From 00cccf78e56a228df58e7a54eb3ffb2ab11e2d02 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Sun, 19 Jul 2026 11:54:53 +0200 Subject: [PATCH] Minor fix --- lib/core/settings.py | 4 ++-- tests/test_decodepage.py | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index a0ee0556a..aaae40388 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.120" +VERSION = "1.10.7.121" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) @@ -501,7 +501,7 @@ ERROR_PARSING_REGEXES = ( ) # Regular expression used for parsing charset info from meta html headers -META_CHARSET_REGEX = r'(?si).*]+charset="?(?P[^"> ]+).*' +META_CHARSET_REGEX = r"""(?si)]*>.*]+charset\s*=\s*["']?(?P[^"'> ]+).*""" # Regular expression used for parsing refresh info from meta html headers META_REFRESH_REGEX = r'(?i)]+content="?[^">]+;\s*(url=)?["\']?(?P[^\'">]+)' diff --git a/tests/test_decodepage.py b/tests/test_decodepage.py index 01eb899c4..699494166 100644 --- a/tests/test_decodepage.py +++ b/tests/test_decodepage.py @@ -25,7 +25,10 @@ from _testutils import bootstrap bootstrap() from lib.request.basic import decodePage +from lib.core.common import extractRegexResult +from lib.core.data import conf, kb from lib.core.exception import SqlmapCompressionException +from lib.core.settings import META_CHARSET_REGEX BODY = b"Hello plain body content 12345 - no markup here" @@ -68,6 +71,43 @@ class TestCharset(unittest.TestCase): out = decodePage(original.encode("utf-8"), None, "text/html; charset=utf-8") self.assertEqual(out, original) + def test_meta_charset_used_when_no_http_charset(self): + # charset declared only via (no HTTP charset) with an attribute on + # must still be honored; byte 0xC0 is 'А' (U+0410) in windows-1251 + page = b'\xc0\xc1\xc2' + conf.encoding = None + kb.pageEncoding = None + out = decodePage(page, None, "text/html") + self.assertIn(u"АБВ", out) + + +class TestMetaCharsetRegex(unittest.TestCase): + """META_CHARSET_REGEX must tolerate real-world /meta forms while staying scoped + to the head so body content can't hijack the detected charset.""" + + def _charset(self, html): + return extractRegexResult(META_CHARSET_REGEX, html) + + def test_head_with_attributes(self): + self.assertEqual(self._charset(''), "iso-8859-2") + + def test_whitespace_around_equals(self): + self.assertEqual(self._charset(''), "utf-8") + + def test_single_quotes_stripped(self): + self.assertEqual(self._charset(""), "utf-8") + + def test_http_equiv_content_type(self): + self.assertEqual(self._charset(''), "windows-1251") + + def test_header_tag_not_matched(self): + #
is not + self.assertIsNone(self._charset('
')) + + def test_body_meta_not_hijacked(self): + # a meta whose content merely mentions charset= in the body must not be picked up + self.assertIsNone(self._charset('t')) + class TestMalformed(unittest.TestCase): def test_invalid_deflate_raises(self):