feat(libinjection): add libinjection 4 final to v2#3535
feat(libinjection): add libinjection 4 final to v2#3535airween merged 13 commits intoowasp-modsecurity:v2/masterfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates ModSecurity v2’s embedded libinjection integration to libinjection v4.0.0 by switching from vendored sources to a Git submodule, updating build/CI wiring accordingly, and adapting the SQLi/XSS detection operators to the new API (including safe capture handling for values containing NUL bytes).
Changes:
- Replaced vendored libinjection sources under
apache2/libinjectionwith a git submodule atapache2/others/libinjection. - Updated build systems (Autotools, CMake, Windows makefiles) and GitHub Actions to initialize and compile against the new submodule path.
- Updated libinjection-backed operators to handle
injection_result_tand addedset_match_to_tx_safe()plus regression tests validatingTX:0capture behavior.
Reviewed changes
Copilot reviewed 21 out of 22 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
tests/regression/misc/25-libinjection.t |
Adds regression coverage verifying capture populates TX.0 for SQLi/XSS operators. |
tests/Makefile.am |
Switches unit-test build sources to libinjection submodule paths. |
standalone/Makefile.am |
Switches standalone build sources to libinjection submodule paths. |
iis/CMakeLists.txt |
Updates IIS build sources and include directories for the new libinjection location. |
apache2/re_operators.c |
Adapts detectSQLi/detectXSS operator logic to libinjection v4 result codes and safe capture. |
apache2/msc_util.h |
Declares new set_match_to_tx_safe() API. |
apache2/msc_util.c |
Implements set_match_to_tx_safe() using length-aware duplication to preserve embedded NULs. |
apache2/Makefile.win |
Updates Windows object list to compile libinjection sources from the submodule. |
apache2/Makefile.am |
Updates Apache module build sources to compile libinjection from the submodule. |
apache2/libinjection/libinjection.h |
Removes vendored libinjection header (now provided by submodule). |
apache2/libinjection/libinjection_xss.h |
Removes vendored libinjection header (now provided by submodule). |
apache2/libinjection/libinjection_xss.c |
Removes vendored libinjection implementation (now provided by submodule). |
apache2/libinjection/libinjection_sqli.h |
Removes vendored libinjection header (now provided by submodule). |
apache2/libinjection/libinjection_sqli.c |
Removes vendored libinjection implementation (now provided by submodule). |
apache2/libinjection/libinjection_html5.h |
Removes vendored libinjection header (now provided by submodule). |
apache2/libinjection/libinjection_html5.c |
Removes vendored libinjection implementation (now provided by submodule). |
apache2/libinjection/COPYING.txt |
Removes vendored libinjection license file (license now tracked via submodule). |
.gitmodules |
Adds libinjection as a git submodule under apache2/others/libinjection. |
.github/workflows/test-ci-windows.yml |
Ensures checkout initializes submodules for Windows CI jobs. |
.github/workflows/ci.yml |
Ensures checkout initializes submodules for Linux CI jobs and adds git where needed. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 22 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 21 out of 22 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
fzipi
changed the title
what
This PR introduces the new version of libinjection (v4.0.0).
Details:
apache2/libinjectiondirectoryset_match_to_tx()function (pass variable's length to handle strings which contain\0chars)TX.0why
Libinjection code part was a bit old in v2. There are several improvements there and we plan to use other submodules too (eg to use a new JSON parser library) this PR starts to use it as a submodule.
Note that there is a similar pending PR for v3, #3528.
references
#3528