Add new tests - check if variable captured

Author: airween

tests/regression/misc/25-libinjection.t

@@ -27,6 +27,34 @@
 		"some_variable=-1' and 1=1 union/* foo */select load_file('/etc/passwd')--"
 	),
 },
+{
+	type => "misc",
+	comment => "libinjection SQLi - with SQLi, check capture",
+	conf => qq(
+		SecRuleEngine On
+		SecDebugLog $ENV{DEBUG_LOG}
+		SecDebugLogLevel 9
+                SecRequestBodyAccess On
+
+		SecRule REQUEST_BODY "\@detectSQLi" "id:192372,log,deny,capture,chain"
+		SecRule TX:0 "\@strEq s&1UE"
+	),
+	match_log => {
+		error => [ qr/String match "s&1UE" at TX:0/, 1 ],
+		debug => [ qr/String match "s&1UE" at TX:0/, 1 ],
+	},
+	match_response => {
+		status => qr/^403$/,
+	},
+	request => new HTTP::Request(
+		POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/index.html",
+		[
+			"Content-Type" => "application/x-www-form-urlencoded",
+		],
+		#  Args
+		"some_variable=-1' and 1=1 union/* foo */select load_file('/etc/passwd')--"
+	),
+},
 {
 	type => "misc",
 	comment => "libinjection SQLi - without SQLi",
@@ -81,6 +109,34 @@
 		"some_variable=<a href=\"javascript:alert(1)\">"
 	),
 },
+{
+	type => "misc",
+	comment => "libinjection XSS - with XSS, check capture",
+	conf => qq(
+		SecRuleEngine On
+		SecDebugLog $ENV{DEBUG_LOG}
+		SecDebugLogLevel 9
+                SecRequestBodyAccess On
+
+		SecRule REQUEST_BODY "\@detectXSS" "id:192372,log,deny,capture,chain"
+		SecRule TX:0 "\@strEq some_variable=<a href='javascript:alert(1)'>"
+	),
+	match_log => {
+		error => [ qr/String match "some_variable=<a href='javascript:alert\(1\)'>" at TX:0/, 1],
+		debug => [ qr/String match "some_variable=<a href='javascript:alert\(1\)'>" at TX:0/, 1 ],
+	},
+	match_response => {
+		status => qr/^403$/,
+	},
+	request => new HTTP::Request(
+		POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/index.html",
+		[
+			"Content-Type" => "application/x-www-form-urlencoded",
+		],
+		#  Args
+		"some_variable=<a href='javascript:alert(1)'>"
+	),
+},
 {
 	type => "misc",
 	comment => "libinjection XSS - without XSS",