1
2
3
4
5
6
7
8
9
10
11 package com.jsql.model.injection.strategy;
12
13 import com.jsql.model.InjectionModel;
14 import com.jsql.model.bean.util.Interaction;
15 import com.jsql.model.bean.util.Request;
16 import com.jsql.model.exception.StoppedByUserSlidingException;
17 import com.jsql.model.injection.strategy.blind.AbstractInjectionBoolean.BooleanMode;
18 import com.jsql.model.injection.strategy.blind.InjectionTime;
19 import com.jsql.model.injection.vendor.model.VendorYaml;
20 import com.jsql.model.suspendable.AbstractSuspendable;
21 import com.jsql.util.I18nUtil;
22 import com.jsql.util.LogLevelUtil;
23 import org.apache.commons.lang3.StringUtils;
24 import org.apache.logging.log4j.LogManager;
25 import org.apache.logging.log4j.Logger;
26
27 public class StrategyInjectionTime extends AbstractStrategy {
28
29
30
31
32 private static final Logger LOGGER = LogManager.getRootLogger();
33
34 private InjectionTime injectionTime;
35
36 public StrategyInjectionTime(InjectionModel injectionModel) {
37 super(injectionModel);
38 }
39
40 @Override
41 public void checkApplicability() throws StoppedByUserSlidingException {
42
43 if (this.injectionModel.getMediatorUtils().getPreferencesUtil().isStrategyTimeDisabled()) {
44
45 LOGGER.log(LogLevelUtil.CONSOLE_INFORM, AbstractStrategy.FORMAT_SKIP_STRATEGY_DISABLED, getName());
46 return;
47
48 } else if (StringUtils.isEmpty(this.injectionModel.getMediatorVendor().getVendor().instance().sqlBooleanTime())) {
49
50 LOGGER.log(
51 LogLevelUtil.CONSOLE_ERROR,
52 AbstractStrategy.FORMAT_STRATEGY_NOT_IMPLEMENTED,
53 getName(),
54 this.injectionModel.getMediatorVendor().getVendor()
55 );
56 return;
57 }
58
59 checkInjection(BooleanMode.OR);
60 checkInjection(BooleanMode.AND);
61 checkInjection(BooleanMode.STACKED);
62 checkInjection(BooleanMode.NO_MODE);
63
64 if (this.isApplicable) {
65
66 this.allow();
67
68 var requestMessageBinary = new Request();
69 requestMessageBinary.setMessage(Interaction.MESSAGE_BINARY);
70 requestMessageBinary.setParameters(this.injectionTime.getInfoMessage());
71 this.injectionModel.sendToViews(requestMessageBinary);
72
73 } else {
74 this.unallow();
75 }
76 }
77
78 private void checkInjection(BooleanMode booleanMode) throws StoppedByUserSlidingException {
79
80 if (this.isApplicable) {
81 return;
82 }
83
84 LOGGER.log(
85 LogLevelUtil.CONSOLE_DEFAULT,
86 "{} [{}] with [{}]...",
87 () -> I18nUtil.valueByKey(KEY_LOG_CHECKING_STRATEGY),
88 this::getName,
89 () -> booleanMode
90 );
91 this.injectionTime = new InjectionTime(this.injectionModel, booleanMode);
92 this.isApplicable = this.injectionTime.isInjectable();
93
94 if (this.isApplicable) {
95 LOGGER.log(
96 LogLevelUtil.CONSOLE_SUCCESS,
97 "{} [{}] injection with [{}]",
98 () -> I18nUtil.valueByKey(KEY_LOG_VULNERABLE),
99 this::getName,
100 () -> booleanMode
101 );
102 }
103 }
104
105 @Override
106 public void allow(int... i) {
107
108 this.injectionModel.appendAnalysisReport(
109 "<span style=color:rgb(0,0,255)>### Strategy: " + getName() + "</span>"
110 + this.injectionModel.getReportWithoutIndex(
111 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTimeTest(
112 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime("<span style=color:rgb(0,128,0)><query></span>", "0", true),
113 this.injectionTime.getBooleanMode()
114 ),
115 "metadataInjectionProcess",
116 null
117 )
118 );
119 this.markVulnerability(Interaction.MARK_TIME_VULNERABLE);
120 }
121
122 @Override
123 public void unallow(int... i) {
124 this.markVulnerability(Interaction.MARK_TIME_INVULNERABLE);
125 }
126
127 @Override
128 public String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) throws StoppedByUserSlidingException {
129 return this.injectionTime.inject(
130 this.injectionModel.getMediatorVendor().getVendor().instance().sqlTime(sqlQuery, startPosition, false),
131 stoppable
132 );
133 }
134
135 @Override
136 public void activateWhenApplicable() {
137 if (this.injectionModel.getMediatorStrategy().getStrategy() == null && this.isApplicable()) {
138
139 LOGGER.log(
140 LogLevelUtil.CONSOLE_INFORM,
141 "{} [{}] with [{}]",
142 () -> I18nUtil.valueByKey("LOG_USING_STRATEGY"),
143 this::getName,
144 () -> this.injectionTime.getBooleanMode().name()
145 );
146 this.injectionModel.getMediatorStrategy().setStrategy(this.injectionModel.getMediatorStrategy().getTime());
147
148 var requestMarkTimeStrategy = new Request();
149 requestMarkTimeStrategy.setMessage(Interaction.MARK_TIME_STRATEGY);
150 this.injectionModel.sendToViews(requestMarkTimeStrategy);
151 }
152 }
153
154 @Override
155 public String getPerformanceLength() {
156 return VendorYaml.DEFAULT_CAPACITY;
157 }
158
159 @Override
160 public String getName() {
161 return "Time";
162 }
163 }