CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adding one more data correctness patch
Some checks failed
/ build (macos-latest, 3.8) (push) Has been cancelled
Details
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
Details
/ build (windows-latest, 3.14) (push) Has been cancelled
Details

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-30 19:06:40 +02:00
parent 5be154b9e2
commit 579e559c71
3 changed files with 67 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

33
tests/test_charset.py
View file

@ -22,6 +22,7 @@ from _testutils import bootstrap
bootstrap()
from lib.request.basic import checkCharEncoding
from lib.request.inject import _pageCharsetCorrupted, _looksLikeMisdecodedUtf8
from lib.core.common import extractRegexResult, paramToDict
from lib.core.enums import PLACE
from lib.core.settings import META_CHARSET_REGEX, HTML_TITLE_REGEX, META_REFRESH_REGEX
@ -58,6 +59,38 @@ class TestBodyHints(unittest.TestCase):
self.assertIsNone(extractRegexResult(HTML_TITLE_REGEX, "<body>no title here</body>"))
class TestCharsetMismatchDetection(unittest.TestCase):
"""The auto-hex recovery triggers on two complementary mismatch directions:
_pageCharsetCorrupted (page charset too NARROW -> undecodable bytes) and
_looksLikeMisdecodedUtf8 (page charset too WIDE -> UTF-8 shown as latin-1, no
undecodable byte). Both must fire on the corruption and NOT on clean data."""
# correctly-decoded UTF-8 and genuine latin-1 text: neither detector may fire (no wasted re-fetch).
# \u escapes keep this source pure-ASCII (py2): cafe / naive / Zurich / CJK / Cyrillic / resume / garcon
CLEAN = [u"admin", u"caf\u00e9", u"na\u00efve", u"Z\u00fcrich", u"\u65e5\u672c\u8a9e",
u"\u0417\u0434\u0440\u0430\u0432\u0435\u0439", u"r\u00e9sum\u00e9", u"gar\u00e7on"]
def test_clean_values_trigger_neither(self):
for v in self.CLEAN:
self.assertFalse(_pageCharsetCorrupted(v), msg="narrow FP: %r" % v)
self.assertFalse(_looksLikeMisdecodedUtf8(v), msg="wide FP: %r" % v)
def test_utf8_shown_as_latin1_is_caught(self):
# gap #1: UTF-8 column bytes decoded as latin-1 -> valid mojibake, no undecodable byte
for word in (u"caf\u00e9", u"\u65e5\u672c\u8a9e", u"\u0417\u0434\u0440\u0430\u0432\u0435\u0439", u"\u20ac"):
mojibake = word.encode("utf-8").decode("latin-1")
self.assertFalse(_pageCharsetCorrupted(mojibake), msg="narrow should miss: %r" % mojibake)
self.assertTrue(_looksLikeMisdecodedUtf8(mojibake), msg="wide should catch: %r" % mojibake)
def test_undecodable_bytes_still_caught_by_narrow(self):
# the other direction (page charset too narrow) leaves reversible \xNN escapes
self.assertTrue(_pageCharsetCorrupted(u"foo\\xe9bar"))
def test_list_and_nonstring_inputs(self):
self.assertTrue(_looksLikeMisdecodedUtf8([u"ok", u"caf\u00c3\u00a9"])) # 'cafe' mojibake
self.assertFalse(_looksLikeMisdecodedUtf8([u"ok", 123, None]))
class TestParamToDict(unittest.TestCase):
# NOTE: GET parsing is covered in test_urls.py; here we only cover the COOKIE place,
# which uses a different (semicolon) delimiter and is a distinct code path.