Make sure we fail to validate DTD/schema after a parsing error. Fixes MODSEC-5.

CHANGES

@@ -1,6 +1,9 @@
 03 Sep 2008 - trunk
 -------------------
 
+ * Fixed XML DTD/Schema validation which will now fail after request body
+   processing errors, even if the XML parser returns a document tree.
+
  * Added ctl:requestBodyBuffering=on|off which, when enabled, will force
    the request body to be buffered and allow REQUEST_BODY to be inspected.
    Previously the REQUEST_BODY target was only populated if the request body

apache2/re_operators.c

@@ -872,6 +872,12 @@ static int msre_op_validateDTD_execute(modsec_rec *msr, msre_rule *rule, msre_va
     xmlValidCtxtPtr cvp;
     xmlDtdPtr dtd;
 
+    if (msr->msc_reqbody_error) {
+        *error_msg = apr_psprintf(msr->mp, "XML: DTD validation could not proceed"
+            " due to previous processing errors.");
+        return 1;
+    }
+
     if ((msr->xml == NULL)||(msr->xml->doc == NULL)) {
         *error_msg = apr_psprintf(msr->mp, "XML document tree could not be found for "
             "DTD validation.");
@@ -928,6 +934,12 @@ static int msre_op_validateSchema_execute(modsec_rec *msr, msre_rule *rule, msre
     xmlSchemaPtr schema;
     int rc;
 
+    if (msr->msc_reqbody_error) {
+        *error_msg = apr_psprintf(msr->mp, "XML: Schema validation could not proceed"
+            " due to previous processing errors.");
+        return 1;
+    }
+
     if ((msr->xml == NULL)||(msr->xml->doc == NULL)) {
         *error_msg = apr_psprintf(msr->mp, "XML document tree could not be found for "
             "Schema validation.");

apache2/t/regression/rule/10-xml.t

@@ -111,9 +111,9 @@
 		        "phase:2,deny,id:12345"
 	),
 	match_log => {
-		debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error/s, 1 ],
-		-debug => [ qr/Failed to load/, 1 ],
-		-error => [ qr/Failed to load/, 1 ],
+		debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error.*validation could not proceed due to previous processing errors/s, 1 ],
+		-debug => [ qr/Failed to load|Successfully validated/, 1 ],
+		-error => [ qr/Failed to load|Successfully validated/, 1 ],
 	},
 	match_response => {
 		status => qr/^403$/,
@@ -291,9 +291,9 @@
 		        "phase:2,deny,id:12345"
 	),
 	match_log => {
-		debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error/s, 1 ],
-		-debug => [ qr/Failed to load/, 1 ],
-		-error => [ qr/Failed to load/, 1 ],
+		debug => [ qr/XML: Initialising parser.*XML: Parsing complete \(well_formed 0\).*XML parser error.*validation could not proceed due to previous processing errors/s, 1 ],
+		-debug => [ qr/Failed to load|Successfully validated/, 1 ],
+		-error => [ qr/Failed to load|Successfully validated/, 1 ],
 	},
 	match_response => {
 		status => qr/^403$/,