CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixes #5933
Some checks are pending
/ build (macos-latest, 3.8) (push) Waiting to run
Details
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
Details
/ build (windows-latest, 3.14) (push) Waiting to run
Details

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-11 12:54:33 +02:00
parent 567e051215
commit 8bc0f4794c
3 changed files with 25 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/test_payload_marking.py
View file

@ -175,10 +175,17 @@ class TestXmlMarking(unittest.TestCase):
CASES = [
("<a>x</a>", "<a>x*</a>"),
('<a id="1">x</a>', '<a id="1">x*</a>'),
# attribute values are now marked too, not just element text (issue #5993)
('<a id="1">x</a>', '<a id="1*">x*</a>'),
("<user><name>bob</name><id>5</id></user>", "<user><name>bob*</name><id>5*</id></user>"),
("<ns:tag>v</ns:tag>", "<ns:tag>v*</ns:tag>"),
("<soap:Body><q>1</q></soap:Body>", "<soap:Body><q>1*</q></soap:Body>"),
# multiple attributes and single-quoted attribute values
('<a id="1" role="x">y</a>', '<a id="1*" role="x*">y*</a>'),
("<a id='1'>y</a>", "<a id='1*'>y*</a>"),
# XML declaration and namespace declarations are left intact (not injection points)
('<?xml version="1.0"?><a>y</a>', '<?xml version="1.0"?><a>y*</a>'),
('<a xmlns="urn:x" id="1">y</a>', '<a xmlns="urn:x" id="1*">y*</a>'),
]
def test_cases(self):