Skip to content

Commit ffb10a0

Browse files
lanshuizhiyuelanshuizhiyue
committed
fix: 修复Burp插件参数解析和后端参数显示问题
- 修复ScanConfigParser.tokenize()等号处理逻辑，确保--answers=xxx=xxx格式的参数值不被截断 - 优化后端_get_task_scan_options_sync方法，显示用户设置的所有参数（包括与默认值相同的参数） - 修复Sass @import弃用警告，改用@use语法
1 parent 4ba34a2 commit ffb10a0

5 files changed

Lines changed: 51 additions & 8 deletions

File tree

‎src/backEnd/model/Task.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ def __init__(self, taskid, remote_addr, scanUrl, host, method, headers, body):
6262
self.output_directory = None
6363
self.options = None
6464
self._original_options = None
65+
self._user_set_options = set() # 跟踪用户显式设置的参数
6566
self._header_rules_applied = False # 标记是否已应用请求头规则
6667
self._body_field_rules_applied = False # 标记是否已应用Body字段规则
6768
self._request_file_path = None # HTTP原始报文文件路径
@@ -98,13 +99,18 @@ def initialize_options(self, taskid):
9899

99100
def set_option(self, option, value):
100101
self.options[option] = value # type: ignore
102+
self._user_set_options.add(option) # 记录用户显式设置的参数
101103

102104
def get_option(self, option):
103105
return self.options[option] # type: ignore
104106

105107
def get_options(self):
106108
return self.options
107109

110+
def get_user_set_options(self):
111+
"""获取用户显式设置的参数名集合"""
112+
return self._user_set_options
113+
108114
def reset_options(self):
109115
self.options = AttribDict(self._original_options)
110116

‎src/backEnd/service/taskService.py‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -551,7 +551,9 @@ def _get_task_scan_options_sync(self, taskId: str):
551551
return (None, False, "task not found", status.HTTP_404_NOT_FOUND)
552552
task = DataStore.tasks[taskId]
553553
task_options = task.get_options()
554+
user_set_options = task.get_user_set_options() # 获取用户显式设置的参数
554555
res_options = []
556+
555557
for option in task_options:
556558
# 跳过内部选项
557559
if option in INTERNAL_OPTIONS:
@@ -561,7 +563,12 @@ def _get_task_scan_options_sync(self, taskId: str):
561563
if option_value is None:
562564
continue
563565

564-
# 跳过与 SQLMap 默认值相同的选项（用户没有显式设置的）
566+
# 用户显式设置的参数，无论值是什么都显示
567+
if option in user_set_options:
568+
res_options.append({"option": option, "value": option_value})
569+
continue
570+
571+
# 非用户设置的参数，跳过与 SQLMap 默认值相同的选项
565572
default_value = SQLMAP_DEFAULTS.get(option)
566573
if default_value is not None and option_value == default_value:
567574
continue

‎src/burpEx/legacy-api/src/main/java/com/sqlmapwebui/burp/ScanConfigParser.java‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -892,12 +892,16 @@ private static String normalizeParamString(String input) {
892892
/**
893893
* 分词为参数数组
894894
* 支持带引号的字符串
895+
*
896+
* 修复：对于 --param=value 格式，只在参数名后的第一个等号处分割，
897+
* 值中的等号将被保留（如 --answers=crack=N,dict=N）
895898
*/
896899
private static String[] tokenize(String input) {
897900
List<String> tokens = new ArrayList<>();
898901
StringBuilder current = new StringBuilder();
899902
boolean inQuote = false;
900903
char quoteChar = 0;
904+
boolean inValue = false; // 标记是否正在解析参数值
901905

902906
for (int i = 0; i < input.length(); i++) {
903907
char c = input.charAt(i);
@@ -917,10 +921,21 @@ private static String[] tokenize(String input) {
917921
tokens.add(current.toString());
918922
current = new StringBuilder();
919923
}
924+
inValue = false; // 空格后重置，下一个可能是新参数
920925
} else if (c == '=') {
921-
if (current.length() > 0) {
922-
tokens.add(current.toString());
923-
current = new StringBuilder();
926+
// 只有当当前token是参数名（以-开头）时，等号才作为分隔符
927+
// 否则等号是值的一部分
928+
String currentStr = current.toString();
929+
if (currentStr.startsWith("-") && !inValue) {
930+
// 这是参数名后的第一个等号，作为分隔符
931+
if (current.length() > 0) {
932+
tokens.add(currentStr);
933+
current = new StringBuilder();
934+
}
935+
inValue = true; // 标记现在开始解析值
936+
} else {
937+
// 值中的等号，保留
938+
current.append(c);
924939
}
925940
} else {
926941
current.append(c);

‎src/burpEx/montoya-api/src/main/java/com/sqlmapwebui/burp/ScanConfigParser.java‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -892,12 +892,16 @@ private static String normalizeParamString(String input) {
892892
/**
893893
* 分词为参数数组
894894
* 支持带引号的字符串
895+
*
896+
* 修复：对于 --param=value 格式，只在参数名后的第一个等号处分割，
897+
* 值中的等号将被保留（如 --answers=crack=N,dict=N）
895898
*/
896899
private static String[] tokenize(String input) {
897900
List<String> tokens = new ArrayList<>();
898901
StringBuilder current = new StringBuilder();
899902
boolean inQuote = false;
900903
char quoteChar = 0;
904+
boolean inValue = false; // 标记是否正在解析参数值
901905

902906
for (int i = 0; i < input.length(); i++) {
903907
char c = input.charAt(i);
@@ -917,10 +921,21 @@ private static String[] tokenize(String input) {
917921
tokens.add(current.toString());
918922
current = new StringBuilder();
919923
}
924+
inValue = false; // 空格后重置，下一个可能是新参数
920925
} else if (c == '=') {
921-
if (current.length() > 0) {
922-
tokens.add(current.toString());
923-
current = new StringBuilder();
926+
// 只有当当前token是参数名（以-开头）时，等号才作为分隔符
927+
// 否则等号是值的一部分
928+
String currentStr = current.toString();
929+
if (currentStr.startsWith("-") && !inValue) {
930+
// 这是参数名后的第一个等号，作为分隔符
931+
if (current.length() > 0) {
932+
tokens.add(currentStr);
933+
current = new StringBuilder();
934+
}
935+
inValue = true; // 标记现在开始解析值
936+
} else {
937+
// 值中的等号，保留
938+
current.append(c);
924939
}
925940
} else {
926941
current.append(c);

‎src/frontEnd/src/views/Config/components/SessionHeadersConfig.vue‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -979,5 +979,5 @@ function truncate(text: string, length: number) {
979979
</script>
980980

981981
<style scoped lang="scss">
982-
@import './SessionHeaders/session-headers.scss';
982+
@use './SessionHeaders/session-headers.scss' as *;
983983
</style>

0 commit comments

Comments
 (0)