Skip to content

Commit acf4897

Browse files
author
David Cooper
authored
Fix pattern matches
This commit fixes three lines of code that use Bash substring matching. In each case, a list of strings to match was enclosed in brackets. This resulted in a match if the string to test contained any character from any of the strings to match. This commit fixes the issue by removing the brackets. (The bugs were introduced in b8e9b09 and 8149c2d)
1 parent 4b42608 commit acf4897

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

testssl.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3370,7 +3370,7 @@ run_cookie_flags() { # ARG1: Path
33703370
fi
33713371

33723372
if [[ ! "$HTTP_STATUS_CODE" =~ 20 ]]; then
3373-
if [[ "$HTTP_STATUS_CODE" =~ [301|302] ]]; then
3373+
if [[ "$HTTP_STATUS_CODE" =~ 301|302 ]]; then
33743374
msg302=" -- maybe better try target URL of 30x"
33753375
msg302_=" (30x detected, better try target URL of 30x)"
33763376
else
@@ -11312,7 +11312,7 @@ run_npn() {
1131211312
fileout "$jsonID" "INFO" "not offered"
1131311313
else
1131411314
# now comes a strange thing: "Protocols advertised by server:" is empty but connection succeeded
11315-
if [[ "$tmpstr" =~ [h2|spdy|http] ]]; then
11315+
if [[ "$tmpstr" =~ h2|spdy|http ]]; then
1131611316
out "$tmpstr"
1131711317
outln " (advertised)"
1131811318
fileout "$jsonID" "INFO" "offered with $tmpstr (advertised)"
@@ -16854,7 +16854,7 @@ run_ccs_injection(){
1685416854
fileout "$jsonID" "OK" "not vulnerable" "$cve" "$cwe"
1685516855
fi
1685616856
elif [[ "${tls_hello_ascii:0:4}" == "1503" ]]; then
16857-
if [[ ! "${tls_hello_ascii:5:2}" =~ [03|02|01|00] ]]; then
16857+
if [[ ! "${tls_hello_ascii:5:2}" =~ 03|02|01|00 ]]; then
1685816858
pr_warning "test failed "
1685916859
out "no proper TLS reply (debug info: protocol sent: 1503${tls_hexcode#x03, x}, reply: ${tls_hello_ascii:0:14}"
1686016860
fileout "$jsonID" "DEBUG" "test failed, around line $LINENO, debug info (${tls_hello_ascii:0:14})" "$cve" "$cwe" "$hint"

0 commit comments

Comments
 (0)