Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0f6e529

Browse files
stamparmstamparm
committed
Fixes #1745 
1 parent 242800c commit 0f6e529

2 files changed

Lines changed: 50 additions & 44 deletions

File tree

‎lib/core/common.py‎

Lines changed: 49 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3142,59 +3142,65 @@ def removeReflectiveValues(content, payload, suppressWarning=False):
31423142

31433143
retVal = content
31443144

3145-
if all([content, payload]) and isinstance(content, unicode) and kb.reflectiveMechanism and not kb.heuristicMode:
3146-
def _(value):
3147-
while 2 * REFLECTED_REPLACEMENT_REGEX in value:
3148-
value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX)
3149-
return value
3150-
3151-
payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ''), convall=True))
3152-
regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string-escape")))
3145+
try:
3146+
if all([content, payload]) and isinstance(content, unicode) and kb.reflectiveMechanism and not kb.heuristicMode:
3147+
def _(value):
3148+
while 2 * REFLECTED_REPLACEMENT_REGEX in value:
3149+
value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX)
3150+
return value
31533151

3154-
if regex != payload:
3155-
if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check
3156-
parts = regex.split(REFLECTED_REPLACEMENT_REGEX)
3157-
retVal = content.replace(payload, REFLECTED_VALUE_MARKER) # dummy approach
3152+
payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ''), convall=True))
3153+
regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string-escape")))
31583154

3159-
if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs
3160-
regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:])))
3155+
if regex != payload:
3156+
if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check
3157+
parts = regex.split(REFLECTED_REPLACEMENT_REGEX)
3158+
retVal = content.replace(payload, REFLECTED_VALUE_MARKER) # dummy approach
31613159

3162-
parts = filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))
3160+
if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs
3161+
regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:])))
31633162

3164-
if regex.startswith(REFLECTED_REPLACEMENT_REGEX):
3165-
regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex[len(REFLECTED_REPLACEMENT_REGEX):])
3166-
else:
3167-
regex = r"\b%s" % regex
3168-
3169-
if regex.endswith(REFLECTED_REPLACEMENT_REGEX):
3170-
regex = r"%s%s" % (regex[:-len(REFLECTED_REPLACEMENT_REGEX)], REFLECTED_BORDER_REGEX)
3171-
else:
3172-
regex = r"%s\b" % regex
3163+
parts = filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))
31733164

3174-
retVal = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, retVal)
3165+
if regex.startswith(REFLECTED_REPLACEMENT_REGEX):
3166+
regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex[len(REFLECTED_REPLACEMENT_REGEX):])
3167+
else:
3168+
regex = r"\b%s" % regex
31753169

3176-
if len(parts) > 2:
3177-
regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:])
3178-
retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, retVal)
3170+
if regex.endswith(REFLECTED_REPLACEMENT_REGEX):
3171+
regex = r"%s%s" % (regex[:-len(REFLECTED_REPLACEMENT_REGEX)], REFLECTED_BORDER_REGEX)
3172+
else:
3173+
regex = r"%s\b" % regex
31793174

3180-
if retVal != content:
3181-
kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1
3182-
if not suppressWarning:
3183-
warnMsg = "reflective value(s) found and filtering out"
3184-
singleTimeWarnMessage(warnMsg)
3175+
retVal = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, retVal)
31853176

3186-
if re.search(r"FRAME[^>]+src=[^>]*%s" % REFLECTED_VALUE_MARKER, retVal, re.I):
3187-
warnMsg = "frames detected containing attacked parameter values. Please be sure to "
3188-
warnMsg += "test those separately in case that attack on this page fails"
3189-
singleTimeWarnMessage(warnMsg)
3177+
if len(parts) > 2:
3178+
regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:])
3179+
retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, retVal)
31903180

3191-
elif not kb.testMode and not kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT]:
3192-
kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] += 1
3193-
if kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] > REFLECTIVE_MISS_THRESHOLD:
3194-
kb.reflectiveMechanism = False
3181+
if retVal != content:
3182+
kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1
31953183
if not suppressWarning:
3196-
debugMsg = "turning off reflection removal mechanism (for optimization purposes)"
3197-
logger.debug(debugMsg)
3184+
warnMsg = "reflective value(s) found and filtering out"
3185+
singleTimeWarnMessage(warnMsg)
3186+
3187+
if re.search(r"FRAME[^>]+src=[^>]*%s" % REFLECTED_VALUE_MARKER, retVal, re.I):
3188+
warnMsg = "frames detected containing attacked parameter values. Please be sure to "
3189+
warnMsg += "test those separately in case that attack on this page fails"
3190+
singleTimeWarnMessage(warnMsg)
3191+
3192+
elif not kb.testMode and not kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT]:
3193+
kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] += 1
3194+
if kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] > REFLECTIVE_MISS_THRESHOLD:
3195+
kb.reflectiveMechanism = False
3196+
if not suppressWarning:
3197+
debugMsg = "turning off reflection removal mechanism (for optimization purposes)"
3198+
logger.debug(debugMsg)
3199+
except MemoryError:
3200+
kb.reflectiveMechanism = False
3201+
if not suppressWarning:
3202+
debugMsg = "turning off reflection removal mechanism (because of low memory issues)"
3203+
logger.debug(debugMsg)
31983204

31993205
return retVal
32003206

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
from lib.core.revision import getRevisionNumber
2121

2222
# sqlmap version and site
23-
VERSION = "1.0.0.12"
23+
VERSION = "1.0.0.13"
2424
REVISION = getRevisionNumber()
2525
STABLE = VERSION.count('.') <= 2
2626
VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev")

0 commit comments

Comments
 (0)