Skip to content

Commit 94a337b

Browse files
stamparmstamparm
committed
Implementation for an Issue sqlmapproject#1306 
1 parent df135a5 commit 94a337b

File tree

4 files changed

+41
-12
lines changed

4 files changed

+41
-12
lines changed

‎lib/core/common.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@
143143
from lib.core.settings import REFLECTED_REPLACEMENT_TIMEOUT
144144
from lib.core.settings import REFLECTED_VALUE_MARKER
145145
from lib.core.settings import REFLECTIVE_MISS_THRESHOLD
146+
from lib.core.settings import SAFE_VARIABLE_MARKER
146147
from lib.core.settings import SENSITIVE_DATA_REGEX
147148
from lib.core.settings import SENSITIVE_OPTIONS
148149
from lib.core.settings import SUPPORTED_DBMS
@@ -4429,3 +4430,9 @@ def getSafeExString(ex, encoding=None):
44294430
retVal = ex.msg
44304431

44314432
return getUnicode(retVal or "", encoding=encoding).strip()
4433+
4434+
def safeVariableNaming(value):
4435+
return re.sub(r"[^\w]", lambda match: "%s%02x" % (SAFE_VARIABLE_MARKER, ord(match.group(0))), value)
4436+
4437+
def unsafeVariableNaming(value):
4438+
return re.sub(r"%s([0-9a-f]{2})" % SAFE_VARIABLE_MARKER, lambda match: match.group(1).decode("hex"), value)

‎lib/core/settings.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.1.10.7"
22+
VERSION = "1.1.10.8"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -63,6 +63,7 @@
6363
ASTERISK_MARKER = "__ASTERISK_MARK__"
6464
REPLACEMENT_MARKER = "__REPLACEMENT_MARK__"
6565
BOUNDED_INJECTION_MARKER = "__BOUNDED_INJECTION_MARK__"
66+
SAFE_VARIABLE_MARKER = "__SAFE__"
6667

6768
RANDOM_INTEGER_MARKER = "[RANDINT]"
6869
RANDOM_STRING_MARKER = "[RANDSTR]"

‎lib/request/connect.py‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,13 @@ class WebSocketException(Exception):
5151
from lib.core.common import randomStr
5252
from lib.core.common import readInput
5353
from lib.core.common import removeReflectiveValues
54+
from lib.core.common import safeVariableNaming
5455
from lib.core.common import singleTimeLogMessage
5556
from lib.core.common import singleTimeWarnMessage
5657
from lib.core.common import stdev
5758
from lib.core.common import wasLastResponseDelayed
5859
from lib.core.common import unicodeencode
60+
from lib.core.common import unsafeVariableNaming
5961
from lib.core.common import urldecode
6062
from lib.core.common import urlencode
6163
from lib.core.data import conf
@@ -1028,8 +1030,11 @@ def _randomizeParameter(paramString, randomParameter):
10281030
for part in item.split(delimiter):
10291031
if '=' in part:
10301032
name, value = part.split('=', 1)
1031-
name = re.sub(r"[^\w]", "", name.strip())
1032-
if name in keywords:
1033+
name = name.strip()
1034+
if safeVariableNaming(name) != name:
1035+
conf.evalCode = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), conf.evalCode)
1036+
name = safeVariableNaming(name)
1037+
elif name in keywords:
10331038
name = "%s%s" % (name, EVALCODE_KEYWORD_SUFFIX)
10341039
value = urldecode(value, convall=True, plusspace=(item==post and kb.postSpaceToPlus))
10351040
variables[name] = value
@@ -1038,8 +1043,11 @@ def _randomizeParameter(paramString, randomParameter):
10381043
for part in cookie.split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER):
10391044
if '=' in part:
10401045
name, value = part.split('=', 1)
1041-
name = re.sub(r"[^\w]", "", name.strip())
1042-
if name in keywords:
1046+
name = name.strip()
1047+
if safeVariableNaming(name) != name:
1048+
conf.evalCode = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), conf.evalCode)
1049+
name = safeVariableNaming(name)
1050+
elif name in keywords:
10431051
name = "%s%s" % (name, EVALCODE_KEYWORD_SUFFIX)
10441052
value = urldecode(value, convall=True)
10451053
variables[name] = value
@@ -1050,10 +1058,18 @@ def _randomizeParameter(paramString, randomParameter):
10501058
except SyntaxError, ex:
10511059
if ex.text:
10521060
original = replacement = ex.text.strip()
1053-
for _ in re.findall(r"[A-Za-z_]+", original)[::-1]:
1054-
if _ in keywords:
1055-
replacement = replacement.replace(_, "%s%s" % (_, EVALCODE_KEYWORD_SUFFIX))
1056-
break
1061+
if '=' in original:
1062+
name, value = original.split('=', 1)
1063+
name = name.strip()
1064+
if safeVariableNaming(name) != name:
1065+
replacement = re.sub(r"\b%s\b" % re.escape(name), safeVariableNaming(name), replacement)
1066+
elif name in keywords:
1067+
replacement = re.sub(r"\b%s\b" % re.escape(name), "%s%s" % (name, EVALCODE_KEYWORD_SUFFIX), replacement)
1068+
else:
1069+
for _ in re.findall(r"[A-Za-z_]+", original)[::-1]:
1070+
if _ in keywords:
1071+
replacement = replacement.replace(_, "%s%s" % (_, EVALCODE_KEYWORD_SUFFIX))
1072+
break
10571073
if original == replacement:
10581074
conf.evalCode = conf.evalCode.replace(EVALCODE_KEYWORD_SUFFIX, "")
10591075
break
@@ -1073,6 +1089,11 @@ def _randomizeParameter(paramString, randomParameter):
10731089
del variables[variable]
10741090
variables[variable.replace(EVALCODE_KEYWORD_SUFFIX, "")] = value
10751091

1092+
if unsafeVariableNaming(variable) != variable:
1093+
value = variables[variable]
1094+
del variables[variable]
1095+
variables[unsafeVariableNaming(variable)] = value
1096+
10761097
uri = variables["uri"]
10771098

10781099
for name, value in variables.items():

‎txt/checksum.md5‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ a66093c734c7f94ecdf94d882c2d8b89 lib/controller/controller.py
2727
310efc965c862cfbd7b0da5150a5ad36 lib/controller/__init__.py
2828
90b4f40ccde13c44e26f53db474afc19 lib/core/agent.py
2929
6cc95a117fbd34ef31b9aa25520f0e31 lib/core/bigarray.py
30-
ff068a628d68a4dcf597ae60e6e8abe2 lib/core/common.py
30+
5ac200c86905d827e22c744a466da8f3 lib/core/common.py
3131
9edefb92b0b9cad862543fcd587aaa66 lib/core/convert.py
3232
a8143dab9d3a27490f7d49b6b29ea530 lib/core/data.py
3333
7936d78b1a7f1f008ff92bf2f88574ba lib/core/datatype.py
@@ -46,7 +46,7 @@ e8e9fd4f224ead0caa1569312b5b2582 lib/core/optiondict.py
4646
d8e9250f3775119df07e9070eddccd16 lib/core/replication.py
4747
785f86e3f963fa3798f84286a4e83ff2 lib/core/revision.py
4848
40c80b28b3a5819b737a5a17d4565ae9 lib/core/session.py
49-
a2dc48679d88e33f075ab1e0e557fa9e lib/core/settings.py
49+
587bd6c44f842c95680d1e471470733d lib/core/settings.py
5050
d91291997d2bd2f6028aaf371bf1d3b6 lib/core/shell.py
5151
2ad85c130cc5f2b3701ea85c2f6bbf20 lib/core/subprocessng.py
5252
effc153067a00bd43461bfc1cdec1122 lib/core/target.py
@@ -68,7 +68,7 @@ ad74fc58fc7214802fd27067bce18dd2 lib/core/unescaper.py
6868
403d873f1d2fd0c7f73d83f104e41850 lib/request/basicauthhandler.py
6969
0c476bde96ad035b3f0dde3b845e5e6e lib/request/basic.py
7070
ef48de622b0a6b4a71df64b0d2785ef8 lib/request/comparison.py
71-
1ec370ec9d037135607b48ad6afd4f40 lib/request/connect.py
71+
fbff2cbabb815c989ec005115a1813a0 lib/request/connect.py
7272
fb6b788d0016ab4ec5e5f661f0f702ad lib/request/direct.py
7373
cc1163d38e9b7ee5db2adac6784c02bb lib/request/dns.py
7474
5dcdb37823a0b5eff65cd1018bcf09e4 lib/request/httpshandler.py

0 commit comments

Comments
 (0)