CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 06:50:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Implementing SQLMAP_UNSAFE_EVAL

Browse source
This commit is contained in:
Your Name 2026-04-23 16:28:31 +02:00
parent dec5a82077
commit 09aaa9b847
3 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/core/option.py
View file

@ -2678,6 +2678,13 @@ def _basicOptionValidation():
errMsg += "'SQLMAP_UNSAFE_ALERT=1' to be explicitly set"
raise SqlmapSystemException(errMsg)
if conf.evalCode and os.environ.get("SQLMAP_UNSAFE_EVAL") != '1':
errMsg = "for security reasons, to prevent execution of potentially malicious "
errMsg += "Python code via configuration files or copy-paste attacks, "
errMsg += "the '--eval' option requires the environment variable "
errMsg += "'SQLMAP_UNSAFE_EVAL=1' to be explicitly set"
raise SqlmapSystemException(errMsg)
if conf.chunked and not any((conf.data, conf.requestFile, conf.forms)):
errMsg = "switch '--chunked' requires usage of (POST) options/switches '--data', '-r' or '--forms'"
raise SqlmapSyntaxException(errMsg)

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.4.9"
VERSION = "1.10.4.10"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)