Skip to content

Commit 1336be4

Browse files
Easton97-Jensjens
Easton97-Jens
authored and
jens
committed
Clean up CI and libinjection integration changes
- update adapter and detection sources - improve multithreaded unit tests - add SQLi/XSS logging changes - hide test override symbols - fix linker visibility for test hooks - consolidate CI workflow updates - update libinjection integration files - improve tests and build configuration
1 parent 582d04e commit 1336be4

File tree

8 files changed

+191
-45
lines changed

8 files changed

+191
-45
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 40 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@ on:
44
push:
55
pull_request:
66

7-
env:
8-
LUA_VERSION: "5.5"
9-
107
jobs:
118
build-linux:
129
name: Linux (${{ matrix.platform.label }}, ${{ matrix.compiler.label }}, ${{ matrix.configure.label }})
@@ -37,18 +34,49 @@ jobs:
3734
- platform: {label: "x32"}
3835
configure: {label: "wo ssdeep"}
3936
steps:
37+
- name: Detect latest Lua dev package
38+
id: detect_lua
39+
shell: bash
40+
run: |
41+
set -euo pipefail
42+
43+
sudo apt-get update -y -qq
44+
45+
CANDIDATES="$(apt-cache pkgnames | grep -E '^liblua[0-9]+\.[0-9]+-dev$' || true)"
46+
47+
if [ -z "$CANDIDATES" ]; then
48+
echo "No libluaX.Y-dev package found"
49+
exit 1
50+
fi
51+
52+
BEST_PKG="$(
53+
printf '%s\n' "$CANDIDATES" \
54+
| sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1 &/' \
55+
| sort -V \
56+
| tail -n1 \
57+
| awk '{print $2}'
58+
)"
59+
60+
if [ -z "$BEST_PKG" ]; then
61+
echo "Failed to determine Lua package"
62+
exit 1
63+
fi
64+
65+
echo "lua_pkg=$BEST_PKG" >> "$GITHUB_OUTPUT"
66+
echo "Using $BEST_PKG"
67+
4068
- name: Setup Dependencies (common)
4169
run: |
4270
sudo dpkg --add-architecture ${{ matrix.platform.arch }}
4371
sudo apt-get update -y -qq
4472
sudo apt-get install -y libyajl-dev:${{ matrix.platform.arch }} \
4573
libcurl4-openssl-dev:${{ matrix.platform.arch }} \
4674
liblmdb-dev:${{ matrix.platform.arch }} \
47-
liblua${{ env.LUA_VERSION }}-dev:${{ matrix.platform.arch }} \
75+
${{ steps.detect_lua.outputs.lua_pkg }}:${{ matrix.platform.arch }} \
4876
libmaxminddb-dev:${{ matrix.platform.arch }} \
4977
libpcre2-dev:${{ matrix.platform.arch }} \
5078
pcre2-utils:${{ matrix.platform.arch }} \
51-
bison flex
79+
bison flex python3 python3-venv
5280
- name: Setup Dependencies (x32)
5381
if: ${{ matrix.platform.label == 'x32' }}
5482
run: |
@@ -58,8 +86,8 @@ jobs:
5886
- name: Setup Dependencies (x64)
5987
if: ${{ matrix.platform.label == 'x64' }}
6088
run: |
61-
sudo apt-get install -y libgeoip-dev:${{ matrix.platform.arch }} \
62-
libfuzzy-dev:${{ matrix.platform.arch }}
89+
sudo apt-get install -y libfuzzy-dev:${{ matrix.platform.arch }}
90+
6391
- uses: actions/checkout@v6
6492
with:
6593
submodules: recursive
@@ -104,27 +132,18 @@ jobs:
104132
libtool \
105133
yajl \
106134
lmdb \
107-
lua@${{ env.LUA_VERSION }} \
135+
lua \
108136
libmaxminddb \
109137
libxml2 \
110138
ssdeep \
111139
pcre \
112140
bison \
113-
flex
141+
flex
142+
114143
- uses: actions/checkout@v6
115144
with:
116145
submodules: recursive
117146
fetch-depth: 0
118-
- name: Build GeoIP
119-
run: |
120-
git clone --depth 1 --no-checkout https://github.com/maxmind/geoip-api-c.git
121-
cd geoip-api-c
122-
git fetch --tags
123-
# Check out the last release, v1.6.12
124-
git checkout 4b526e7331ca1d692b74a0509ddcc725622ed31a
125-
autoreconf --install
126-
./configure --disable-dependency-tracking --disable-silent-rules --prefix=/opt/homebrew
127-
make install
128147
- name: build.sh
129148
run: ./build.sh
130149
- name: configure
@@ -201,7 +220,8 @@ jobs:
201220
automake \
202221
libtool \
203222
cppcheck
204-
- uses: actions/checkout@v4
223+
224+
- uses: actions/checkout@v6
205225
with:
206226
submodules: recursive
207227
fetch-depth: 0

‎.github/workflows/ci_new.yml‎

Lines changed: 90 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@ on:
44
push:
55
pull_request:
66

7-
env:
8-
LUA_VERSION: "5.5"
9-
107
jobs:
118
build-linux:
129
name: Linux (${{ matrix.platform.label }}, ${{ matrix.compiler.label }}, ${{ matrix.configure.label }})
@@ -43,14 +40,45 @@ jobs:
4340
fetch-depth: 0
4441
submodules: recursive
4542

46-
- name: Install dependencies
43+
- name: Detect latest Lua dev package
44+
id: detect_lua
45+
shell: bash
4746
run: |
47+
set -euo pipefail
48+
4849
sudo apt-get update -y -qq
50+
51+
CANDIDATES="$(apt-cache pkgnames | grep -E '^liblua[0-9]+\.[0-9]+-dev$' || true)"
52+
53+
if [ -z "$CANDIDATES" ]; then
54+
echo "No libluaX.Y-dev package found"
55+
exit 1
56+
fi
57+
58+
BEST_PKG="$(
59+
printf '%s\n' "$CANDIDATES" \
60+
| sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1 &/' \
61+
| sort -V \
62+
| tail -n1 \
63+
| awk '{print $2}'
64+
)"
65+
66+
if [ -z "$BEST_PKG" ]; then
67+
echo "Failed to determine Lua package"
68+
exit 1
69+
fi
70+
71+
echo "lua_pkg=$BEST_PKG" >> "$GITHUB_OUTPUT"
72+
echo "Using $BEST_PKG"
73+
74+
75+
- name: Install dependencies
76+
run: |
4977
sudo apt-get install -y \
5078
libyajl-dev \
5179
libcurl4-openssl-dev \
5280
liblmdb-dev \
53-
liblua${{ env.LUA_VERSION }}-dev \
81+
${{ steps.detect_lua.outputs.lua_pkg }} \
5482
libmaxminddb-dev \
5583
libpcre2-dev \
5684
libxml2-dev \
@@ -63,6 +91,11 @@ jobs:
6391
python3 \
6492
python3-venv
6593
94+
- name: Show Lua installation
95+
run: |
96+
which lua || true
97+
lua -v || true
98+
dpkg -l | grep lua || true
6699
67100
- name: Run build preparation script
68101
run: ./build.sh
@@ -83,11 +116,12 @@ jobs:
83116

84117
build-macos:
85118
name: macOS (${{ matrix.configure.label }})
86-
runs-on: macos-15
119+
runs-on: ${{ matrix.os }}
87120

88121
strategy:
89122
fail-fast: false
90123
matrix:
124+
os: [macos-15, macos-26]
91125
configure:
92126
- { label: "with parser generation", opt: "--enable-parser-generation" }
93127
- { label: "without curl", opt: "--without-curl" }
@@ -114,14 +148,13 @@ jobs:
114148
libtool \
115149
yajl \
116150
lmdb \
117-
lua@${{ env.LUA_VERSION }} \
151+
lua \
118152
libmaxminddb \
119153
libxml2 \
120154
ssdeep \
121155
pcre \
122156
bison \
123-
flex \
124-
python3
157+
flex
125158
126159
- name: Run build preparation script
127160
run: ./build.sh
@@ -202,7 +235,7 @@ jobs:
202235

203236
cppcheck:
204237
name: Static analysis (cppcheck)
205-
runs-on: macos-15
238+
runs-on: macos-26
206239

207240
steps:
208241
- uses: actions/checkout@v6
@@ -212,7 +245,7 @@ jobs:
212245

213246
- name: Install cppcheck
214247
run: |
215-
brew install autoconf automake libtool cppcheck libmaxminddb yajl lua@${{ env.LUA_VERSION }} lmdb ssdeep python3
248+
brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep
216249
217250
- name: Configure project
218251
run: |
@@ -240,11 +273,47 @@ jobs:
240273
with:
241274
fetch-depth: 0
242275
submodules: recursive
276+
277+
- name: Detect latest Lua packages
278+
id: detect_lua
279+
shell: bash
280+
run: |
281+
set -euo pipefail
282+
283+
apt-get update
284+
285+
CANDIDATES="$(apt-cache pkgnames | grep -E '^liblua[0-9]+\.[0-9]+-dev$' || true)"
286+
287+
if [ -z "$CANDIDATES" ]; then
288+
echo "No libluaX.Y-dev package found"
289+
exit 1
290+
fi
291+
292+
BEST_PKG="$(
293+
printf '%s\n' "$CANDIDATES" \
294+
| sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1 &/' \
295+
| sort -V \
296+
| tail -n1 \
297+
| awk '{print $2}'
298+
)"
243299
300+
if [ -z "$BEST_PKG" ]; then
301+
echo "Failed to determine Lua dev package"
302+
printf '%s\n' "$CANDIDATES"
303+
exit 1
304+
fi
305+
306+
BEST_VER="$(printf '%s\n' "$BEST_PKG" | sed -E 's/^liblua([0-9]+\.[0-9]+)-dev$/\1/')"
307+
LUA_PKG="lua$BEST_VER"
308+
309+
echo "lua_dev_pkg=$BEST_PKG" >> "$GITHUB_OUTPUT"
310+
echo "lua_pkg=$LUA_PKG" >> "$GITHUB_OUTPUT"
311+
312+
echo "Using dev package: $BEST_PKG"
313+
echo "Using interpreter: $LUA_PKG"
244314
245315
- name: Install dependencies (v2 style)
246316
run: |
247-
apt-get update
248317
apt-get install -y \
249318
autoconf \
250319
automake \
@@ -255,7 +324,8 @@ jobs:
255324
libyajl-dev \
256325
libcurl4-openssl-dev \
257326
liblmdb-dev \
258-
liblua${{ env.LUA_VERSION }}-dev \
327+
${{ steps.detect_lua.outputs.lua_dev_pkg }} \
328+
${{ steps.detect_lua.outputs.lua_pkg }} \
259329
libmaxminddb-dev \
260330
libpcre2-dev \
261331
libxml2-dev \
@@ -265,7 +335,13 @@ jobs:
265335
flex \
266336
python3 \
267337
python3-venv
268-
338+
339+
- name: Show Lua installation
340+
run: |
341+
which lua || true
342+
lua -v || true
343+
dpkg -l | grep lua || true
344+
269345
- name: Run build preparation script
270346
run: ./build.sh
271347

‎others/Makefile.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ noinst_HEADERS = \
1515
libinjection/src/libinjection_sqli.h \
1616
libinjection/src/libinjection_sqli_data.h \
1717
libinjection/src/libinjection_xss.h \
18+
libinjection/src/libinjection_error.h \
1819
mbedtls/include/mbedtls/base64.h \
1920
mbedtls/include/mbedtls/check_config.h \
2021
mbedtls/include/mbedtls/mbedtls_config.h \

‎src/operators/detect_sqli.cc‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,17 @@
2222
#include "src/operators/operator.h"
2323
#include "src/operators/libinjection_utils.h"
2424
#include "src/operators/libinjection_adapter.h"
25+
#include "src/utils/string.h"
2526
#include "libinjection/src/libinjection_error.h"
2627

2728
namespace modsecurity::operators {
2829

2930
bool DetectSQLi::evaluate(Transaction *t, RuleWithActions *rule,
3031
const std::string& input, RuleMessage &ruleMessage) {
32+
#ifndef NO_LOGS
33+
const std::string loggable_input =
34+
utils::string::limitTo(80, utils::string::toHexIfNeeded(input));
35+
#endif
3136

3237
std::array<char, 8> fingerprint{};
3338

@@ -42,9 +47,11 @@ bool DetectSQLi::evaluate(Transaction *t, RuleWithActions *rule,
4247
case LIBINJECTION_RESULT_TRUE:
4348
t->m_matched.emplace_back(fingerprint.data());
4449

50+
#ifndef NO_LOGS
4551
ms_dbg_a(t, 4,
4652
std::string("detected SQLi using libinjection with fingerprint '")
47-
+ fingerprint.data() + "' at: '" + input + "'");
53+
+ fingerprint.data() + "' at: '" + loggable_input + "'");
54+
#endif
4855

4956
if (rule != nullptr && rule->hasCaptureAction()) {
5057
t->m_collections.m_tx_collection->storeOrUpdateFirst(
@@ -57,11 +64,13 @@ bool DetectSQLi::evaluate(Transaction *t, RuleWithActions *rule,
5764
break;
5865

5966
case LIBINJECTION_RESULT_ERROR:
67+
#ifndef NO_LOGS
6068
ms_dbg_a(t, 4,
6169
std::string("libinjection parser error during SQLi analysis (")
6270
+ libinjectionResultToString(sqli_result)
6371
+ "); treating as match (fail-safe). Input: '"
64-
+ input + "'");
72+
+ loggable_input + "'");
73+
#endif
6574

6675
if (rule != nullptr && rule->hasCaptureAction()) {
6776
t->m_collections.m_tx_collection->storeOrUpdateFirst(
@@ -77,9 +86,11 @@ bool DetectSQLi::evaluate(Transaction *t, RuleWithActions *rule,
7786
break;
7887

7988
case LIBINJECTION_RESULT_FALSE:
89+
#ifndef NO_LOGS
8090
ms_dbg_a(t, 9,
8191
std::string("libinjection was not able to find any SQLi in: ")
82-
+ input);
92+
+ loggable_input);
93+
#endif
8394
break;
8495
}
8596

0 commit comments

Comments
 (0)