sqlmapproject/sqlmap
1
1
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2024-11-25 11:03:47 +03:00
Code Issues Packages Projects Releases Wiki Activity

More general approach for PostgreSQL concatenation operator precedence problem (Issue #219)

Browse Source
This commit is contained in:
Miroslav Stampar 2012-10-25 10:41:16 +02:00
parent afd82b92dd
commit ba55bed008
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
plugins/dbms/postgresql/syntax.py
View File

@ -14,6 +14,11 @@ class Syntax(GenericSyntax):
@staticmethod @staticmethod
def unescape(expression, quote=True): def unescape(expression, quote=True):
"""
Note: PostgreSQL has a general problem with concenation operator (||) precedence (hence the parentheses enclosing)
e.g. SELECT 1 WHERE 'a'!='a'||'b' will trigger error ("argument of WHERE must be type boolean, not type text")
"""
if quote: if quote:
while True: while True:
index = expression.find("'") index = expression.find("'")
@ -28,11 +33,11 @@ class Syntax(GenericSyntax):
lastIndex = firstIndex + index lastIndex = firstIndex + index
old = "'%s'" % expression[firstIndex:lastIndex] old = "'%s'" % expression[firstIndex:lastIndex]
unescaped = "||".join("CHR(%d)" % (ord(expression[i])) for i in xrange(firstIndex, lastIndex)) # Postgres CHR() function already accepts Unicode code point of character(s) unescaped = "(%s)" % "||".join("CHR(%d)" % (ord(expression[i])) for i in xrange(firstIndex, lastIndex)) # Postgres CHR() function already accepts Unicode code point of character(s)
expression = expression.replace(old, unescaped) expression = expression.replace(old, unescaped)
else: else:
expression = "||".join("CHR(%d)" % ord(c) for c in expression) expression = "(%s)" % "||".join("CHR(%d)" % ord(c) for c in expression)
return expression return expression

2
plugins/generic/databases.py
View File

@ -256,7 +256,7 @@ class Databases:
if condition: if condition:
if conf.excludeSysDbs: if conf.excludeSysDbs:
query += " WHERE " query += " WHERE "
query += " AND ".join("%s != ('%s')" % (condition, unsafeSQLIdentificatorNaming(db)) for db in self.excludeDbsList) query += " AND ".join("%s != '%s'" % (condition, unsafeSQLIdentificatorNaming(db)) for db in self.excludeDbsList)
infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList))
logger.info(infoMsg) logger.info(infoMsg)
elif not Backend.isDbms(DBMS.SQLITE): elif not Backend.isDbms(DBMS.SQLITE):