FS#56287 - [sqlmap] wrapper script breaks relative paths in argv
Attached to Project:
Community Packages
Opened by Pedro F. (psf) - Friday, 10 November 2017, 02:07 GMT
Last edited by Jelle van der Waa (jelly) - Sunday, 03 September 2023, 09:37 GMT
Opened by Pedro F. (psf) - Friday, 10 November 2017, 02:07 GMT
Last edited by Jelle van der Waa (jelly) - Sunday, 03 September 2023, 09:37 GMT
|
Details
Description: sqlmap using sh wrapper changes directory
losing context.
Additional info: package version(s): 1.1.11#stable Steps to reproduce: # sqlmap -r request.req To fix: Just change remove the `cd` lines from the wrapper and call the program using its full path. Example: python2 /opt/${pkgname}/sqlmapi.py "\$@" That should be enough to avoid losing the context. Output of the issue: http://ix.io/C82/sh If more info is needed, I'll be glad to provide. |
This task depends upon
Closed by Jelle van der Waa (jelly)
Sunday, 03 September 2023, 09:37 GMT
Reason for closing: No response
Sunday, 03 September 2023, 09:37 GMT
Reason for closing: No response
@anthraxx, maybe a better fix would be to create a python wrapper which uses sys.path.insert() -- also why is it installed to /opt instead of say /usr/share or path munging and placing it in /usr/lib/python2.7 or something?
Maybe upstream would accept a rework that allowed their software to actually be installed in a halfway reasonable manner, and fixed PEP 394 in the process?
In my humble opinion, just removing the `cd` on PKGBUILD, therefore creating a sh wrapper that won't change the directory, is enough. I think creating a python wrapper is a little bit too much maybe? What would be the benefits of that?
Now about changing it upstream, sounds like a good idea. Even though that should take some time to be accepted, I believe. That's why the idea of only removing the `cd` as a more fast fix.
Thanks and good day.
PS: thanks for changing the summary, my bad.
I suggest you try running `python2 /opt/sqlmap/sqlmap.py -r /root/ctf/hackthebox/boxes/10.10.10.31/login.req -p user` from outside of /opt/sqlmap, you will see exactly why the cd was necessary. /opt/sqlmap/lib *must* be able to be imported.
This would be easy to fix if all the lib files were modified to actually perform relative imports, rather than assuming that no one will every run sqlmap outside of a local git clone.
Good afternoon.
Just did, seems to be working just fine. But then again, I'm no authority nor a Python expert; I'm just trying to help. :)
I tried to take a look at the code and this function seems pretty interesting: https://github.com/sqlmapproject/sqlmap/blob/master/sqlmap.py#L75.
Cheers.
Logs: http://ix.io/C8G/+
PS: I didn't have the original request file to reproduce the same command than before, but you can see from the changes in the wrapper that it won't change directory.
Hacking around with the $PWD because upstream doesn't support anything other than cd'ing into a git clone, isn't very feasible. But that's the only way to do it right now.
You're right that they don't provide relative imports for their modules but they have done that workaround/hack to prevent errors when launching sqlmap.py outside of the clone dir. This patch (https://paste.rs/w1S) will fix the issue.