Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3b3b8d4

Browse files
stamparmstamparm
committed
Potential bug fix (escaping formatted regular expressions)
1 parent 268e774 commit 3b3b8d4

6 files changed

Lines changed: 15 additions & 15 deletions

File tree

‎lib/core/common.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1286,7 +1286,7 @@ def expandAsteriskForColumns(expression):
12861286
if expression != conf.query:
12871287
conf.db = db
12881288
else:
1289-
expression = re.sub(r"([^\w])%s" % conf.tbl, "\g<1>%s.%s" % (conf.db, conf.tbl), expression)
1289+
expression = re.sub(r"([^\w])%s" % re.escape(conf.tbl), "\g<1>%s.%s" % (conf.db, conf.tbl), expression)
12901290
else:
12911291
conf.db = db
12921292
conf.db = safeSQLIdentificatorNaming(conf.db)
@@ -2503,11 +2503,11 @@ def removeDynamicContent(page):
25032503
if prefix is None and suffix is None:
25042504
continue
25052505
elif prefix is None:
2506-
page = re.sub(r'(?s)^.+%s' % suffix, suffix, page)
2506+
page = re.sub(r'(?s)^.+%s' % re.escape(suffix), suffix, page)
25072507
elif suffix is None:
2508-
page = re.sub(r'(?s)%s.+$' % prefix, prefix, page)
2508+
page = re.sub(r'(?s)%s.+$' % re.escape(prefix), prefix, page)
25092509
else:
2510-
page = re.sub(r'(?s)%s.+%s' % (prefix, suffix), '%s%s' % (prefix, suffix), page)
2510+
page = re.sub(r'(?s)%s.+%s' % (re.escape(prefix), re.escape(suffix)), '%s%s' % (prefix, suffix), page)
25112511

25122512
return page
25132513

‎lib/core/option.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ def _parseBurpLog(content):
233233
for match in re.finditer(BURP_XML_HISTORY_REGEX, content, re.I | re.S):
234234
port, request = match.groups()
235235
request = request.decode("base64")
236-
_ = re.search(r"%s:.+" % HTTP_HEADER.HOST, request)
236+
_ = re.search(r"%s:.+" % re.escape(HTTP_HEADER.HOST), request)
237237
if _:
238238
host = _.group(0).strip()
239239
if not re.search(r":\d+\Z", host):

‎lib/parse/banner.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ def characters(self, data):
6363
def endElement(self, name):
6464
if name == "signature":
6565
for version in (self._version, self._versionAlt):
66-
if version and re.search(r" %s[\.\ ]+" % version, self._banner):
66+
if version and re.search(r" %s[\.\ ]+" % re.escape(version), self._banner):
6767
self._feedInfo("dbmsRelease", self._release)
6868
self._feedInfo("dbmsVersion", self._version)
6969
self._feedInfo("dbmsServicePack", self._servicePack)

‎lib/request/connect.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -752,14 +752,14 @@ def queryPage(value=None, place=None, content=False, getRatioValue=False, silent
752752
if conf.csrfToken:
753753
def _adjustParameter(paramString, parameter, newValue):
754754
retVal = paramString
755-
match = re.search("%s=(?P<value>[^&]*)" % parameter, paramString)
755+
match = re.search("%s=(?P<value>[^&]*)" % re.escape(parameter), paramString)
756756
if match:
757757
origValue = match.group("value")
758-
retVal = re.sub("%s=[^&]*" % parameter, "%s=%s" % (parameter, newValue), paramString)
758+
retVal = re.sub("%s=[^&]*" % re.escape(parameter), "%s=%s" % (parameter, newValue), paramString)
759759
return retVal
760760

761761
page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST))
762-
match = re.search(r"<input[^>]+name=[\"']?%s[\"']?\s[^>]*value=(\"([^\"]+)|'([^']+)|([^ >]+))" % conf.csrfToken, page or "")
762+
match = re.search(r"<input[^>]+name=[\"']?%s[\"']?\s[^>]*value=(\"([^\"]+)|'([^']+)|([^ >]+))" % re.escape(conf.csrfToken), page or "")
763763
token = (match.group(2) or match.group(3) or match.group(4)) if match else None
764764

765765
if not token:
@@ -802,10 +802,10 @@ def _adjustParameter(paramString, parameter, newValue):
802802
if conf.rParam:
803803
def _randomizeParameter(paramString, randomParameter):
804804
retVal = paramString
805-
match = re.search("%s=(?P<value>[^&;]+)" % randomParameter, paramString)
805+
match = re.search("%s=(?P<value>[^&;]+)" % re.escape(randomParameter), paramString)
806806
if match:
807807
origValue = match.group("value")
808-
retVal = re.sub("%s=[^&;]+" % randomParameter, "%s=%s" % (randomParameter, randomizeParameterValue(origValue)), paramString)
808+
retVal = re.sub("%s=[^&;]+" % re.escape(randomParameter), "%s=%s" % (randomParameter, randomizeParameterValue(origValue)), paramString)
809809
return retVal
810810

811811
for randomParameter in conf.rParam:
@@ -847,7 +847,7 @@ def _randomizeParameter(paramString, randomParameter):
847847
found = False
848848
value = unicode(value)
849849

850-
regex = r"((\A|%s)%s=).+?(%s|\Z)" % (re.escape(delimiter), name, re.escape(delimiter))
850+
regex = r"((\A|%s)%s=).+?(%s|\Z)" % (re.escape(delimiter), re.escape(name), re.escape(delimiter))
851851
if re.search(regex, (get or "")):
852852
found = True
853853
get = re.sub(regex, "\g<1>%s\g<3>" % value, get)

‎lib/utils/pivotdumptable.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ def pivotDumpTable(table, colList, count=None, blind=True):
6464
colList = filter(None, sorted(colList, key=lambda x: len(x) if x else MAX_INT))
6565

6666
if conf.pivotColumn:
67-
if any(re.search(r"(.+\.)?%s" % conf.pivotColumn, _, re.I) for _ in colList):
67+
if any(re.search(r"(.+\.)?%s" % re.escape(conf.pivotColumn), _, re.I) for _ in colList):
6868
infoMsg = "using column '%s' as a pivot " % conf.pivotColumn
6969
infoMsg += "for retrieving row data"
7070
logger.info(infoMsg)
@@ -173,7 +173,7 @@ def whereQuery(query):
173173
prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "")
174174

175175
if "%s)" % conf.tbl.upper() in prefix.upper():
176-
prefix = re.sub(r"(?i)%s\)" % conf.tbl, "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
176+
prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix)
177177
elif re.search(r"(?i)\bWHERE\b", prefix):
178178
prefix += " AND %s" % conf.dumpWhere
179179
else:

‎plugins/generic/entries.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ def dumpTable(self, foundData=None):
147147
for column in colList:
148148
_ = agent.preprocessField(tbl, column)
149149
if _ != column:
150-
colString = re.sub(r"\b%s\b" % column, _, colString)
150+
colString = re.sub(r"\b%s\b" % re.escape(column), _, colString)
151151

152152
entriesCount = 0
153153

0 commit comments

Comments
 (0)