From: Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) <oshumeik@cisco.com>
Date: Tue, 21 Mar 2023 11:40:22 +0000 (+0000)
Subject: Pull request #3784: js_norm: Initialize normalizer after script was found
X-Git-Tag: 3.1.58.0~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=839129e7c147b44b9f76c75de9a17b1215545aca;p=thirdparty%2Fsnort3.git

Pull request #3784: js_norm: Initialize normalizer after script was found

Merge in SNORT/snort3 from ~DKYRYLOV/snort3:jsn_perf_fix to master

Squashed commit of the following:

commit a54f7df1a0443a886091118006020608ef3140b6
Author: dkyrylov <dkyrylov@cisco.com>
Date:   Fri Mar 17 18:20:46 2023 +0200

    js_norm: initialize normalization context only when script is detected
---

diff --git a/src/js_norm/js_norm.cc b/src/js_norm/js_norm.cc
index ba6d1aa75..1ca0557c9 100644
--- a/src/js_norm/js_norm.cc
+++ b/src/js_norm/js_norm.cc
@@ -70,12 +70,6 @@ JSNorm::JSNorm(JSNormConfig* jsn_config, bool ext_script_type) :
 
     if (!alive)
         return;
-
-    idn_ctx = new JSIdentifierCtx(config->identifier_depth,
-        config->max_scope_depth, config->ignored_ids, config->ignored_props);
-    jsn_ctx = new JSNormalizer(*idn_ctx, config->bytes_depth,
-        config->max_template_nesting, config->max_bracket_depth);
-
     debug_log(4, js_trace, TRACE_PROC, nullptr, "context created\n");
 }
 
@@ -118,6 +112,12 @@ void JSNorm::normalize(const void* in_data, size_t in_len, const void*& data, si
 
     while (alive and pre_proc())
     {
+        if (idn_ctx == nullptr)
+            idn_ctx = new JSIdentifierCtx(config->identifier_depth,
+                config->max_scope_depth, config->ignored_ids, config->ignored_props);
+        if (jsn_ctx == nullptr)
+            jsn_ctx = new JSNormalizer(*idn_ctx, config->bytes_depth,
+                config->max_template_nesting, config->max_bracket_depth);
         trace_logf(3, js_trace, TRACE_DUMP, packet,
             "original[%zu]: %.*s\n", src_end - src_ptr, (int)(src_end - src_ptr), src_ptr);
 
@@ -133,9 +133,11 @@ void JSNorm::normalize(const void* in_data, size_t in_len, const void*& data, si
         alive = post_proc(ret);
     }
 
-    len = jsn_ctx->script_size();
-    data = jsn_ctx->get_script();
-
+    if (jsn_ctx != nullptr)
+    {
+        len = jsn_ctx->script_size();
+        data = jsn_ctx->get_script();
+    }
     if (data and len)
         trace_logf(1, js_trace, TRACE_DUMP, packet,
             "js_data[%u]: %.*s\n", (unsigned)len, (int)len, (const char*)data);
@@ -143,19 +145,28 @@ void JSNorm::normalize(const void* in_data, size_t in_len, const void*& data, si
 
 void JSNorm::flush_data(const void*& data, size_t& len)
 {
-    len = jsn_ctx->script_size();
-    data = jsn_ctx->take_script();
+    if (jsn_ctx != nullptr)
+    {
+        len = jsn_ctx->script_size();
+        data = jsn_ctx->take_script();
+    }
 }
 
 void JSNorm::flush_data()
 {
-    delete[] jsn_ctx->take_script();
+    if (jsn_ctx != nullptr)
+    {
+        delete[] jsn_ctx->take_script();
+    }
 }
 
 void JSNorm::get_data(const void*& data, size_t& len)
 {
-    len = jsn_ctx->script_size();
-    data = jsn_ctx->get_script();
+    if (jsn_ctx != nullptr)
+    {
+        len = jsn_ctx->script_size();
+        data = jsn_ctx->get_script();
+    }
 }
 
 bool JSNorm::pre_proc()
diff --git a/src/service_inspectors/http_inspect/http_js_norm.cc b/src/service_inspectors/http_inspect/http_js_norm.cc
index 666bae67a..b07aef00c 100644
--- a/src/service_inspectors/http_inspect/http_js_norm.cc
+++ b/src/service_inspectors/http_inspect/http_js_norm.cc
@@ -370,7 +370,7 @@ bool HttpInlineJSNorm::pre_proc()
     }
 
     ext_script_type = false;
-    output_size = jsn_ctx->script_size();
+    output_size = (jsn_ctx != nullptr) ? jsn_ctx->script_size() : 0;
 
     return true;
 }