refactor: validate byte range operator

g4/SecLangLexer.g4

@@ -630,7 +630,7 @@ OPERATOR_UNCONDITIONAL_MATCH
 	;
 
 OPERATOR_VALIDATE_BYTE_RANGE
-	: 'validateByteRange'
+	: 'validateByteRange' -> pushMode(REMOVE_SPACE_MODE)
 	;
 
 OPERATOR_VALIDATE_DTD
@@ -1393,4 +1393,32 @@ HASH_COMMENT_BLOCK
 
 BLOCK_COMMENT_END
    : '\r'? '\n' '\r'? '\n' -> popMode
+   ;
+
+mode REMOVE_SPACE_MODE;
+
+WS_REMOVE_SPACE
+   : ' '  -> skip, pushMode(INT_RANGE_MODE)
+   ;
+
+mode INT_RANGE_MODE;
+
+INT_RANGE_VALUE 
+   : DIGIT+
+   ;
+
+MINUS_INT_RANGE
+   : '-'
+   ;
+
+WS_INT_RANGE
+   : ' '+
+   ;
+
+QUOTE_INT_RANGE
+   : '"' -> type(QUOTE), pushMode(DEFAULT_MODE)
+   ;
+
+COMMA_INT_RANGE
+   : ',' -> type(COMMA)
    ;

g4/SecLangParser.g4

@@ -138,6 +138,10 @@ remove_rule_by_id_values:
     | int_range # remove_rule_by_id_int_range
     ;
 
+operator_int_range:
+    INT_RANGE_VALUE MINUS_INT_RANGE INT_RANGE_VALUE
+    ;
+
 int_range:
     range_start MINUS range_end
     ;
@@ -305,7 +309,7 @@ operator_name:
 operator_value:
     variable_enum
     | STRING
-    | (INT | int_range) (COMMA (INT | int_range))*
+    | WS_INT_RANGE* (INT_RANGE_VALUE | operator_int_range) (COMMA WS_INT_RANGE* (INT_RANGE_VALUE | operator_int_range))*
     | OPERATOR_UNQUOTED_STRING
     | OPERATOR_QUOTED_STRING
     ;

listener.go

@@ -86,6 +86,20 @@ func (l *TreeShapeListener) EnterRange_end(ctx *parser.Range_endContext) {
 	l.results.RangeEndEvents = append(l.results.RangeEndEvents, i)
 }
 
+func (l *TreeShapeListener) EnterOperator_int_range(ctx *parser.Operator_int_rangeContext) {
+	l.results.RangeEvents = append(l.results.RangeEvents, ctx.GetText())
+	i, err := strconv.Atoi(ctx.INT_RANGE_VALUE(0).GetText())
+	if err != nil {
+		panic(err)
+	}
+	l.results.RangeStartEvents = append(l.results.RangeStartEvents, i)
+	i, err = strconv.Atoi(ctx.INT_RANGE_VALUE(1).GetText())
+	if err != nil {
+		panic(err)
+	}
+	l.results.RangeEndEvents = append(l.results.RangeEndEvents, i)
+}
+
 func (l *TreeShapeListener) EnterRemove_rule_by_id(ctx *parser.Remove_rule_by_idContext) {
 	l.results.DirectiveList = append(l.results.DirectiveList, ctx.GetText())
 }

src/seclang_parser/SecLangParserListener.py

@@ -134,6 +134,15 @@ def exitRemove_rule_by_id_int_range(self, ctx:SecLangParser.Remove_rule_by_id_in
         pass
 
 
+    # Enter a parse tree produced by SecLangParser#operator_int_range.
+    def enterOperator_int_range(self, ctx:SecLangParser.Operator_int_rangeContext):
+        pass
+
+    # Exit a parse tree produced by SecLangParser#operator_int_range.
+    def exitOperator_int_range(self, ctx:SecLangParser.Operator_int_rangeContext):
+        pass
+
+
     # Enter a parse tree produced by SecLangParser#int_range.
     def enterInt_range(self, ctx:SecLangParser.Int_rangeContext):
         pass

src/seclang_parser/listener.py

@@ -49,6 +49,11 @@ def enterRange_start(self, ctx: SecLangParser.Range_startContext):
     def enterRange_end(self, ctx: SecLangParser.Range_endContext):
         self.results.range_end_events.append(int(ctx.getText()))
 
+    def enterOperator_int_range(self, ctx: SecLangParser.Operator_int_rangeContext):
+        self.results.range_events.append(ctx.getText())
+        self.results.range_start_events.append(int(ctx.INT_RANGE_VALUE(0).getText()))
+        self.results.range_end_events.append(int(ctx.INT_RANGE_VALUE(1).getText()))
+
     def enterRemove_rule_by_id(self, ctx: SecLangParser.Remove_rule_by_idContext):
         self.results.directive_list.append(ctx.getText())
 

testdata/test_40_var_operators.conf

@@ -1,4 +1,4 @@
-SecRule REQUEST_HEADERS|!REQUEST_HEADERS:User-Agent "@validateByteRange 32,34,38,42-59,61,65-90,95,97-122" \
+SecRule REQUEST_HEADERS|!REQUEST_HEADERS:User-Agent "@validateByteRange 32, 34,38,42-59,61,65-90,95,97-122" \
     "id:920274,\
     phase:1,\
     block"

testdata/tests.yaml

@@ -302,7 +302,7 @@ check_output_tests:
         - validateByteRange
         - eq
       operator_value_list:
-        - "32,34,38,42-59,61,65-90,95,97-122"
+        - "32, 34,38,42-59,61,65-90,95,97-122"
         - "0"
       directive_list:
         - SecRule