Skip to content

Commit 601eb1e

Browse files
stamparmstamparm
committed
Unescaping is renamed to escaping
1 parent c717de9 commit 601eb1e

File tree

37 files changed

+51
-287
lines changed

37 files changed

+51
-287
lines changed

‎extra/shutils/_sqlmap.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
'(--invalid-bignum)'--invalid-bignum'[Use big numbers for invalidating values]' \
5656
'(--invalid-logical)'--invalid-logical'[Use logical operations for invalidating values]' \
5757
'(--no-cast)'--no-cast'[Turn off payload casting mechanism]' \
58-
'(--no-unescape)'--no-unescape'[Turn off string unescaping mechanism]' \
58+
'(--no-escape)'--no-unescape'[Turn off string escaping mechanism]' \
5959
'(--prefix)'--prefix=-'[Injection payload prefix string]:PREFIX' \
6060
'(--suffix)'--suffix=-'[Injection payload suffix string]:SUFFIX' \
6161
'(--skip)'--skip=-'[Skip testing for given parameter(s)]:SKIP' \

‎lib/core/agent.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ def prefixQuery(self, expression, prefix=None, where=None, clause=None):
157157
return self.payloadDirect(expression)
158158

159159
expression = self.cleanupPayload(expression)
160-
expression = unescaper.unescape(expression)
160+
expression = unescaper.escape(expression)
161161
query = None
162162

163163
if where is None and kb.technique and kb.technique in kb.injection.data:
@@ -917,7 +917,7 @@ def forgeQueryOutputLength(self, expression):
917917
else:
918918
lengthExpr = lengthQuery % expression
919919

920-
return unescaper.unescape(lengthExpr)
920+
return unescaper.escape(lengthExpr)
921921

922922
def forgeCaseStatement(self, expression):
923923
"""

‎lib/core/common.py‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
from lib.core.convert import utf8encode
5555
from lib.core.decorators import cachedmethod
5656
from lib.core.dicts import DBMS_DICT
57-
from lib.core.dicts import DEPRECATED_HINTS
57+
from lib.core.dicts import DEPRECATED_OPTIONS
5858
from lib.core.dicts import SQL_STATEMENTS
5959
from lib.core.enums import ADJUST_TIME_DELAY
6060
from lib.core.enums import CHARSET_TYPE
@@ -84,7 +84,6 @@
8484
from lib.core.settings import DEFAULT_COOKIE_DELIMITER
8585
from lib.core.settings import DEFAULT_GET_POST_DELIMITER
8686
from lib.core.settings import DEFAULT_MSSQL_SCHEMA
87-
from lib.core.settings import DEPRECATED_OPTIONS
8887
from lib.core.settings import DESCRIPTION
8988
from lib.core.settings import DUMMY_SQL_INJECTION_CHARS
9089
from lib.core.settings import DUMMY_USER_INJECTION
@@ -3055,8 +3054,8 @@ def checkDeprecatedOptions(args):
30553054
for _ in args:
30563055
if _ in DEPRECATED_OPTIONS:
30573056
errMsg = "switch/option '%s' is deprecated" % _
3058-
if _ in DEPRECATED_HINTS:
3059-
errMsg += " (hint: %s)" % DEPRECATED_HINTS[_]
3057+
if DEPRECATED_OPTIONS[_]:
3058+
errMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_]
30603059
raise SqlmapSyntaxException(errMsg)
30613060

30623061
def evaluateCode(code, variables=None):

‎lib/core/dicts.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -202,9 +202,10 @@
202202
POST_HINT.XML: "application/xml",
203203
}
204204

205-
DEPRECATED_HINTS = {
205+
DEPRECATED_OPTIONS = {
206206
"--replicate": "use '--dump-format=SQLITE' instead",
207-
}
207+
"--no-unescape": "use '--no-escape' instead",
208+
}
208209

209210
DUMP_DATA_PREPROCESS = {
210211
DBMS.ORACLE: {"XMLTYPE": "(%s).getStringVal()"}, # Reference: https://www.tibcommunity.com/docs/DOC-3643

‎lib/core/optiondict.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
"invalidBignum": "boolean",
6666
"invalidLogical": "boolean",
6767
"noCast": "boolean",
68-
"noUnescape": "boolean",
68+
"noEscape": "boolean",
6969
"prefix": "string",
7070
"suffix": "string",
7171
"skip": "string",

‎lib/core/settings.py‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@
278278
# Maximum length used for retrieving data over MSSQL error based payload due to trimming problems with longer result strings
279279
MSSQL_ERROR_CHUNK_LENGTH = 100
280280

281-
# Do not unescape the injected statement if it contains any of the following SQL words
281+
# Do not escape the injected statement if it contains any of the following SQL keywords
282282
EXCLUDE_UNESCAPE = ("WAITFOR DELAY ", " INTO DUMPFILE ", " INTO OUTFILE ", "CREATE ", "BULK ", "EXEC ", "RECONFIGURE ", "DECLARE ", "'%s'" % CHAR_INFERENCE_MARK)
283283

284284
# Mark used for replacement of reflected values
@@ -308,9 +308,6 @@
308308
# Maximum integer value
309309
MAX_INT = sys.maxint
310310

311-
# List of deprecated options
312-
DEPRECATED_OPTIONS = ("--replicate",)
313-
314311
# Parameters to be ignored in detection phase (upper case)
315312
IGNORE_PARAMETERS = ("__VIEWSTATE", "__VIEWSTATEENCRYPTED", "__EVENTARGUMENT", "__EVENTTARGET", "__EVENTVALIDATION", "ASPSESSIONID", "ASP.NET_SESSIONID", "JSESSIONID", "CFID", "CFTOKEN")
316313

‎lib/core/unescaper.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
from lib.core.settings import EXCLUDE_UNESCAPE
1212

1313
class Unescaper(AttribDict):
14-
def unescape(self, expression, quote=True, dbms=None):
15-
if conf.noUnescape:
14+
def escape(self, expression, quote=True, dbms=None):
15+
if conf.noEscape:
1616
return expression
1717

1818
if expression is None:

‎lib/parse/cmdline.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -209,9 +209,9 @@ def cmdLineParser():
209209
action="store_true",
210210
help="Turn off payload casting mechanism")
211211

212-
injection.add_option("--no-unescape", dest="noUnescape",
212+
injection.add_option("--no-escape", dest="noEscape",
213213
action="store_true",
214-
help="Turn off string unescaping mechanism")
214+
help="Turn off string escaping mechanism")
215215

216216
injection.add_option("--prefix", dest="prefix",
217217
help="Injection payload prefix string")

‎lib/takeover/udf.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ def udfExecCmd(self, cmd, silent=False, udfName=None):
8484
if udfName is None:
8585
udfName = "sys_exec"
8686

87-
cmd = unescaper.unescape(self.udfForgeCmd(cmd))
87+
cmd = unescaper.escape(self.udfForgeCmd(cmd))
8888

8989
return inject.goStacked("SELECT %s(%s)" % (udfName, cmd), silent)
9090

@@ -103,7 +103,7 @@ def udfEvalCmd(self, cmd, first=None, last=None, udfName=None):
103103

104104
output = new_output
105105
else:
106-
cmd = unescaper.unescape(self.udfForgeCmd(cmd))
106+
cmd = unescaper.escape(self.udfForgeCmd(cmd))
107107

108108
inject.goStacked("INSERT INTO %s(%s) VALUES (%s(%s))" % (self.cmdTblName, self.tblField, udfName, cmd))
109109
output = unArrayizeValue(inject.getValue("SELECT %s FROM %s" % (self.tblField, self.cmdTblName), resumeValue=False, firstChar=first, lastChar=last, safeCharEncode=False))

‎lib/techniques/blind/inference.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,9 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
107107
_, _, _, _, _, _, fieldToCastStr, _ = agent.getFields(expression)
108108
nulledCastedField = agent.nullAndCastField(fieldToCastStr)
109109
expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1)
110-
expressionUnescaped = unescaper.unescape(expressionReplaced)
110+
expressionUnescaped = unescaper.escape(expressionReplaced)
111111
else:
112-
expressionUnescaped = unescaper.unescape(expression)
112+
expressionUnescaped = unescaper.escape(expression)
113113

114114
if length and isinstance(length, basestring) and length.isdigit():
115115
length = int(length)
@@ -234,7 +234,7 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None,
234234
else:
235235
# e.g.: ... > '%c' -> ... > ORD(..)
236236
markingValue = "'%s'" % CHAR_INFERENCE_MARK
237-
unescapedCharValue = unescaper.unescape("'%s'" % decodeIntToUnicode(posValue))
237+
unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(posValue))
238238
forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx)).replace(markingValue, unescapedCharValue)
239239

240240
result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False)
@@ -461,7 +461,7 @@ def blindThread():
461461
# it via equal against the query output
462462
if commonValue is not None:
463463
# One-shot query containing equals commonValue
464-
testValue = unescaper.unescape("'%s'" % commonValue) if "'" not in commonValue else unescaper.unescape("%s" % commonValue, quote=False)
464+
testValue = unescaper.escape("'%s'" % commonValue) if "'" not in commonValue else unescaper.escape("%s" % commonValue, quote=False)
465465
query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (expressionUnescaped, testValue)))
466466
query = agent.suffixQuery(query)
467467
result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False)
@@ -483,7 +483,7 @@ def blindThread():
483483
if commonPattern is not None:
484484
# Substring-query containing equals commonPattern
485485
subquery = queries[Backend.getIdentifiedDbms()].substring.query % (expressionUnescaped, 1, len(commonPattern))
486-
testValue = unescaper.unescape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.unescape("%s" % commonPattern, quote=False)
486+
testValue = unescaper.escape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.escape("%s" % commonPattern, quote=False)
487487
query = agent.prefixQuery(safeStringFormat("AND (%s) = %s", (subquery, testValue)))
488488
query = agent.suffixQuery(query)
489489
result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False)

0 commit comments

Comments
 (0)