diff --git a/src/Makefile.am b/src/Makefile.am index ff9db98a..b7c10524 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -174,11 +174,15 @@ libmodsecurity_la_SOURCES = \ rule.cc \ unique_id.cc \ ${ACTIONS} \ + ${LIBINJECTION} \ ${OPERATORS} \ ${UTILS} \ ${VARIABLES} +LIBINJECTION = \ + ../others/libinjection/src/libinjection_html5.c \ + ../others/libinjection/src/libinjection_xss.c libmodsecurity_la_CFLAGS = diff --git a/src/operators/detect_xss.cc b/src/operators/detect_xss.cc index 022d226a..14af2ea3 100644 --- a/src/operators/detect_xss.cc +++ b/src/operators/detect_xss.cc @@ -18,25 +18,35 @@ #include #include "operators/operator.h" - +#include "others/libinjection/src/libinjection.h" namespace ModSecurity { namespace operators { -bool DetectXSS::evaluate(Assay *assay) { - /** - * @todo Implement the operator DetectXSS. - * Reference: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#detectxss - */ - return true; + +bool DetectXSS::evaluate(Assay *assay, const std::string &input) { + int is_xss; + + is_xss = libinjection_xss(input.c_str(), input.length()); + + if (is_xss) { + if (assay) { + assay->debug(5, "detected XSS using libinjection."); + } + } else { + if (assay) { + assay->debug(9, "libinjection was not able to " \ + "find any XSS in: " + input); + } + } + + if (negation) { + return is_xss == 0; + } + + return is_xss != 0; } -DetectXSS::DetectXSS(std::string op, std::string param, bool negation) - : Operator() { - this->op = op; - this->param = param; -} - } // namespace operators } // namespace ModSecurity diff --git a/src/operators/detect_xss.h b/src/operators/detect_xss.h index 0e816c83..3a5c3cdb 100644 --- a/src/operators/detect_xss.h +++ b/src/operators/detect_xss.h @@ -20,20 +20,20 @@ #include "operators/operator.h" -#ifdef __cplusplus namespace ModSecurity { namespace operators { class DetectXSS : public Operator { public: /** @ingroup ModSecurity_Operator */ - DetectXSS(std::string o, std::string p, bool i); - bool evaluate(Assay *assay); + DetectXSS(std::string op, std::string param, bool negation) + : Operator(op, param, negation) { } + + bool evaluate(Assay *assay, const std::string &input); }; } // namespace operators } // namespace ModSecurity -#endif #endif // SRC_OPERATORS_DETECT_XSS_H_