CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-22 11:43:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Harden REST API option handling and require authentication credentials (#6073)

Browse source
This commit is contained in:
Miroslav Štampar 2026-06-10 18:37:46 +02:00
parent ecf8ccc72e
commit ab1efed0d5
4 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/utils/api.py
View file

@ -490,6 +490,11 @@ def option_set(taskid):
logger.warning("[%s] Invalid JSON options provided to option_set()" % taskid)
return jsonize({"success": False, "message": "Invalid JSON options"})
for key in request.json:
if key in RESTAPI_UNSUPPORTED_OPTIONS:
logger.warning("[%s] Unsupported option '%s' provided to option_set()" % (taskid, key))
return jsonize({"success": False, "message": "Unsupported option '%s'" % key})
for option, value in request.json.items():
DataStore.tasks[taskid].set_option(option, value)
@ -687,6 +692,9 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
REST-JSON API server
"""
if not all((username, password)):
logger.critical("REST-JSON API server requires both username and password")
DataStore.admin_token = encodeHex(os.urandom(16), binary=False)
DataStore.username = username
DataStore.password = password