Better fix for that page/headers/comparison --string candidate problem

stamparm · stamparm · commit ac7709204ae9 · 2013-01-18T17:00:11.000+01:00
diff --git a/lib/controller/checks.py b/lib/controller/checks.py
@@ -379,7 +379,7 @@ def genCmpPayload():
                             if not injectable and not any((conf.string, conf.notString, conf.regexp)) and kb.pageStable:
                                 trueSet = set(extractTextTagContent(truePage))
                                 falseSet = set(extractTextTagContent(falsePage))
-                                candidates = filter(None, (_.strip() if _.strip() in (kb.pageTemplate or "") and _.strip() not in falsePage else None for _ in (trueSet - falseSet)))
+                                candidates = filter(None, (_.strip() if _.strip() in (kb.pageTemplate or "") and _.strip() not in falsePage and _.strip() not in threadData.lastComparisonHeaders else None for _ in (trueSet - falseSet)))
                                 if candidates:
                                     conf.string = candidates[0]
                                     infoMsg = "%s parameter '%s' seems to be '%s' injectable (with --string=\"%s\")" % (place, parameter, title, repr(conf.string).lstrip('u').strip("'"))
diff --git a/lib/core/threads.py b/lib/core/threads.py
@@ -42,6 +42,7 @@ def reset(self):
         self.hashDBCursor = None
         self.inTransaction = False
         self.lastComparisonPage = None
+        self.lastComparisonHeaders = None
         self.lastErrorPage = None
         self.lastHTTPError = None
         self.lastRedirectMsg = None
diff --git a/lib/request/comparison.py b/lib/request/comparison.py
@@ -47,6 +47,7 @@ def _comparison(page, headers, code, getRatioValue, pageLength):
     threadData = getCurrentThreadData()
 
     if kb.testMode:
+        threadData.lastComparisonHeaders = listToStrValue(headers.headers) if headers else ""
         threadData.lastComparisonPage = page
 
     if page is None and pageLength is None:
@@ -56,7 +57,7 @@ def _comparison(page, headers, code, getRatioValue, pageLength):
     seqMatcher.set_seq1(kb.pageTemplate)
 
     if any((conf.string, conf.notString, conf.regexp)):
-        rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page)
+        rawResponse = "%s%s" % (listToStrValue(headers.headers) if headers else "", page)
 
         # String to match in page when the query is True and/or valid
         if conf.string:
