From e9973dd2190d241acdd1a89b35537f6abcd98ac4 Mon Sep 17 00:00:00 2001 From: Nicolas Dreno Date: Tue, 3 Nov 2026 18:52:02 +0100 Subject: [PATCH] Release 0.1.2 Bump the version to 0.1.2 and cut the changelog: the libinjection 4.0.1 move (#7), the low-byte entity comparison in htmlencode_startswith (87c1e8c, which had no changelog entry), and Dependabot. The entries that shipped in 0.1.1 move under a 0.1.1 heading. --- CHANGELOG.md | 54 +++++++++++++++++++++++++++++++++------------------- Cargo.toml | 2 +- 2 files changed, 35 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eead9f8..5d29ab3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,40 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [0.1.2] - 2026-11-03 + +### Fixed +- `htmlencode_startswith` compares each pattern byte against the low byte of + the decoded entity, as C's `*a != (char)cb` does, so `d́ta:` (0x341, low + byte `A`) starts with `DATA`. A URL attribute value spelling a blacklisted + scheme with out-of-range numeric entities is flagged, as in C. + +### Changed +- The C reference is libinjection 4.0.1. The `libinjection-c` submodule had + been pinned at 85e252a (February 2025) since the port began. The port follows + the detection changes since then: + - A number like `1.e` or `10.E` with no exponent digits produces no token, + as MySQL ignores it, so `1' or 1.e(1)` folds and is flagged as in C. + - `LIKE (` is read as a function only when it does not follow an operand + (number, string, bareword, variable or `)`). + - The HTML5 tokenizer reads bytes unsigned when skipping whitespace, so a + 0xFF byte is no longer taken as end of input and attributes after it are + checked. + - The XSS event-handler list follows upstream's 432 entries (145 added, 11 + removed). + - `html_decode_char_at` and the event-handler comparison mirror 4.0.1's + length guards. Verdicts are unchanged. + + 4.0.0 fixed the `htmlencode_startswith` over-read noted under 0.1.1; the + harness keeps the zero padding. Over the corpus, now 163,275 inputs, SQLi and + XSS divergences from the C library remain at 0. + +### Added +- Dependabot watches the `libinjection-c` submodule, so upstream changes open + a pull request that the differential job runs against. + +## [0.1.1] - 2026-09-12 + ### Fixed - Word merging now folds multi-word keywords by table presence, matching the C library's `ch != CHAR_NULL` check, so `LOCK IN SHARE MODE` and `IN BOOLEAN @@ -45,28 +79,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). table keeps the behaviour. - A line-coverage gate in CI (`cargo-llvm-cov`), enforcing a floor on the library. -- Dependabot watches the `libinjection-c` submodule, so upstream changes open - a pull request that the differential job runs against. ### Changed -- The C reference is libinjection 4.0.1. The `libinjection-c` submodule had - been pinned at 85e252a (February 2025) since the port began. The port follows - the detection changes since then: - - A number like `1.e` or `10.E` with no exponent digits produces no token, - as MySQL ignores it, so `1' or 1.e(1)` folds and is flagged as in C. - - `LIKE (` is read as a function only when it does not follow an operand - (number, string, bareword, variable or `)`). - - The HTML5 tokenizer reads bytes unsigned when skipping whitespace, so a - 0xFF byte is no longer taken as end of input and attributes after it are - checked. - - The XSS event-handler list follows upstream's 432 entries (145 added, 11 - removed). - - `html_decode_char_at` and the event-handler comparison mirror 4.0.1's - length guards. Verdicts are unchanged. - - 4.0.0 fixed the `htmlencode_startswith` over-read described below; the - harness keeps the zero padding. Over the corpus, now 163,275 inputs, SQLi and - XSS divergences from the C library remain at 0. - The differential fingerprint ceiling is lowered from 1,631 to 0: SQLi fingerprints now match the C library exactly across the corpus. - The FFI harness zero-pads the C input. libinjection reads a few bytes past diff --git a/Cargo.toml b/Cargo.toml index 916bd42..7247408 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -3,7 +3,7 @@ resolver = "2" members = ["libinjectionrs", "comparison-bin", "benches"] [workspace.package] -version = "0.1.1" +version = "0.1.2" edition = "2021" authors = ["William Saar "] license = "BSD-3-Clause"