injection: LuaJIT FFI bindings to libinjection (https://github.com/client9/libinjection)
Installation
If you haven't set up RPM repository subscription, sign up. Then you can proceed with the following steps.
CentOS/RHEL 7 or Amazon Linux 2
yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum -y install lua-resty-injection
CentOS/RHEL 8+, Fedora Linux, Amazon Linux 2023
yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum -y install lua5.1-resty-injection
To use this Lua library with NGINX, ensure that nginx-module-lua is installed.
This document describes lua-resty-injection v1.0 released on Sep 15 2016.
LuaJIT FFI bindings to libinjection (https://github.com/client9/libinjection) — SQL / SQLI / XSS tokenizer parser analyzer.
Synopsis
local injection = require "resty.injection"
-- Print version of libinjection
print(injection.version)
-- Testing SQL injection detection
print(injection.sql("test; DROP users;"))
print(injection.sql("test"))
print(injection.sql("test<script></script>"))
-- Testing Cross-Site Scripting injection detection
print(injection.xss("test; DROP users;"))
print(injection.xss("test"))
print(injection.xss("test<script></script>"))
The above would output something similar to this:
3.9.1
true n;Tn;
false
false
false
false
true
The second line contains fingerprint of the injection.
License
lua-resty-injection
uses two clause BSD license.
Copyright (c) 2016 Aapo Talvensaari
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice, this
list of conditions and the following disclaimer in the documentation and/or
other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
GitHub
You may find additional configuration tips and documentation for this module in the GitHub repository for nginx-module-injection.