fix: allow SecRuleScript without actions and stop parser state bleed into next rule

src/parser/driver.cc

@@ -26,6 +26,36 @@
 namespace modsecurity {
 namespace Parser {
 
+namespace {
+
+/*
+ * Attaches the rule to the chain opened by *lastRule, if any.
+ *
+ * Returns 1 when the rule was appended, 0 when there is no open chain and
+ * -1 when the rule is not a valid chain link (the error is written to
+ * parserError).
+ */
+template <typename RuleType>
+int appendRuleToChain(RuleWithActions **lastRule,
+    std::unique_ptr<RuleType> *rule,
+    std::ostringstream *parserError) {
+    if (*lastRule == nullptr || !(*lastRule)->isChained()) {
+        return 0;
+    }
+    rule->get()->setPhase((*lastRule)->getPhase());
+    if (rule->get()->hasDisruptiveAction()) {
+        *parserError << "Disruptive actions can only be specified by";
+        *parserError << " chain starter rules.";
+        return -1;
+    }
+    (*lastRule)->m_chainedRuleChild = std::move(*rule);
+    (*lastRule)->m_chainedRuleChild->m_chainedRuleParent = *lastRule;
+    *lastRule = (*lastRule)->m_chainedRuleChild.get();
+    return 1;
+}
+
+}  // namespace
+
 Driver::Driver()
   : RulesSetProperties(),
   trace_scanning(false),
@@ -68,6 +98,11 @@
 
 
 int Driver::addSecRuleScript(std::unique_ptr<RuleScript> rule) {
+    const int chained = appendRuleToChain(&m_lastRule, &rule, &m_parserError);
+    if (chained != 0) {
+        return chained > 0;
+    }
+
     m_rulesSetPhases.insert(std::move(rule));
     return true;
 }
@@ -80,18 +115,9 @@
         return false;
     }
 
-    /* is it a chained rule? */
-    if (m_lastRule != nullptr && m_lastRule->isChained()) {
-        r->setPhase(m_lastRule->getPhase());
-        if (r->hasDisruptiveAction()) {
-            m_parserError << "Disruptive actions can only be specified by";
-            m_parserError << " chain starter rules.";
-            return false;
-        }
-        m_lastRule->m_chainedRuleChild = std::move(r);
-        m_lastRule->m_chainedRuleChild->m_chainedRuleParent = m_lastRule;
-        m_lastRule = m_lastRule->m_chainedRuleChild.get();
-        return true;
+    const int chained = appendRuleToChain(&m_lastRule, &r, &m_parserError);
+    if (chained != 0) {
+        return chained > 0;
     }
 
     std::shared_ptr<RuleWithActions> rule(std::move(r));

src/parser/driver.h

@@ -91,6 +91,7 @@ class Driver : public RulesSetProperties {
     // Ordinarily other solutions would have been preferable, but location.hh is a
     // bison-generated file, which makes some alternative solutions impractical.
     std::list<std::string> m_filenames;
+
 };