View Javadoc
1   package com.jsql.model.injection.strategy;
2   
3   import com.jsql.model.InjectionModel;
4   import com.jsql.model.bean.util.Header;
5   import com.jsql.model.bean.util.Interaction;
6   import com.jsql.model.bean.util.Request;
7   import com.jsql.model.exception.JSqlException;
8   import com.jsql.model.exception.StoppedByUserSlidingException;
9   import com.jsql.model.suspendable.AbstractSuspendable;
10  import com.jsql.util.I18nUtil;
11  import com.jsql.util.LogLevelUtil;
12  import org.apache.logging.log4j.LogManager;
13  import org.apache.logging.log4j.Logger;
14  
15  import java.util.EnumMap;
16  import java.util.Map;
17  
18  /**
19   * Define a strategy to inject SQL with methods like Error and Time.
20   */
21  public abstract class AbstractStrategy {
22  
23      /**
24       * Log4j logger sent to view.
25       */
26      private static final Logger LOGGER = LogManager.getRootLogger();
27  
28      protected static final String KEY_LOG_CHECKING_STRATEGY = "LOG_CHECKING_STRATEGY";
29      protected static final String KEY_LOG_VULNERABLE = "LOG_VULNERABLE";
30      protected static final String FORMAT_STRATEGY_NOT_IMPLEMENTED = "Strategy [{}] for [{}] not implemented, share a working example to GitHub to speed up release";
31      protected static final String FORMAT_SKIP_STRATEGY_DISABLED = "Skipping strategy [{}] disabled";
32      protected static final String FORMAT_CHECKING_STRATEGY = "{} [{}]...";
33  
34      /**
35       * True if injection can be used, false otherwise.
36       */
37      protected boolean isApplicable = false;
38  
39      protected final InjectionModel injectionModel;
40      
41      protected AbstractStrategy(InjectionModel injectionModel) {
42          this.injectionModel = injectionModel;
43      }
44  
45      /**
46       * Test if this strategy can be used to inject SQL.
47       */
48      public abstract void checkApplicability() throws JSqlException;
49      
50      /**
51       * Inform the view that this strategy can be used.
52       */
53      protected abstract void allow(int... i);
54      
55      /**
56       * Inform the view that this strategy can't be used.
57       */
58      protected abstract void unallow(int... i);
59      
60      /**
61       * Start the strategy work.
62       * @return Source code
63       */
64      public abstract String inject(String sqlQuery, String startPosition, AbstractSuspendable stoppable, String metadataInjectionProcess) throws StoppedByUserSlidingException;
65      
66      /**
67       * Change model strategy to current applicable strategy only when not already set.
68       * Union > Stacked > Error > Multibit > Blind > Time
69       */
70      public abstract void activateWhenApplicable();
71      
72      /**
73       * Get number of characters you can obtain from the strategy.
74       */
75      public abstract String getPerformanceLength();
76      
77      /**
78       * Get the injection strategy name.
79       */
80      public abstract String getName();
81  
82      public void logChecking() {
83          LOGGER.log(
84              LogLevelUtil.CONSOLE_DEFAULT,
85              AbstractStrategy.FORMAT_CHECKING_STRATEGY,
86              () -> I18nUtil.valueByKey(AbstractStrategy.KEY_LOG_CHECKING_STRATEGY),
87              this::getName
88          );
89      }
90      
91      public void markVulnerability(Interaction message, int... indexErrorStrategy) {
92          var request = new Request();
93          request.setMessage(message);
94          
95          Map<Header, Object> msgHeader = new EnumMap<>(Header.class);
96          msgHeader.put(Header.URL, this.injectionModel.getMediatorUtils().getConnectionUtil().getUrlByUser());
97          
98          // Ellipse default to non null array
99          if (indexErrorStrategy.length > 0) {
100             msgHeader.put(Header.INDEX_ERROR_STRATEGY, indexErrorStrategy[0]);
101             msgHeader.put(Header.INJECTION_MODEL, this.injectionModel);
102         }
103 
104         request.setParameters(msgHeader);
105         this.injectionModel.sendToViews(request);
106     }
107     
108     @Override
109     public String toString() {
110         return this.getName();
111     }
112 
113 
114     // Getter and setter
115     
116     public boolean isApplicable() {
117         return this.isApplicable;
118     }
119     
120     public void setApplicable(boolean isApplicable) {
121         this.isApplicable = isApplicable;
122     }
123 }