what

• Updated the SQLi and XSS detection operators to support the newer libinjection return codes (injection_result_t).
• Added explicit handling for TRUE, FALSE, and ERROR results from libinjection_sqli and libinjection_xss.
• Treated LIBINJECTION_RESULT_ERROR as a fail-safe match to avoid missing potentially malicious input.
• Preserved diagnostic context by storing raw input in TX.0 when capture is enabled, even on parser errors.
• Maintained previous behavior for positive detections (fingerprints for SQLi, input storage for XSS).
• Added regression tests for benign inputs to ensure no false positives are introduced.

why

• Newer versions of libinjection introduced injection_result_t, requiring explicit handling in ModSecurity operators.
• Without this update, parser errors could be handled inconsistently and weaken fail-safe detection behavior.
• Treating parser errors as matches ensures conservative and security-focused handling when input cannot be reliably parsed.
• Preserving captured input during error cases improves debugging and visibility for rule authors.
• Regression tests ensure the updated logic does not introduce false positives for safe inputs.

references

• Related to adapting ModSecurity to newer libinjection APIs.
• Adds regression coverage for parser error handling and safe input validation.