Update SQLi/XSS operators for libinjection v4.0.0 by Easton97-Jens · Pull Request #3522 · owasp-modsecurity/ModSecurity

Easton97-Jens · 2026-03-27T14:51:14Z

what

Updated the SQLi and XSS detection operators to support the newer libinjection return codes (injection_result_t).
Added explicit handling for TRUE, FALSE, and ERROR results from libinjection_sqli and libinjection_xss.
Treated LIBINJECTION_RESULT_ERROR as a fail-safe match to avoid missing potentially malicious input.
Preserved diagnostic context by storing raw input in TX.0 when capture is enabled, even on parser errors.
Maintained previous behavior for positive detections (fingerprints for SQLi, input storage for XSS).
Added regression tests for benign inputs to ensure no false positives are introduced.

why

Newer versions of libinjection introduced injection_result_t, requiring explicit handling in ModSecurity operators.
Without this update, parser errors could be handled inconsistently and weaken fail-safe detection behavior.
Treating parser errors as matches ensures conservative and security-focused handling when input cannot be reliably parsed.
Preserving captured input during error cases improves debugging and visibility for rule authors.
Regression tests ensure the updated logic does not introduce false positives for safe inputs.

references

Related to adapting ModSecurity to newer libinjection APIs.
Adds regression coverage for parser error handling and safe input validation.

…on-v4.0-api Treat libinjection parser errors as matches in DetectSQLi/DetectXSS and add benign regression tests

airween · 2026-03-27T15:27:26Z

Hi @Easton97-Jens,

thanks for this PR - could you take a look at the failed tests on macOS and also the SonarCloud reports?

Copilot

Pull request overview

Updates ModSecurity’s @detectSQLi and @detectXSS operators to work with libinjection v4’s injection_result_t return codes, including explicit handling for TRUE/FALSE/ERROR and fail-safe matching on parser errors.

Changes:

Switched SQLi/XSS operator evaluation to injection_result_t and added explicit TRUE/FALSE/ERROR handling.
Implemented fail-safe behavior by treating LIBINJECTION_RESULT_ERROR as a match and preserving captured input when capture is enabled.
Added regression coverage for benign inputs for both operators.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

File	Description
`src/operators/detect_xss.cc`	Update XSS operator to handle libinjection v4 result codes and fail-safe error behavior.
`src/operators/detect_sqli.cc`	Update SQLi operator to handle libinjection v4 result codes and fail-safe error behavior.
`test/test-cases/regression/operator-detectxss.json`	Add benign-input regression case for `@detectXSS`.
`test/test-cases/regression/operator-detectsqli.json`	Add benign-input regression case for `@detectSQLi`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-27T15:36:37Z

src/operators/detect_xss.cc

+            case LIBINJECTION_RESULT_ERROR:
+                is_match = true;
+                ms_dbg_a(t, 4, "libinjection parser error during XSS "
+                    "analysis; treating as match (fail-safe). Input: " + input);
+                if (rule && rule->hasCaptureAction()) {
+                    t->m_collections.m_tx_collection->storeOrUpdateFirst(
+                        "0", std::string(input));
+                    ms_dbg_a(t, 7, "Added DetectXSS error input TX.0: " + \
+                        std::string(input));
+                }
+                break;


The new LIBINJECTION_RESULT_ERROR fail-safe path changes behavior (treat error as match and optionally capture raw input). Please add a regression test that reliably triggers a libinjection ERROR result and asserts the match/capture behavior, so this security-critical branch stays covered.

Copilot · 2026-03-27T15:36:37Z

test/test-cases/regression/operator-detectsqli.json

+        "Host": "localhost",
+        "User-Agent": "curl/7.38.0",
+        "Accept": "*/*",
+        "Content-Length": "18",


Content-Length doesn't match the request body length here (param1=just_a_value is 19 bytes). The regression harness may auto-correct it, but keeping it accurate avoids confusion when reusing this case outside the harness.

Suggested change

"Content-Length": "18",

"Content-Length": "19",

Copilot · 2026-03-27T15:36:37Z

src/operators/detect_sqli.cc


 #include "src/operators/operator.h"
 #include "libinjection/src/libinjection.h"
+#include "libinjection/src/libinjection_error.h"


New dependency on libinjection/src/libinjection_error.h: please ensure this header is present in the vendored libinjection submodule version and is included in release artifacts (e.g., add it to others/Makefile.am noinst_HEADERS if make dist/packaging relies on that list). Otherwise builds from distribution tarballs can fail with a missing-header error.

Suggested change

#include "libinjection/src/libinjection_error.h"

Copilot · 2026-03-27T15:36:38Z

src/operators/detect_xss.cc

 #include "libinjection/src/libinjection.h"
+#include "libinjection/src/libinjection_error.h"


New dependency on libinjection/src/libinjection_error.h: please ensure this header is present in the vendored libinjection submodule version and is included in release artifacts (e.g., add it to others/Makefile.am noinst_HEADERS if make dist/packaging relies on that list). Otherwise builds from distribution tarballs can fail with a missing-header error.

Copilot · 2026-03-27T15:36:38Z

src/operators/detect_sqli.cc

+        case LIBINJECTION_RESULT_ERROR:
+            is_match = true;
+            ms_dbg_a(t, 4, "libinjection parser error during SQLi "
+                "analysis; treating as match (fail-safe). Input: '" + input + "'");
+            if (rule && rule->hasCaptureAction()) {
+                t->m_collections.m_tx_collection->storeOrUpdateFirst(
+                    "0", std::string(input));
+                ms_dbg_a(t, 7, "Added DetectSQLi error input TX.0: " + \
+                    std::string(input));
+            }
+            break;


The new LIBINJECTION_RESULT_ERROR fail-safe path changes behavior (treat error as match and optionally capture raw input). Please add a regression test that reliably triggers a libinjection ERROR result and asserts the match/capture behavior, so this security-critical branch stays covered.

Easton97-Jens · 2026-03-27T16:29:58Z

Hi,

thanks for pointing that out!

I had a look at the failed macOS tests and the SonarCloud report. The Lua-related error does not seem to be caused by the changes in this PR, but rather appears to be a general issue in the project. Therefore, I’d suggest addressing it separately from this PR.

Let me know if you’d still like me to investigate it further here.

Best regards

…_dbg_a)

fzipi · 2026-03-28T02:08:18Z

The macos build should be fixed by #3524. Once it is merged, you can rebase.

sonarqubecloud · 2026-03-28T17:19:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

jens and others added 4 commits March 26, 2026 20:31

Update libinjection to v4.0.0

289b6e3

Stabilize detectSQLi/XSS regression coverage for full test run

38d9391

Make benign detectSQLi/XSS regression cases assert no-match logs

0c610c0

Merge pull request #23 from Easton97-Jens/codex/migrate-to-libinjecti…

0b29169

…on-v4.0-api Treat libinjection parser errors as matches in DetectSQLi/DetectXSS and add benign regression tests

Easton97-Jens changed the title ~~V3/master libinjection v4.0~~ Update SQLi/XSS operators for libinjection v4.0.0 Mar 27, 2026

fzipi requested a review from Copilot March 27, 2026 15:31

Copilot started reviewing on behalf of fzipi March 27, 2026 15:31 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

Easton97-Jens and others added 11 commits March 27, 2026 20:12

Harden libinjection v4 handling in DetectSQLi/DetectXSS operators

46dabc0

Fix namespace declaration in libinjection_utils.h

c816add

Fix namespace declaration syntax in libinjection_utils.h

d94cbeb

fix(logging): remove trailing semicolon from debug macros (ms_dbg, ms…

b4b81aa

…_dbg_a)

Update detect_sqli.cc

15fd157

Add array header to detect_sqli.cc

4bacc36

Fix formatting issues in transaction.h debug macros

f9b2885

Refactor fingerprint handling in detect_sqli.cc

a8debeb

Fix debug logging for XSS detection in detect_xss.cc

c67f876

Fix debug message formatting in detect_sqli.cc

7b5bf7f

Replace push_back with emplace_back for efficiency

e169d59

Easton97-Jens added 3 commits March 28, 2026 18:14

Update operator-detectsqli.json

724b197

Update XSS test cases with new payloads

b9393e7

Update operator-detectsqli.json

d1eaa04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update SQLi/XSS operators for libinjection v4.0.0#3522

Update SQLi/XSS operators for libinjection v4.0.0#3522
Easton97-Jens wants to merge 18 commits intoowasp-modsecurity:v3/masterfrom
Easton97-Jens:v3/master-libinjection-v4.0

Easton97-Jens commented Mar 27, 2026

Uh oh!

airween commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Copilot AI Mar 27, 2026

Uh oh!

Easton97-Jens commented Mar 27, 2026

Uh oh!

fzipi commented Mar 28, 2026

Uh oh!

sonarqubecloud bot commented Mar 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		#include "libinjection/src/libinjection.h"
		#include "libinjection/src/libinjection_error.h"

Conversation

Easton97-Jens commented Mar 27, 2026

what

why

references

Uh oh!

airween commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Easton97-Jens commented Mar 27, 2026

Uh oh!

fzipi commented Mar 28, 2026

Uh oh!

sonarqubecloud bot commented Mar 28, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants