CERBERUS/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-08-04 14:55:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing charunicodeencode tamper script

Browse source
This commit is contained in:
Miroslav Štampar 2026-07-20 10:16:57 +02:00
parent 6234b62c6f
commit 620f3a77a1
2 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/core/settings.py
View file

@ -20,7 +20,7 @@ from lib.core.enums import OS
from thirdparty import six
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
VERSION = "1.10.7.142"
VERSION = "1.10.7.143"
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

11
tamper/charunicodeencode.py
View file

@ -35,6 +35,8 @@ def tamper(payload, **kwargs):
>>> tamper('SELECT FIELD%20FROM TABLE')
'%u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045'
>>> tamper(u'\U0001F600') == '%uD83D%uDE00'
True
"""
retVal = payload
@ -48,7 +50,14 @@ def tamper(payload, **kwargs):
retVal += "%%u00%s" % payload[i + 1:i + 3]
i += 3
else:
retVal += '%%u%.4X' % ord(payload[i])
ordinal = ord(payload[i])
if ordinal > 0xFFFF:
# Note: %uXXXX is UTF-16 based, so a non-BMP char (e.g. an emoji) must be emitted
# as a surrogate pair - '%.4X' alone would produce an invalid 5-digit '%uXXXXX'
ordinal -= 0x10000
retVal += "%%u%04X%%u%04X" % (0xD800 + (ordinal >> 10), 0xDC00 + (ordinal & 0x3FF))
else:
retVal += '%%u%.4X' % ordinal
i += 1
return retVal