Merge pull request #207 from AikidoSec/null-byte

Upgrade to latest Zen internals version

Author: bitterpanda63

Makefile

@@ -32,7 +32,7 @@ cov: check_binaries
 
 # Binaries :
 
-BASE_URL = https://github.com/AikidoSec/zen-internals/releases/download/v0.1.39
+BASE_URL = https://github.com/AikidoSec/zen-internals/releases/download/v0.1.43
 FILES = \
     libzen_internals_aarch64-apple-darwin.dylib \
     libzen_internals_aarch64-apple-darwin.dylib.sha256sum \

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/sql_injection/RustSQLInterface.java

@@ -2,29 +2,37 @@
 
 import jnr.ffi.LibraryLoader;
 import jnr.ffi.LibraryOption;
+import jnr.ffi.annotations.Encoding;
 import dev.aikido.agent_api.helpers.logging.LogManager;
 import dev.aikido.agent_api.helpers.logging.Logger;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.HashMap;
 import java.util.Map;
+import java.nio.charset.StandardCharsets;
 
 import static dev.aikido.agent_api.vulnerabilities.sql_injection.GetBinaryPath.getPathForBinary;
 
 public final class RustSQLInterface {
     private RustSQLInterface() {}
 
     private static final Logger logger = LogManager.getLogger(RustSQLInterface.class);
+
+    @Encoding("UTF-8")
     public interface SqlLib {
-        int detect_sql_injection(String query, String userinput, int dialect);
+        int detect_sql_injection(String query, long queryLen, String userinput, long userinputLen, int dialect);
     }
+
     public static boolean detectSqlInjection(String query, String userInput, Dialect dialect) {
         int dialectInteger = dialect.getDialectInteger();
         try {
             SqlLib lib = loadLibrary();
             if (lib != null) {
-                return lib.detect_sql_injection(query, userInput, dialectInteger) != 0;
+                long queryLen = query != null ? query.getBytes(StandardCharsets.UTF_8).length : 0;
+                long userInputLen = userInput != null ? userInput.getBytes(StandardCharsets.UTF_8).length : 0;
+                int result = lib.detect_sql_injection(query, queryLen, userInput, userInputLen, dialectInteger);
+                return result == 1;
             }
         } catch (Throwable e) {
             logger.trace(e);