1 | package com.jsql.model.injection.strategy; | |
2 | ||
3 | import com.jsql.model.InjectionModel; | |
4 | import com.jsql.model.accessible.DataAccess; | |
5 | import com.jsql.model.bean.util.Interaction; | |
6 | import com.jsql.model.bean.util.Request; | |
7 | import com.jsql.model.exception.JSqlException; | |
8 | import com.jsql.model.injection.vendor.model.VendorYaml; | |
9 | import com.jsql.model.suspendable.AbstractSuspendable; | |
10 | import com.jsql.model.suspendable.SuspendableGetIndexes; | |
11 | import com.jsql.util.I18nUtil; | |
12 | import com.jsql.util.LogLevelUtil; | |
13 | import com.jsql.util.StringUtil; | |
14 | import org.apache.commons.lang3.StringUtils; | |
15 | import org.apache.logging.log4j.LogManager; | |
16 | import org.apache.logging.log4j.Logger; | |
17 | ||
18 | import java.util.ArrayList; | |
19 | import java.util.Arrays; | |
20 | import java.util.Comparator; | |
21 | import java.util.List; | |
22 | import java.util.regex.Pattern; | |
23 | ||
24 | public class StrategyUnion extends AbstractStrategy { | |
25 | | |
26 | private static final Logger LOGGER = LogManager.getRootLogger(); | |
27 | ||
28 | protected String visibleIndex; // matching index | |
29 | protected String sourceIndexesFound = StringUtils.EMPTY; // matching page source | |
30 | private int nbIndexesFound = 0; | |
31 | ||
32 | private String performanceLength = "0"; | |
33 | | |
34 | public StrategyUnion(InjectionModel injectionModel) { | |
35 | super(injectionModel); | |
36 | } | |
37 | ||
38 | @Override | |
39 | public void checkApplicability() throws JSqlException { | |
40 |
1
1. checkApplicability : negated conditional → NO_COVERAGE |
if (this.injectionModel.getMediatorUtils().getPreferencesUtil().isStrategyUnionDisabled()) { |
41 | LOGGER.log(LogLevelUtil.CONSOLE_INFORM, AbstractStrategy.FORMAT_SKIP_STRATEGY_DISABLED, this.getName()); | |
42 | return; | |
43 | } | |
44 | ||
45 |
1
1. checkApplicability : removed call to com/jsql/model/injection/strategy/StrategyUnion::logChecking → NO_COVERAGE |
this.logChecking(); |
46 | ||
47 |
1
1. checkApplicability : removed call to com/jsql/model/InjectionModel::setIndexesInUrl → NO_COVERAGE |
this.injectionModel.setIndexesInUrl(new SuspendableGetIndexes(this.injectionModel).run()); |
48 | ||
49 | // Define visibleIndex, i.e, 2 in "..union select 1,2,..", if 2 is found in HTML body | |
50 |
1
1. checkApplicability : negated conditional → NO_COVERAGE |
if (StringUtils.isNotEmpty(this.injectionModel.getIndexesInUrl())) { |
51 | this.visibleIndex = this.getVisibleIndex(this.sourceIndexesFound); | |
52 | } | |
53 | | |
54 |
1
1. checkApplicability : negated conditional → NO_COVERAGE |
this.isApplicable = StringUtils.isNotEmpty(this.injectionModel.getIndexesInUrl()) |
55 |
2
1. checkApplicability : changed conditional boundary → NO_COVERAGE 2. checkApplicability : negated conditional → NO_COVERAGE |
&& Integer.parseInt(this.injectionModel.getMediatorStrategy().getUnion().getPerformanceLength()) > 0 |
56 |
1
1. checkApplicability : negated conditional → NO_COVERAGE |
&& StringUtils.isNotBlank(this.visibleIndex); |
57 | | |
58 |
1
1. checkApplicability : negated conditional → NO_COVERAGE |
if (this.isApplicable) { |
59 | LOGGER.log( | |
60 | LogLevelUtil.CONSOLE_SUCCESS, | |
61 | "{} [{}] at index [{}] showing [{}] characters", | |
62 |
1
1. lambda$checkApplicability$0 : replaced return value with null for com/jsql/model/injection/strategy/StrategyUnion::lambda$checkApplicability$0 → NO_COVERAGE |
() -> I18nUtil.valueByKey("LOG_VULNERABLE"), |
63 | this::getName, | |
64 |
1
1. lambda$checkApplicability$1 : replaced return value with null for com/jsql/model/injection/strategy/StrategyUnion::lambda$checkApplicability$1 → NO_COVERAGE |
() -> this.visibleIndex, |
65 |
1
1. lambda$checkApplicability$2 : replaced return value with null for com/jsql/model/injection/strategy/StrategyUnion::lambda$checkApplicability$2 → NO_COVERAGE |
() -> this.performanceLength |
66 | ); | |
67 |
1
1. checkApplicability : removed call to com/jsql/model/injection/strategy/StrategyUnion::allow → NO_COVERAGE |
this.allow(); |
68 | } else { | |
69 |
1
1. checkApplicability : removed call to com/jsql/model/injection/strategy/StrategyUnion::unallow → NO_COVERAGE |
this.unallow(); |
70 | } | |
71 | } | |
72 | ||
73 | @Override | |
74 | public void allow(int... i) { | |
75 |
1
1. allow : removed call to com/jsql/model/InjectionModel::appendAnalysisReport → NO_COVERAGE |
this.injectionModel.appendAnalysisReport( |
76 | StringUtil.formatReport(LogLevelUtil.COLOR_BLU, "### Strategy: " + this.getName()) | |
77 | + this.injectionModel.getReportWithIndexes( | |
78 | this.injectionModel.getMediatorVendor().getVendor().instance().sqlUnion(StringUtil.formatReport(LogLevelUtil.COLOR_GREEN, "<query>"), "0", true), | |
79 | "metadataInjectionProcess" | |
80 | ) | |
81 | ); | |
82 |
1
1. allow : removed call to com/jsql/model/injection/strategy/StrategyUnion::markVulnerability → NO_COVERAGE |
this.markVulnerability(Interaction.MARK_UNION_VULNERABLE); |
83 | } | |
84 | ||
85 | @Override | |
86 | public void unallow(int... i) { | |
87 |
1
1. unallow : removed call to com/jsql/model/injection/strategy/StrategyUnion::markVulnerability → NO_COVERAGE |
this.markVulnerability(Interaction.MARK_UNION_INVULNERABLE); |
88 | } | |
89 | ||
90 | @Override | |
91 | public String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) { | |
92 |
1
1. inject : replaced return value with "" for com/jsql/model/injection/strategy/StrategyUnion::inject → NO_COVERAGE |
return this.injectionModel.injectWithIndexes( |
93 | this.injectionModel.getMediatorVendor().getVendor().instance().sqlUnion(sqlQuery, startPosition, false), | |
94 | metadataInjectionProcess | |
95 | ); | |
96 | } | |
97 | ||
98 | @Override | |
99 | public void activateWhenApplicable() { | |
100 |
2
1. activateWhenApplicable : negated conditional → NO_COVERAGE 2. activateWhenApplicable : negated conditional → NO_COVERAGE |
if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) { |
101 | LOGGER.log( | |
102 | LogLevelUtil.CONSOLE_INFORM, | |
103 | "{} [{}]", | |
104 |
1
1. lambda$activateWhenApplicable$3 : replaced return value with null for com/jsql/model/injection/strategy/StrategyUnion::lambda$activateWhenApplicable$3 → NO_COVERAGE |
() -> I18nUtil.valueByKey("LOG_USING_STRATEGY"), |
105 | this::getName | |
106 | ); | |
107 |
1
1. activateWhenApplicable : removed call to com/jsql/model/injection/strategy/MediatorStrategy::setStrategy → NO_COVERAGE |
this.injectionModel.getMediatorStrategy().setStrategy(this); |
108 | ||
109 | var request = new Request(); | |
110 |
1
1. activateWhenApplicable : removed call to com/jsql/model/bean/util/Request::setMessage → NO_COVERAGE |
request.setMessage(Interaction.MARK_UNION_STRATEGY); |
111 |
1
1. activateWhenApplicable : removed call to com/jsql/model/InjectionModel::sendToViews → NO_COVERAGE |
this.injectionModel.sendToViews(request); |
112 | } | |
113 | } | |
114 | | |
115 | /** | |
116 | * Runnable class, search the most efficient index.<br> | |
117 | * Some indexes will display a lots of characters, others won't, | |
118 | * so sort them by order of efficiency:<br> | |
119 | * find the one that displays the most number of characters. | |
120 | * @return Integer index with most efficiency and visible in source code | |
121 | */ | |
122 | public String getVisibleIndex(String firstSuccessPageSource) { | |
123 | // Parse all indexes found | |
124 | // Fix #4007 (initialize firstSuccessPageSource to empty String instead of null) | |
125 | String regexAllIndexes = String.format(VendorYaml.FORMAT_INDEX, "(\\d+?)"); | |
126 | var regexSearch = Pattern.compile("(?s)"+ regexAllIndexes).matcher(firstSuccessPageSource); | |
127 | | |
128 | List<String> foundIndexes = new ArrayList<>(); | |
129 |
1
1. getVisibleIndex : negated conditional → NO_COVERAGE |
while (regexSearch.find()) { |
130 | foundIndexes.add(regexSearch.group(1)); | |
131 | } | |
132 | ||
133 | String[] indexes = foundIndexes.toArray(new String[0]); | |
134 | ||
135 | // Make url shorter, replace useless indexes from 1337[index]7331 to 1 | |
136 | String regexAllExceptIndexesFound = String.format( | |
137 | VendorYaml.FORMAT_INDEX, | |
138 | "(?!"+ String.join("|", indexes) +"7331)\\d*" | |
139 | ); | |
140 | String indexesInUrl = this.injectionModel.getIndexesInUrl().replaceAll(regexAllExceptIndexesFound, "1"); | |
141 | ||
142 | // Replace correct indexes from 1337(index)7331 to | |
143 | // ==> ${lead}(index)######...###### | |
144 | // Search for index that displays the most # | |
145 | String performanceQuery = this.injectionModel.getMediatorVendor().getVendor().instance().sqlCapacity(indexes); | |
146 | String performanceSourcePage = this.injectionModel.injectWithoutIndex(performanceQuery, "union#size"); | |
147 | ||
148 | // Build a 2D array of string with: | |
149 | // column 1: index | |
150 | // column 2: # found, so #######...####### | |
151 | regexSearch = Pattern.compile("(?s)"+ DataAccess.LEAD +"(\\d+)("+ VendorYaml.CALIBRATOR_SQL +"+)").matcher(performanceSourcePage); | |
152 | List<String[]> performanceResults = new ArrayList<>(); | |
153 |
1
1. getVisibleIndex : negated conditional → NO_COVERAGE |
while (regexSearch.find()) { |
154 | performanceResults.add(new String[]{regexSearch.group(1), regexSearch.group(2)}); | |
155 | } | |
156 | ||
157 |
1
1. getVisibleIndex : negated conditional → NO_COVERAGE |
if (performanceResults.isEmpty()) { |
158 | this.performanceLength = "0"; | |
159 |
1
1. getVisibleIndex : replaced return value with "" for com/jsql/model/injection/strategy/StrategyUnion::getVisibleIndex → NO_COVERAGE |
return null; |
160 | } | |
161 | | |
162 | // Switch from previous array to 2D integer array | |
163 | // column 1: length of #######...####### | |
164 | // column 2: index | |
165 | var lengthFields = new Integer[performanceResults.size()][2]; | |
166 | | |
167 |
2
1. getVisibleIndex : changed conditional boundary → NO_COVERAGE 2. getVisibleIndex : negated conditional → NO_COVERAGE |
for (var i = 0 ; i < performanceResults.size() ; i++) { |
168 | lengthFields[i] = new Integer[] { | |
169 |
1
1. getVisibleIndex : Replaced integer addition with subtraction → NO_COVERAGE |
performanceResults.get(i)[1].length() + performanceResults.get(i)[0].length(), |
170 | Integer.parseInt(performanceResults.get(i)[0]) | |
171 | }; | |
172 | } | |
173 | ||
174 | // Sort by length of #######...####### | |
175 |
2
1. getVisibleIndex : removed call to java/util/Arrays::sort → NO_COVERAGE 2. lambda$getVisibleIndex$4 : replaced Integer return value with 0 for com/jsql/model/injection/strategy/StrategyUnion::lambda$getVisibleIndex$4 → NO_COVERAGE |
Arrays.sort(lengthFields, Comparator.comparing((Integer[] s) -> s[0])); |
176 |
1
1. getVisibleIndex : Replaced integer subtraction with addition → NO_COVERAGE |
Integer[] bestLengthFields = lengthFields[lengthFields.length - 1]; |
177 | this.performanceLength = bestLengthFields[0].toString(); | |
178 | ||
179 | // Reduce all others indexes | |
180 | String regexAllIndexesExceptBest = String.format( | |
181 | VendorYaml.FORMAT_INDEX, | |
182 | "(?!"+ bestLengthFields[1] +"7331)\\d*" | |
183 | ); | |
184 | indexesInUrl = indexesInUrl.replaceAll(regexAllIndexesExceptBest, "1"); | |
185 | | |
186 |
1
1. getVisibleIndex : removed call to com/jsql/model/InjectionModel::setIndexesInUrl → NO_COVERAGE |
this.injectionModel.setIndexesInUrl(indexesInUrl); |
187 | | |
188 |
1
1. getVisibleIndex : replaced return value with "" for com/jsql/model/injection/strategy/StrategyUnion::getVisibleIndex → NO_COVERAGE |
return Integer.toString(bestLengthFields[1]); |
189 | } | |
190 | | |
191 | | |
192 | // Getters and setters | |
193 | | |
194 | @Override | |
195 | public String getPerformanceLength() { | |
196 |
1
1. getPerformanceLength : replaced return value with "" for com/jsql/model/injection/strategy/StrategyUnion::getPerformanceLength → NO_COVERAGE |
return this.performanceLength; |
197 | } | |
198 | | |
199 | @Override | |
200 | public String getName() { | |
201 |
1
1. getName : replaced return value with "" for com/jsql/model/injection/strategy/StrategyUnion::getName → NO_COVERAGE |
return "Union"; |
202 | } | |
203 | ||
204 | public String getVisibleIndex() { | |
205 |
1
1. getVisibleIndex : replaced return value with "" for com/jsql/model/injection/strategy/StrategyUnion::getVisibleIndex → NO_COVERAGE |
return this.visibleIndex; |
206 | } | |
207 | ||
208 | public void setVisibleIndex(String visibleIndex) { | |
209 | this.visibleIndex = visibleIndex; | |
210 | } | |
211 | ||
212 | public void setSourceIndexesFound(String sourceIndexesFound) { | |
213 | this.sourceIndexesFound = sourceIndexesFound; | |
214 | } | |
215 | ||
216 | public int getNbIndexesFound() { | |
217 |
1
1. getNbIndexesFound : replaced int return with 0 for com/jsql/model/injection/strategy/StrategyUnion::getNbIndexesFound → NO_COVERAGE |
return this.nbIndexesFound; |
218 | } | |
219 | ||
220 | public void setNbIndexesFound(int nbIndexesFound) { | |
221 | this.nbIndexesFound = nbIndexesFound; | |
222 | } | |
223 | } | |
Mutations | ||
40 |
1.1 |
|
45 |
1.1 |
|
47 |
1.1 |
|
50 |
1.1 |
|
54 |
1.1 |
|
55 |
1.1 2.2 |
|
56 |
1.1 |
|
58 |
1.1 |
|
62 |
1.1 |
|
64 |
1.1 |
|
65 |
1.1 |
|
67 |
1.1 |
|
69 |
1.1 |
|
75 |
1.1 |
|
82 |
1.1 |
|
87 |
1.1 |
|
92 |
1.1 |
|
100 |
1.1 2.2 |
|
104 |
1.1 |
|
107 |
1.1 |
|
110 |
1.1 |
|
111 |
1.1 |
|
129 |
1.1 |
|
153 |
1.1 |
|
157 |
1.1 |
|
159 |
1.1 |
|
167 |
1.1 2.2 |
|
169 |
1.1 |
|
175 |
1.1 2.2 |
|
176 |
1.1 |
|
186 |
1.1 |
|
188 |
1.1 |
|
196 |
1.1 |
|
201 |
1.1 |
|
205 |
1.1 |
|
217 |
1.1 |