Objective
Deliver a pure-Zig, allocation-conscious libinjection 4.0.0 implementation with an idiomatic Zig API, compatible C ABI, pinned differential corpus, fuzzing, benchmarks, Pantry packaging, and release artifacts.
Deliverables
- Implement the complete scoped behavior without Git submodules.
- Keep public APIs explicit about ownership, resource limits, and errors.
- Add focused unit, integration, compatibility, fuzz, and benchmark coverage as applicable.
- Update documentation and machine-readable compatibility status.
Acceptance criteria
- The scoped implementation and tests are merged on
main. - Zig formatting, focused tests, and the repository CI suite pass.
- No unexplained compatibility skips, silent fallbacks, leaks, or unbounded hostile-input paths remain.
- Benchmarks or security evidence is attached when this affects a hot or untrusted path.
Relationships
- Parent: Top-level tracking epic
Blocked by
None
Blocks
None
Roadmap
- INJECT-01: Bootstrap the Zig 0.17 Pantry package
- INJECT-02: Build the pinned upstream corpus and differential harness
- INJECT-03: Implement the allocation-free SQL tokenizer and reusable state
- INJECT-04: Implement folding, keyword classification, and fingerprints
- INJECT-05: Expose the idiomatic Zig SQLi API
- INJECT-06: Implement the HTML5 tokenizer
- INJECT-07: Implement compatible XSS detection
- INJECT-08: Provide libinjection 4-compatible C symbols and headers
- INJECT-09: Add fuzzing and hostile-input resource limits
- INJECT-10: Meet or exceed libinjection performance
- INJECT-11: Publish v1.0 with Pantry metadata, SBOM, and documentation
Baselines
- Zig 0.17-dev resolved and locked through Pantry.
- ModSecurity 3.0.16, Coraza 3.7.0, CRS 4.28.0, and libinjection 4.0.0 where applicable.