lib/contrast/agent/protect/rule/no_sqli.rb in contrast-agent-4.6.0 vs lib/contrast/agent/protect/rule/no_sqli.rb in contrast-agent-4.7.0
- old
+ new
@@ -10,11 +10,11 @@
# The Ruby implementation of the Protect NoSQL Injection rule.
class NoSqli < Contrast::Agent::Protect::Rule::BaseService
NAME = 'nosql-injection'
BLOCK_MESSAGE = 'NoSQLi rule triggered. Response blocked.'
- def name
+ def rule_name
NAME
end
def block_message
BLOCK_MESSAGE
@@ -30,10 +30,14 @@
raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
end
def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
- return result if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION || mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
+ if mode == Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION ||
+ mode == Contrast::Api::Settings::ProtectionRule::Mode::PERMIT
+
+ return result
+ end
attack_string = input_analysis_result.value
regexp = Regexp.new(Regexp.escape(attack_string), Regexp::IGNORECASE)
return unless query_string.match?(regexp)