GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — sqlmap/tests/test_comparison.py at master · sqlmapproject/sqlmap Expand file tree/ Copy pathtest_comparison.pyMore file actions 132 lines (95 loc) · 4.16 KB / Copy pathtest_comparison.pyFile metadata and controls132 lines (95 loc) · 4.16 KB 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 #!/usr/bin/env python """ Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org) See the file 'LICENSE' for copying permission The true/false/None response oracle (lib/request/comparison.py). The seqMatcher ratio path needs a live page template and is intentionally left to --vuln. What IS pure and worth pinning here is the short-circuit decision table: --string / --not-string / --regexp / --code matching, and the _adjust() negative-logic flip. These are the rules that decide whether a payload counts as True, and they are easy to break with a refactor. """ import os import sys import unittest sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) from _testutils import bootstrap bootstrap() from lib.request.comparison import comparison, _adjust from lib.core.common import removeReflectiveValues from lib.core.settings import REFLECTED_VALUE_MARKER from lib.core.data import conf, kb def _reset_match_conf(): conf.string = conf.notString = conf.regexp = conf.code = None class TestStringMatch(unittest.TestCase): def setUp(self): _reset_match_conf() kb.negativeLogic = False def tearDown(self): _reset_match_conf() def test_string_present_is_true(self): conf.string = "WELCOME" self.assertTrue(comparison("xx WELCOME yy", None, code=200)) def test_string_absent_is_false(self): conf.string = "WELCOME" self.assertFalse(comparison("nothing here", None, code=200)) class TestRegexpMatch(unittest.TestCase): def setUp(self): _reset_match_conf() kb.negativeLogic = False def tearDown(self): _reset_match_conf() def test_regexp_match_is_true(self): conf.regexp = "id=\\d+" self.assertTrue(comparison("user id=42 ok", None, code=200)) def test_regexp_nomatch_is_false(self): conf.regexp = "id=\\d+" self.assertFalse(comparison("user name", None, code=200)) class TestCodeMatch(unittest.TestCase): def setUp(self): _reset_match_conf() kb.negativeLogic = False def tearDown(self): _reset_match_conf() def test_code_match_is_true(self): conf.code = 200 self.assertTrue(comparison("body", None, code=200)) def test_code_mismatch_is_false(self): conf.code = 200 self.assertFalse(comparison("body", None, code=404)) class TestAdjustNegativeLogic(unittest.TestCase): """_adjust flips the condition under negative logic (the raw-page scheme), but leaves None untouched and never flips when getRatioValue is requested.""" def setUp(self): _reset_match_conf() # negative logic only applies with no string/regexp/code set def tearDown(self): _reset_match_conf() kb.negativeLogic = False def test_plain_passthrough(self): kb.negativeLogic = False self.assertEqual(_adjust(True, False), True) self.assertEqual(_adjust(False, False), False) def test_negative_logic_flips(self): kb.negativeLogic = True self.assertEqual(_adjust(True, False), False) self.assertEqual(_adjust(False, False), True) def test_negative_logic_leaves_none(self): kb.negativeLogic = True self.assertIsNone(_adjust(None, False)) class TestRemoveReflectiveValues(unittest.TestCase): """Reflected payloads are masked before comparison so a page echoing the injected string isn't mistaken for a True/different response. Note: the masking engages for *bordered* payloads (containing non-alpha chars), which is what real injection payloads look like.""" def test_reflected_payload_is_masked(self): out = removeReflectiveValues(u"id=1 UNION SELECT 1,2,3 end", u"1 UNION SELECT 1,2,3") self.assertIn(REFLECTED_VALUE_MARKER, out) self.assertNotIn(u"UNION SELECT 1,2,3", out) def test_not_reflected_unchanged(self): content = u"<html>nothing reflected here</html>" self.assertEqual(removeReflectiveValues(content, u"1 AND 1=1"), content) def test_none_payload_unchanged(self): content = u"id=1 AND 1=1 end" self.assertEqual(removeReflectiveValues(content, None), content) if __name__ == "__main__": unittest.main(verbosity=2) |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |