Coverage for graphqler / fuzzer / engine / detectors / ssrf_injection / ssrf_injection_materialilzer.py: 30%

1from typing import override 

2 

3from graphqler.utils.api import API 

4 

5from ...materializers.getter import Getter 

6from ...materializers.injection_materializer import InjectionMaterializer 

7 

8 

9# The main class that's being used 

10class SSRFInjectionMaterializer(InjectionMaterializer): 

11 def __init__(self, api: API, fail_on_hard_dependency_not_met: bool = False, max_depth: int = 20): 

12 super().__init__(api, fail_on_hard_dependency_not_met) 

13 self.api = api 

14 self.fail_on_hard_dependency_not_met = fail_on_hard_dependency_not_met 

15 self.max_depth = max_depth 

16 self.getter = SSRFInjectionGetter() 

17 

18 

19# Override the getters class to add custom getters for SQL injection 

20class SSRFInjectionGetter(Getter): 

21 def __init__(self): 

22 super().__init__() 

23 

24 @override 

25 def get_random_string(self, input_name: str) -> str: 

26 if input_name == "url": 

27 return '"http://localhost:3000"' 

28 elif input_name == "uri": 

29 return '"http://localhost:3000"' 

30 elif input_name == "host": 

31 return '"localhost"' 

32 elif input_name == "path": 

33 return '"/"' 

34 elif input_name == "protocol": 

35 return '"http"' 

36 elif input_name == "port": 

37 return "3000" 

38 elif input_name == "ip": 

39 return "" 

40 elif input_name == "scheme": 

41 return '"http"' 

42 else: 

43 return super().get_random_string(input_name)