sqlmap/lib/request/direct.py

79 lines
2.6 KiB
Python
Raw Normal View History

#!/usr/bin/env python
"""
$Id$
2012-01-11 18:59:46 +04:00
Copyright (c) 2006-2012 sqlmap developers (http://www.sqlmap.org/)
2010-10-15 03:18:29 +04:00
See the file 'doc/COPYING' for copying permission
"""
import time
2012-02-27 16:55:28 +04:00
from extra.safe2bin.safe2bin import safecharencode
from lib.core.agent import agent
from lib.core.common import Backend
from lib.core.common import calculateDeltaSeconds
from lib.core.common import getCurrentThreadData
2010-06-02 16:45:40 +04:00
from lib.core.common import getUnicode
2012-02-27 16:14:01 +04:00
from lib.core.common import hashDBRetrieve
from lib.core.common import hashDBWrite
from lib.core.data import conf
from lib.core.data import kb
from lib.core.data import logger
from lib.core.enums import DBMS
from lib.core.settings import SQL_STATEMENTS
2011-01-30 14:36:03 +03:00
from lib.core.settings import UNICODE_ENCODING
2010-04-06 19:12:52 +04:00
from lib.utils.timeout import timeout
def direct(query, content=True):
select = True
query = agent.payloadDirect(query)
query = agent.adjustLateValues(query)
threadData = getCurrentThreadData()
if Backend.isDbms(DBMS.ORACLE) and query.startswith("SELECT ") and " FROM " not in query:
query = "%s FROM DUAL" % query
for sqlTitle, sqlStatements in SQL_STATEMENTS.items():
for sqlStatement in sqlStatements:
if query.lower().startswith(sqlStatement) and sqlTitle != "SQL SELECT statement":
select = False
break
if select and not query.upper().startswith("SELECT "):
query = "SELECT " + query
2011-01-16 02:28:31 +03:00
logger.log(9, query)
2012-02-27 16:14:01 +04:00
output = hashDBRetrieve(query, True, True)
start = time.time()
if not select and "EXEC " not in query:
2012-01-14 01:01:58 +04:00
_ = timeout(func=conf.dbmsConnector.execute, args=(query,), duration=conf.timeout, default=None)
2012-02-27 16:14:01 +04:00
elif not (output and "sqlmapoutput" not in query and "sqlmapfile" not in query):
output = timeout(func=conf.dbmsConnector.select, args=(query,), duration=conf.timeout, default=None)
2012-02-27 16:14:01 +04:00
hashDBWrite(query, output, True)
elif output:
infoMsg = "resumed: %s..." % getUnicode(output, UNICODE_ENCODING)[:20]
logger.info(infoMsg)
threadData.lastQueryDuration = calculateDeltaSeconds(start)
2012-01-14 01:03:50 +04:00
if not output:
return output
elif content:
2012-02-07 14:46:55 +04:00
if output and isinstance(output, (list, tuple)):
if len(output[0]) == 1:
2012-02-07 14:46:55 +04:00
if len(output) > 1:
output = map(lambda _: _[0], output)
else:
output = output[0][0]
2012-02-27 16:55:28 +04:00
retVal = getUnicode(output, noneToNull=True)
return safecharencode(retVal) if kb.safeCharEncode else retVal
else:
for line in output:
if line[0] in (1, -1):
return True
else:
return False