CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Minor fix

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-19 11:54:53 +02:00
parent 109ce217ec
commit 00cccf78e5
2 changed files with 42 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>) # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.120" VERSION = "1.10.7.121"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@ -501,7 +501,7 @@ ERROR_PARSING_REGEXES = (
) )
# Regular expression used for parsing charset info from meta html headers # Regular expression used for parsing charset info from meta html headers
META_CHARSET_REGEX = r'(?si)<head>.*<meta[^>]+charset="?(?P<result>[^"> ]+).*</head>' META_CHARSET_REGEX = r"""(?si)<head\b[^>]*>.*<meta[^>]+charset\s*=\s*["']?(?P<result>[^"'> ]+).*</head>"""
# Regular expression used for parsing refresh info from meta html headers # Regular expression used for parsing refresh info from meta html headers
META_REFRESH_REGEX = r'(?i)<meta http-equiv="?refresh"?[^>]+content="?[^">]+;\s*(url=)?["\']?(?P<result>[^\'">]+)' META_REFRESH_REGEX = r'(?i)<meta http-equiv="?refresh"?[^>]+content="?[^">]+;\s*(url=)?["\']?(?P<result>[^\'">]+)'

40
tests/test_decodepage.py
View file

@ -25,7 +25,10 @@ from _testutils import bootstrap
bootstrap() bootstrap()
from lib.request.basic import decodePage from lib.request.basic import decodePage
from lib.core.common import extractRegexResult
from lib.core.data import conf, kb
from lib.core.exception import SqlmapCompressionException from lib.core.exception import SqlmapCompressionException
from lib.core.settings import META_CHARSET_REGEX
BODY = b"Hello plain body content 12345 - no markup here" BODY = b"Hello plain body content 12345 - no markup here"
@ -68,6 +71,43 @@ class TestCharset(unittest.TestCase):
out = decodePage(original.encode("utf-8"), None, "text/html; charset=utf-8") out = decodePage(original.encode("utf-8"), None, "text/html; charset=utf-8")
self.assertEqual(out, original) self.assertEqual(out, original)
def test_meta_charset_used_when_no_http_charset(self):
# charset declared only via <meta> (no HTTP charset) with an attribute on <head>
# must still be honored; byte 0xC0 is 'А' (U+0410) in windows-1251
page = b'<html><head lang="ru"><meta charset="windows-1251"></head><body>\xc0\xc1\xc2</body></html>'
conf.encoding = None
kb.pageEncoding = None
out = decodePage(page, None, "text/html")
self.assertIn(u"АБВ", out)
class TestMetaCharsetRegex(unittest.TestCase):
"""META_CHARSET_REGEX must tolerate real-world <head>/meta forms while staying scoped
to the head so body content can't hijack the detected charset."""
def _charset(self, html):
return extractRegexResult(META_CHARSET_REGEX, html)
def test_head_with_attributes(self):
self.assertEqual(self._charset('<html><head lang="en"><meta charset="iso-8859-2"></head></html>'), "iso-8859-2")
def test_whitespace_around_equals(self):
self.assertEqual(self._charset('<html><head><meta charset = "utf-8"></head></html>'), "utf-8")
def test_single_quotes_stripped(self):
self.assertEqual(self._charset("<html><head><meta charset='utf-8'></head></html>"), "utf-8")
def test_http_equiv_content_type(self):
self.assertEqual(self._charset('<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"></head></html>'), "windows-1251")
def test_header_tag_not_matched(self):
# <header> is not <head>
self.assertIsNone(self._charset('<html><header><meta charset="utf-8"></header></html>'))
def test_body_meta_not_hijacked(self):
# a meta whose content merely mentions charset= in the body must not be picked up
self.assertIsNone(self._charset('<html><head><title>t</title></head><body><meta name="d" content="learn charset=evil"></body></html>'))
class TestMalformed(unittest.TestCase): class TestMalformed(unittest.TestCase):
def test_invalid_deflate_raises(self): def test_invalid_deflate_raises(self):