fix: rx operators better null checks

[wooffie]

what

Add nullptr check in one more place

why

I think it can cause null derefence, because before we check for null:

ModSecurity/src/operators/rx.cc

Line 62 in 1ff9f2a

if (transaction && transaction->m_rules->m_pcreMatchLimit.m_set) {

But after forget about this check and do dereference:

ModSecurity/src/operators/rx.cc

Line 71 in 1ff9f2a

transaction->m_variableMscPcreError.set("1", transaction->m_variableOffset);

I cannot create PoC, maybe I'm wrong and using regex without limit will never cause != Utils::RegexResult::Ok, but looks legit

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
100.0% Duplication on New Code

See analysis details on SonarQube Cloud

[airween]

Hi @wooffie,

thanks for this PR!

because before we check for null:
...
But after forget about this check and do dereference:

I think the first one is not necessary, because evaluate() is called from a Transaction object originally. But indeed, checking it won't hurt anyone.

maybe I'm wrong and using regex without limit will never cause

yes, you're right - checking nullptr value is always a good step.

Thank you!