '|'),
+};
+
+#undef NAMED_ENTITY
+
+bool lookup_named_entity(const unsigned char *name, std::size_t name_len,
+                         unsigned char *out) {
+    for (const auto &e : named_entities) {
+        if (e.len == name_len &&
+            strncasecmp(reinterpret_cast<const char *>(name), e.name,
+                        name_len) == 0) {
+            *out = e.ch;
+            return true;
+        }
+    }
+    return false;
+}
+
+}  // namespace
+
+
 static inline bool inplace(std::string &value) {
     const auto input_len = value.length();
     auto d = reinterpret_cast<unsigned char*>(value.data());
@@ -118,27 +225,14 @@ static inline bool inplace(std::string &value) {
                 while ((j < input_len) && (isalnum(input[j]))) {
                     j++;
                 }
-                if (j > k) { /* Do we have at least one digit? */
-                    const auto *x = reinterpret_cast<const char*>(&input[k]);
-
-                    /* Decode the entity. */
-                    /* ENH What about others? */
-                    if (strncasecmp(x, "quot", 4) == 0) {
-                        *d++ = '"';
-                    } else if (strncasecmp(x, "amp", 3) == 0) {
-                        *d++ = '&';
-                    } else if (strncasecmp(x, "lt", 2) == 0) {
-                        *d++ = '<';
-                    } else if (strncasecmp(x, "gt", 2) == 0) {
-                        *d++ = '>';
-                    } else if (strncasecmp(x, "nbsp", 4) == 0) {
-                        *d++ = NBSP;
-                    } else {
-                        /* We do no want to convert this entity,
-                         * copy the raw data over. */
+                if (j > k) { /* Do we have at least one character? */
+                    unsigned char decoded = 0;
+                    if (!lookup_named_entity(&input[k], j - k, &decoded)) {
+                        /* Unknown entity: copy the raw data over. */
                         copy = j - k + 1;
                         goto HTML_ENT_OUT;
                     }
+                    *d++ = decoded;
 
                     /* Skip over the semicolon if it's there. */
                     if ((j < input_len) && (input[j] == ';')) {

src/actions/transformations/remove_comments.cc

@@ -58,17 +58,11 @@ static inline int inplace(std::string &value) {
                 && (input[i + 1] == '/')) {
                 incomment = false;
                 i += 2;
-                input[j] = input[i];
-                i++;
-                j++;
             } else if ((input[i] == '-') && (i + 1 < input_len)
                 && (input[i + 1] == '-') && (i + 2 < input_len)
                 && (input[i+2] == '>'))   {
                 incomment = false;
                 i += 3;
-                input[j] = input[i];
-                i++;
-                j++;
             } else {
                 i++;
             }

src/operators/rx.cc

@@ -30,29 +30,40 @@
 bool Rx::init(const std::string &arg, std::string *error) {
     if (m_string->m_containsMacro == false) {
         m_re = new Regex(m_param);
+        if (m_re->hasError()) {
+            if (error) {
+                *error = "Invalid regular expression: " + m_param;
+            }
+            return false;
+        }
     }
 
     return true;
 }
 
 
 bool Rx::evaluate(Transaction *transaction, RuleWithActions *rule,
     const std::string& input, RuleMessage &ruleMessage) {
-    Regex *re;
+    const Regex* re = nullptr;
+    std::unique_ptr<Regex> re_ptr;
 
     if (m_param.empty() && !m_string->m_containsMacro) {
         return true;
     }
 
     if (m_string->m_containsMacro) {
         std::string eparam(m_string->evaluate(transaction));
-        re = new Regex(eparam);
+        re_ptr = std::make_unique<Regex>(eparam);
+        re = re_ptr.get();
     } else {
         re = m_re;
     }
 
     if (re->hasError()) {
-        ms_dbg_a(transaction, 3, "Error with regular expression: \"" + re->pattern + "\"");
+        if (transaction) {
+            ms_dbg_a(transaction, 1, "Error with regular expression: \"" + re->pattern + "\"");
+            transaction->m_variableMscPcreError.set("1", transaction->m_variableOffset);
+        }
         return false;
     }
 
@@ -100,10 +111,6 @@
         logOffset(ruleMessage, capture.m_offset, capture.m_length);
     }
 
-    if (m_string->m_containsMacro) {
-        delete re;
-    }
-
     if (!captures.empty()) {
         return true;
     }

src/operators/rx_global.cc

@@ -30,6 +30,12 @@
 bool RxGlobal::init(const std::string &arg, std::string *error) {
     if (m_string->m_containsMacro == false) {
         m_re = new Regex(m_param);
+        if (m_re->hasError()) {
+            if (error) {
+                *error = "Invalid regular expression: " + m_param;
+            }
+            return false;
+        }
     }
 
     return true;
@@ -38,19 +44,29 @@
 
 bool RxGlobal::evaluate(Transaction *transaction, RuleWithActions *rule,
     const std::string& input, RuleMessage &ruleMessage) {
-    Regex *re;
+    const Regex *re;
+    std::unique_ptr<Regex> re_ptr;
 
     if (m_param.empty() && !m_string->m_containsMacro) {
         return true;
     }
 
     if (m_string->m_containsMacro) {
         std::string eparam(m_string->evaluate(transaction));
-        re = new Regex(eparam);
+        re_ptr = std::make_unique<Regex>(eparam);
+        re = re_ptr.get();
     } else {
         re = m_re;
     }
 
+    if (re->hasError()) {
+        if (transaction) {
+            ms_dbg_a(transaction, 1, "Error with regular expression: \"" + re->pattern + "\"");
+            transaction->m_variableMscPcreError.set("1", transaction->m_variableOffset);
+        }
+        return false;
+    }
+
     Utils::RegexResult regex_result;
     std::vector<Utils::SMatchCapture> captures;
     if (transaction && transaction->m_rules->m_pcreMatchLimit.m_set) {
@@ -95,10 +111,6 @@
         logOffset(ruleMessage, capture.m_offset, capture.m_length);
     }
 
-    if (m_string->m_containsMacro) {
-        delete re;
-    }
-
     if (captures.size() > 0) {
         return true;
     }