From 2a7358dfe1b5dcba7024920bfc5f5b9be3b71bf6 Mon Sep 17 00:00:00 2001
From: Jeffrey Shalom <jeffshalom06@gmail.com>
Date: Fri, 12 Jun 2026 10:39:02 +0530
Subject: [PATCH] NSE: Fix potential crashes in ms-sql scripts and refactor
 deprecated format_output

---
 scripts/ms-sql-brute.nse       | 5 ++---
 scripts/ms-sql-config.nse      | 4 ++--
 scripts/ms-sql-hasdbaccess.nse | 4 ++--
 scripts/ms-sql-query.nse       | 6 +++++-
 scripts/ms-sql-tables.nse      | 8 ++------
 scripts/ms-sql-xp-cmdshell.nse | 5 ++++-
 6 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/scripts/ms-sql-brute.nse b/scripts/ms-sql-brute.nse
index 71d7f0d44..44e444c87 100644
--- a/scripts/ms-sql-brute.nse
+++ b/scripts/ms-sql-brute.nse
@@ -82,8 +82,7 @@ dependencies = {"broadcast-ms-sql-discover", "ms-sql-empty-password"}
 --- Returns formatted output for the given instance
 local function create_instance_output_table( instance )
 
-  local instanceOutput = {}
-  instanceOutput["name"] = string.format( "[%s]", instance:GetName() )
+  local instanceOutput = stdnse.output_table()
   if ( instance.ms_sql_brute.credentials ) then
     local credsOutput = {}
     credsOutput["name"] = "Credentials found:"
@@ -126,7 +125,7 @@ local function create_instance_output_table( instance )
     end
   end
 
-  return stdnse.format_output(true, instanceOutput)
+  return instanceOutput
 
 end
 
diff --git a/scripts/ms-sql-config.nse b/scripts/ms-sql-config.nse
index 83db0306f..85f12e631 100644
--- a/scripts/ms-sql-config.nse
+++ b/scripts/ms-sql-config.nse
@@ -125,8 +125,8 @@ local function process_instance( instance )
 
   helper:Disconnect()
 
-  -- TODO: structured output instead of format_output
-  return stdnse.format_output(true, result)
+  -- Return structured output directly
+  return result
 end
 
 action, portrule, hostrule = mssql.Helper.InitScript(process_instance)
diff --git a/scripts/ms-sql-hasdbaccess.nse b/scripts/ms-sql-hasdbaccess.nse
index 3d28f3771..cd9de2a9c 100644
--- a/scripts/ms-sql-hasdbaccess.nse
+++ b/scripts/ms-sql-hasdbaccess.nse
@@ -142,8 +142,8 @@ local function process_instance( instance )
     end
   end
 
-  -- TODO: structured output, not format_output
-  return stdnse.format_output(true, output)
+  -- Return structured output directly
+  return output
 end
 
 
diff --git a/scripts/ms-sql-query.nse b/scripts/ms-sql-query.nse
index 8096da1d3..96ceb9193 100644
--- a/scripts/ms-sql-query.nse
+++ b/scripts/ms-sql-query.nse
@@ -99,9 +99,13 @@ do_action, portrule, hostrule = mssql.Helper.InitScript(process_instance)
 action = function(...)
   local scriptOutput = do_action(...)
 
+  if not scriptOutput then
+    return nil
+  end
+
   if ( not( stdnse.get_script_args( {'ms-sql-query.query', 'mssql-query.query' } ) ) ) then
     table.insert(scriptOutput, 1, "(Use --script-args=ms-sql-query.query='<QUERY>' to change query.)")
   end
 
-  return stdnse.format_output( true, scriptOutput )
+  return scriptOutput
 end
diff --git a/scripts/ms-sql-tables.nse b/scripts/ms-sql-tables.nse
index 45f32c554..4bc1dac37 100644
--- a/scripts/ms-sql-tables.nse
+++ b/scripts/ms-sql-tables.nse
@@ -241,12 +241,8 @@ local function process_instance( instance )
   end
 
 
-  local instanceOutput = {}
-  instanceOutput["name"] = string.format( "[%s]", instance:GetName() )
-  table.insert( instanceOutput, output )
-
-  return stdnse.format_output(true, instanceOutput)
-
+  -- Return structured output directly
+  return output
 end
 
 
diff --git a/scripts/ms-sql-xp-cmdshell.nse b/scripts/ms-sql-xp-cmdshell.nse
index b5dc4a3f3..ddc3f25ee 100644
--- a/scripts/ms-sql-xp-cmdshell.nse
+++ b/scripts/ms-sql-xp-cmdshell.nse
@@ -145,9 +145,12 @@ do_action, portrule, hostrule = mssql.Helper.InitScript(process_instance)
 
 action = function(...)
   local scriptOutput = do_action(...)
+  if not scriptOutput then
+    return nil
+  end
   if ( not(stdnse.get_script_args( {'ms-sql-xp-cmdshell.cmd', 'mssql-xp-cmdshell.cmd'} ) ) ) then
     table.insert(scriptOutput, 1, "(Use --script-args=ms-sql-xp-cmdshell.cmd='<CMD>' to change command.)")
   end
 
-  return stdnse.format_output( true, scriptOutput )
+  return scriptOutput
 end