Changeset 449

Timestamp:

06/18/2010 01:39:41 AM (3 years ago)

Author:

sullo

Message:

Fix for #133: regular expression matching causes errors.
Removed char_escape and some other regexs in favor of the faster quotemeta().
Optimized rm_active_content() a little by shuffling code and reducing some mem copies/regexs. Needs more work.

Location:

trunk

Files:

• docs/CHANGES.txt (modified) (1 diff)
• plugins/nikto_apacheusers.plugin (modified) (2 diffs)
• plugins/nikto_core.plugin (modified) (5 diffs)
• plugins/nikto_robots.plugin (modified) (1 diff)

trunk/docs/CHANGES.txt

@@ +1 @@
+2010-06-17
+        - Fix for #133: regular expression matching causes errors. Removed char_escape and some other
+          regexs in favor of the faster quotemeta(). Also set many regexs to non-capturing for speed.
+        - Optimized rm_active_content() a little by shuffling code and reducing some mem copies/regexs. Needs more work.
 2010-06-15
         - Fix for #127: dav methods are treated specially and reported all at once

trunk/plugins/nikto_apacheusers.plugin

@@ -48 +48 @@
     (my $result, $content) = nfetch($mark, "/~root", "GET", "", "", "", "apacheusers: known user");
 
-    $content = char_escape($content);
+    $content = quotemeta($content);
     if ($content =~ /forbidden/i)    # good on "root"
     {
@@ -54 +54 @@
                                         "GET", "", "", "", "apacheusers: invalid user");
 
-        $content = char_escape($content);
+        $content = quotemeta($content);
         if ($content !~ /forbidden/i)    # Good, it gave an error instead of forbidden
         {

trunk/plugins/nikto_core.plugin

@@ -282 +282 @@
 
     # Try to remove active content which could mess up the file's signature
-    my $cont = $_[0];
-    my $file = $_[1];
-
-    # filename
-    if ($file ne '') {
-        $file =~ s/([^a-zA-Z0-9\s])/\\$1/g;
-        $cont =~ s/$file//g;
-    }
+    my ($cont, $file) = @_;
 
     # Dates
@@ -301 +294 @@
     # URI, if provided, plus encoded versions of it
     # $_[1] has unescaped file name, and $file has escaped. use appropriate one!
-    if (defined $file) {
-
-        # match pages which link to themselves w/diff args
-        my $e = $file;
-        $e    =~ s/^\/$file\??//;
-        $cont =~ s/$e//gs;
-
-        # again but with the index in place
-        $e = $file;
-        $cont =~ s/$e//gs;
+    if ($file ne '') {
+        $file = quotemeta($file);
+        $cont =~ s/$file//g;
 
         # base 64
-        $e = LW2::encode_base64($_[1]);
+        my $e = LW2::encode_base64($_[1]);
         $cont =~ s/$e//gs;
 
@@ -330 +316 @@
 
         # url encoding, query portion
-        if ($file =~ /\?/) {
-            $e = $file;
-            $e =~ s/\?(.*$)//;
-            my $qs = $1;
+        if ($file =~ /\?(.*$)/) {
+            my $qs = $1;
+
+            # match pages which link to themselves w/diff args
+            $cont =~ s/$qs//gs;
+
+            # url encoded
             $qs =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
-            $e .= "?$qs";
-            $cont =~ s/$e//gs;
+            $cont =~ s/$qs//gs;
         }
     }
@@ -2026 +2014 @@
                 $db_extensions{$ext} = 1;
 
-                # This escapes regex characters in the conditionals. 
-                # This will have to change if regex is ever allowed in the db
-                for (my $y = 5 ; $y <= 9 ; $y++) { $item[$y] =~ s/([^a-zA-Z0-9\s])/\\$1/g; }
+                # Escape chars in the conditionals.  This must change if regexs are allowed in the db.
+                for (my $y = 5 ; $y <= 9 ; $y++) { $item[$y] = quotemeta($item[$y]); }
 
                 $NIKTO{total_checks}++;
@@ -2058 +2045 @@
 sub max_test_id {
     return (sort { $a <=> $b } keys %TESTS)[-1];
-}
-
-#######################################################################
-sub char_escape {
-    $_[0] =~ s/([^a-zA-Z0-9 ])/\\$1/g;
-    return $_[0];
 }
 

trunk/plugins/nikto_robots.plugin

@@ -48 +48 @@
         my @DOC = split(/\n/, $CONTENT);
         foreach my $line (@DOC) {
-            $line = char_escape($line);
+            $line = quotemeta($line);
             if ($line =~ /allow/i)
             {