diff --git a/lib/controller/checks.py b/lib/controller/checks.py index d5d03434c..d12f4313f 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -329,11 +329,6 @@ def checkSqlInjection(place, parameter, value): kb.matchRatio = None Request.queryPage(genCmpPayload(), place, raise404=False) - # If in the comparing stage there was an error - # then anything non-error will be considered as True - if kb.errorIsNone and kb.matchRatio is None: - kb.matchRatio = LOWER_RATIO_BOUND - # Perform the test's True request trueResult = Request.queryPage(reqPayload, place, raise404=False) diff --git a/lib/request/comparison.py b/lib/request/comparison.py index ccc727496..82599f0cb 100644 --- a/lib/request/comparison.py +++ b/lib/request/comparison.py @@ -29,30 +29,34 @@ from lib.core.settings import UPPER_RATIO_BOUND from lib.core.threads import getCurrentThreadData def comparison(page, headers, code=None, getRatioValue=False, pageLength=None): + #return _checkNegativeLogic(_comparison(page, headers, code, getRatioValue, pageLength), getRatioValue) + return _comparison(page, headers, code, getRatioValue, pageLength) + +def _checkNegativeLogic(condition, getRatioValue): + condition = not (condition or False) if kb.negativeLogic else condition + return condition if not getRatioValue else (MAX_RATIO if condition else MIN_RATIO) + +def _comparison(page, headers, code, getRatioValue, pageLength): if page is None and pageLength is None: return None seqMatcher = getCurrentThreadData().seqMatcher seqMatcher.set_seq1(kb.pageTemplate) - def checkNegativeLogic(condition): - condition = not condition if kb.negativeLogic else condition - return condition if not getRatioValue else (MAX_RATIO if condition else MIN_RATIO) - if any([conf.string, conf.regexp]): rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) # String to match in page when the query is valid if conf.string: - return checkNegativeLogic(conf.string in rawResponse) + return conf.string in rawResponse # Regular expression to match in page when the query is valid if conf.regexp: - return checkNegativeLogic(re.search(conf.regexp, rawResponse, re.I | re.M) is not None) + return re.search(conf.regexp, rawResponse, re.I | re.M) is not None # HTTP code to match when the query is valid if isinstance(code, int) and conf.code: - return checkNegativeLogic(conf.code == code) + return conf.code == code if page: # In case of an DBMS error page return None