Adds support to the @detectXSS operator

src/Makefile.am

@@ -174,11 +174,15 @@ libmodsecurity_la_SOURCES = \
 	rule.cc \
 	unique_id.cc \
 	${ACTIONS} \
+	${LIBINJECTION} \
 	${OPERATORS} \
 	${UTILS} \
 	${VARIABLES}
 
 
+LIBINJECTION = \
+	../others/libinjection/src/libinjection_html5.c \
+	../others/libinjection/src/libinjection_xss.c
 
 
 libmodsecurity_la_CFLAGS = 

src/operators/detect_xss.cc

@@ -18,25 +18,35 @@
 #include <string>
 
 #include "operators/operator.h"
-
+#include "others/libinjection/src/libinjection.h"
 
 namespace ModSecurity {
 namespace operators {
 
-bool DetectXSS::evaluate(Assay *assay) {
+
-    /**
+bool DetectXSS::evaluate(Assay *assay, const std::string &input) {
-     * @todo Implement the operator DetectXSS.
+    int is_xss;
-     *       Reference: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#detectxss
+
-     */
+    is_xss = libinjection_xss(input.c_str(), input.length());
-    return true;
+
+    if (is_xss) {
+        if (assay) {
+            assay->debug(5, "detected XSS using libinjection.");
+        }
+    } else {
+        if (assay) {
+            assay->debug(9, "libinjection was not able to " \
+                "find any XSS in: " + input);
+        }
+    }
+
+    if (negation) {
+        return is_xss == 0;
+    }
+
+    return is_xss != 0;
 }
 
 
-DetectXSS::DetectXSS(std::string op, std::string param, bool negation)
-    : Operator() {
-    this->op = op;
-    this->param = param;
-}
-
 }  // namespace operators
 }  // namespace ModSecurity

src/operators/detect_xss.h

@@ -20,20 +20,20 @@
 
 #include "operators/operator.h"
 
-#ifdef __cplusplus
 namespace ModSecurity {
 namespace operators {
 
 class DetectXSS : public Operator {
  public:
     /** @ingroup ModSecurity_Operator */
-    DetectXSS(std::string o, std::string p, bool i);
+    DetectXSS(std::string op, std::string param, bool negation)
-    bool evaluate(Assay *assay);
+        : Operator(op, param, negation) { }
+
+    bool evaluate(Assay *assay, const std::string &input);
 };
 
 }  // namespace operators
 }  // namespace ModSecurity
-#endif
 
 
 #endif  // SRC_OPERATORS_DETECT_XSS_H_