sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-05-12 19:53:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

This PR adds SORTABLE_HTML to dump options for adding sort links to the tables in HTML dumps.

Browse Source
This commit is contained in:
Miroslav Stampar 2025-03-29 08:04:00 +01:00 committed by tanaydin
parent c8c7feebb0
commit 1646a072df
5 changed files with 162 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/core/dump.py
View File

@ -47,6 +47,8 @@ from lib.core.exception import SqlmapValueException
from lib.core.replication import Replication from lib.core.replication import Replication
from lib.core.settings import DUMP_FILE_BUFFER_SIZE from lib.core.settings import DUMP_FILE_BUFFER_SIZE
from lib.core.settings import HTML_DUMP_CSS_STYLE from lib.core.settings import HTML_DUMP_CSS_STYLE
from lib.core.settings import HTML_DUMP_CSS_SORTABLE_STYLE
from lib.core.settings import HTML_DUMP_SORTABLE_JAVASCRIPT
from lib.core.settings import IS_WIN from lib.core.settings import IS_WIN
from lib.core.settings import METADB_SUFFIX from lib.core.settings import METADB_SUFFIX
from lib.core.settings import MIN_BINARY_DISK_DUMP_SIZE from lib.core.settings import MIN_BINARY_DISK_DUMP_SIZE
@ -541,6 +543,9 @@ class Dump(object):
dataToDumpFile(dumpFP, "<meta name=\"generator\" content=\"%s\" />\n" % VERSION_STRING) dataToDumpFile(dumpFP, "<meta name=\"generator\" content=\"%s\" />\n" % VERSION_STRING)
dataToDumpFile(dumpFP, "<title>%s</title>\n" % ("%s%s" % ("%s." % db if METADB_SUFFIX not in db else "", table))) dataToDumpFile(dumpFP, "<title>%s</title>\n" % ("%s%s" % ("%s." % db if METADB_SUFFIX not in db else "", table)))
dataToDumpFile(dumpFP, HTML_DUMP_CSS_STYLE) dataToDumpFile(dumpFP, HTML_DUMP_CSS_STYLE)
if conf.dumpSortable:
dataToDumpFile(dumpFP, HTML_DUMP_CSS_SORTABLE_STYLE)
dataToDumpFile(dumpFP, HTML_DUMP_SORTABLE_JAVASCRIPT)
dataToDumpFile(dumpFP, "\n</head>\n<body>\n<table>\n<thead>\n<tr>\n") dataToDumpFile(dumpFP, "\n</head>\n<body>\n<table>\n<thead>\n<tr>\n")
if count == 1: if count == 1:

1
lib/core/enums.py
View File

@ -229,6 +229,7 @@ class REGISTRY_OPERATION(object):
class DUMP_FORMAT(object): class DUMP_FORMAT(object):
CSV = "CSV" CSV = "CSV"
HTML = "HTML" HTML = "HTML"
SORTABLE_HTML = "SORTABLE_HTML"
SQLITE = "SQLITE" SQLITE = "SQLITE"
class HTTP_HEADER(object): class HTTP_HEADER(object):

162
lib/core/settings.py
View File

@ -921,29 +921,163 @@ HTTP_CHUNKED_SPLIT_KEYWORDS = ("SELECT", "UPDATE", "INSERT", "FROM", "LOAD_FILE"
# CSS style used in HTML dump format # CSS style used in HTML dump format
HTML_DUMP_CSS_STYLE = """<style> HTML_DUMP_CSS_STYLE = """<style>
table{ table {
margin:10; margin: 10px;
background-color:#FFFFFF; background: #fff;
font-family:verdana; font: 12px verdana;
font-size:12px; text-align: center;
align:center;
} }
thead{ thead{
font-weight:bold; font-weight:bold;
background-color:#4F81BD; background-color:#4F81BD;
color:#FFFFFF; color: #fff;
} }
tr:nth-child(even) { tr:nth-child(even) {
background-color: #D3DFEE background-color: #D3DFEE;
}
td{
font-size:12px;
}
th{
font-size:12px;
} }
</style>""" </style>"""
HTML_DUMP_CSS_SORTABLE_STYLE = """
<style>
table thead th {
cursor: pointer;
white-space: nowrap;
position: sticky;
top: 0;
z-index: 1;
}
table thead th::after,
table thead th::before {
color: transparent;
}
table thead th::after {
margin-left: 3px;
content: "▸";
}
table thead th:hover::after,
table thead th[aria-sort]::after {
color: inherit;
}
table thead th[aria-sort=descending]::after {
content: "▾";
}
table thead th[aria-sort=ascending]::after {
content: "▴";
}
table thead th.indicator-left::before {
margin-right: 3px;
content: "▸";
}
table thead th.indicator-left[aria-sort=descending]::before {
color: inherit;
content: "▾";
}
table thead th.indicator-left[aria-sort=ascending]::before {
color: inherit;
content: "▴";
}
</style>
"""
HTML_DUMP_SORTABLE_JAVASCRIPT = """<script>
window.addEventListener('DOMContentLoaded', () => {
document.addEventListener('click', event => {
try {
const isAltSort = event.shiftKey || event.altKey;
// Find the clicked table header
const findParentElement = (element, nodeName) =>
element.nodeName === nodeName ? element : findParentElement(element.parentNode, nodeName);
const headerCell = findParentElement(event.target, 'TH');
const headerRow = headerCell.parentNode;
const thead = headerRow.parentNode;
const table = thead.parentNode;
if (thead.nodeName !== 'THEAD') return;
// Reset sort indicators on other headers
Array.from(headerRow.cells).forEach(cell => {
if (cell !== headerCell) cell.removeAttribute('aria-sort');
});
// Toggle sort direction
const currentSort = headerCell.getAttribute('aria-sort');
const isAscending = table.classList.contains('asc') && currentSort !== 'ascending';
const sortDirection = (currentSort === 'descending' || isAscending) ? 'ascending' : 'descending';
headerCell.setAttribute('aria-sort', sortDirection);
// Debounce sort operation
if (table.dataset.timer) clearTimeout(Number(table.dataset.timer));
table.dataset.timer = setTimeout(() => {
sortTable(table, isAltSort);
}, 1).toString();
} catch (error) {
console.error('Sorting error:', error);
}
});
});
function sortTable(table, useAltSort) {
table.dispatchEvent(new CustomEvent('sort-start', { bubbles: true }));
const sortHeader = table.tHead.querySelector('th[aria-sort]');
const headerRow = table.tHead.children[0];
const isAscending = sortHeader.getAttribute('aria-sort') === 'ascending';
const shouldPushEmpty = table.classList.contains('n-last');
const sortColumnIndex = Number(sortHeader.dataset.sortCol ?? sortHeader.cellIndex);
const getCellValue = cell => {
if (useAltSort) return cell.dataset.sortAlt;
return cell.dataset.sort ?? cell.textContent;
};
const compareRows = (row1, row2) => {
const value1 = getCellValue(row1.cells[sortColumnIndex]);
const value2 = getCellValue(row2.cells[sortColumnIndex]);
// Handle empty values
if (shouldPushEmpty) {
if (value1 === '' && value2 !== '') return -1;
if (value2 === '' && value1 !== '') return 1;
}
// Compare numerically if possible, otherwise use string comparison
const numericDiff = Number(value1) - Number(value2);
const comparison = isNaN(numericDiff) ?
value1.localeCompare(value2, undefined, { numeric: true }) :
numericDiff;
// Handle tiebreaker
if (comparison === 0 && headerRow.cells[sortColumnIndex]?.dataset.sortTbr) {
const tiebreakIndex = Number(headerRow.cells[sortColumnIndex].dataset.sortTbr);
return compareRows(row1, row2, tiebreakIndex);
}
return isAscending ? -comparison : comparison;
};
// Sort each tbody
Array.from(table.tBodies).forEach(tbody => {
const rows = Array.from(tbody.rows);
const sortedRows = rows.sort(compareRows);
const newTbody = tbody.cloneNode();
newTbody.append(...sortedRows);
tbody.replaceWith(newTbody);
});
table.dispatchEvent(new CustomEvent('sort-end', { bubbles: true }));
}
</script>"""
# Leaving (dirty) possibility to change values from here (e.g. `export SQLMAP__MAX_NUMBER_OF_THREADS=20`) # Leaving (dirty) possibility to change values from here (e.g. `export SQLMAP__MAX_NUMBER_OF_THREADS=20`)
for key, value in os.environ.items(): for key, value in os.environ.items():
if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX): if key.upper().startswith("%s_" % SQLMAP_ENVIRONMENT_PREFIX):

3
sqlmap.conf
View File

@ -758,9 +758,10 @@ csvDel = ,
dumpFile = dumpFile =
# Format of dumped data # Format of dumped data
# Valid: CSV, HTML or SQLITE # Valid: CSV, HTML, SORTABLE_HTML or SQLITE
dumpFormat = CSV dumpFormat = CSV
dumpSortable = False
# Force character encoding used for data retrieval. # Force character encoding used for data retrieval.
encoding = encoding =

6
sqlmap.py
View File

@ -158,6 +158,12 @@ def main():
if checkPipedInput(): if checkPipedInput():
conf.batch = True conf.batch = True
if conf.get("dumpFormat") == "SORTABLE_HTML":
conf.dumpFormat = "HTML"
conf.dumpSortable = True
else:
conf.dumpSortable = False
if conf.get("api"): if conf.get("api"):
# heavy imports # heavy imports
from lib.utils.api import StdDbOut from lib.utils.api import StdDbOut