diff --git a/lib/core/settings.py b/lib/core/settings.py index b587082ac..1eae49f1d 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.228" +VERSION = "1.10.7.229" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/tamper/charunicodeescape.py b/tamper/charunicodeescape.py index 0bc2624ae..30e1e4337 100644 --- a/tamper/charunicodeescape.py +++ b/tamper/charunicodeescape.py @@ -33,7 +33,13 @@ def tamper(payload, **kwargs): retVal += "\\u00%s" % payload[i + 1:i + 3] i += 3 else: - retVal += '\\u%.4X' % ord(payload[i]) + ordinal = ord(payload[i]) + if ordinal > 0xFFFF: + # non-BMP: emit a UTF-16 surrogate pair (a bare 5-hex '\uXXXXX' is invalid) + ordinal -= 0x10000 + retVal += "\\u%04X\\u%04X" % (0xD800 + (ordinal >> 10), 0xDC00 + (ordinal & 0x3FF)) + else: + retVal += "\\u%04X" % ordinal i += 1 return retVal diff --git a/tamper/overlongutf8.py b/tamper/overlongutf8.py index 75bd678e7..8246ed516 100644 --- a/tamper/overlongutf8.py +++ b/tamper/overlongutf8.py @@ -38,7 +38,12 @@ def tamper(payload, **kwargs): i += 3 else: if payload[i] not in (string.ascii_letters + string.digits): - retVal += "%%%.2X%%%.2X" % (0xc0 + (ord(payload[i]) >> 6), 0x80 + (ord(payload[i]) & 0x3f)) + ordinal = ord(payload[i]) + if ordinal <= 0x7FF: + retVal += "%%%.2X%%%.2X" % (0xc0 + (ordinal >> 6), 0x80 + (ordinal & 0x3f)) + else: + # the 2-byte overlong form can't hold code points > U+07FF; fall back to real UTF-8 + retVal += "".join("%%%.2X" % _ for _ in bytearray(payload[i].encode("utf8"))) else: retVal += payload[i] i += 1 diff --git a/tamper/overlongutf8more.py b/tamper/overlongutf8more.py index 391464f6e..c8ad07d31 100644 --- a/tamper/overlongutf8more.py +++ b/tamper/overlongutf8more.py @@ -37,7 +37,12 @@ def tamper(payload, **kwargs): retVal += payload[i:i + 3] i += 3 else: - retVal += "%%%.2X%%%.2X" % (0xc0 + (ord(payload[i]) >> 6), 0x80 + (ord(payload[i]) & 0x3f)) + ordinal = ord(payload[i]) + if ordinal <= 0x7FF: + retVal += "%%%.2X%%%.2X" % (0xc0 + (ordinal >> 6), 0x80 + (ordinal & 0x3f)) + else: + # the 2-byte overlong form can't hold code points > U+07FF; fall back to real UTF-8 + retVal += "".join("%%%.2X" % _ for _ in bytearray(payload[i].encode("utf8"))) i += 1 return retVal