Skip to content

Commit fafed56

Browse files
Xhoenixfzipi
andauthored
feat: added MongoDB operators (#4162)
* feat: added MongoDB operators * remove duplicate * regex update * added MongoDB operators * add operators and refactor * update regex assembly syntax * crs-toolchain regex update * added comments * chore: crs-toolchain regex format * Update regex-assembly/942290.ra Co-authored-by: Felipe Zipitría <3012076+fzipi@users.noreply.github.com> --------- Co-authored-by: Felipe Zipitría <3012076+fzipi@users.noreply.github.com>
1 parent 7f819d2 commit fafed56

File tree

2 files changed

+202
-18
lines changed

2 files changed

+202
-18
lines changed

regex-assembly/942290.ra

Lines changed: 201 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
##! Please refer to the documentation at
22
##! https://coreruleset.org/docs/development/regex_assembly/.
33

4+
##! The following curl commands can be used to get the operators:
5+
##! curl -s https://www.mongodb.com/docs/manual/reference/operator/update.md | grep -oP '\[\`\$.*\`\]' | cut -d\` -f2 | sort -u
6+
##! curl -s https://www.mongodb.com/docs/manual/reference/operator/aggregation.md | grep -oP '\[\`\$.*\`\]' | cut -d\` -f2 | sort -u
7+
##! curl -s https://www.mongodb.com/docs/manual/reference/operator/query.md | grep -oP '\[\`\$.*\`\]' | cut -d\` -f2 | sort -u
8+
##!
49
##!+ i
510

611
##!> define operator_syntax_start \[?\$
@@ -9,32 +14,211 @@
914
##!> assemble
1015
{{operator_syntax_start}}
1116
##!=>
12-
ne
17+
abs
18+
accumulator
19+
acos
20+
acosh
21+
add
22+
addToSet
23+
all
24+
allElementsTrue
25+
and
26+
anyElementTrue
27+
arrayElemAt
28+
arrayToObject
29+
asin
30+
asinh
31+
atan
32+
atan2
33+
atanh
34+
avg
35+
between
36+
binarySize
37+
bit
38+
bitAnd
39+
bitNot
40+
bitOr
41+
bitXor
42+
bottom
43+
bottomN
44+
bsonSize
45+
bucket
46+
bucketAuto
47+
ceil
48+
cmp
49+
concat
50+
concatArrays
51+
cond
52+
convert
53+
cos
54+
cosh
55+
count
56+
covariancePop
57+
covarianceSamp
58+
currentDate
59+
dateAdd
60+
dateDiff
61+
dateFromParts
62+
dateFromString
63+
dateSubtract
64+
dateToParts
65+
dateToString
66+
dateTrunc
67+
dayOfMonth
68+
dayOfWeek
69+
dayOfYear
70+
degreesToRadians
71+
denseRank
72+
derivative
73+
div
74+
divide
75+
documentNumber
76+
each
77+
elemMatch
1378
eq
79+
exists
80+
exp
81+
expMovingAvg
82+
expr
83+
filter
84+
first
85+
firstN
86+
floor
87+
function
88+
getField
89+
group
90+
gt
91+
gte
92+
hour
93+
ifNull
94+
in
95+
inc
96+
indexOfArray
97+
indexOfBytes
98+
indexOfCP
99+
integral
100+
isArray
101+
isNumber
102+
isoDayOfWeek
103+
isoWeek
104+
isoWeekYear
105+
jsonSchema
106+
last
107+
lastN
108+
let
109+
like
110+
linearFill
111+
literal
112+
ln
113+
locf
114+
log
115+
log10
14116
lt
15117
lte
16-
ni
17-
nin
118+
ltrim
119+
map
120+
max
121+
maxN
122+
median
123+
mergeObjects
124+
meta
125+
millisecond
126+
min
127+
minN
128+
minute
18129
mod
19-
all
20-
size
21-
exists
22-
type
23-
slice
24-
or
25-
xor
26-
nor
27-
div
28-
like
29-
between
30-
and
130+
month
131+
mul
132+
multiply
133+
natural
134+
ne
135+
nin
31136
nor
32137
not
138+
objectToArray
139+
or
140+
percentile
141+
pop
142+
position
143+
pow
144+
project
145+
pull
146+
pullAll
147+
push
148+
radiansToDegrees
149+
rand
150+
range
151+
rank
152+
reduce
33153
regex
154+
regexFind
155+
regexFindAll
156+
regexMatch
157+
rename
158+
replaceAll
159+
replaceOne
160+
reverseArray
161+
round
162+
rtrim
163+
sampleRate
164+
second
165+
set
166+
setDifference
167+
setEquals
168+
setField
169+
setIntersection
170+
setIsSubset
171+
setOnInsert
172+
setUnion
173+
setWindowFields
174+
shift
175+
sin
176+
sinh
177+
size
178+
slice
179+
sort
180+
sortArray
181+
split
182+
sqrt
183+
stdDevPop
184+
stdDevSamp
185+
strLenBytes
186+
strLenCP
187+
strcasecmp
188+
substr
189+
substrBytes
190+
substrCP
191+
subtract
192+
sum
193+
switch
194+
tan
195+
tanh
34196
text
197+
toBool
198+
toDate
199+
toDecimal
200+
toDouble
201+
toHashedIndexKey
202+
toInt
203+
toLong
204+
toLower
205+
toObjectId
206+
toString
207+
toUUID
208+
toUpper
209+
top
210+
topN
211+
trim
212+
trunc
213+
tsIncrement
214+
tsSecond
215+
type
216+
unset
217+
week
35218
where
36-
jsonSchema
37-
elemMatch
219+
xor
220+
year
221+
zip
38222
##!=>
39223
{{operator_syntax_end}}
40224
##!=>

rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -385,7 +385,7 @@ SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST
385385
# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
386386
# crs-toolchain regex update 942290
387387
#
388-
SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\[?\$(?:n(?:e|in?|o[rt])|e(?:q|xists|lemMatch)|l(?:te?|ike)|mod|a(?:ll|nd)|(?:s(?:iz|lic)|wher)e|t(?:ype|ext)|x?or|div|between|regex|jsonSchema)\]?" \
388+
SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\[?\$(?:a(?:bs|c(?:cumulator|osh?)|dd(?:ToSet)?|ll(?:ElementsTrue)?|n(?:d|yElementTrue)|rray(?:ElemA|ToObjec)t|sinh?|tan[2h]?|vg)|b(?:etween|i(?:narySize|t(?:And|Not|(?:O|Xo)r)?)|ottomN?|sonSize|ucket(?:Auto)?)|c(?:eil|mp|o(?:n(?:cat(?:Arrays)?|d|vert)|sh?|unt|variance(?:Po|Sam)p)|urrentDate)|d(?:a(?:te(?:Add|Diff|From(?:Parts|String)|Subtract|T(?:o(?:Parts|String)|runc))|yOf(?:Month|Week|Year))|e(?:greesToRadians|nseRank|rivative)|iv(?:ide)?|ocumentNumber)|e(?:(?:a|lemMat)ch|q|x(?:ists|p(?:MovingAvg|r)?))|f(?:i(?:lter|rstN?)|loor|unction)|g(?:etField|roup|te?)|(?:hou|xo|yea)r|i(?:fNull|n(?:c|dexOf(?:Array|Bytes|CP)|tegral)?|s(?:Array|Number|o(?:DayOfWeek|Week(?:Year)?)))|jsonSchema|l(?:astN?|et|i(?:ke|(?:nearFil|tera)l)|n|o(?:cf|g(?:10)?)|t(?:e|rim)?)|m(?:a(?:p|xN?)|e(?:dian|rgeObjects|ta)|i(?:llisecond|n(?:N|ute)?)|o(?:d|nth)|ul(?:tiply)?)|n(?:atural|e|in|o[rt])|o(?:bjectToArray|r)|p(?:ercentile|o(?:[pw]|sition)|roject|u(?:ll(?:All)?|sh))|r(?:a(?:diansToDegrees|n(?:[dk]|ge))|e(?:(?:duc|nam)e|gex(?:Find(?:All)?|Match)?|place(?:All|One)|verseArray)|ound|trim)|s(?:(?:ampleRat|lic)e|e(?:cond|t(?:Difference|(?:Equal|WindowField)s|Field|I(?:ntersection|sSubset)|OnInsert|Union)?)|(?:hif|pli|qr)t|i(?:nh?|ze)|ort(?:Array)?|t(?:dDev(?:Po|Sam)p|r(?:Len(?:Bytes|CP)|casecmp))|u(?:b(?:str(?:Bytes|CP)?|tract)|m)|witch)|t(?:anh?|ext|o(?:Bool|D(?:(?:at|oubl)e|ecimal)|HashedIndexKey|Int|Lo(?:ng|wer)|ObjectId|String|U(?:UID|pper)|pN?)|r(?:im|unc)|s(?:Increment|Second)|ype)|unset|w(?:eek|here)|zip)\]?" \
389389
"id:942290,\
390390
phase:2,\
391391
block,\

0 commit comments

Comments
 (0)