Some refactoring

lib/core/common.py

@@ -1586,7 +1586,6 @@ def setPaths(rootPath):
     paths.COMMON_COLUMNS = os.path.join(paths.SQLMAP_TXT_PATH, "common-columns.txt")
     paths.COMMON_FILES = os.path.join(paths.SQLMAP_TXT_PATH, "common-files.txt")
     paths.COMMON_TABLES = os.path.join(paths.SQLMAP_TXT_PATH, "common-tables.txt")
-    paths.DIGEST_FILE = os.path.join(paths.SQLMAP_TXT_PATH, "sha256sums.txt")
     paths.SQL_KEYWORDS = os.path.join(paths.SQLMAP_TXT_PATH, "keywords.txt")
     paths.SMALL_DICT = os.path.join(paths.SQLMAP_TXT_PATH, "smalldict.txt")
     paths.USER_AGENTS = os.path.join(paths.SQLMAP_TXT_PATH, "user-agents.txt")
@@ -5840,30 +5839,35 @@ def chunkSplitPostData(data):
 
     return "".join(retVal)
 
-def checkSums():
+def isGitRepository():
     """
-    Validate the content of the digest file (i.e. sha256sums.txt)
-    >>> checkSums()
+    Whether the running source tree is a git working copy (i.e. a clone / dev checkout, as opposed to a
+    pip/tarball install)
+    """
+
+    return os.path.isdir(os.path.join(paths.SQLMAP_ROOT_PATH, ".git"))
+
+def codeIsModified():
+    """
+    Best-effort check whether a git working copy has local modifications, used to avoid auto-reporting
+    crashes that stem from a user's OWN changes. Only meaningful for git checkouts (dev/clone); a
+    pip/tarball install is taken as shipped (returns False). A transient git error also yields False,
+    so a missing git binary never silences a legitimate report.
+
+    >>> codeIsModified() in (True, False)
     True
     """
 
-    retVal = True
+    retVal = False
 
-    if paths.get("DIGEST_FILE"):
-        for entry in getFileItems(paths.DIGEST_FILE):
-            match = re.search(r"([0-9a-f]+)\s+([^\s]+)", entry)
-            if match:
-                expected, filename = match.groups()
-                filepath = os.path.join(paths.SQLMAP_ROOT_PATH, filename).replace('/', os.path.sep)
-                if not checkFile(filepath, False):
-                    continue
-                with open(filepath, "rb") as f:
-                    content = f.read()
-                    if b'\0' not in content:
-                        content = content.replace(b"\r\n", b"\n")
-                if not hashlib.sha256(content).hexdigest() == expected:
-                    retVal &= False
-                    break
+    if isGitRepository():
+        try:
+            process = subprocess.Popen("git diff-index --quiet HEAD --", shell=True, cwd=paths.SQLMAP_ROOT_PATH, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            process.communicate()
+            if process.returncode == 1:             # 0 == clean, 1 == modified (anything else == git error)
+                retVal = True
+        except Exception:
+            pass
 
     return retVal
 

lib/core/option.py

@@ -157,7 +157,7 @@ from lib.utils.har import HTTPCollectorFactory
 from lib.utils.purge import purge
 from lib.utils.search import search
 from thirdparty import six
-from thirdparty.multipart import multipartpost
+from lib.request.multiparthandler import MultipartPostHandler
 from thirdparty.six.moves import collections_abc as _collections
 from thirdparty.six.moves import http_client as _http_client
 from thirdparty.six.moves import http_cookiejar as _http_cookiejar
@@ -173,7 +173,7 @@ keepAliveHandlerHTTPS = HTTPSKeepAliveHandler()
 proxyHandler = _urllib.request.ProxyHandler()
 redirectHandler = SmartRedirectHandler()
 rangeHandler = HTTPRangeHandler()
-multipartPostHandler = multipartpost.MultipartPostHandler()
+multipartPostHandler = MultipartPostHandler()
 
 # Reference: https://mail.python.org/pipermail/python-list/2009-November/558615.html
 try:

lib/core/settings.py

@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.31"
+VERSION = "1.10.7.32"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

lib/request/multiparthandler.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
+See the file 'LICENSE' for copying permission
+"""
+
+import io
+import mimetypes
+import re
+
+from lib.core.compat import choose_boundary
+from lib.core.convert import getBytes
+from lib.core.exception import SqlmapDataException
+from thirdparty.six.moves import urllib as _urllib
+
+# Controls how sequences are encoded: if True, an element may be given multiple values by assigning a sequence
+DOSEQ = True
+
+class MultipartPostHandler(_urllib.request.BaseHandler):
+    """
+    urllib handler that transparently encodes a dict request body as multipart/form-data when it carries
+    file-like values (and as a plain urlencoded body otherwise). Native replacement for the historically
+    vendored 'thirdparty/multipart/multipartpost.py' (Will Holcomb, 2006); the logic already relied on
+    sqlmap's own helpers, so it now lives here as a first-class request handler.
+    """
+
+    handler_order = _urllib.request.HTTPHandler.handler_order - 10   # must run before the HTTP handler
+
+    def http_request(self, request):
+        data = request.data
+
+        if isinstance(data, dict):
+            files, variables = [], []
+
+            try:
+                for key, value in data.items():
+                    if hasattr(value, "fileno") or hasattr(value, "file") or isinstance(value, io.IOBase):
+                        files.append((key, value))
+                    else:
+                        variables.append((key, value))
+            except TypeError:
+                raise SqlmapDataException("not a valid non-string sequence or mapping object")
+
+            if not files:
+                data = _urllib.parse.urlencode(variables, DOSEQ)
+            else:
+                boundary, data = self.multipartEncode(variables, files)
+                request.add_unredirected_header("Content-Type", "multipart/form-data; boundary=%s" % boundary)
+
+            request.data = data
+
+        # normalize bare LF to CRLF inside a multipart body (Reference: https://github.com/sqlmapproject/sqlmap/issues/4235)
+        if request.data:
+            for match in re.finditer(b"(?i)\\s*-{20,}\\w+(\\s+Content-Disposition[^\\n]+\\s+|\\-\\-\\s*)", request.data):
+                part = match.group(0)
+                if b'\r' not in part:
+                    request.data = request.data.replace(part, part.replace(b'\n', b"\r\n"))
+
+        return request
+
+    def multipartEncode(self, variables, files, boundary=None):
+        boundary = boundary or choose_boundary()
+        buffer_ = b""
+
+        for key, value in variables:
+            if key is not None and value is not None:
+                buffer_ += b"--%s\r\n" % getBytes(boundary)
+                buffer_ += b"Content-Disposition: form-data; name=\"%s\"" % getBytes(key)
+                buffer_ += b"\r\n\r\n" + getBytes(value) + b"\r\n"
+
+        for key, fd in files:
+            filename = fd.name.split('/')[-1] if '/' in fd.name else fd.name.split('\\')[-1]
+            try:
+                contentType = mimetypes.guess_type(filename)[0] or b"application/octet-stream"
+            except Exception:
+                # Reference: http://bugs.python.org/issue9291
+                contentType = b"application/octet-stream"
+            buffer_ += b"--%s\r\n" % getBytes(boundary)
+            buffer_ += b"Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"\r\n" % (getBytes(key), getBytes(filename))
+            buffer_ += b"Content-Type: %s\r\n" % getBytes(contentType)
+            fd.seek(0)
+            buffer_ += b"\r\n%s\r\n" % fd.read()
+
+        buffer_ += b"--%s--\r\n\r\n" % getBytes(boundary)
+
+        return boundary, getBytes(buffer_)
+
+    https_request = http_request