Avoid extra processing of subsequent interventions if one was already triggered

Author: defanator

src/ngx_http_modsecurity_body_filter.c

@@ -56,6 +56,10 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
  return ngx_http_next_body_filter(r, in);
  }
 
+ if (ctx->intervention_triggered) {
+ return ngx_http_next_body_filter(r, in);
+ }
+
 #if defined(MODSECURITY_SANITY_CHECKS) && (MODSECURITY_SANITY_CHECKS)
  mcf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity_module);
  if (mcf != NULL && mcf->sanity_checks_enabled != NGX_CONF_UNSET)

src/ngx_http_modsecurity_common.h

@@ -97,6 +97,7 @@ typedef struct {
  unsigned waiting_more_body:1;
  unsigned body_requested:1;
  unsigned processed:1;
+ unsigned intervention_triggered:1;
 } ngx_http_modsecurity_ctx_t;
 
 

src/ngx_http_modsecurity_header_filter.c

@@ -430,6 +430,10 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r)
  return ngx_http_next_header_filter(r);
  }
 
+ if (ctx->intervention_triggered) {
+ return ngx_http_next_header_filter(r);
+ }
+
 /* XXX: can it happen ? already processed i mean */
 /* XXX: check behaviour on 'ModSecurity off' */
 

src/ngx_http_modsecurity_pre_access.c

@@ -78,6 +78,10 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
  return NGX_HTTP_INTERNAL_SERVER_ERROR;
  }
 
+ if (ctx->intervention_triggered) {
+ return NGX_DECLINED;
+ }
+
  if (ctx->waiting_more_body == 1)
  {
  dd("waiting for more data before proceed. / count: %d",

src/ngx_http_modsecurity_rewrite.c

@@ -117,6 +117,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
  dd("Processing intervention with the connection information filled in");
  ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
  if (ret > 0) {
+ ctx->intervention_triggered = 1;
  return ret;
  }
 
@@ -157,6 +158,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
  dd("Processing intervention with the transaction information filled in (uri, method and version)");
  ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
  if (ret > 0) {
+ ctx->intervention_triggered = 1;
  return ret;
  }
 
@@ -208,6 +210,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
  return NGX_DECLINED;
  }
  if (ret > 0) {
+ ctx->intervention_triggered = 1;
  return ret;
  }
  }