lib/rex/proto/http/request.rb in librex-0.0.65 vs lib/rex/proto/http/request.rb in librex-0.0.66

- old
+ new

@@ -1,5 +1,6 @@ +# -*- coding: binary -*- require 'uri' require 'rex/proto/http' module Rex module Proto @@ -17,11 +18,11 @@ ## # # Some individual request types. # ## - + # # HTTP GET request class wrapper. # class Get < Request def initialize(uri = '/', proto = DefaultProtocol) @@ -100,19 +101,19 @@ self.relative_resource = resource end # normalize out multiple slashes, directory traversal, and self referrential directories def normalize!(str) - i = 0 + i = 0 while (str.gsub!(/(\/\.\/|\/\w+\/\.\.\/|\/\/)/,'/')); i += 1; end i end # Puts a URI back together based on the URI parts def uri str = self.uri_parts['Resource'].dup || '/' - + # /././././ if self.junk_self_referring_directories str.gsub!(/\//) { '/.' * (rand(3) + 1) + '/' } @@ -123,11 +124,11 @@ if self.junk_param_start str.sub!(/\//, '/%3f' + Rex::Text.rand_text_alpha(rand(5) + 1) + '=' + Rex::Text.rand_text_alpha(rand(10) + 1) + '/../') end # /RAND/../RAND../ - if self.junk_directories + if self.junk_directories str.gsub!(/\//) { dirs = '' (rand(5)+5).times { dirs << '/' + Rex::Text.rand_text_alpha(rand(5) + 1) + '/..' } @@ -142,11 +143,11 @@ str.gsub!(/\//) { '/' * (rand(3) + 2) } str.sub!(/^[\/]+/, '/') # only one beginning slash! end - + # /%20HTTP/1.0%0d%0a/../../ # which decodes to "/ HTTP/1.0\r\n" if self.junk_end_of_uri str.sub!(/^\//, '/%20HTTP/1.0%0d%0a/../../') end @@ -156,11 +157,11 @@ if !PostRequests.include?(self.method) if param_string.size > 0 str << '?' + param_string end end - str + str end def param_string params=[] self.uri_parts['QueryString'].each_pair { |param, value| @@ -173,15 +174,15 @@ if value.kind_of?(Array) value.each { |subvalue| params.push(Rex::Text.uri_encode(param, self.uri_encode_mode) + '=' + Rex::Text.uri_encode(subvalue, self.uri_encode_mode)) } else - if !value.nil? - params.push(Rex::Text.uri_encode(param, self.uri_encode_mode) + '=' + Rex::Text.uri_encode(value, self.uri_encode_mode)) - else - params.push(Rex::Text.uri_encode(param, self.uri_encode_mode)) - end + if !value.nil? + params.push(Rex::Text.uri_encode(param, self.uri_encode_mode) + '=' + Rex::Text.uri_encode(value, self.uri_encode_mode)) + else + params.push(Rex::Text.uri_encode(param, self.uri_encode_mode)) + end end } # inject some junk params at the end of the param list, just to be sure :P if self.junk_params @@ -195,11 +196,11 @@ # Updates the underlying URI structure def uri=(str) self.raw_uri = str update_uri_parts end - + # Returns a request packet def to_s str = '' if self.junk_pipeline host = '' @@ -215,11 +216,11 @@ def body str = super || '' if str.length > 0 return str end - + if PostRequests.include?(self.method) return param_string end '' end @@ -289,33 +290,33 @@ # attr_accessor :relative_resource # add junk directories attr_accessor :junk_directories - - # add junk slashes + + # add junk slashes attr_accessor :junk_slashes - + # add junk self referring directories (aka /././././) attr_accessor :junk_self_referring_directories # add junk params attr_accessor :junk_params - + # add junk pipeline requests attr_accessor :junk_pipeline # add junk start of params attr_accessor :junk_param_start - + # add junk end of URI attr_accessor :junk_end_of_uri - - # encoding uri + + # encoding uri attr_accessor :uri_encode_mode - + protected # # Parses a CGI query string into the var/val combinations. # @@ -324,10 +325,10 @@ # Delimit on each variable str.split(/[;&]/).each { |vv| var = vv val = '' - + if (md = vv.match(/(.+?)=(.*)/)) var = md[1] val = md[2] end