From 6ce5d7d7e428d695de1fb47cf465b05210aeacbd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= <miroslav.stampar@gmail.com>
Date: Mon, 20 Jul 2026 12:37:16 +0200
Subject: [PATCH] Adding some more boundaries

---
 data/xml/boundaries.xml          | 58 ++++++++++++++++++++++++++++++++
 lib/core/enums.py                |  2 ++
 lib/core/settings.py             |  2 +-
 tests/test_payloads_structure.py |  2 +-
 4 files changed, 62 insertions(+), 2 deletions(-)

diff --git a/data/xml/boundaries.xml b/data/xml/boundaries.xml
index 541ab7968..0b5eb6053 100644
--- a/data/xml/boundaries.xml
+++ b/data/xml/boundaries.xml
@@ -55,6 +55,8 @@ Tag: <boundary>
             4: Double quoted string
             5: LIKE double quoted string
             6: Identifier (e.g. column name)
+            7: Block comment
+            8: Alternative quoted string (e.g. PostgreSQL $$...$$, Oracle q'[...]')
 
     Sub-tag: <prefix>
         A string to prepend to the payload.
@@ -517,6 +519,18 @@ Formats:
     </boundary>
     <!-- End of pre-WHERE derived table boundaries -->
 
+    <!-- Block-comment escape: injection point sits INSIDE /* ... */ (e.g. a query tag / trace / tenant
+         annotation). '*/' terminates the app comment, the test runs, '/*' re-opens a comment that the
+         app's original '*/' closes. Inert (stays inside the literal) when the value is not in a comment. -->
+    <boundary>
+        <level>4</level>
+        <clause>1,2,3</clause>
+        <where>1,2</where>
+        <ptype>7</ptype>
+        <prefix>*/</prefix>
+        <suffix>/*</suffix>
+    </boundary>
+
     <!-- Escaped column name (e.g. SELECT `...` FROM table) boundaries -->
     <boundary>
         <level>4</level>
@@ -565,4 +579,48 @@ Formats:
         <suffix>#</suffix>
     </boundary>
     <!-- End of AGAINST boolean full-text search boundaries -->
+
+    <!-- Alternative quoted string delimiters where ' and " have no terminating effect:
+         PostgreSQL $$...$$ dollar quoting, Oracle q'[...]' / q'{...}' / q'(...)' / q'<...>'. -->
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1,2</where>
+        <ptype>8</ptype>
+        <prefix>$$</prefix>
+        <suffix>[GENERIC_SQL_COMMENT]</suffix>
+    </boundary>
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1,2</where>
+        <ptype>8</ptype>
+        <prefix>]'</prefix>
+        <suffix>[GENERIC_SQL_COMMENT]</suffix>
+    </boundary>
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1,2</where>
+        <ptype>8</ptype>
+        <prefix>}'</prefix>
+        <suffix>[GENERIC_SQL_COMMENT]</suffix>
+    </boundary>
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1,2</where>
+        <ptype>8</ptype>
+        <prefix>)'</prefix>
+        <suffix>[GENERIC_SQL_COMMENT]</suffix>
+    </boundary>
+    <boundary>
+        <level>5</level>
+        <clause>1</clause>
+        <where>1,2</where>
+        <ptype>8</ptype>
+        <prefix>&gt;'</prefix>
+        <suffix>[GENERIC_SQL_COMMENT]</suffix>
+    </boundary>
+    <!-- End of alternative quoted string boundaries -->
 </root>
diff --git a/lib/core/enums.py b/lib/core/enums.py
index da201af23..ced9700a8 100644
--- a/lib/core/enums.py
+++ b/lib/core/enums.py
@@ -339,6 +339,8 @@ class PAYLOAD(object):
         4: "Double quoted string",
         5: "LIKE double quoted string",
         6: "Identifier (e.g. column name)",
+        7: "Block comment",
+        8: "Alternative quoted string",
     }
 
     RISK = {
diff --git a/lib/core/settings.py b/lib/core/settings.py
index 66481f1d2..2e64ff364 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.148"
+VERSION = "1.10.7.149"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
diff --git a/tests/test_payloads_structure.py b/tests/test_payloads_structure.py
index 504f4288e..16556a5a1 100644
--- a/tests/test_payloads_structure.py
+++ b/tests/test_payloads_structure.py
@@ -109,7 +109,7 @@ class TestBoundaryEntries(unittest.TestCase):
         # ptype feeds the recorded injection identity (report label, (place,parameter,ptype) dedup
         # key, session hash) - an out-of-range value silently corrupts all three
         for b in conf.boundaries:
-            self.assertIn(b.ptype, (1, 2, 3, 4, 5, 6), msg="boundary %r bad ptype %r" % (b.prefix, b.ptype))
+            self.assertIn(b.ptype, (1, 2, 3, 4, 5, 6, 7, 8), msg="boundary %r bad ptype %r" % (b.prefix, b.ptype))
 
     def test_ptype_matches_prefix_quote(self):
         # The lexical quote a prefix opens with must agree with ptype (else the injection is recorded