CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 06:50:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Implementing SQLMAP_UNSAFE_EVAL

Browse source
This commit is contained in:
Your Name 2026-04-23 16:28:31 +02:00
parent dec5a82077
commit 09aaa9b847
3 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/core/option.py
View file

@ -2678,6 +2678,13 @@ def _basicOptionValidation():
errMsg += "'SQLMAP_UNSAFE_ALERT=1' to be explicitly set"
raise SqlmapSystemException(errMsg)
if conf.evalCode and os.environ.get("SQLMAP_UNSAFE_EVAL") != '1':
errMsg = "for security reasons, to prevent execution of potentially malicious "
errMsg += "Python code via configuration files or copy-paste attacks, "
errMsg += "the '--eval' option requires the environment variable "
errMsg += "'SQLMAP_UNSAFE_EVAL=1' to be explicitly set"
raise SqlmapSystemException(errMsg)
if conf.chunked and not any((conf.data, conf.requestFile, conf.forms)):
errMsg = "switch '--chunked' requires usage of (POST) options/switches '--data', '-r' or '--forms'"
raise SqlmapSyntaxException(errMsg)