View Javadoc
1   package com.jsql.model.injection.strategy;
2   
3   import com.jsql.model.InjectionModel;
4   import com.jsql.model.bean.util.Header;
5   import com.jsql.model.bean.util.Interaction;
6   import com.jsql.model.bean.util.Request;
7   import com.jsql.model.exception.JSqlException;
8   import com.jsql.model.exception.StoppedByUserSlidingException;
9   import com.jsql.model.suspendable.AbstractSuspendable;
10  import com.jsql.util.I18nUtil;
11  import com.jsql.util.LogLevelUtil;
12  import org.apache.logging.log4j.LogManager;
13  import org.apache.logging.log4j.Logger;
14  
15  import java.util.EnumMap;
16  import java.util.Map;
17  
18  /**
19   * Define a strategy to inject SQL with methods like Error and Time.
20   */
21  public abstract class AbstractStrategy {
22  
23      /**
24       * Log4j logger sent to view.
25       */
26      private static final Logger LOGGER = LogManager.getRootLogger();
27  
28      protected static final String KEY_LOG_CHECKING_STRATEGY = "LOG_CHECKING_STRATEGY";
29      protected static final String KEY_LOG_VULNERABLE = "LOG_VULNERABLE";
30      protected static final String FORMAT_STRATEGY_NOT_IMPLEMENTED = "Strategy [{}] for [{}] not implemented, share a working example to GitHub to speed up release";
31      protected static final String FORMAT_SKIP_STRATEGY_DISABLED = "Skipping strategy [{}] disabled";
32      protected static final String FORMAT_CHECKING_STRATEGY = "{} [{}]...";
33  
34      /**
35       * True if injection can be used, false otherwise.
36       */
37      protected boolean isApplicable = false;
38  
39      protected final InjectionModel injectionModel;
40      
41      protected AbstractStrategy(InjectionModel injectionModel) {
42          this.injectionModel = injectionModel;
43      }
44  
45      /**
46       * Test if this strategy can be used to inject SQL.
47       */
48      public abstract void checkApplicability() throws JSqlException;
49      
50      /**
51       * Inform the view that this strategy can be used.
52       */
53      protected abstract void allow(int... i);
54      
55      /**
56       * Inform the view that this strategy can't be used.
57       */
58      protected abstract void unallow(int... i);
59      
60      /**
61       * Start the strategy work.
62       * @return Source code
63       */
64      public abstract String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) throws StoppedByUserSlidingException;
65      
66      /**
67       * Change model strategy to current applicable strategy only when not already set.
68       * Union > Stacked > Error > Multibit > Blind > Time
69       */
70      public abstract void activateWhenApplicable();
71      
72      /**
73       * Get number of characters you can obtain from the strategy.
74       */
75      public abstract String getPerformanceLength();
76      
77      /**
78       * Get the injection strategy name.
79       */
80      public abstract String getName();
81  
82      public void logChecking() {
83          LOGGER.log(LogLevelUtil.CONSOLE_DEFAULT, AbstractStrategy.FORMAT_CHECKING_STRATEGY, () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_CHECKING_STRATEGY), this::getName);
84      }
85      
86      public void markVulnerability(Interaction message, int... indexErrorStrategy) {
87          var request = new Request();
88          request.setMessage(message);
89          
90          Map<Header, Object> msgHeader = new EnumMap<>(Header.class);
91          msgHeader.put(Header.URL, this.injectionModel.getMediatorUtils().getConnectionUtil().getUrlByUser());
92          
93          // Ellipse default to non null array
94          if (indexErrorStrategy.length > 0) {
95              msgHeader.put(Header.INDEX_ERROR_STRATEGY, indexErrorStrategy[0]);
96              msgHeader.put(Header.INJECTION_MODEL, this.injectionModel);
97          }
98  
99          request.setParameters(msgHeader);
100         this.injectionModel.sendToViews(request);
101     }
102     
103     @Override
104     public String toString() {
105         return this.getName();
106     }
107 
108 
109     // Getter and setter
110     
111     public boolean isApplicable() {
112         return this.isApplicable;
113     }
114     
115     public void setApplicable(boolean isApplicable) {
116         this.isApplicable = isApplicable;
117     }
118 }