Coverage for graphqler / fuzzer / engine / detectors / os_command_injection / os_command_injection_materializer.py: 36%

1from ...materializers.injection_materializer import InjectionMaterializer 

2from graphqler.utils.api import API 

3from ...materializers.getter import Getter 

4 

5from typing import override 

6 

7 

8# The main class that's being used 

9class OSCommandInjectionMaterializer(InjectionMaterializer): 

10 def __init__(self, api: API, fail_on_hard_dependency_not_met: bool = False, max_depth: int = 20): 

11 super().__init__(api, fail_on_hard_dependency_not_met) 

12 self.api = api 

13 self.fail_on_hard_dependency_not_met = fail_on_hard_dependency_not_met 

14 self.getter = OSCommandInjectionGetter() 

15 

16 

17# Override the getters class to add custom getters for SQL injection 

18class OSCommandInjectionGetter(Getter): 

19 def __init__(self): 

20 super().__init__() 

21 

22 @override 

23 def get_random_string(self, input_name: str) -> str: 

24 random_str = "" 

25 if input_name.lower() == "host": 

26 random_str = "localhost" 

27 elif input_name.lower() == "port": 

28 random_str = "80" 

29 elif input_name.lower() == "path": 

30 random_str = "/ ; cat /etc/passwd" 

31 elif input_name.lower() == "scheme": 

32 random_str = "http" 

33 elif input_name.lower() == "cmd": 

34 random_str = "cat /etc/passwd" 

35 else: 

36 return super().get_random_string(input_name) 

37 

38 return f"\"{random_str}\""