Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5f17134

Browse files
stamparmstamparm
committed
introduced safe string formatting
1 parent dcf0b2a commit 5f17134

5 files changed

Lines changed: 31 additions & 9 deletions

File tree

‎lib/core/common.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@
4141
from lib.core.data import temp
4242
from lib.core.convert import urlencode
4343
from lib.core.exception import sqlmapFilePathException
44+
from lib.core.exception import sqlmapNoneDataException
4445
from lib.core.settings import IS_WIN
4546
from lib.core.settings import SQL_STATEMENTS
4647
from lib.core.settings import VERSION_STRING
@@ -847,3 +848,20 @@ def normalizePath(path):
847848
else:
848849
retVal = ntpath.normpath(path)
849850
return retVal
851+
852+
def safeStringFormat(formatStr, params):
853+
index = 0
854+
count = 0
855+
856+
retVal = formatStr.replace('%d', '%s')
857+
858+
while index !=- 1:
859+
index = retVal.find('%s')
860+
if index != -1:
861+
if count < len(params):
862+
retVal = retVal[:index] + str(params[count]) + retVal[index+2:]
863+
else:
864+
raise sqlmapNoneDataException, "wrong number of parameters during string formatting"
865+
count += 1
866+
867+
return retVal

‎lib/techniques/blind/inference.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
from lib.core.common import dataToStdout
3232
from lib.core.common import getCharset
3333
from lib.core.common import replaceNewlineTabs
34+
from lib.core.common import safeStringFormat
3435
from lib.core.data import conf
3536
from lib.core.data import kb
3637
from lib.core.data import logger
@@ -117,7 +118,7 @@ def getChar(idx, asciiTbl=asciiTbl):
117118
queriesCount[0] += 1
118119
position = (len(asciiTbl) / 2)
119120
posValue = asciiTbl[position]
120-
forgedPayload = payload % (expressionUnescaped, idx, posValue)
121+
forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx, posValue))
121122
result = Request.queryPage(forgedPayload)
122123

123124
if result:

‎lib/techniques/inband/union/test.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
from lib.core.agent import agent
2626
from lib.core.common import randomStr
27+
from lib.core.common import safeStringFormat
2728
from lib.core.data import conf
2829
from lib.core.data import kb
2930
from lib.core.data import logger
@@ -121,7 +122,7 @@ def __forgeUserFriendlyValue(payload):
121122
value = ""
122123

123124
if kb.injPlace == "GET":
124-
value = "%s?%s" % (conf.url, payload)
125+
value = safeStringFormat("%s?%s", (conf.url, payload))
125126
elif kb.injPlace == "POST":
126127
value = "URL:\t'%s'" % conf.url
127128
value += "\nPOST:\t'%s'\n" % payload
@@ -202,7 +203,7 @@ def unionTest():
202203
technique = "NULL bruteforcing"
203204

204205
infoMsg = "testing inband sql injection on parameter "
205-
infoMsg += "'%s' with %s technique" % (kb.injParameter, technique)
206+
infoMsg += safeStringFormat("'%s' with %s technique", (kb.injParameter, technique))
206207
logger.info(infoMsg)
207208

208209
value = ""

‎lib/techniques/inband/union/use.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727

2828
from lib.core.agent import agent
2929
from lib.core.common import parseUnionPage
30+
from lib.core.common import safeStringFormat
3031
from lib.core.data import conf
3132
from lib.core.data import kb
3233
from lib.core.data import logger

‎lib/utils/resume.py‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import re
2626

2727
from lib.core.common import dataToSessionFile
28+
from lib.core.common import safeStringFormat
2829
from lib.core.data import conf
2930
from lib.core.data import kb
3031
from lib.core.data import logger
@@ -74,7 +75,7 @@ def queryOutputLength(expression, payload):
7475
if output:
7576
return 0, output, regExpr
7677

77-
dataToSessionFile("[%s][%s][%s][%s][" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], lengthExpr))
78+
dataToSessionFile(safeStringFormat("[%s][%s][%s][%s][", (conf.url, kb.injPlace, conf.parameters[kb.injPlace], lengthExpr)))
7879

7980
lengthExprUnescaped = unescaper.unescape(lengthExpr)
8081
count, length = bisection(payload, lengthExprUnescaped)
@@ -144,20 +145,20 @@ def resume(expression, payload):
144145
infoMsg += "%s" % resumedValue.split("\n")[0]
145146
logger.info(infoMsg)
146147

147-
dataToSessionFile("[%s][%s][%s][%s][%s]\n" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], expression, resumedValue))
148+
dataToSessionFile(safeStringFormat("[%s][%s][%s][%s][%s]\n", (conf.url, kb.injPlace, conf.parameters[kb.injPlace], expression, resumedValue)))
148149

149150
return resumedValue
150151
elif len(resumedValue) < int(length):
151152
infoMsg = "resumed from file '%s': " % conf.sessionFile
152153
infoMsg += "%s..." % resumedValue.split("\n")[0]
153154
logger.info(infoMsg)
154155

155-
dataToSessionFile("[%s][%s][%s][%s][%s" % (conf.url, kb.injPlace, conf.parameters[kb.injPlace], expression, resumedValue))
156+
dataToSessionFile(safeStringFormat("[%s][%s][%s][%s][%s", (conf.url, kb.injPlace, conf.parameters[kb.injPlace], expression, resumedValue)))
156157

157158
if select:
158-
newExpr = expression.replace(regExpr, substringQuery % (regExpr, len(resumedValue) + 1, int(length)), 1)
159+
newExpr = expression.replace(regExpr, safeStringFormat(substringQuery, (regExpr, len(resumedValue) + 1, int(length))), 1)
159160
else:
160-
newExpr = substringQuery % (expression, len(resumedValue) + 1, int(length))
161+
newExpr = safeStringFormat(substringQuery, (expression, len(resumedValue) + 1, int(length)))
161162

162163
missingCharsLength = int(length) - len(resumedValue)
163164

@@ -175,6 +176,6 @@ def resume(expression, payload):
175176

176177
return None
177178

178-
return "%s%s" % (resumedValue, finalValue)
179+
return safeStringFormat("%s%s", (resumedValue, finalValue))
179180

180181
return None

0 commit comments

Comments
 (0)