Skip to content

Commit 2acd844

Browse files
postmodernpostmodern
committed
Added Ronin::Code::SQL::Mixin.
1 parent 8f09790 commit 2acd844

4 files changed

Lines changed: 124 additions & 73 deletions

File tree

‎lib/ronin/code/sql.rb‎

Lines changed: 2 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@
1818
# along with ronin-code-sql. If not, see <https://www.gnu.org/licenses/>.
1919
#
2020

21-
require 'ronin/code/sql/statement_list'
22-
require 'ronin/code/sql/injection'
21+
require 'ronin/code/sql/mixin'
2322

2423
module Ronin
2524
module Code
@@ -30,65 +29,7 @@ module Code
3029
# @see http://en.wikipedia.org/wiki/SQL_injection
3130
#
3231
module SQL
33-
#
34-
# Creates a new SQL statement list.
35-
#
36-
# @yield [(statements)]
37-
# If a block is given, it will be evaluated within the statement list.
38-
# If the block accepts an argument, the block will be called with the
39-
# new statement list.
40-
#
41-
# @yieldparam [StatementList] statements
42-
# The new statement list.
43-
#
44-
# @return [StatementList]
45-
# The new SQL statement list.
46-
#
47-
# @example
48-
# sql { select(1,2,3,4,id).from(users) }
49-
# # => #<Ronin::Code::SQL::StatementList: SELECT (1,2,3,4,id) FROM users>
50-
#
51-
# @api public
52-
#
53-
def sql(&block)
54-
StatementList.new(&block)
55-
end
56-
57-
#
58-
# Creates a new SQL injection (SQLi)
59-
#
60-
# @param [Hash{Symbol => Object}] kwargs
61-
# Additional keyword arguments for {Injection#initialize}.
62-
#
63-
# @option kwargs [:integer, :decimal, :string, :column] :escape
64-
# The type of element to escape out of.
65-
#
66-
# @option kwargs [Boolean] :terminate
67-
# Specifies whether to terminate the SQLi with a comment.
68-
#
69-
# @option kwargs [String, Symbol, Integer] :place_holder
70-
# Place-holder data.
71-
#
72-
# @yield [(injection)]
73-
# If a block is given, it will be evaluated within the injection.
74-
# If the block accepts an argument, the block will be called with the
75-
# new injection.
76-
#
77-
# @yieldparam [Injection] injection
78-
# The new injection.
79-
#
80-
# @return [Injection]
81-
# The new SQL injection.
82-
#
83-
# @example
84-
# sqli { self.and { 1 == 1 }.select(1,2,3,4,id).from(users) }
85-
# # => #<Ronin::Code::SQL::Injection: 1 AND 1=1; SELECT (1,2,3,4,id) FROM users; SELECT (1,2,3,4,id) FROM users>
86-
#
87-
# @api public
88-
#
89-
def sqli(**kwargs,&block)
90-
Injection.new(**kwargs,&block)
91-
end
32+
include Mixin
9233
end
9334
end
9435
end

‎lib/ronin/code/sql/mixin.rb‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# frozen_string_literal: true
2+
#
3+
# ronin-code-sql - A Ruby DSL for crafting SQL Injections.
4+
#
5+
# Copyright (c) 2007-2023 Hal Brodigan (postmodern.mod3 at gmail.com)
6+
#
7+
# ronin-code-sql is free software: you can redistribute it and/or modify
8+
# it under the terms of the GNU Lesser General Public License as published
9+
# by the Free Software Foundation, either version 3 of the License, or
10+
# (at your option) any later version.
11+
#
12+
# ronin-code-sql is distributed in the hope that it will be useful,
13+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
14+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15+
# GNU Lesser General Public License for more details.
16+
#
17+
# You should have received a copy of the GNU Lesser General Public License
18+
# along with ronin-code-sql. If not, see <https://www.gnu.org/licenses/>.
19+
#
20+
21+
require 'ronin/code/sql/statement_list'
22+
require 'ronin/code/sql/injection'
23+
24+
module Ronin
25+
module Code
26+
module SQL
27+
#
28+
# Adds helper methods for building SQL or SQL injections.
29+
#
30+
# @since 2.1.0
31+
#
32+
module Mixin
33+
#
34+
# Creates a new SQL statement list.
35+
#
36+
# @yield [(statements)]
37+
# If a block is given, it will be evaluated within the statement list.
38+
# If the block accepts an argument, the block will be called with the
39+
# new statement list.
40+
#
41+
# @yieldparam [StatementList] statements
42+
# The new statement list.
43+
#
44+
# @return [StatementList]
45+
# The new SQL statement list.
46+
#
47+
# @example
48+
# sql { select(1,2,3,4,id).from(users) }
49+
# # => #<Ronin::Code::SQL::StatementList: SELECT (1,2,3,4,id) FROM users>
50+
#
51+
# @api public
52+
#
53+
def sql(&block)
54+
StatementList.new(&block)
55+
end
56+
57+
#
58+
# Creates a new SQL injection (SQLi)
59+
#
60+
# @param [Hash{Symbol => Object}] kwargs
61+
# Additional keyword arguments for {Injection#initialize}.
62+
#
63+
# @option kwargs [:integer, :decimal, :string, :column] :escape
64+
# The type of element to escape out of.
65+
#
66+
# @option kwargs [Boolean] :terminate
67+
# Specifies whether to terminate the SQLi with a comment.
68+
#
69+
# @option kwargs [String, Symbol, Integer] :place_holder
70+
# Place-holder data.
71+
#
72+
# @yield [(injection)]
73+
# If a block is given, it will be evaluated within the injection.
74+
# If the block accepts an argument, the block will be called with the
75+
# new injection.
76+
#
77+
# @yieldparam [Injection] injection
78+
# The new injection.
79+
#
80+
# @return [Injection]
81+
# The new SQL injection.
82+
#
83+
# @example
84+
# sqli { self.and { 1 == 1 }.select(1,2,3,4,id).from(users) }
85+
# # => #<Ronin::Code::SQL::Injection: 1 AND 1=1; SELECT (1,2,3,4,id) FROM users; SELECT (1,2,3,4,id) FROM users>
86+
#
87+
# @api public
88+
#
89+
def sqli(**kwargs,&block)
90+
Injection.new(**kwargs,&block)
91+
end
92+
end
93+
end
94+
end
95+
end

‎spec/sql/mixin_spec.rb‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
require 'spec_helper'
2+
require 'ronin/code/sql/mixin'
3+
4+
describe Ronin::Code::SQL::Mixin do
5+
module TestMixin
6+
class TestClass
7+
include Ronin::Code::SQL::Mixin
8+
end
9+
end
10+
11+
let(:test_class) { TestMixin::TestClass }
12+
subject { test_class.new }
13+
14+
describe "#sql" do
15+
it "should return a new SQL::StatementList" do
16+
expect(subject.sql).to be_kind_of(Ronin::Code::SQL::StatementList)
17+
end
18+
end
19+
20+
describe "#sqli" do
21+
it "should return a new SQL::Injection" do
22+
expect(subject.sqli).to be_kind_of(Ronin::Code::SQL::Injection)
23+
end
24+
end
25+
end

‎spec/sql_spec.rb‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,7 @@
22
require 'ronin/code/sql'
33

44
describe Ronin::Code::SQL do
5-
subject { Object.new.extend(described_class) }
6-
7-
describe "#sql" do
8-
it "should return a new SQL::StatementList" do
9-
expect(subject.sql).to be_kind_of(Ronin::Code::SQL::StatementList)
10-
end
11-
end
12-
13-
describe "#sqli" do
14-
it "should return a new SQL::Injection" do
15-
expect(subject.sqli).to be_kind_of(Ronin::Code::SQL::Injection)
16-
end
5+
it "must include SQL::Mixin" do
6+
expect(subject).to include(Ronin::Code::SQL::Mixin)
177
end
188
end

0 commit comments

Comments
 (0)