CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Minor fix

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-19 11:54:53 +02:00
parent 109ce217ec
commit 00cccf78e5
2 changed files with 42 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.120"
VERSION = "1.10.7.121"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@ -501,7 +501,7 @@ ERROR_PARSING_REGEXES = (
)
# Regular expression used for parsing charset info from meta html headers
META_CHARSET_REGEX = r'(?si)<head>.*<meta[^>]+charset="?(?P<result>[^"> ]+).*</head>'
META_CHARSET_REGEX = r"""(?si)<head\b[^>]*>.*<meta[^>]+charset\s*=\s*["']?(?P<result>[^"'> ]+).*</head>"""
# Regular expression used for parsing refresh info from meta html headers
META_REFRESH_REGEX = r'(?i)<meta http-equiv="?refresh"?[^>]+content="?[^">]+;\s*(url=)?["\']?(?P<result>[^\'">]+)'

40
tests/test_decodepage.py
View file

@ -25,7 +25,10 @@ from _testutils import bootstrap
bootstrap()
from lib.request.basic import decodePage
from lib.core.common import extractRegexResult
from lib.core.data import conf, kb
from lib.core.exception import SqlmapCompressionException
from lib.core.settings import META_CHARSET_REGEX
BODY = b"Hello plain body content 12345 - no markup here"
@ -68,6 +71,43 @@ class TestCharset(unittest.TestCase):
out = decodePage(original.encode("utf-8"), None, "text/html; charset=utf-8")
self.assertEqual(out, original)
def test_meta_charset_used_when_no_http_charset(self):
# charset declared only via <meta> (no HTTP charset) with an attribute on <head>
# must still be honored; byte 0xC0 is 'А' (U+0410) in windows-1251
page = b'<html><head lang="ru"><meta charset="windows-1251"></head><body>\xc0\xc1\xc2</body></html>'
conf.encoding = None
kb.pageEncoding = None
out = decodePage(page, None, "text/html")
self.assertIn(u"АБВ", out)
class TestMetaCharsetRegex(unittest.TestCase):
"""META_CHARSET_REGEX must tolerate real-world <head>/meta forms while staying scoped
to the head so body content can't hijack the detected charset."""
def _charset(self, html):
return extractRegexResult(META_CHARSET_REGEX, html)
def test_head_with_attributes(self):
self.assertEqual(self._charset('<html><head lang="en"><meta charset="iso-8859-2"></head></html>'), "iso-8859-2")
def test_whitespace_around_equals(self):
self.assertEqual(self._charset('<html><head><meta charset = "utf-8"></head></html>'), "utf-8")
def test_single_quotes_stripped(self):
self.assertEqual(self._charset("<html><head><meta charset='utf-8'></head></html>"), "utf-8")
def test_http_equiv_content_type(self):
self.assertEqual(self._charset('<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"></head></html>'), "windows-1251")
def test_header_tag_not_matched(self):
# <header> is not <head>
self.assertIsNone(self._charset('<html><header><meta charset="utf-8"></header></html>'))
def test_body_meta_not_hijacked(self):
# a meta whose content merely mentions charset= in the body must not be picked up
self.assertIsNone(self._charset('<html><head><title>t</title></head><body><meta name="d" content="learn charset=evil"></body></html>'))
class TestMalformed(unittest.TestCase):
def test_invalid_deflate_raises(self):