From 1c869b74306d3988048c5550bc588ef9b3b67bba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Tue, 28 Jul 2026 21:27:54 +0200 Subject: [PATCH] Fixing core helpers (decodeStringEscape round-trip, joinValue on Python 3, parseUnionPage case-sensitive de-duplication) --- lib/core/common.py | 16 ++++++++++++---- lib/core/settings.py | 2 +- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/lib/core/common.py b/lib/core/common.py index ef3b29364..8751aa34d 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -2009,7 +2009,10 @@ def parseUnionPage(page): entry = entry.split(kb.chars.start)[-1] if kb.unionDuplicates: - key = entry.lower() + # Note: de-dup on the EXACT entry, not entry.lower() - the doubled emission repeats each + # row verbatim, so case-folding here would silently drop genuinely case-distinct rows + # (e.g. 'Admin' vs 'admin'). Force-uppercased pages are already lower-cased before parsing. + key = entry if key not in keys: keys.add(key) else: @@ -3859,7 +3862,7 @@ def joinValue(value, delimiter=','): """ if isListLike(value): - retVal = delimiter.join(getText(_ if _ is not None else "None") for _ in value) + retVal = delimiter.join(getText(getUnicode(_) if _ is not None else "None") for _ in value) else: retVal = value @@ -4264,9 +4267,14 @@ def decodeStringEscape(value): retVal = value if value and '\\' in value: - charset = "\\%s" % string.whitespace.replace(" ", "") - for _ in charset: + # Note: shield an escaped backslash ('\\\\') behind a marker BEFORE decoding the whitespace + # escapes, then restore it - otherwise decoding '\\\\' -> '\\' first turns a literal '\\n' + # into a newline (i.e. the round-trip with encodeStringEscape was not lossless) + _marker = "\x00" + retVal = retVal.replace("\\\\", _marker) + for _ in string.whitespace.replace(" ", ""): retVal = retVal.replace(repr(_).strip("'"), _) + retVal = retVal.replace(_marker, "\\") return retVal diff --git a/lib/core/settings.py b/lib/core/settings.py index c8865064d..723fd8a33 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.230" +VERSION = "1.10.7.231" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)