diff --git a/lib/core/settings.py b/lib/core/settings.py index e2a9a0058..f3edf814d 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.153" +VERSION = "1.10.7.154" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/parse/html.py b/lib/parse/html.py index b4d9883a9..03e599536 100644 --- a/lib/parse/html.py +++ b/lib/parse/html.py @@ -9,6 +9,7 @@ import re from xml.sax.handler import ContentHandler +from lib.core.common import singleTimeWarnMessage from lib.core.common import urldecode from lib.core.common import parseXmlFile from lib.core.data import kb @@ -86,7 +87,12 @@ def htmlParser(page): handler._markAsErrorPage() return retVal - parseXmlFile(xmlfile, handler) + try: + parseXmlFile(xmlfile, handler) + except Exception: + # DBMS fingerprinting from the error page is best-effort - a broken or third-party-patched + # xml.sax (e.g. a modified stdlib on some distros) must not abort the whole scan (see #6086) + singleTimeWarnMessage("unable to parse the response page for DBMS-specific error messages") if handler.dbms and handler.dbms not in kb.htmlFp: kb.lastParserStatus = handler.dbms