Pull request #3784: js_norm: Initialize normalizer after script was found

Merge in SNORT/snort3 from ~DKYRYLOV/snort3:jsn_perf_fix to master

Squashed commit of the following:

commit a54f7df1a0443a886091118006020608ef3140b6
Author: dkyrylov <dkyrylov@cisco.com>
Date:   Fri Mar 17 18:20:46 2023 +0200

    js_norm: initialize normalization context only when script is detected

diff --git a/src/js_norm/js_norm.cc b/src/js_norm/js_norm.cc
index ba6d1aa754957261921e7db99dc1000d58ca36ae..1ca0557c9e71be2547d4d0919310c399ddafe472 100644 (file)
--- a/src/js_norm/js_norm.cc
+++ b/src/js_norm/js_norm.cc
@@ -70,12 +70,6 @@ JSNorm::JSNorm(JSNormConfig* jsn_config, bool ext_script_type) :
 
     if (!alive)
         return;
-
-    idn_ctx = new JSIdentifierCtx(config->identifier_depth,
-        config->max_scope_depth, config->ignored_ids, config->ignored_props);
-    jsn_ctx = new JSNormalizer(*idn_ctx, config->bytes_depth,
-        config->max_template_nesting, config->max_bracket_depth);
-
     debug_log(4, js_trace, TRACE_PROC, nullptr, "context created\n");
 }
 
@@ -118,6 +112,12 @@ void JSNorm::normalize(const void* in_data, size_t in_len, const void*& data, si
 
     while (alive and pre_proc())
     {
+        if (idn_ctx == nullptr)
+            idn_ctx = new JSIdentifierCtx(config->identifier_depth,
+                config->max_scope_depth, config->ignored_ids, config->ignored_props);
+        if (jsn_ctx == nullptr)
+            jsn_ctx = new JSNormalizer(*idn_ctx, config->bytes_depth,
+                config->max_template_nesting, config->max_bracket_depth);
         trace_logf(3, js_trace, TRACE_DUMP, packet,
             "original[%zu]: %.*s\n", src_end - src_ptr, (int)(src_end - src_ptr), src_ptr);
 
@@ -133,9 +133,11 @@ void JSNorm::normalize(const void* in_data, size_t in_len, const void*& data, si
         alive = post_proc(ret);
     }
 
-    len = jsn_ctx->script_size();
-    data = jsn_ctx->get_script();
-
+    if (jsn_ctx != nullptr)
+    {
+        len = jsn_ctx->script_size();
+        data = jsn_ctx->get_script();
+    }
     if (data and len)
         trace_logf(1, js_trace, TRACE_DUMP, packet,
             "js_data[%u]: %.*s\n", (unsigned)len, (int)len, (const char*)data);
@@ -143,19 +145,28 @@ void JSNorm::normalize(const void* in_data, size_t in_len, const void*& data, si
 
 void JSNorm::flush_data(const void*& data, size_t& len)
 {
-    len = jsn_ctx->script_size();
-    data = jsn_ctx->take_script();
+    if (jsn_ctx != nullptr)
+    {
+        len = jsn_ctx->script_size();
+        data = jsn_ctx->take_script();
+    }
 }
 
 void JSNorm::flush_data()
 {
-    delete[] jsn_ctx->take_script();
+    if (jsn_ctx != nullptr)
+    {
+        delete[] jsn_ctx->take_script();
+    }
 }
 
 void JSNorm::get_data(const void*& data, size_t& len)
 {
-    len = jsn_ctx->script_size();
-    data = jsn_ctx->get_script();
+    if (jsn_ctx != nullptr)
+    {
+        len = jsn_ctx->script_size();
+        data = jsn_ctx->get_script();
+    }
 }
 
 bool JSNorm::pre_proc()

diff --git a/src/service_inspectors/http_inspect/http_js_norm.cc b/src/service_inspectors/http_inspect/http_js_norm.cc
index 666bae67a9ea3180b223acf81f7c70bcaaab0a2f..b07aef00c56467fbc8191e1639992362c24d1ced 100644 (file)
--- a/src/service_inspectors/http_inspect/http_js_norm.cc
+++ b/src/service_inspectors/http_inspect/http_js_norm.cc
@@ -370,7 +370,7 @@ bool HttpInlineJSNorm::pre_proc()
     }
 
     ext_script_type = false;
-    output_size = jsn_ctx->script_size();
+    output_size = (jsn_ctx != nullptr) ? jsn_ctx->script_size() : 0;
 
     return true;
 }