Update SQLi/XSS operators for libinjection v4.0.0 cleaned

[Easton97-Jens]

what

• Updated the SQLi and XSS detection operators to support the newer libinjection return codes (injection_result_t).
• Added explicit handling for TRUE, FALSE, and ERROR results from libinjection_sqli and libinjection_xss.
• Treated LIBINJECTION_RESULT_ERROR as a fail-safe match to avoid missing potentially malicious input.
• Preserved diagnostic context by storing raw input in TX.0 when capture is enabled, even on parser errors.
• Maintained previous behavior for positive detections (fingerprints for SQLi, input storage for XSS).
• Added regression tests for benign inputs to ensure no false positives are introduced.

why

• Newer versions of libinjection introduced injection_result_t, requiring explicit handling in ModSecurity operators.
• Without this update, parser errors could be handled inconsistently and weaken fail-safe detection behavior.
• Treating parser errors as matches ensures conservative and security-focused handling when input cannot be reliably parsed.
• Preserving captured input during error cases improves debugging and visibility for rule authors.
• Regression tests ensure the updated logic does not introduce false positives for safe inputs.

references

• Related to adapting ModSecurity to newer libinjection APIs.
• Adds regression coverage for parser error handling and safe input validation.

[Copilot]

Pull request overview

Updates ModSecurity’s @detectSQLi / @detectXSS operators to support libinjection v4’s injection_result_t return codes, including explicit fail-safe handling for parser errors, and expands regression coverage around detection/false-positive behavior.

Changes:

• Add shared helpers for interpreting libinjection TRUE/FALSE/ERROR results.
• Update DetectSQLi / DetectXSS to treat LIBINJECTION_RESULT_ERROR as a match and preserve capture behavior.
• Expand regression test cases for multiple XSS/SQLi payloads and benign inputs.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
src/operators/libinjection_utils.h	Adds shared helpers to map libinjection results to match/no-match semantics and diagnostic strings.
src/operators/detect_xss.cc	Switches XSS operator logic to injection_result_t and adds explicit handling for TRUE/FALSE/ERROR.
src/operators/detect_sqli.cc	Switches SQLi operator logic to injection_result_t, modernizes fingerprint storage, and handles TRUE/FALSE/ERROR.
test/test-cases/regression/operator-detectxss.json	Adds multiple positive and negative XSS regression cases.
test/test-cases/regression/operator-detectsqli.json	Adds multiple positive and negative SQLi regression cases (including fingerprint expectations).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

OperatorTest::eval reads TX.0 from the shared Transaction when capture is enabled. In mtstress mode the same transaction instance is shared across many threads, so concurrent writes/reads of the TX collection can cause data races and flaky/crashing unit tests (especially now that output comparisons are enforced). Consider using a per-thread Transaction in mtstress runs (or disabling capture/output assertions under mtstress) so TX.0 access is thread-safe/deterministic.

[airween]

@Easton97-Jens,

even thought this case (shared transaction objects) is a bit far from the reality, I think it would be nice to find a solution to meet this expectation.

(Moreover, there is no mtstress option at all between test cases.)

Could you take a look at this?

If you think it's not necessarily now, we can skip now, and we might add this later (with new test cases...)

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
4 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud