Avoid extra processing of subsequent interventions if one was already triggered

Author: defanator

src/ngx_http_modsecurity_body_filter.c

@@ -56,6 +56,10 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
 returnngx_http_next_body_filter(r, in);
  }
 
+if (ctx->intervention_triggered){
+returnngx_http_next_body_filter(r, in);
+ }
+
 #if defined(MODSECURITY_SANITY_CHECKS) && (MODSECURITY_SANITY_CHECKS)
 mcf=ngx_http_get_module_loc_conf(r, ngx_http_modsecurity_module);
 if (mcf!=NULL&&mcf->sanity_checks_enabled!=NGX_CONF_UNSET)

src/ngx_http_modsecurity_common.h

@@ -97,6 +97,7 @@ typedef struct{
 unsignedwaiting_more_body:1;
 unsignedbody_requested:1;
 unsignedprocessed:1;
+unsignedintervention_triggered:1;
 } ngx_http_modsecurity_ctx_t;
 
 

src/ngx_http_modsecurity_header_filter.c

@@ -430,6 +430,10 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r)
 returnngx_http_next_header_filter(r);
  }
 
+if (ctx->intervention_triggered){
+returnngx_http_next_header_filter(r);
+ }
+
 /* XXX: can it happen ? already processed i mean */
 /* XXX: check behaviour on 'ModSecurity off' */
 

src/ngx_http_modsecurity_pre_access.c

@@ -78,6 +78,10 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
 returnNGX_HTTP_INTERNAL_SERVER_ERROR;
  }
 
+if (ctx->intervention_triggered){
+returnNGX_DECLINED;
+ }
+
 if (ctx->waiting_more_body==1)
 {
 dd("waiting for more data before proceed. / count: %d",

src/ngx_http_modsecurity_rewrite.c

@@ -117,6 +117,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
 dd("Processing intervention with the connection information filled in");
 ret=ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
 if (ret>0){
+ctx->intervention_triggered=1;
 returnret;
  }
 
@@ -157,6 +158,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
 dd("Processing intervention with the transaction information filled in (uri, method and version)");
 ret=ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
 if (ret>0){
+ctx->intervention_triggered=1;
 returnret;
  }
 
@@ -208,6 +210,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
 returnNGX_DECLINED;
  }
 if (ret>0){
+ctx->intervention_triggered=1;
 returnret;
  }
  }