add libinjection expr helpers (#2914)

pkg/exprhelpers/expr_lib.go

@@ -441,6 +441,20 @@ var exprFuncs = []exprCustomFunc{
 			new(func(float64, float64) bool),
 		},
 	},
+	{
+		name:     "LibInjectionIsSQLI",
+		function: LibInjectionIsSQLI,
+		signature: []interface{}{
+			new(func(string) bool),
+		},
+	},
+	{
+		name:     "LibInjectionIsXSS",
+		function: LibInjectionIsXSS,
+		signature: []interface{}{
+			new(func(string) bool),
+		},
+	},
 }
 
 //go 1.20 "CutPrefix":              strings.CutPrefix,

pkg/exprhelpers/libinjection.go

@@ -0,0 +1,17 @@
+package exprhelpers
+
+import "github.com/corazawaf/libinjection-go"
+
+func LibInjectionIsSQLI(params ...any) (any, error) {
+	str := params[0].(string)
+
+	ret, _ := libinjection.IsSQLi(str)
+	return ret, nil
+}
+
+func LibInjectionIsXSS(params ...any) (any, error) {
+	str := params[0].(string)
+
+	ret := libinjection.IsXSS(str)
+	return ret, nil
+}

pkg/exprhelpers/libinjection_test.go

@@ -0,0 +1,60 @@
+package exprhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLibinjectionHelpers(t *testing.T) {
+	tests := []struct {
+		name         string
+		function     func(params ...any) (any, error)
+		params       []any
+		expectResult any
+	}{
+		{
+			name:         "LibInjectionIsSQLI",
+			function:     LibInjectionIsSQLI,
+			params:       []any{"?__f__73=73&&__f__75=75&delivery=1&max=24.9&min=15.9&n=12&o=2&p=(select(0)from(select(sleep(15)))v)/*'%2B(select(0)from(select(sleep(15)))v)%2B'\x22%2B(select(0)from(select(sleep(15)))v)%2B\x22*/&rating=4"},
+			expectResult: true,
+		},
+		{
+			name:         "LibInjectionIsSQLI - no match",
+			function:     LibInjectionIsSQLI,
+			params:       []any{"?bla=42&foo=bar"},
+			expectResult: false,
+		},
+		{
+			name:         "LibInjectionIsSQLI - no match 2",
+			function:     LibInjectionIsSQLI,
+			params:       []any{"https://foo.com/asdkfj?bla=42&foo=bar"},
+			expectResult: false,
+		},
+		{
+			name:         "LibInjectionIsXSS",
+			function:     LibInjectionIsXSS,
+			params:       []any{"<script>alert('XSS')</script>"},
+			expectResult: true,
+		},
+		{
+			name:         "LibInjectionIsXSS - no match",
+			function:     LibInjectionIsXSS,
+			params:       []any{"?bla=42&foo=bar"},
+			expectResult: false,
+		},
+		{
+			name:         "LibInjectionIsXSS - no match 2",
+			function:     LibInjectionIsXSS,
+			params:       []any{"https://foo.com/asdkfj?bla=42&foo[]=bar&foo"},
+			expectResult: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result, _ := test.function(test.params...)
+			assert.Equal(t, test.expectResult, result)
+		})
+	}
+}