MCPcopy Index your code
hub / github.com/sqlmapproject/sqlmap / nullCastConcatFields

Method nullCastConcatFields

lib/core/agent.py:532–579  ·  view source on GitHub ↗

Take in input a sequence of fields string and return its processed nulled, casted and concatenated fields string. Examples: MySQL input: user,password MySQL output: IFNULL(CAST(user AS CHAR(10000)), ' '),'UWciUe',IFNULL(CAST(password AS CHAR(10000)), ' ')

(self, fields)

Source from the content-addressed store, hash-verified

530 return nulledCastedField
531
532 def nullCastConcatFields(self, fields):
533 """
534 Take in input a sequence of fields string and return its processed
535 nulled, casted and concatenated fields string.
536
537 Examples:
538
539 MySQL input: user,password
540 MySQL output: IFNULL(CAST(user AS CHAR(10000)), ' '),'UWciUe',IFNULL(CAST(password AS CHAR(10000)), ' ')
541 MySQL scope: SELECT user, password FROM mysql.user
542
543 PostgreSQL input: usename,passwd
544 PostgreSQL output: COALESCE(CAST(usename AS CHARACTER(10000)), ' ')||'xRBcZW'||COALESCE(CAST(passwd AS CHARACTER(10000)), ' ')
545 PostgreSQL scope: SELECT usename, passwd FROM pg_shadow
546
547 Oracle input: COLUMN_NAME,DATA_TYPE
548 Oracle output: NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), ' ')||'UUlHUa'||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), ' ')
549 Oracle scope: SELECT COLUMN_NAME, DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s'
550
551 Microsoft SQL Server input: name,master.dbo.fn_varbintohexstr(password)
552 Microsoft SQL Server output: ISNULL(CAST(name AS VARCHAR(8000)), ' ')+'nTBdow'+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), ' ')
553 Microsoft SQL Server scope: SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins
554
555 @param fields: fields string to be processed
556 @type fields: C{str}
557
558 @return: fields string nulled, casted and concatened
559 @rtype: C{str}
560 """
561
562 if not Backend.getIdentifiedDbms():
563 return fields
564
565 if fields.startswith("(CASE") or fields.startswith("(IIF") or fields.startswith("SUBSTR") or fields.startswith("MID(") or re.search(r"\A'[^']+'\Z", fields):
566 nulledCastedConcatFields = fields
567 else:
568 fieldsSplitted = splitFields(fields)
569 dbmsDelimiter = queries[Backend.getIdentifiedDbms()].delimiter.query
570 nulledCastedFields = []
571
572 for field in fieldsSplitted:
573 field = re.sub(r"(?i) AS \w+\Z", "", field) # NOTE: fields such as "... AS type_name" have to be stripped from the alias part for this functionality to work
574 nulledCastedFields.append(self.nullAndCastField(field))
575
576 delimiterStr = "%s'%s'%s" % (dbmsDelimiter, kb.chars.delimiter, dbmsDelimiter)
577 nulledCastedConcatFields = delimiterStr.join(field for field in nulledCastedFields)
578
579 return nulledCastedConcatFields
580
581 def getFields(self, query):
582 """

Callers 1

concatQueryMethod · 0.95

Calls 5

nullAndCastFieldMethod · 0.95
splitFieldsFunction · 0.90
getIdentifiedDbmsMethod · 0.80
searchMethod · 0.45
appendMethod · 0.45

Tested by

no test coverage detected