API reference

Every declaration below is extracted from zig-injection's source, with the doc comments as written there. A declaration listed without prose is public but undocumented in the source.

Root

version

const version = "0.0.0-dev"

sqli

const sqli = @import("sqli.zig")

xss

const xss = @import("xss.zig")

c_api

const c_api = @import("c_api.zig")

sqli

fingerprint_capacity

const fingerprint_capacity = 5

ParserKind

const ParserKind = enum

Dispatch categories for the first byte of a token; the table lives in sqli_data.zig.

Result

const Result = struct

fingerprintBytes

fn fingerprintBytes(self: *const Result) []const u8

State

const State = struct

Reusable caller-owned detection state. It is large enough that callers should keep one per worker rather than per call.

reset

fn reset(self: *State) void

detect

fn detect(input: []const u8, state: *State) Result

Detect SQL injection using reusable caller-owned state. Returns whether the input is SQLi and, when it is, the matched libinjection fingerprint.

formatFolding

fn formatFolding(input: []const u8, state: *State, out: []u8) []const u8

Fold input and format each resulting token as libinjection's test driver does (category value, one per line), for the differential folding corpus.

xss

AttributeType

const AttributeType = enum(u8)

Flags

const Flags = enum

The five HTML5 parsing contexts libinjection reparses the input under.

detect

fn detect(input: []const u8) bool

Whether input contains cross-site scripting, checked across all five HTML5 parsing contexts libinjection reparses under.

c_api

abi_version

const abi_version: u32 = 0x0001_0000

ABI version: 0x00_MM_mm_pp. Bump the major on any breaking change.