minor refactoring before a huge bug fix reported by Ahmed Shawky (we are falsely urlencoding ORIGINAL part of the injection payload)

stamparm · stamparm · commit 03413bd5e07f · 2011-01-27T16:55:58.000Z
diff --git a/lib/core/settings.py b/lib/core/settings.py
@@ -13,6 +13,7 @@
 import sys
 
 from lib.core.enums import DBMS
+from lib.core.enums import PLACE
 from lib.core.revision import getRevisionNumber
 
 # sqlmap version and site
@@ -204,3 +205,6 @@
 
 # Splitter used between requests in BURP log files
 BURP_SPLITTER = "======================================================"
+
+# Do the url-encoding based on parameter place
+URL_ENCODE_PAYLOAD = { PLACE.GET: True, PLACE.POST: True, PLACE.COOKIE: False, PLACE.UA: True, PLACE.URI: False }
diff --git a/lib/request/connect.py b/lib/request/connect.py
@@ -40,6 +40,7 @@
 from lib.core.exception import sqlmapConnectionException
 from lib.core.exception import sqlmapSyntaxException
 from lib.core.settings import MIN_TIME_RESPONSES
+from lib.core.settings import URL_ENCODE_PAYLOAD
 from lib.core.threads import getCurrentThreadData
 from lib.request.basic import decodePage
 from lib.request.basic import forgeHeaders
@@ -382,7 +383,6 @@ def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent
         pageLength  = None
         uri         = None
         raise404    = place != PLACE.URI if raise404 is None else raise404
-        toUrlencode = { PLACE.GET: True, PLACE.POST: True, PLACE.COOKIE: conf.cookieUrlencode, PLACE.UA: True, PLACE.URI: False }
 
         if not place:
             place = kb.injection.place
@@ -403,7 +403,7 @@ def queryPage(value=None, place=None, content=False, getSeqMatcher=False, silent
             value = agent.removePayloadDelimiters(value, False)
             value = urlEncodeCookieValues(value)
         elif place:
-            value = agent.removePayloadDelimiters(value, toUrlencode[place])
+            value = agent.removePayloadDelimiters(value, URL_ENCODE_PAYLOAD[place])
 
         if conf.checkPayload:
             checkPayload(value)
