From 52f86c2d10f51a238b9e23961e65075a44c85fc9 Mon Sep 17 00:00:00 2001
From: blotus <sebastien@crowdsec.net>
Date: Thu, 21 Mar 2024 11:39:37 +0100
Subject: [PATCH] add libinjection expr helpers (#2914)

---
 pkg/exprhelpers/expr_lib.go          | 14 +++++++
 pkg/exprhelpers/libinjection.go      | 17 ++++++++
 pkg/exprhelpers/libinjection_test.go | 60 ++++++++++++++++++++++++++++
 3 files changed, 91 insertions(+)
 create mode 100644 pkg/exprhelpers/libinjection.go
 create mode 100644 pkg/exprhelpers/libinjection_test.go

diff --git a/pkg/exprhelpers/expr_lib.go b/pkg/exprhelpers/expr_lib.go
index db191b84a..520799287 100644
--- a/pkg/exprhelpers/expr_lib.go
+++ b/pkg/exprhelpers/expr_lib.go
@@ -441,6 +441,20 @@ var exprFuncs = []exprCustomFunc{
 			new(func(float64, float64) bool),
 		},
 	},
+	{
+		name:     "LibInjectionIsSQLI",
+		function: LibInjectionIsSQLI,
+		signature: []interface{}{
+			new(func(string) bool),
+		},
+	},
+	{
+		name:     "LibInjectionIsXSS",
+		function: LibInjectionIsXSS,
+		signature: []interface{}{
+			new(func(string) bool),
+		},
+	},
 }
 
 //go 1.20 "CutPrefix":              strings.CutPrefix,
diff --git a/pkg/exprhelpers/libinjection.go b/pkg/exprhelpers/libinjection.go
new file mode 100644
index 000000000..e9f33e4f4
--- /dev/null
+++ b/pkg/exprhelpers/libinjection.go
@@ -0,0 +1,17 @@
+package exprhelpers
+
+import "github.com/corazawaf/libinjection-go"
+
+func LibInjectionIsSQLI(params ...any) (any, error) {
+	str := params[0].(string)
+
+	ret, _ := libinjection.IsSQLi(str)
+	return ret, nil
+}
+
+func LibInjectionIsXSS(params ...any) (any, error) {
+	str := params[0].(string)
+
+	ret := libinjection.IsXSS(str)
+	return ret, nil
+}
diff --git a/pkg/exprhelpers/libinjection_test.go b/pkg/exprhelpers/libinjection_test.go
new file mode 100644
index 000000000..7b4ab825d
--- /dev/null
+++ b/pkg/exprhelpers/libinjection_test.go
@@ -0,0 +1,60 @@
+package exprhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLibinjectionHelpers(t *testing.T) {
+	tests := []struct {
+		name         string
+		function     func(params ...any) (any, error)
+		params       []any
+		expectResult any
+	}{
+		{
+			name:         "LibInjectionIsSQLI",
+			function:     LibInjectionIsSQLI,
+			params:       []any{"?__f__73=73&&__f__75=75&delivery=1&max=24.9&min=15.9&n=12&o=2&p=(select(0)from(select(sleep(15)))v)/*'%2B(select(0)from(select(sleep(15)))v)%2B'\x22%2B(select(0)from(select(sleep(15)))v)%2B\x22*/&rating=4"},
+			expectResult: true,
+		},
+		{
+			name:         "LibInjectionIsSQLI - no match",
+			function:     LibInjectionIsSQLI,
+			params:       []any{"?bla=42&foo=bar"},
+			expectResult: false,
+		},
+		{
+			name:         "LibInjectionIsSQLI - no match 2",
+			function:     LibInjectionIsSQLI,
+			params:       []any{"https://foo.com/asdkfj?bla=42&foo=bar"},
+			expectResult: false,
+		},
+		{
+			name:         "LibInjectionIsXSS",
+			function:     LibInjectionIsXSS,
+			params:       []any{"<script>alert('XSS')</script>"},
+			expectResult: true,
+		},
+		{
+			name:         "LibInjectionIsXSS - no match",
+			function:     LibInjectionIsXSS,
+			params:       []any{"?bla=42&foo=bar"},
+			expectResult: false,
+		},
+		{
+			name:         "LibInjectionIsXSS - no match 2",
+			function:     LibInjectionIsXSS,
+			params:       []any{"https://foo.com/asdkfj?bla=42&foo[]=bar&foo"},
+			expectResult: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			result, _ := test.function(test.params...)
+			assert.Equal(t, test.expectResult, result)
+		})
+	}
+}