SuspendableGetIndexes.java

package com.jsql.model.suspendable;

import com.jsql.model.InjectionModel;
import com.jsql.model.exception.JSqlException;
import com.jsql.model.exception.StoppedByUserSlidingException;
import com.jsql.model.injection.vendor.model.VendorYaml;
import com.jsql.model.suspendable.callable.CallablePageSource;
import com.jsql.util.LogLevelUtil;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

import java.util.concurrent.CompletionService;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.ExecutorCompletionService;
import java.util.concurrent.ExecutorService;
import java.util.regex.Pattern;

/**
 * Runnable class, search the correct number of fields in the SQL query.
 * Concurrent search with stop capability
 */
public class SuspendableGetIndexes extends AbstractSuspendable {
    
    /**
     * Log4j logger sent to view.
     */
    private static final Logger LOGGER = LogManager.getRootLogger();
    
    public SuspendableGetIndexes(InjectionModel injectionModel) {
        super(injectionModel);
    }

    @Override
    public String run(Object... args) throws JSqlException {
        // Concurrent search
        ExecutorService taskExecutor = this.injectionModel.getMediatorUtils().getThreadUtil().getExecutor("CallableGetIndexes");
        CompletionService<CallablePageSource> taskCompletionService = new ExecutorCompletionService<>(taskExecutor);

        String initialQuery = StringUtils.EMPTY;
        int nbIndex;
        
        int countUnionIndex = this.injectionModel.getMediatorUtils().getPreferencesUtil().isLimitingUnionIndex()
            ? this.injectionModel.getMediatorUtils().getPreferencesUtil().countUnionIndex()
            : 50;

        // SQL fields are built like 1337[index]7330+1
        // 7330+1 allows to exclude false positive when page contains injection URL
        // Search if the source contains 1337[index]7331
        for (nbIndex = 1 ; nbIndex <= countUnionIndex ; nbIndex++) {
            taskCompletionService.submit(
                new CallablePageSource(
                    this.injectionModel.getMediatorVendor().getVendor().instance().sqlIndices(nbIndex),
                    this.injectionModel,
                    "union#" + nbIndex,
                    nbIndex
                )
            );
        }
        
        nbIndex = 1;
        try {
            while (nbIndex <= countUnionIndex) {
                if (this.isSuspended()) {
                    throw new StoppedByUserSlidingException();
                }
                CallablePageSource currentCallable = taskCompletionService.take().get();
                nbIndex++;
                // Found a correct mark 1337[index]7331 in the source
                String regexAllIndexes = String.format(VendorYaml.FORMAT_INDEX, "\\d+");
                if (Pattern.compile("(?s).*"+ regexAllIndexes +".*").matcher(currentCallable.getContent()).matches()) {
                    
                    this.injectionModel.getMediatorStrategy().getSpecificUnion().setNbIndexesFound(currentCallable.getNbIndex());
                    this.injectionModel.getMediatorStrategy().getSpecificUnion().setSourceIndexesFound(currentCallable.getContent());
                    initialQuery = currentCallable.getQuery().replace("0%2b1", "1");
                    
                    if (this.injectionModel.getMediatorUtils().getPreferencesUtil().isPerfIndexDisabled()) {
                        String regexIndexesExceptFirst = String.format(VendorYaml.FORMAT_INDEX, "(?!17331)\\d+");
                        initialQuery = initialQuery.replaceAll(regexIndexesExceptFirst, "1");
                        LOGGER.log(LogLevelUtil.CONSOLE_INFORM, "Calibrating indexes disabled, forcing to index [1]");
                    }
                    LOGGER.log(
                        LogLevelUtil.CONSOLE_INFORM,
                        "Strategy [Union] triggered by [{}]",
                        () -> currentCallable.getQuery().trim()
                        .replaceAll("1337(\\d*)7330%2b1", "$1")
                        .replaceAll("\\s+", StringUtils.SPACE)
                    );
                    break;
                }
            }
            this.injectionModel.getMediatorUtils().getThreadUtil().shutdown(taskExecutor);
        } catch (InterruptedException e) {
            LOGGER.log(LogLevelUtil.IGNORE, e, e);
            Thread.currentThread().interrupt();
        } catch (ExecutionException e) {
            LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e);
        }
        return initialQuery;
    }
}















Active mutators

CONDITIONALS_BOUNDARY
EMPTY_RETURNS
FALSE_RETURNS
INCREMENTS
INVERT_NEGS
MATH
NEGATE_CONDITIONALS
NULL_RETURNS
PRIMITIVE_RETURNS
TRUE_RETURNS
VOID_METHOD_CALLS

Tests examined

Report generated by PIT 1.19.1

1		package com.jsql.model.suspendable;
2
3		import com.jsql.model.InjectionModel;
4		import com.jsql.model.exception.JSqlException;
5		import com.jsql.model.exception.StoppedByUserSlidingException;
6		import com.jsql.model.injection.vendor.model.VendorYaml;
7		import com.jsql.model.suspendable.callable.CallablePageSource;
8		import com.jsql.util.LogLevelUtil;
9		import org.apache.commons.lang3.StringUtils;
10		import org.apache.logging.log4j.LogManager;
11		import org.apache.logging.log4j.Logger;
12
13		import java.util.concurrent.CompletionService;
14		import java.util.concurrent.ExecutionException;
15		import java.util.concurrent.ExecutorCompletionService;
16		import java.util.concurrent.ExecutorService;
17		import java.util.regex.Pattern;
18
19		/**
20		* Runnable class, search the correct number of fields in the SQL query.
21		* Concurrent search with stop capability
22		*/
23		public class SuspendableGetIndexes extends AbstractSuspendable {
24
25		/**
26		* Log4j logger sent to view.
27		*/
28		private static final Logger LOGGER = LogManager.getRootLogger();
29
30		public SuspendableGetIndexes(InjectionModel injectionModel) {
31		super(injectionModel);
32		}
33
34		@Override
35		public String run(Object... args) throws JSqlException {
36		// Concurrent search
37		ExecutorService taskExecutor = this.injectionModel.getMediatorUtils().getThreadUtil().getExecutor("CallableGetIndexes");
38		CompletionService<CallablePageSource> taskCompletionService = new ExecutorCompletionService<>(taskExecutor);
39
40		String initialQuery = StringUtils.EMPTY;
41		int nbIndex;
42
43	1 1. run : negated conditional → NO_COVERAGE	int countUnionIndex = this.injectionModel.getMediatorUtils().getPreferencesUtil().isLimitingUnionIndex()
44		? this.injectionModel.getMediatorUtils().getPreferencesUtil().countUnionIndex()
45		: 50;
46
47		// SQL fields are built like 1337[index]7330+1
48		// 7330+1 allows to exclude false positive when page contains injection URL
49		// Search if the source contains 1337[index]7331
50	2 1. run : negated conditional → NO_COVERAGE 2. run : changed conditional boundary → NO_COVERAGE	for (nbIndex = 1 ; nbIndex <= countUnionIndex ; nbIndex++) {
51		taskCompletionService.submit(
52		new CallablePageSource(
53		this.injectionModel.getMediatorVendor().getVendor().instance().sqlIndices(nbIndex),
54		this.injectionModel,
55		"union#" + nbIndex,
56		nbIndex
57		)
58		);
59		}
60
61		nbIndex = 1;
62		try {
63	2 1. run : changed conditional boundary → NO_COVERAGE 2. run : negated conditional → NO_COVERAGE	while (nbIndex <= countUnionIndex) {
64	1 1. run : negated conditional → NO_COVERAGE	if (this.isSuspended()) {
65		throw new StoppedByUserSlidingException();
66		}
67		CallablePageSource currentCallable = taskCompletionService.take().get();
68	1 1. run : Changed increment from 1 to -1 → NO_COVERAGE	nbIndex++;
69		// Found a correct mark 1337[index]7331 in the source
70		String regexAllIndexes = String.format(VendorYaml.FORMAT_INDEX, "\\d+");
71	1 1. run : negated conditional → NO_COVERAGE	if (Pattern.compile("(?s)."+ regexAllIndexes +".").matcher(currentCallable.getContent()).matches()) {
72
73	1 1. run : removed call to com/jsql/model/injection/strategy/StrategyUnion::setNbIndexesFound → NO_COVERAGE	this.injectionModel.getMediatorStrategy().getSpecificUnion().setNbIndexesFound(currentCallable.getNbIndex());
74	1 1. run : removed call to com/jsql/model/injection/strategy/StrategyUnion::setSourceIndexesFound → NO_COVERAGE	this.injectionModel.getMediatorStrategy().getSpecificUnion().setSourceIndexesFound(currentCallable.getContent());
75		initialQuery = currentCallable.getQuery().replace("0%2b1", "1");
76
77	1 1. run : negated conditional → NO_COVERAGE	if (this.injectionModel.getMediatorUtils().getPreferencesUtil().isPerfIndexDisabled()) {
78		String regexIndexesExceptFirst = String.format(VendorYaml.FORMAT_INDEX, "(?!17331)\\d+");
79		initialQuery = initialQuery.replaceAll(regexIndexesExceptFirst, "1");
80		LOGGER.log(LogLevelUtil.CONSOLE_INFORM, "Calibrating indexes disabled, forcing to index [1]");
81		}
82		LOGGER.log(
83		LogLevelUtil.CONSOLE_INFORM,
84		"Strategy [Union] triggered by [{}]",
85	1 1. lambda$run$0 : replaced return value with null for com/jsql/model/suspendable/SuspendableGetIndexes::lambda$run$0 → NO_COVERAGE	() -> currentCallable.getQuery().trim()
86		.replaceAll("1337(\\d*)7330%2b1", "$1")
87		.replaceAll("\\s+", StringUtils.SPACE)
88		);
89		break;
90		}
91		}
92	1 1. run : removed call to com/jsql/util/ThreadUtil::shutdown → NO_COVERAGE	this.injectionModel.getMediatorUtils().getThreadUtil().shutdown(taskExecutor);
93		} catch (InterruptedException e) {
94		LOGGER.log(LogLevelUtil.IGNORE, e, e);
95	1 1. run : removed call to java/lang/Thread::interrupt → NO_COVERAGE	Thread.currentThread().interrupt();
96		} catch (ExecutionException e) {
97		LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e);
98		}
99	1 1. run : replaced return value with "" for com/jsql/model/suspendable/SuspendableGetIndexes::run → NO_COVERAGE	return initialQuery;
100		}
101		}
		Mutations
43		1.1 Location : run Killed by : none negated conditional → NO_COVERAGE
50		1.1 Location : run Killed by : none negated conditional → NO_COVERAGE 2.2 Location : run Killed by : none changed conditional boundary → NO_COVERAGE
63		1.1 Location : run Killed by : none changed conditional boundary → NO_COVERAGE 2.2 Location : run Killed by : none negated conditional → NO_COVERAGE
64		1.1 Location : run Killed by : none negated conditional → NO_COVERAGE
68		1.1 Location : run Killed by : none Changed increment from 1 to -1 → NO_COVERAGE
71		1.1 Location : run Killed by : none negated conditional → NO_COVERAGE
73		1.1 Location : run Killed by : none removed call to com/jsql/model/injection/strategy/StrategyUnion::setNbIndexesFound → NO_COVERAGE
74		1.1 Location : run Killed by : none removed call to com/jsql/model/injection/strategy/StrategyUnion::setSourceIndexesFound → NO_COVERAGE
77		1.1 Location : run Killed by : none negated conditional → NO_COVERAGE
85		1.1 Location : lambda$run$0 Killed by : none replaced return value with null for com/jsql/model/suspendable/SuspendableGetIndexes::lambda$run$0 → NO_COVERAGE
92		1.1 Location : run Killed by : none removed call to com/jsql/util/ThreadUtil::shutdown → NO_COVERAGE
95		1.1 Location : run Killed by : none removed call to java/lang/Thread::interrupt → NO_COVERAGE
99		1.1 Location : run Killed by : none replaced return value with "" for com/jsql/model/suspendable/SuspendableGetIndexes::run → NO_COVERAGE

SuspendableGetIndexes.java

Mutations

Active mutators

Tests examined