diff --git a/lib/rex/post/postgresql/ui/console/command_dispatcher/client.rb b/lib/rex/post/postgresql/ui/console/command_dispatcher/client.rb index f0b2205bfc31..2196f33e6a5f 100644 --- a/lib/rex/post/postgresql/ui/console/command_dispatcher/client.rb +++ b/lib/rex/post/postgresql/ui/console/command_dispatcher/client.rb @@ -95,7 +95,7 @@ def cmd_shell(*args) return end - formatted_query = raw_query.split.map { |word| word.chomp('\\') }.reject(&:empty?).compact.join(' ') + formatted_query = process_query(query: raw_query) unless formatted_query.empty? print_status "Running SQL Command: '#{formatted_query}'" @@ -155,6 +155,12 @@ def cmd_query(*args) print_line(table.to_s) end end + + def process_query(query: '') + return '' if query.empty? + + query.lines.each.map { |line| line.chomp("\\\n").strip }.reject(&:empty?).compact.join(' ') + end end end end diff --git a/spec/lib/rex/post/postgresql/ui/console/command_dispatcher/client_spec.rb b/spec/lib/rex/post/postgresql/ui/console/command_dispatcher/client_spec.rb new file mode 100644 index 000000000000..7bd37bd306d1 --- /dev/null +++ b/spec/lib/rex/post/postgresql/ui/console/command_dispatcher/client_spec.rb @@ -0,0 +1,28 @@ +# frozen_string_literal: true + +require 'spec_helper' +require 'rex/post/postgresql' + +RSpec.describe Rex::Post::PostgreSQL::Ui::Console::CommandDispatcher::Client do + let (:client) { described_class.new(nil) } + + before(:each) do + allow(client).to receive(:process_query).and_call_original + end + + describe '.process_query' do + [ + { query: "SELECT \\\nVERSION();", result: 'SELECT VERSION();' }, + { query: "SELECT \VERSION();", result: 'SELECT VERSION();' }, + { query: "SELECT * \\\nFROM dummy_table\\\nWHERE name='example_name'\\\n;", result: "SELECT * FROM dummy_table WHERE name='example_name' ;" }, + { query: "SELECT \\\n* FROM dummy_table\\\n WHERE name='example_name';\n", result: "SELECT * FROM dummy_table WHERE name='example_name';" }, + { query: "INSERT INTO dummy_table VALUES (\\\n'username' \\\n'password_!@£$%^&*()\\'\\\n);", result: "INSERT INTO dummy_table VALUES ( 'username' 'password_!@£$%^&*()\\' );" }, + { query: "DELETE\\\n FROM\\\n dummy_table\\\n WHERE\\\n field='\"\\'\\\n;", result: "DELETE FROM dummy_table WHERE field='\"\\' ;" }, + { query: "SELECT * FROM dummy_table WHERE field='example\\\nfield'", result: "SELECT * FROM dummy_table WHERE field='example field'" }, + ].each do |expected| + it 'returns the expected value' do + expect(client.process_query(query: expected[:query])).to eq(expected[:result]) + end + end + end +end