diff --git a/Makefile b/Makefile index f76b8e7..4916153 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,7 @@ clean: rm -rf libinjection + rm -f src/bindings.rs + cargo clean fix-python: sed -i 's/python$$/python2/g' libinjection/src/*.py diff --git a/src/lib.rs b/src/lib.rs index e69de29..61bd217 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -0,0 +1,4 @@ +mod bindings; +mod wrapper; + +pub use wrapper::{sqli, xss}; diff --git a/src/wrapper.rs b/src/wrapper.rs new file mode 100644 index 0000000..835b228 --- /dev/null +++ b/src/wrapper.rs @@ -0,0 +1,26 @@ +use bindings; +use std::ffi::CString; + +/// Checks `input` for SQL injection detection, and returns an option of (is_sqli, fingerprint) +pub fn sqli(input: &str) -> Option<(bool, String)> { + let fingerprint_cstring = CString::new("").ok()?; + let fingerprint_raw_ptr = fingerprint_cstring.into_raw(); + let input_cstring = CString::new(input).ok()?; + let input_ptr = input_cstring.as_ptr(); + let is_sqli = + unsafe { bindings::libinjection_sqli(input_ptr, input.len(), fingerprint_raw_ptr) }; + Some(( + is_sqli == 1, + unsafe { CString::from_raw(fingerprint_raw_ptr) } + .into_string() + .ok()?, + )) +} + +/// Checks `input` for XSS detection, and returns an option of is_xss +pub fn xss(input: &str) -> Option { + let input_cstring = CString::new(input).ok()?; + let input_ptr = input_cstring.as_ptr(); + let is_xss = unsafe { bindings::libinjection_xss(input_ptr, input.len()) }; + Some(is_xss == 1) +} diff --git a/tests/lib_test.rs b/tests/lib_test.rs new file mode 100644 index 0000000..c664610 --- /dev/null +++ b/tests/lib_test.rs @@ -0,0 +1,22 @@ +extern crate libinjection; + +use libinjection::{sqli, xss}; + +#[test] +fn test_sqli() { + let (is_sqli, fingerprint) = sqli("' OR '2'='2' --").unwrap(); + assert!(is_sqli); + assert_eq!("s&sos", fingerprint); + + let (is_sqli, fingerprint) = sqli("SELECT * FROM users").unwrap(); + assert!(!is_sqli); + assert!(fingerprint.is_empty()); +} + +fn test_xss() { + let is_xss = xss("").unwrap(); + assert!(is_xss); + + let is_xss = xss("is not XSS").unwrap(); + assert!(!is_xss); +}