Skip to content

Commit db0a1e5

Browse files
stamparmstamparm
committed
Update for an Issue sqlmapproject#352 
1 parent d6fc100 commit db0a1e5

File tree

11 files changed

+138
-8
lines changed

11 files changed

+138
-8
lines changed

‎lib/core/common.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1480,7 +1480,7 @@ def isWindowsDriveLetterPath(filepath):
14801480
def posixToNtSlashes(filepath):
14811481
"""
14821482
Replaces all occurances of Posix slashes (/) in provided
1483-
filepath with NT ones (/)
1483+
filepath with NT ones (\)
14841484
14851485
>>> posixToNtSlashes('C:/Windows')
14861486
'C:\\\\Windows'

‎lib/core/convert.py‎

Lines changed: 80 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,33 @@
1313
from lib.core.settings import UNICODE_ENCODING
1414

1515
def base64decode(value):
16+
"""
17+
Decodes string value from Base64 to plain format
18+
19+
>>> base64decode('Zm9vYmFy')
20+
'foobar'
21+
"""
22+
1623
return value.decode("base64")
1724

1825
def base64encode(value):
26+
"""
27+
Encodes string value from plain to Base64 format
28+
29+
>>> base64encode('foobar')
30+
'Zm9vYmFy'
31+
"""
32+
1933
return value.encode("base64")[:-1].replace("\n", "")
2034

2135
def base64pickle(value):
36+
"""
37+
Serializes (with pickle) and encodes to Base64 format supplied (binary) value
38+
39+
>>> base64pickle('foobar')
40+
'gAJVBmZvb2JhcnEALg=='
41+
"""
42+
2243
retVal = None
2344
try:
2445
retVal = base64encode(pickle.dumps(value, pickle.HIGHEST_PROTOCOL))
@@ -31,21 +52,42 @@ def base64pickle(value):
3152
return retVal
3253

3354
def base64unpickle(value):
55+
"""
56+
Decodes value from Base64 to plain format and deserializes (with pickle) it's content
57+
58+
>>> base64unpickle('gAJVBmZvb2JhcnEALg==')
59+
'foobar'
60+
"""
61+
3462
return pickle.loads(base64decode(value))
3563

3664
def hexdecode(value):
65+
"""
66+
Decodes string value from hex to plain format
67+
68+
>>> hexdecode('666f6f626172')
69+
'foobar'
70+
"""
71+
3772
value = value.lower()
3873
return (value[2:] if value.startswith("0x") else value).decode("hex")
3974

4075
def hexencode(value):
76+
"""
77+
Encodes string value from plain to hex format
78+
79+
>>> hexencode('foobar')
80+
'666f6f626172'
81+
"""
82+
4183
return utf8encode(value).encode("hex")
4284

4385
def unicodeencode(value, encoding=None):
4486
"""
45-
Return 8-bit string representation of the supplied unicode value:
87+
Returns 8-bit string representation of the supplied unicode value
4688
47-
>>> unicodeencode(u'test')
48-
'test'
89+
>>> unicodeencode(u'foobar')
90+
'foobar'
4991
"""
5092

5193
retVal = value
@@ -57,16 +99,33 @@ def unicodeencode(value, encoding=None):
5799
return retVal
58100

59101
def utf8encode(value):
102+
"""
103+
Returns 8-bit string representation of the supplied UTF-8 value
104+
105+
>>> utf8encode(u'foobar')
106+
'foobar'
107+
"""
108+
60109
return unicodeencode(value, "utf-8")
61110

62111
def utf8decode(value):
63-
return value.decode("utf-8")
112+
"""
113+
Returns UTF-8 representation of the supplied 8-bit string representation
64114
65-
def htmlescape(value):
66-
codes = (('&', '&amp;'), ('<', '&lt;'), ('>', '&gt;'), ('"', '&quot;'), ("'", '&#39;'), (' ', '&nbsp;'))
67-
return reduce(lambda x, y: x.replace(y[0], y[1]), codes, value)
115+
>>> utf8decode('foobar')
116+
u'foobar'
117+
"""
118+
119+
return value.decode("utf-8")
68120

69121
def htmlunescape(value):
122+
"""
123+
Returns (basic conversion) HTML unescaped value
124+
125+
>>> htmlunescape('a&lt;b')
126+
'a<b'
127+
"""
128+
70129
retVal = value
71130
if value and isinstance(value, basestring):
72131
codes = (('&lt;', '<'), ('&gt;', '>'), ('&quot;', '"'), ('&nbsp;', ' '), ('&amp;', '&'))
@@ -103,7 +162,21 @@ def stdoutencode(data):
103162
return retVal
104163

105164
def jsonize(data):
165+
"""
166+
Returns JSON serialized data
167+
168+
>>> jsonize({'foo':'bar'})
169+
'{\\n "foo": "bar"\\n}'
170+
"""
171+
106172
return json.dumps(data, sort_keys=False, indent=4)
107173

108174
def dejsonize(data):
175+
"""
176+
Returns JSON deserialized data
177+
178+
>>> dejsonize('{\\n "foo": "bar"\\n}')
179+
{u'foo': u'bar'}
180+
"""
181+
109182
return json.loads(data)

‎plugins/dbms/db2/syntax.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ def __init__(self):
1313

1414
@staticmethod
1515
def escape(expression, quote=True):
16+
"""
17+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
18+
'SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar'
19+
"""
20+
1621
def escaper(value):
1722
return "||".join("CHR(%d)" % ord(_) for _ in value)
1823

‎plugins/dbms/firebird/syntax.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
See the file 'doc/COPYING' for copying permission
66
"""
77

8+
from lib.core.common import Backend
89
from lib.core.common import isDBMSVersionAtLeast
910
from plugins.generic.syntax import Syntax as GenericSyntax
1011

@@ -14,6 +15,17 @@ def __init__(self):
1415

1516
@staticmethod
1617
def escape(expression, quote=True):
18+
"""
19+
>>> Backend.setVersion('2.0')
20+
['2.0']
21+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
22+
"SELECT 'abcdefgh' FROM foobar"
23+
>>> Backend.setVersion('2.1')
24+
['2.1']
25+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
26+
'SELECT ASCII_CHAR(97)||ASCII_CHAR(98)||ASCII_CHAR(99)||ASCII_CHAR(100)||ASCII_CHAR(101)||ASCII_CHAR(102)||ASCII_CHAR(103)||ASCII_CHAR(104) FROM foobar'
27+
"""
28+
1729
def escaper(value):
1830
return "||".join("ASCII_CHAR(%d)" % ord(_) for _ in value)
1931

‎plugins/dbms/maxdb/syntax.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,9 @@ def __init__(self):
1313

1414
@staticmethod
1515
def escape(expression, quote=True):
16+
"""
17+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
18+
"SELECT 'abcdefgh' FROM foobar"
19+
"""
20+
1621
return expression

‎plugins/dbms/mssqlserver/syntax.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ def __init__(self):
1313

1414
@staticmethod
1515
def escape(expression, quote=True):
16+
"""
17+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
18+
'SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+CHAR(101)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar'
19+
"""
20+
1621
def escaper(value):
1722
return "+".join("%s(%d)" % ("CHAR" if ord(value[i]) < 256 else "NCHAR", ord(value[i])) for i in xrange(len(value)))
1823

‎plugins/dbms/mysql/syntax.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ def __init__(self):
1616

1717
@staticmethod
1818
def escape(expression, quote=True):
19+
"""
20+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
21+
'SELECT 0x6162636465666768 FROM foobar'
22+
"""
23+
1924
def escaper(value):
2025
retVal = None
2126
try:

‎plugins/dbms/oracle/syntax.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ def __init__(self):
1313

1414
@staticmethod
1515
def escape(expression, quote=True):
16+
"""
17+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
18+
'SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar'
19+
"""
20+
1621
def escaper(value):
1722
return "||".join("%s(%d)" % ("CHR" if ord(value[i]) < 256 else "NCHR", ord(value[i])) for i in xrange(len(value)))
1823

‎plugins/dbms/postgresql/syntax.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ def escape(expression, quote=True):
1616
"""
1717
Note: PostgreSQL has a general problem with concenation operator (||) precedence (hence the parentheses enclosing)
1818
e.g. SELECT 1 WHERE 'a'!='a'||'b' will trigger error ("argument of WHERE must be type boolean, not type text")
19+
20+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
21+
'SELECT (CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104)) FROM foobar'
1922
"""
2023

2124
def escaper(value):

‎plugins/dbms/sqlite/syntax.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
import binascii
99

10+
from lib.core.common import Backend
1011
from lib.core.common import isDBMSVersionAtLeast
1112
from lib.core.settings import UNICODE_ENCODING
1213
from plugins.generic.syntax import Syntax as GenericSyntax
@@ -17,6 +18,17 @@ def __init__(self):
1718

1819
@staticmethod
1920
def escape(expression, quote=True):
21+
"""
22+
>>> Backend.setVersion('2')
23+
['2']
24+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
25+
"SELECT 'abcdefgh' FROM foobar"
26+
>>> Backend.setVersion('3')
27+
['3']
28+
>>> Syntax.escape("SELECT 'abcdefgh' FROM foobar")
29+
"SELECT CAST(X'6162636465666768' AS TEXT) FROM foobar"
30+
"""
31+
2032
def escaper(value):
2133
# Reference: http://stackoverflow.com/questions/3444335/how-do-i-quote-a-utf-8-string-literal-in-sqlite3
2234
return "CAST(X'%s' AS TEXT)" % binascii.hexlify(value.encode(UNICODE_ENCODING) if isinstance(value, unicode) else value)

0 commit comments

Comments
 (0)