CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing limitCondition double-LIMIT

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-28 16:24:22 +02:00
parent f992e44fb5
commit e8a2fc50e0
3 changed files with 24 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tests/test_agent.py
View file

@ -460,6 +460,21 @@ class TestLimitQuery(DbmsStateMixin, unittest.TestCase):
self.assertIn("NOT IN", out.upper(), msg=out)
class TestLimitConditionUserLimit(DbmsStateMixin, unittest.TestCase):
"""A user LIMIT in --sql-query must be parsed AND stripped for the 'append LIMIT/OFFSET'
DBMSes, else limitQuery appends a 2nd LIMIT and blind/error read bogus offsets."""
APPEND_DBMSES = (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE, DBMS.H2, DBMS.CLICKHOUSE, DBMS.CRATEDB, DBMS.SPANNER, DBMS.HANA)
def test_user_limit_stripped_and_parsed(self):
for dbms in self.APPEND_DBMSES:
set_dbms(dbms)
expression, limitCond, _, startLimit, stopLimit = agent.limitCondition("SELECT name FROM t ORDER BY y LIMIT 3")
self.assertTrue(limitCond, msg=dbms)
self.assertEqual((startLimit, stopLimit), (0, 3), msg=dbms)
self.assertIsNone(re.search(r"(?i)\bLIMIT\b", expression), msg="%s not stripped: %s" % (dbms, expression))
class TestWhereQuery(DbmsStateMixin, unittest.TestCase):
"""whereQuery only acts when conf.dumpWhere is set."""