From: Mike Stepanek (mstepane) <mstepane@cisco.com>
Date: Mon, 16 May 2022 12:11:19 +0000 (+0000)
Subject: Pull request #3421: JS Normalizer: regex literal detection
X-Git-Tag: 3.1.30.0~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=60c2d0ee7a1caa6ec8c906ecea0ed235859545c1;p=thirdparty%2Fsnort3.git

Pull request #3421: JS Normalizer: regex literal detection

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:js_sc_regex_op to master

Squashed commit of the following:

commit 6282b69c758f5aee95bf88c412fd0d8ed15d4240
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Fri May 13 14:29:19 2022 +0300

    utils: allow regex literals after operator
---

diff --git a/src/utils/js_tokenizer.l b/src/utils/js_tokenizer.l
index f130c523a..cf6f02de0 100644
--- a/src/utils/js_tokenizer.l
+++ b/src/utils/js_tokenizer.l
@@ -2762,7 +2762,7 @@ JSTokenizer::JSRet JSTokenizer::operator_prefix()
     EXEC(do_semicolon_insertion(ASI_GROUP_6))
     EXEC(do_operator_spacing())
     ECHO;
-    BEGIN(divop);
+    BEGIN(regst);
     set_ident_norm(true);
     return EOS;
 }
@@ -2786,7 +2786,7 @@ JSTokenizer::JSRet JSTokenizer::general_operator()
     dealias_prefix_reset();
     EXEC(do_operator_spacing())
     ECHO;
-    BEGIN(divop);
+    BEGIN(regst);
     set_ident_norm(true);
     return EOS;
 }
diff --git a/src/utils/test/js_normalizer_test.cc b/src/utils/test/js_normalizer_test.cc
index fba494958..8c5d7b9f2 100644
--- a/src/utils/test/js_normalizer_test.cc
+++ b/src/utils/test/js_normalizer_test.cc
@@ -1111,6 +1111,14 @@ static const char syntax_cases_expected24[] =
     "var a=/[[[[/]]]]/;"
     "var b=/[[[[";
 
+static const char syntax_cases_buf25[] =
+    "return /regex0/.foo + /regex1/.bar ;"
+    "return /regex2/.baz * /regex3/.qux ;";
+
+static const char syntax_cases_expected25[] =
+    "return /regex0/.var_0000+/regex1/.var_0001;"
+    "return /regex2/.var_0002*/regex3/.var_0003;";
+
 TEST_CASE("syntax cases", "[JSNormalizer]")
 {
     SECTION("variables")
@@ -1193,6 +1201,10 @@ TEST_CASE("syntax cases", "[JSNormalizer]")
         NORMALIZE(syntax_cases_buf22);
         VALIDATE(syntax_cases_buf22, syntax_cases_expected22);
     }
+    SECTION("regex after operator")
+    {
+        NORMALIZE_S(syntax_cases_buf25, syntax_cases_expected25);
+    }
 }
 
 TEST_CASE("bad tokens", "[JSNormalizer]")