sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2025-02-17 03:50:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

Oracle supports inline comments too (Issue #267)

Browse Source
This commit is contained in:
Miroslav Stampar 2012-12-10 12:00:15 +01:00
parent a024884ca7
commit 5606a860ce
1 changed files with 11 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/request/connect.py
View File

@ -18,7 +18,6 @@ import traceback
from extra.safe2bin.safe2bin import safecharencode from extra.safe2bin.safe2bin import safecharencode
from lib.core.agent import agent from lib.core.agent import agent
from lib.core.common import asciifyUrl from lib.core.common import asciifyUrl
from lib.core.common import Backend
from lib.core.common import calculateDeltaSeconds from lib.core.common import calculateDeltaSeconds
from lib.core.common import clearConsoleLine from lib.core.common import clearConsoleLine
from lib.core.common import cpuThrottle from lib.core.common import cpuThrottle
@ -44,7 +43,6 @@ from lib.core.data import logger
from lib.core.dicts import POST_HINT_CONTENT_TYPES from lib.core.dicts import POST_HINT_CONTENT_TYPES
from lib.core.enums import ADJUST_TIME_DELAY from lib.core.enums import ADJUST_TIME_DELAY
from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import CUSTOM_LOGGING
from lib.core.enums import DBMS
from lib.core.enums import HTTPHEADER from lib.core.enums import HTTPHEADER
from lib.core.enums import HTTPMETHOD from lib.core.enums import HTTPMETHOD
from lib.core.enums import NULLCONNECTION from lib.core.enums import NULLCONNECTION
@ -632,7 +630,6 @@ class Connect(object):
match = re.search("(\w+)=%s(.+?)%s" % (_, _), value) match = re.search("(\w+)=%s(.+?)%s" % (_, _), value)
if match: if match:
parameter, content = match.groups() parameter, content = match.groups()
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.MSSQL, DBMS.PGSQL): # DBMSes that support inline comments
for splitter in (urlencode(' '), ' '): for splitter in (urlencode(' '), ' '):
if splitter in content: if splitter in content:
prefix, suffix = ("*/", "/*") if splitter == ' ' else (urlencode(_) for _ in ("*/", "/*")) prefix, suffix = ("*/", "/*") if splitter == ' ' else (urlencode(_) for _ in ("*/", "/*"))
@ -644,15 +641,6 @@ class Connect(object):
payload = "".join(parts) payload = "".join(parts)
value = agent.replacePayload(value, payload) value = agent.replacePayload(value, payload)
break break
else:
for splitter in (urlencode(','), ','): # generic
if splitter in content:
parts = content.split(splitter)
for i in xrange(1, len(parts)):
parts[i] = "%s%s=%s" % (DEFAULT_GET_POST_DELIMITER, parameter, parts[i])
payload = "".join(parts)
value = agent.replacePayload(value, payload)
break
else: else:
warnMsg = "HTTP parameter pollution works only with regular " warnMsg = "HTTP parameter pollution works only with regular "
warnMsg += "GET and POST parameters" warnMsg += "GET and POST parameters"