Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6bacbdb

Browse files
bdamelebdamele
committed
Merge branch 'master' of github.com:sqlmapproject/sqlmap
2 parents 5abca52 + 9b5f335 commit 6bacbdb

5 files changed

Lines changed: 20 additions & 17 deletions

File tree

‎lib/core/common.py‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -829,6 +829,10 @@ def readInput(message, default=None, checkBatch=True):
829829
elif message[-1] == ']':
830830
message += " "
831831

832+
if kb.prependFlag:
833+
message = "\n%s" % message
834+
kb.prependFlag = False
835+
832836
if conf.answers:
833837
for item in conf.answers.split(','):
834838
question = item.split('=')[0].strip()
@@ -2814,7 +2818,7 @@ def safeSQLIdentificatorNaming(name, isTable=False):
28142818
if retVal.upper() in kb.keywords or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ("." if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal)
28152819
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS):
28162820
retVal = "`%s`" % retVal.strip("`")
2817-
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.DB2):
2821+
elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2):
28182822
retVal = "\"%s\"" % retVal.strip("\"")
28192823
elif Backend.getIdentifiedDbms() in (DBMS.MSSQL,):
28202824
retVal = "[%s]" % retVal.strip("[]")

‎lib/core/dump.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -579,9 +579,9 @@ def dbColumns(self, dbColumnsDict, colConsider, dbs):
579579

580580
for column in dbColumnsDict.keys():
581581
if colConsider == "1":
582-
colConsiderStr = "s like '" + column + "' were"
582+
colConsiderStr = "s like '%s' were" % unsafeSQLIdentificatorNaming(column)
583583
else:
584-
colConsiderStr = " '%s' was" % column
584+
colConsiderStr = " '%s' was" % unsafeSQLIdentificatorNaming(column)
585585

586586
msg = "Column%s found in the " % colConsiderStr
587587
msg += "following databases:"

‎plugins/generic/databases.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ def getTables(self, bruteForce=None):
247247
return tableExists(paths.COMMON_TABLES)
248248

249249
infoMsg = "fetching tables for database"
250-
infoMsg += "%s: '%s'" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs)))
250+
infoMsg += "%s: '%s'" % ("s" if len(dbs) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(unArrayizeValue(db)) for db in sorted(dbs)))
251251
logger.info(infoMsg)
252252

253253
rootQuery = queries[Backend.getIdentifiedDbms()].tables
@@ -261,7 +261,7 @@ def getTables(self, bruteForce=None):
261261
query += " WHERE %s" % condition
262262

263263
if conf.excludeSysDbs:
264-
infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList))
264+
infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in self.excludeDbsList))
265265
logger.info(infoMsg)
266266
query += " IN (%s)" % ",".join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs) if db not in self.excludeDbsList)
267267
else:
@@ -290,7 +290,7 @@ def getTables(self, bruteForce=None):
290290
if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct:
291291
for db in dbs:
292292
if conf.excludeSysDbs and db in self.excludeDbsList:
293-
infoMsg = "skipping system database '%s'" % db
293+
infoMsg = "skipping system database '%s'" % unsafeSQLIdentificatorNaming(db)
294294
logger.info(infoMsg)
295295

296296
continue
@@ -569,7 +569,7 @@ def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None):
569569
and conf.db in kb.data.cachedColumns and tbl in \
570570
kb.data.cachedColumns[conf.db]:
571571
infoMsg = "fetched tables' columns on "
572-
infoMsg += "database '%s'" % conf.db
572+
infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
573573
logger.info(infoMsg)
574574

575575
return {conf.db: kb.data.cachedColumns[conf.db]}
@@ -692,7 +692,7 @@ def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None):
692692

693693
if not kb.data.cachedColumns:
694694
warnMsg = "unable to retrieve column names for "
695-
warnMsg += ("table '%s' " % tblList[0]) if len(tblList) == 1 else "any table "
695+
warnMsg += ("table '%s' " % unsafeSQLIdentificatorNaming(unArrayizeValue(tblList))) if len(tblList) == 1 else "any table "
696696
warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db)
697697
logger.warn(warnMsg)
698698

‎plugins/generic/entries.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ def dumpAll(self):
363363

364364
self.dumpTable()
365365
except SqlmapNoneDataException:
366-
infoMsg = "skipping table '%s'" % table
366+
infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(table)
367367
logger.info(infoMsg)
368368

369369
def dumpFoundColumn(self, dbs, foundCols, colConsider):
@@ -378,7 +378,7 @@ def dumpFoundColumn(self, dbs, foundCols, colConsider):
378378

379379
for db, tblData in dbs.items():
380380
if tblData:
381-
message += "[%s]\n" % db
381+
message += "[%s]\n" % unsafeSQLIdentificatorNaming(db)
382382

383383
message += "[q]uit"
384384
test = readInput(message, default="a")
@@ -396,7 +396,7 @@ def dumpFoundColumn(self, dbs, foundCols, colConsider):
396396

397397
conf.db = db
398398
dumpFromTbls = []
399-
message = "which table(s) of database '%s'?\n" % db
399+
message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db)
400400
message += "[a]ll (default)\n"
401401

402402
for tbl in tblData:
@@ -441,7 +441,7 @@ def dumpFoundTables(self, tables):
441441

442442
for db, tablesList in tables.items():
443443
if tablesList:
444-
message += "[%s]\n" % db
444+
message += "[%s]\n" % unsafeSQLIdentificatorNaming(db)
445445

446446
message += "[q]uit"
447447
test = readInput(message, default="a")
@@ -459,11 +459,11 @@ def dumpFoundTables(self, tables):
459459

460460
conf.db = db
461461
dumpFromTbls = []
462-
message = "which table(s) of database '%s'?\n" % db
462+
message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db)
463463
message += "[a]ll (default)\n"
464464

465465
for tbl in tablesList:
466-
message += "[%s]\n" % tbl
466+
message += "[%s]\n" % unsafeSQLIdentificatorNaming(tbl)
467467

468468
message += "[s]kip\n"
469469
message += "[q]uit"

‎plugins/generic/search.py‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -508,7 +508,6 @@ def searchColumn(self):
508508
colQuery = colQuery % unsafeSQLIdentificatorNaming(column)
509509

510510
for db in dbData:
511-
db = safeSQLIdentificatorNaming(db)
512511
conf.db = origDb
513512
conf.tbl = origTbl
514513

@@ -519,7 +518,7 @@ def searchColumn(self):
519518
logger.info(infoMsg)
520519

521520
query = rootQuery.blind.count2
522-
query = query % db
521+
query = query % unsafeSQLIdentificatorNaming(db)
523522
query += " AND %s" % colQuery
524523
query += whereTblsQuery
525524

@@ -545,7 +544,7 @@ def searchColumn(self):
545544
else:
546545
query += " AND %s" % (colQuery + whereTblsQuery)
547546

548-
query = safeStringFormat(query, db)
547+
query = safeStringFormat(query, unsafeSQLIdentificatorNaming(db))
549548
query = agent.limitQuery(index, query)
550549

551550
tbl = unArrayizeValue(inject.getValue(query, union=False, error=False))

0 commit comments

Comments
 (0)