Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ff968c2

Browse files
stamparmstamparm
committed
More drei stuff
1 parent 2791ea5 commit ff968c2

13 files changed

Lines changed: 113 additions & 94 deletions

File tree

‎extra/safe2bin/safe2bin.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,9 @@ def safecharencode(value):
6464
for char in SAFE_ENCODE_SLASH_REPLACEMENTS:
6565
retVal = retVal.replace(char, repr(char).strip('\''))
6666

67-
retVal = reduce(lambda x, y: x + (y if (y in string.printable or isinstance(value, text_type) and ord(y) >= 160) else '\\x%02x' % ord(y)), retVal, type(value)())
67+
for char in set(retVal):
68+
if not (char in string.printable or isinstance(value, text_type) and ord(char) >= 160):
69+
retVal = retVal.replace(char, '\\x%02x' % ord(char))
6870

6971
retVal = retVal.replace(SLASH_MARKER, "\\\\")
7072
retVal = retVal.replace(HEX_ENCODED_PREFIX_MARKER, HEX_ENCODED_PREFIX)

‎lib/controller/checks.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1377,7 +1377,7 @@ def checkWaf():
13771377
conf.timeout = IDS_WAF_CHECK_TIMEOUT
13781378

13791379
try:
1380-
retVal = Request.queryPage(place=place, value=value, getRatioValue=True, noteResponseTime=False, silent=True, disableTampering=True)[1] < IDS_WAF_CHECK_RATIO
1380+
retVal = (Request.queryPage(place=place, value=value, getRatioValue=True, noteResponseTime=False, silent=True, disableTampering=True)[1] or 0) < IDS_WAF_CHECK_RATIO
13811381
except SqlmapConnectionException:
13821382
retVal = True
13831383
finally:

‎lib/core/common.py‎

Lines changed: 39 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import contextlib
1212
import copy
1313
import distutils
14+
import functools
1415
import getpass
1516
import hashlib
1617
import inspect
@@ -1849,7 +1850,7 @@ def safeFilepathEncode(filepath):
18491850

18501851
retVal = filepath
18511852

1852-
if filepath and isinstance(filepath, six.text_type):
1853+
if filepath and six.PY2 and isinstance(filepath, six.text_type):
18531854
retVal = filepath.encode(sys.getfilesystemencoding() or UNICODE_ENCODING)
18541855

18551856
return retVal
@@ -1929,8 +1930,8 @@ def getFilteredPageContent(page, onlyText=True, split=" "):
19291930
Returns filtered page content without script, style and/or comments
19301931
or all HTML tags
19311932
1932-
>>> getFilteredPageContent(u'<html><title>foobar</title><body>test</body></html>')
1933-
u'foobar test'
1933+
>>> getFilteredPageContent(u'<html><title>foobar</title><body>test</body></html>') == "foobar test"
1934+
True
19341935
"""
19351936

19361937
retVal = page
@@ -1947,8 +1948,8 @@ def getPageWordSet(page):
19471948
"""
19481949
Returns word set used in page content
19491950
1950-
>>> sorted(getPageWordSet(u'<html><title>foobar</title><body>test</body></html>'))
1951-
[u'foobar', u'test']
1951+
>>> sorted(getPageWordSet(u'<html><title>foobar</title><body>test</body></html>')) == [u'foobar', u'test']
1952+
True
19521953
"""
19531954

19541955
retVal = set()
@@ -2459,13 +2460,13 @@ def decodeHex(value):
24592460
True
24602461
"""
24612462

2462-
return bytes.fromhex(value) if hasattr(bytes, "fromhex") else value.decode("hex")
2463+
return bytes.fromhex(getUnicode(value)) if hasattr(bytes, "fromhex") else value.decode("hex")
24632464

24642465
def getBytes(value, encoding=UNICODE_ENCODING, errors="strict"):
24652466
"""
24662467
Returns byte representation of provided Unicode value
24672468
2468-
>>> getBytes(getUnicode("foo\x01\x83\xffbar")) == b"foo\x01\x83\xffbar"
2469+
>>> getBytes(getUnicode(b"foo\\x01\\x83\\xffbar")) == b"foo\\x01\\x83\\xffbar"
24692470
True
24702471
"""
24712472

@@ -2488,9 +2489,9 @@ def getOrds(value):
24882489
"""
24892490
Returns ORD(...) representation of provided string value
24902491
2491-
>>> getOrds(u'fo\xf6bar')
2492+
>>> getOrds(u'fo\\xf6bar')
24922493
[102, 111, 246, 98, 97, 114]
2493-
>>> getOrds(b"fo\xc3\xb6bar")
2494+
>>> getOrds(b"fo\\xc3\\xb6bar")
24942495
[102, 111, 195, 182, 98, 97, 114]
24952496
"""
24962497

@@ -2642,8 +2643,8 @@ def extractErrorMessage(page):
26422643
"""
26432644
Returns reported error message from page if it founds one
26442645
2645-
>>> extractErrorMessage(u'<html><title>Test</title>\\n<b>Warning</b>: oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated<br><p>Only a test page</p></html>')
2646-
u'oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated'
2646+
>>> extractErrorMessage(u'<html><title>Test</title>\\n<b>Warning</b>: oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated<br><p>Only a test page</p></html>') == u'oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated'
2647+
True
26472648
"""
26482649

26492650
retVal = None
@@ -2716,10 +2717,10 @@ def urldecode(value, encoding=None, unsafe="%%&=;+%s" % CUSTOM_INJECTION_MARK_CH
27162717
"""
27172718
URL decodes given value
27182719
2719-
>>> urldecode('AND%201%3E%282%2B3%29%23', convall=True)
2720-
u'AND 1>(2+3)#'
2721-
>>> urldecode('AND%201%3E%282%2B3%29%23', convall=False)
2722-
u'AND 1>(2%2B3)#'
2720+
>>> urldecode('AND%201%3E%282%2B3%29%23', convall=True) == 'AND 1>(2+3)#'
2721+
True
2722+
>>> urldecode('AND%201%3E%282%2B3%29%23', convall=False) == 'AND 1>(2%2B3)#'
2723+
True
27232724
"""
27242725

27252726
result = value
@@ -2738,7 +2739,7 @@ def urldecode(value, encoding=None, unsafe="%%&=;+%s" % CUSTOM_INJECTION_MARK_CH
27382739
charset = set(string.printable) - set(unsafe)
27392740

27402741
def _(match):
2741-
char = chr(ord(match.group(1).decode("hex")))
2742+
char = getUnicode(decodeHex(match.group(1)))
27422743
return char if char in charset else match.group(0)
27432744

27442745
if spaceplus:
@@ -3020,13 +3021,15 @@ def findDynamicContent(firstPage, secondPage):
30203021
prefix = prefix[-DYNAMICITY_BOUNDARY_LENGTH:]
30213022
suffix = suffix[:DYNAMICITY_BOUNDARY_LENGTH]
30223023

3023-
infix = max(re.search(r"(?s)%s(.+)%s" % (re.escape(prefix), re.escape(suffix)), _) for _ in (firstPage, secondPage)).group(1)
3024-
3025-
if infix[0].isalnum():
3026-
prefix = trimAlphaNum(prefix)
3027-
3028-
if infix[-1].isalnum():
3029-
suffix = trimAlphaNum(suffix)
3024+
for _ in (firstPage, secondPage):
3025+
match = re.search(r"(?s)%s(.+)%s" % (re.escape(prefix), re.escape(suffix)), _)
3026+
if match:
3027+
infix = match.group(1)
3028+
if infix[0].isalnum():
3029+
prefix = trimAlphaNum(prefix)
3030+
if infix[-1].isalnum():
3031+
suffix = trimAlphaNum(suffix)
3032+
break
30303033

30313034
kb.dynamicMarkings.append((prefix if prefix else None, suffix if suffix else None))
30323035

@@ -3557,7 +3560,7 @@ def getLatestRevision():
35573560
req = _urllib.request.Request(url="https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/lib/core/settings.py")
35583561

35593562
try:
3560-
content = _urllib.request.urlopen(req).read()
3563+
content = getUnicode(_urllib.request.urlopen(req).read())
35613564
retVal = extractRegexResult(r"VERSION\s*=\s*[\"'](?P<result>[\d.]+)", content)
35623565
except:
35633566
pass
@@ -4423,12 +4426,8 @@ def serializeObject(object_):
44234426
"""
44244427
Serializes given object
44254428
4426-
>>> serializeObject([1, 2, 3, ('a', 'b')])
4427-
'gAJdcQEoSwFLAksDVQFhVQFihnECZS4='
4428-
>>> serializeObject(None)
4429-
'gAJOLg=='
4430-
>>> serializeObject('foobar')
4431-
'gAJVBmZvb2JhcnEBLg=='
4429+
>>> type(serializeObject([1, 2, 3, ('a', 'b')])) == six.binary_type
4430+
True
44324431
"""
44334432

44344433
return base64pickle(object_)
@@ -4668,7 +4667,10 @@ def prioritySortColumns(columns):
46684667
def _(column):
46694668
return column and "id" in column.lower()
46704669

4671-
return sorted(sorted(columns, key=len), lambda x, y: -1 if _(x) and not _(y) else 1 if not _(x) and _(y) else 0)
4670+
if six.PY2:
4671+
return sorted(sorted(columns, key=len), lambda x, y: -1 if _(x) and not _(y) else 1 if not _(x) and _(y) else 0)
4672+
else:
4673+
return sorted(sorted(columns, key=len), key=functools.cmp_to_key(lambda x, y: -1 if _(x) and not _(y) else 1 if not _(x) and _(y) else 0))
46724674

46734675
def getRequestHeader(request, name):
46744676
"""
@@ -4975,25 +4977,25 @@ def safeVariableNaming(value):
49754977
"""
49764978
Returns escaped safe-representation of a given variable name that can be used in Python evaluated code
49774979
4978-
>>> safeVariableNaming("class.id")
4979-
'EVAL_636c6173732e6964'
4980+
>>> safeVariableNaming("class.id") == "EVAL_636c6173732e6964"
4981+
True
49804982
"""
49814983

49824984
if value in keyword.kwlist or re.search(r"\A[^a-zA-Z]|[^\w]", value):
4983-
value = "%s%s" % (EVALCODE_ENCODED_PREFIX, value.encode(UNICODE_ENCODING).encode("hex"))
4985+
value = "%s%s" % (EVALCODE_ENCODED_PREFIX, getUnicode(binascii.hexlify(getBytes(value))))
49844986

49854987
return value
49864988

49874989
def unsafeVariableNaming(value):
49884990
"""
49894991
Returns unescaped safe-representation of a given variable name
49904992
4991-
>>> unsafeVariableNaming("EVAL_636c6173732e6964")
4992-
u'class.id'
4993+
>>> unsafeVariableNaming("EVAL_636c6173732e6964") == "class.id"
4994+
True
49934995
"""
49944996

49954997
if value.startswith(EVALCODE_ENCODED_PREFIX):
4996-
value = value[len(EVALCODE_ENCODED_PREFIX):].decode("hex").decode(UNICODE_ENCODING)
4998+
value = getUnicode(decodeHex(value[len(EVALCODE_ENCODED_PREFIX):]))
49974999

49985000
return value
49995001

‎lib/core/compat.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,10 @@ def whseed(self, a=None):
162162
z = (z + a) % 256 or 1
163163
self.__whseed(x, y, z)
164164

165+
def patchHeaders(headers):
166+
if not hasattr(headers, "headers"):
167+
headers.headers = ["%s: %s\r\n" % (header, headers[header]) for header in headers]
168+
165169
# Reference: https://github.com/urllib3/urllib3/blob/master/src/urllib3/filepost.py
166170
def choose_boundary():
167171
return uuid.uuid4().hex

‎lib/core/convert.py‎

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import pickle
1212

1313
import base64
14+
import binascii
1415
import json
1516
import re
1617
import sys
@@ -24,8 +25,8 @@ def base64decode(value):
2425
"""
2526
Decodes string value from Base64 to plain format
2627
27-
>>> base64decode('Zm9vYmFy')
28-
'foobar'
28+
>>> base64decode('Zm9vYmFy') == b'foobar'
29+
True
2930
"""
3031

3132
return base64.b64decode(unicodeencode(value))
@@ -34,8 +35,8 @@ def base64encode(value):
3435
"""
3536
Encodes string value from plain to Base64 format
3637
37-
>>> base64encode('foobar')
38-
'Zm9vYmFy'
38+
>>> base64encode('foobar') == b'Zm9vYmFy'
39+
True
3940
"""
4041

4142
return base64.b64encode(unicodeencode(value))
@@ -44,8 +45,8 @@ def base64pickle(value):
4445
"""
4546
Serializes (with pickle) and encodes to Base64 format supplied (binary) value
4647
47-
>>> base64pickle('foobar')
48-
'gAJVBmZvb2JhcnEBLg=='
48+
>>> base64unpickle(base64pickle([1, 2, 3])) == [1, 2, 3]
49+
True
4950
"""
5051

5152
retVal = None
@@ -68,8 +69,8 @@ def base64unpickle(value):
6869
"""
6970
Decodes value from Base64 to plain format and deserializes (with pickle) its content
7071
71-
>>> base64unpickle('gAJVBmZvb2JhcnEBLg==')
72-
'foobar'
72+
>>> type(base64unpickle('gAJjX19idWlsdGluX18Kb2JqZWN0CnEBKYFxAi4=')) == object
73+
True
7374
"""
7475

7576
retVal = None
@@ -85,8 +86,8 @@ def hexdecode(value):
8586
"""
8687
Decodes string value from hex to plain format
8788
88-
>>> hexdecode('666f6f626172')
89-
'foobar'
89+
>>> hexdecode('666f6f626172') == b'foobar'
90+
True
9091
"""
9192

9293
value = value.lower()
@@ -103,25 +104,21 @@ def hexencode(value, encoding=None):
103104
"""
104105
Encodes string value from plain to hex format
105106
106-
>>> hexencode('foobar')
107-
'666f6f626172'
107+
>>> hexencode('foobar') == b'666f6f626172'
108+
True
108109
"""
109110

110111
retVal = unicodeencode(value, encoding)
111-
112-
if six.PY2:
113-
retVal = retVal.encode("hex")
114-
else:
115-
retVal = retVal.hex()
112+
retVal = binascii.hexlify(retVal)
116113

117114
return retVal
118115

119116
def unicodeencode(value, encoding=None):
120117
"""
121118
Returns 8-bit string representation of the supplied unicode value
122119
123-
>>> unicodeencode(u'foobar')
124-
'foobar'
120+
>>> unicodeencode(u'foobar') == b'foobar'
121+
True
125122
"""
126123

127124
retVal = value
@@ -138,8 +135,8 @@ def utf8encode(value):
138135
"""
139136
Returns 8-bit string representation of the supplied UTF-8 value
140137
141-
>>> utf8encode(u'foobar')
142-
'foobar'
138+
>>> utf8encode(u'foobar') == b'foobar'
139+
True
143140
"""
144141

145142
return unicodeencode(value, "utf-8")
@@ -148,11 +145,16 @@ def utf8decode(value):
148145
"""
149146
Returns UTF-8 representation of the supplied 8-bit string representation
150147
151-
>>> utf8decode('foobar')
148+
>>> utf8decode(b'foobar')
152149
u'foobar'
153150
"""
154151

155-
return value.decode("utf-8")
152+
retVal = value
153+
154+
if isinstance(value, six.binary_type):
155+
retVal = value.decode("utf-8")
156+
157+
return retVal
156158

157159
def htmlunescape(value):
158160
"""
@@ -217,8 +219,8 @@ def dejsonize(data):
217219
"""
218220
Returns JSON deserialized data
219221
220-
>>> dejsonize('{\\n "foo": "bar"\\n}')
221-
{u'foo': u'bar'}
222+
>>> dejsonize('{\\n "foo": "bar"\\n}') == {u'foo': u'bar'}
223+
True
222224
"""
223225

224226
return json.loads(data)

‎lib/core/option.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1765,7 +1765,8 @@ class _(six.text_type):
17651765
conf.string = decodeStringEscape(conf.string)
17661766

17671767
if conf.getAll:
1768-
map(lambda _: conf.__setitem__(_, True), WIZARD.ALL)
1768+
for _ in WIZARD.ALL:
1769+
conf.__setitem__(_, True)
17691770

17701771
if conf.noCast:
17711772
for _ in list(DUMP_REPLACEMENTS.keys()):

‎lib/core/settings.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
from lib.core.enums import OS
1818

1919
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
20-
VERSION = "1.3.5.3"
20+
VERSION = "1.3.5.4"
2121
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2222
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2323
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -839,8 +839,8 @@
839839
def _reversible(ex):
840840
if isinstance(ex, UnicodeDecodeError):
841841
if INVALID_UNICODE_PRIVATE_AREA:
842-
return ("".join(unichr(int('000f00%2x' % ord(_), 16)) for _ in ex.object[ex.start:ex.end]), ex.end)
842+
return (u"".join(unichr(int('000f00%2x' % (_ if isinstance(_, int) else ord(_)), 16)) for _ in ex.object[ex.start:ex.end]), ex.end)
843843
else:
844-
return ("".join(INVALID_UNICODE_CHAR_FORMAT % ord(_) for _ in ex.object[ex.start:ex.end]).decode(UNICODE_ENCODING), ex.end)
844+
return (u"".join(INVALID_UNICODE_CHAR_FORMAT % (_ if isinstance(_, int) else ord(_)) for _ in ex.object[ex.start:ex.end]), ex.end)
845845

846846
codecs.register_error("reversible", _reversible)

0 commit comments

Comments
 (0)