Update SQLi/XSS operators for libinjection v4.0.0 cleaned

[Easton97-Jens]

what

• Updated the SQLi and XSS detection operators to support the newer libinjection return codes (injection_result_t).
• Added explicit handling for TRUE, FALSE, and ERROR results from libinjection_sqli and libinjection_xss.
• Treated LIBINJECTION_RESULT_ERROR as a fail-safe match to avoid missing potentially malicious input.
• Preserved diagnostic context by storing raw input in TX.0 when capture is enabled, even on parser errors.
• Maintained previous behavior for positive detections (fingerprints for SQLi, input storage for XSS).
• Added regression tests for benign inputs to ensure no false positives are introduced.

why

• Newer versions of libinjection introduced injection_result_t, requiring explicit handling in ModSecurity operators.
• Without this update, parser errors could be handled inconsistently and weaken fail-safe detection behavior.
• Treating parser errors as matches ensures conservative and security-focused handling when input cannot be reliably parsed.
• Preserving captured input during error cases improves debugging and visibility for rule authors.
• Regression tests ensure the updated logic does not introduce false positives for safe inputs.

references

• Related to adapting ModSecurity to newer libinjection APIs.
• Adds regression coverage for parser error handling and safe input validation.

[Copilot]

Pull request overview

Updates ModSecurity’s @detectSQLi / @detectXSS operators to support libinjection v4’s injection_result_t return codes, including explicit fail-safe handling for parser errors, and expands regression coverage around detection/false-positive behavior.

Changes:

• Add shared helpers for interpreting libinjection TRUE/FALSE/ERROR results.
• Update DetectSQLi / DetectXSS to treat LIBINJECTION_RESULT_ERROR as a match and preserve capture behavior.
• Expand regression test cases for multiple XSS/SQLi payloads and benign inputs.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
src/operators/libinjection_utils.h	Adds shared helpers to map libinjection results to match/no-match semantics and diagnostic strings.
src/operators/detect_xss.cc	Switches XSS operator logic to injection_result_t and adds explicit handling for TRUE/FALSE/ERROR.
src/operators/detect_sqli.cc	Switches SQLi operator logic to injection_result_t, modernizes fingerprint storage, and handles TRUE/FALSE/ERROR.
test/test-cases/regression/operator-detectxss.json	Adds multiple positive and negative XSS regression cases.
test/test-cases/regression/operator-detectsqli.json	Adds multiple positive and negative SQLi regression cases (including fingerprint expectations).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The new LIBINJECTION_RESULT_ERROR fail-safe behavior (treating parser errors as matches and capturing raw input into TX.0 when capture is enabled) is not exercised by the current regression tests. Add a regression case that reliably triggers libinjection_xss returning ERROR and asserts both the disruptive outcome and TX.0 capture behavior.

[Copilot]

The new LIBINJECTION_RESULT_ERROR path (fail-safe match + storing raw input in TX.0 when capture is enabled) does not appear to be covered by the regression tests. Add a regression case that triggers libinjection_sqli returning ERROR and asserts both that the operator matches and that TX.0 contains the raw input (not the fingerprint) when capture is enabled.

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud