Home page logo
/

nmap-dev logo Nmap Development mailing list archives

Re: parsing of script-args is broken
From: David Fifield <david () bamsoftware com>
Date: Thu, 30 Apr 2009 18:16:11 -0600

On Mon, Apr 27, 2009 at 04:38:20PM -0600, Patrick Donnelly wrote:
On Mon, Apr 27, 2009 at 7:53 AM, jah <jah () zadkiel plus com> wrote:
This patch looks good to me.  Do you think we should allow lists too:
vhost={domain.co.uk,domain.com}?
Your patch will pass that example to loadstring() as:
["vhost"]={domain.co.uk,domain.com}
whereas it is intented as:
["vhost"]={"domain.co.uk", "domain.com"}
supplying the arguments with quoted list-members works fine by the way:
--script-args vhost={'domain.co.uk','domain.com'}
=> ["vhost"]={'domain.co.uk','domain.com'}

A list seems to me to be a reasonable thing to be able to supply to a
script and with this patch, the user will have to quote the list items
themselves which isn't very intuitive given that we can quote key/value
pairs on their behalf.

I don't think array were originally intended but I have updated the
patch to allow this. Correctly implementing this with Lua's limited
regular expressions can be tricky to get correct so if you find any
more bugs (or have suggestions) let us know.

This patch looks fine to me too. Check it in, just please be sure to
give examples of any new syntax in scripting.xml. (Something like the
"domain.co.uk" above is fine.)

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]