CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing some more wrong ptype values in boundaries.xml

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-20 12:22:04 +02:00
parent b0408f1bd8
commit fc9b3c9b67
3 changed files with 23 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
data/xml/boundaries.xml
View file

@ -502,7 +502,7 @@ Formats:
<level>4</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<ptype>6</ptype>
<prefix>` WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>
@ -511,7 +511,7 @@ Formats:
<level>5</level>
<clause>1</clause>
<where>1</where>
<ptype>1</ptype>
<ptype>6</ptype>
<prefix>`) WHERE [RANDNUM]=[RANDNUM]</prefix>
<suffix>[GENERIC_SQL_COMMENT]</suffix>
</boundary>

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.147"
VERSION = "1.10.7.148"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

20
tests/test_payloads_structure.py
View file

@ -105,6 +105,26 @@ class TestBoundaryEntries(unittest.TestCase):
for b in conf.boundaries:
self.assertTrue(isinstance(b.clause, (list, tuple)), msg="boundary clause not list-like")
def test_ptype_in_range(self):
# ptype feeds the recorded injection identity (report label, (place,parameter,ptype) dedup
# key, session hash) - an out-of-range value silently corrupts all three
for b in conf.boundaries:
self.assertIn(b.ptype, (1, 2, 3, 4, 5, 6), msg="boundary %r bad ptype %r" % (b.prefix, b.ptype))
def test_ptype_matches_prefix_quote(self):
# The lexical quote a prefix opens with must agree with ptype (else the injection is recorded
# under the wrong type - e.g. a backtick identifier breakout mislabelled numeric). Only the
# unambiguous cases are asserted: backtick is ALWAYS an identifier delimiter (ptype 6), and a
# leading single quote is ALWAYS a single-quoted string (ptype 2/3). Double quote is left out
# on purpose - it is a string literal (4/5) under some DBMS and an ANSI identifier (6) under
# others, so it is genuinely ambiguous from the prefix alone.
for b in conf.boundaries:
prefix = (b.prefix or "").lstrip()
if prefix.startswith('`'):
self.assertEqual(b.ptype, 6, msg="backtick prefix %r must be identifier ptype 6, got %r" % (b.prefix, b.ptype))
elif prefix.startswith("'"):
self.assertIn(b.ptype, (2, 3), msg="single-quote prefix %r must be ptype 2/3, got %r" % (b.prefix, b.ptype))
if __name__ == "__main__":
unittest.main(verbosity=2)