PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-06 04:31:29 +00:00
Code Issues Projects Releases Wiki Activity

Avoid format-string bugs. Fixes #2634

Browse Source
This commit is contained in:
dmiller
2023-07-20 17:24:16 +00:00
parent 7f435acec9
commit 1a7a96274a
9 changed files with 54 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
scripts/http-form-brute.nse
View File

@@ -514,21 +514,21 @@ action = function (host, port)
if not path_ok(path, hostname, port) then
return stdnse.format_output(false, string.format("Unusable form action %q", path))
end
stdnse.debug(form_debug, "Form submission path: " .. path)
stdnse.debug(form_debug, "Form submission path: %s", path)
-- HTTP method POST is the default
method = string.upper(method or "POST")
if not (method == "GET" or method == "POST") then
return stdnse.format_output(false, string.format("Invalid HTTP method %q", method))
end
stdnse.debug(form_debug, "HTTP method: " .. method)
stdnse.debug(form_debug, "HTTP method: %s", method)
-- passvar must be specified or detected, uservar is optional
if not passvar then
return stdnse.format_output(false, "No passvar was specified or detected (see http-form-brute.passvar)")
end
stdnse.debug(form_debug, "Username field: " .. (uservar or "(not set)"))
stdnse.debug(form_debug, "Password field: " .. passvar)
stdnse.debug(form_debug, "Username field: %s", uservar or "(not set)")
stdnse.debug(form_debug, "Password field: %s", passvar)
if onsuccess and onfailure then
return stdnse.format_output(false, "Either the onsuccess or onfailure argument should be passed, not both.")