Skip to content

Commit 9641e84

Browse files
stamparmstamparm
committed
Bug fixes for HSQLDB
1 parent fa4e867 commit 9641e84

File tree

9 files changed

+32
-12
lines changed

9 files changed

+32
-12
lines changed

‎lib/core/agent.py‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -480,7 +480,7 @@ def getFields(self, query):
480480
@rtype: C{str}
481481
"""
482482

483-
prefixRegex = r"(?:\s+(?:FIRST|SKIP)\s+\d+)*"
483+
prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT \d+)\s+\d+)*"
484484
fieldsSelectTop = re.search(r"\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", query, re.I)
485485
fieldsSelectRownum = re.search(r"\ASELECT\s+([^()]+?),\s*ROWNUM AS LIMIT FROM", query, re.I)
486486
fieldsSelectDistinct = re.search(r"\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I)
@@ -508,7 +508,10 @@ def getFields(self, query):
508508
elif fieldsSelectRownum:
509509
fieldsToCastStr = fieldsSelectRownum.groups()[0]
510510
elif fieldsSelectDistinct:
511-
fieldsToCastStr = fieldsSelectDistinct.groups()[0]
511+
if Backend.getDbms() in (DBMS.HSQLDB,):
512+
fieldsToCastStr = fieldsNoSelect
513+
else:
514+
fieldsToCastStr = fieldsSelectDistinct.groups()[0]
512515
elif fieldsSelectCase:
513516
fieldsToCastStr = fieldsSelectCase.groups()[0]
514517
elif fieldsSelectFrom:
@@ -888,6 +891,10 @@ def limitQuery(self, num, query, field=None, uniqueField=None):
888891
limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1)
889892
limitedQuery += " %s" % limitStr
890893

894+
elif Backend.isDbms(DBMS.HSQLDB):
895+
limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (1, num)
896+
limitedQuery += " %s" % limitStr
897+
891898
elif Backend.isDbms(DBMS.FIREBIRD):
892899
limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num + 1, num + 1)
893900
limitedQuery += " %s" % limitStr

‎lib/core/dump.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ def currentUser(self, data):
160160
def currentDb(self, data):
161161
if Backend.isDbms(DBMS.MAXDB):
162162
self.string("current database (no practical usage on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
163-
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL):
163+
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB):
164164
self.string("current schema (equivalent to database on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB)
165165
else:
166166
self.string("current database", data, content_type=CONTENT_TYPE.CURRENT_DB)

‎lib/core/settings.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,8 @@
222222
REFERER_ALIASES = ("ref", "referer", "referrer")
223223
HOST_ALIASES = ("host",)
224224

225+
HSQLDB_DEFAULT_SCHEMA = "PUBLIC"
226+
225227
# Names that can't be used to name files on Windows OS
226228
WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9")
227229

‎plugins/dbms/hsqldb/enumeration.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
from lib.core.data import queries
1313
from lib.core.common import Backend
1414
from lib.core.common import unArrayizeValue
15+
from lib.core.settings import HSQLDB_DEFAULT_SCHEMA
1516
from lib.request import inject
1617

1718
class Enumeration(GenericEnumeration):
@@ -40,3 +41,6 @@ def getPrivileges(self, *args):
4041
def getHostname(self):
4142
warnMsg = "on HSQLDB it is not possible to enumerate the hostname"
4243
logger.warn(warnMsg)
44+
45+
def getCurrentDb(self):
46+
return HSQLDB_DEFAULT_SCHEMA

‎plugins/generic/databases.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -674,7 +674,7 @@ def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMod
674674
continue
675675

676676
for index in getLimitRange(count):
677-
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
677+
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB):
678678
query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db))
679679
query += condQuery
680680
field = None

‎plugins/generic/entries.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -296,7 +296,7 @@ def dumpTable(self, foundData=None):
296296
if column not in entries:
297297
entries[column] = BigArray()
298298

299-
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL):
299+
if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB):
300300
query = rootQuery.blind.query % (agent.preprocessField(tbl, column), conf.db, conf.tbl, sorted(colList, key=len)[0], index)
301301
elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2):
302302
query = rootQuery.blind.query % (agent.preprocessField(tbl, column),

‎txt/common-columns.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2596,3 +2596,7 @@ tmp_lahir
25962596
universitas
25972597
urut
25982598
waktu
2599+
2600+
# WebGoat
2601+
cookie
2602+
login_count

‎txt/common-tables.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3366,3 +3366,6 @@ tuser
33663366
tusers
33673367
userstbl
33683368
usertbl
3369+
3370+
# WebGoat
3371+
user_data

‎xml/queries.xml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -652,7 +652,7 @@
652652
<length query="CHAR_LENGTH(%s)"/>
653653
<isnull query="IFNULL(%s,' ')"/>
654654
<delimiter query=","/>
655-
<limit query="LIMIT %d %d"/>
655+
<limit query="LIMIT %d OFFSET %d"/>
656656
<limitregexp query="\s+LIMIT\s+([\d]+)\s*\,\s*([\d]+)" query2="\s+LIMIT\s+([\d]+)"/>
657657
<limitgroupstart query="1"/>
658658
<limitgroupstop query="2"/>
@@ -675,30 +675,30 @@
675675
<check_udf/>
676676
<users>
677677
<!-- LIMIT is needed at start for v1.7 this gets mangled unless no-cast is used -->
678-
<blind query="SELECT LIMIT %d 1 DISTINCT(user) FROM INFORMATION_SCHEMA.SYSTEM_USERS" count="SELECT COUNT(DISTINCT(user)) FROM INFORMATION_SCHEMA.SYSTEM_USERS"/>
678+
<blind query="SELECT LIMIT %d 1 DISTINCT(user) FROM INFORMATION_SCHEMA.SYSTEM_USERS ORDER BY user" count="SELECT COUNT(DISTINCT(user)) FROM INFORMATION_SCHEMA.SYSTEM_USERS"/>
679679
<inband query="SELECT user FROM INFORMATION_SCHEMA.SYSTEM_USERS"/>
680680
</users>
681681
<passwords>
682682
<!-- Passwords only shown in later versions &gt;=2.0 -->
683-
<blind query="SELECT LIMIT %d 1 DISTINCT(password_digest) FROM INFORMATION_SCHEMA.SYSTEM_USERS WHERE user_name='%s'" count="SELECT COUNT(DISTINCT(password_digest)) FROM INFORMATION_SCHEMA.SYSTEM_USERS WHERE user_name='%s'"/>
683+
<blind query="SELECT LIMIT %d 1 DISTINCT(password_digest) FROM INFORMATION_SCHEMA.SYSTEM_USERS WHERE user_name='%s' ORDER BY password_digest" count="SELECT COUNT(DISTINCT(password_digest)) FROM INFORMATION_SCHEMA.SYSTEM_USERS WHERE user_name='%s'"/>
684684
<inband query="SELECT user_name,password_digest FROM INFORMATION_SCHEMA.SYSTEM_USERS" condition="user_name"/>
685685
</passwords>
686686
<privileges/>
687687
<roles/>
688688
<dbs>
689-
<blind query="SELECT LIMIT %d 1 DISTINCT(table_schem) FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS" count="SELECT COUNT(table_schem) FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS"/>
689+
<blind query="SELECT LIMIT %d 1 DISTINCT(table_schem) FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS ORDER BY table_schem" count="SELECT COUNT(table_schem) FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS"/>
690690
<inband query="SELECT table_schem FROM INFORMATION_SCHEMA.SYSTEM_SCHEMAS" />
691691
</dbs>
692692
<tables>
693-
<blind query="SELECT LIMIT %d 1 table_name FROM INFORMATION_SCHEMA.SYSTEM_TABLES WHERE table_schem='%s' " count="SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.SYSTEM_TABLES WHERE table_schem='%s'"/>
693+
<blind query="SELECT LIMIT %d 1 table_name FROM INFORMATION_SCHEMA.SYSTEM_TABLES WHERE table_schem='%s' ORDER BY table_name" count="SELECT COUNT(table_name) FROM INFORMATION_SCHEMA.SYSTEM_TABLES WHERE table_schem='%s'"/>
694694
<inband query="SELECT table_schem,table_name FROM INFORMATION_SCHEMA.SYSTEM_TABLES" condition="table_schem"/>
695695
</tables>
696696
<columns>
697-
<blind query="SELECT column_name FROM INFORMATION_SCHEMA.SYSTEM_COLUMNS WHERE table_name='%s' AND table_schem='%s'" query2="SELECT column_type FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='%s' AND column_name='%s' AND table_schema='%s'" count="SELECT COUNT(column_name) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name='%s' AND table_schema='%s'" condition="column_name"/>
697+
<blind query="SELECT column_name FROM INFORMATION_SCHEMA.SYSTEM_COLUMNS WHERE table_name='%s' AND table_schem='%s' ORDER BY column_name" query2="SELECT column_type FROM INFORMATION_SCHEMA.SYSTEM_COLUMNS WHERE table_name='%s' AND column_name='%s' AND table_schem='%s'" count="SELECT COUNT(column_name) FROM INFORMATION_SCHEMA.SYSTEM_COLUMNS WHERE table_name='%s' AND table_schem='%s'" condition="column_name"/>
698698
<inband query="SELECT column_name,type_name FROM INFORMATION_SCHEMA.SYSTEM_COLUMNS WHERE table_name='%s' AND table_schem='%s'" condition="column_name"/>
699699
</columns>
700700
<dump_table>
701-
<blind query="SELECT LIMIT %d 1 %s FROM %s.%s ORDER BY %s " count="SELECT COUNT(*) FROM %s.%s"/>
701+
<blind query="SELECT %s FROM %s.%s ORDER BY %s LIMIT 1 OFFSET %d" count="SELECT COUNT(*) FROM %s.%s"/>
702702
<inband query="SELECT %s FROM %s.%s ORDER BY %s"/>
703703
</dump_table>
704704
<search_db>

0 commit comments

Comments
 (0)