Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: ffuf ANSI code processing preventing task to finish #1058

Merged
merged 2 commits into from
Nov 24, 2023
Merged

fix: ffuf ANSI code processing preventing task to finish #1058

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d49c58b
fix ANSI processing
ocervell Nov 21, 2023
862f667
fix ffuf extensions
yogeshojha Nov 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 21 additions & 21 deletions web/reNgine/definitions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -398,27 +398,27 @@

# Default Dir File Fuzz Params
DEFAULT_DIR_FILE_FUZZ_EXTENSIONS = [
'html',
'php',
'git',
'yaml',
'conf',
'cnf',
'config',
'gz',
'env',
'log',
'db',
'mysql',
'bak',
'asp',
'aspx',
'txt',
'conf',
'sql',
'json',
'yml',
'pdf',
'.html',
'.php',
'.git',
'.yaml',
'.conf',
'.cnf',
'.config',
'.gz',
'.env',
'.log',
'.db',
'.mysql',
'.bak',
'.asp',
'.aspx',
'.txt',
'.conf',
'.sql',
'.json',
'.yml',
'.pdf',
]

# Roles and Permissions
Expand Down
18 changes: 13 additions & 5 deletions web/reNgine/tasks.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1575,6 +1575,8 @@ def dir_file_fuzz(self, ctx={}, description=None):
enable_http_crawl = config.get(ENABLE_HTTP_CRAWL, DEFAULT_ENABLE_HTTP_CRAWL)
rate_limit = config.get(RATE_LIMIT) or self.yaml_configuration.get(RATE_LIMIT, DEFAULT_RATE_LIMIT)
extensions = config.get(EXTENSIONS, DEFAULT_DIR_FILE_FUZZ_EXTENSIONS)
# prepend . on extensions
extensions = [ext if ext.startswith('.') else '.' + ext for ext in extensions]
extensions_str = ','.join(map(str, extensions))
follow_redirect = config.get(FOLLOW_REDIRECT, FFUF_DEFAULT_FOLLOW_REDIRECT)
max_time = config.get(MAX_TIME, 0)
Expand Down Expand Up @@ -3176,7 +3178,7 @@ def parse_nmap_results(xml_file, output_file=None):
if hostnames_dict:
# Ensure that hostnames['hostname'] is a list for consistency
hostnames_list = hostnames_dict['hostname'] if isinstance(hostnames_dict['hostname'], list) else [hostnames_dict['hostname']]

# Extract all the @name values from the list of dictionaries
hostnames = [entry.get('@name') for entry in hostnames_list]
else:
Expand Down Expand Up @@ -3511,7 +3513,7 @@ def record_exists(model, data, exclude_keys=[]):
Returns:
bool: True if the record exists, False otherwise.
"""

# Extract the keys that will be used for the lookup
lookup_fields = {key: data[key] for key in data if key not in exclude_keys}

Expand Down Expand Up @@ -4123,15 +4125,21 @@ def stream_command(cmd, cwd=None, shell=False, history_file=None, encoding='utf-
process = subprocess.Popen(
command,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
stderr=subprocess.STDOUT,
universal_newlines=True,
shell=shell)

# Log the output in real-time to the database
output = ""

# Process the output
for line in iter(lambda: process.stdout.readline() or process.stderr.readline(), b''):
line = re.sub(r'\x1b[^m]*m', '', line.decode('utf-8').strip())
for line in iter(lambda: process.stdout.readline(), b''):
if not line:
break
line = line.strip()
ansi_escape = re.compile(r'\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])')

Check warning

Code scanning / CodeQL

Overly permissive regular expression range

Suspicious character range that is equivalent to \[@A-Z\].

Check warning

Code scanning / CodeQL

Overly permissive regular expression range

Suspicious character range that is equivalent to \[0-9:;<=>?\].
line = ansi_escape.sub('', line)
line = line.replace('\\x0d\\x0a', '\n')
if trunc_char and line.endswith(trunc_char):
line = line[:-1]
item = line
Expand Down