Saturday, May 09, 2026 AM03:21:24 HKT

2026-05-09 03:21:32 +08:00
commit 41f17b127c
884 changed files with 263824 additions and 0 deletions
@@ -0,0 +1,79 @@
+# Libinjection integration
+
+[libinjection](https://github.com/client9/libinjection) is a 3rd party library (developped by client9) aiming at detecting SQL injections (sqli) and cross-site scripting (xss) by tokenization. This library is integrated within naxsi for two purposes :
+ - generic detection of xss/sqli
+ - virtual patching
+
+### Generic Detection
+
+libinjection generic detection *must* be explicitely enabled using specific directives : [LibInjectionXss](directives.md#libinjectionxss) or [LibInjectionSql](directives.md#libinjectionsql). It can as well be enabled at runtime using [runtime modifiers](runtime-modifiers.md) : `naxsi_flag_libinjection_xss` and `naxsi_flag_libinjection_sql`.
+
+ * Generic libinjection_xss rule has internal id 18 and increases named score `$LIBINJECTION_XSS` of 8 per match.
+
+ * Generic libinjection_sql rule has internal id 17 and increases named score `$LIBINJECTION_SQL` of 8 per match.
+
+
+A generic setup to block any request triggering libinjection_xss looks like :
+
+```
+location / {
+ SecRulesEnabled;
+ LibInjectionXss;
+ CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
+...
+}
+```
+
+for libinjection_sql :
+```
+location / {
+ SecRulesEnabled;
+ LibInjectionSql;
+ CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
+...
+}
+```
+
+When generic detection is enabled, false positives can be whitelisted using id 17 ([libinjection_xss](internal-rules.md#libinjection_xss)) or 18 ([libinjection_sql](internal-rules.md#libinjection_sql)).
+
+
+Using runtime modifiers, it might look like :
+
+
+```
+#/foobar as LOTS of sql injections
+if ($request_uri ~ ^/foobar(.*)$ ) {
+    set $naxsi_flag_libinjection_sql 1;
+}
+...
+location / {
+ ...
+ CheckRule "$LIBINJECTION_SQL >= 8" DROP;
+ ...
+}
+```
+
+
+### Virtual Patching
+
+(>= 0.55rc2)
+
+Widely enabling libinjection might not be possible depending on the application context.
+However, libinjection can as well be used for virtual patching :
+
+```
+MainRule "d:libinj_xss" "s:DROP" "mz:$ARGS_VAR:ruuu" id:41231;
+```
+
+
+_Pass the content of GET variable 'ruuu' to libinjection, and drop request if it's detected as xss_
+
+```
+MainRule "d:libinj_sql" "s:DROP" "mz:$ARGS_VAR:ruuu" id:41231;
+```
+
+_DROP any request triggering libinjection_sql in GET variable 'ruuu'_
+
+
+Using virtual patching approach, user-created rules can be managed/whitelisted without specificities.
+