From e5899369828fa2eefcb6f1ca45e98b4d069ae4a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0tampar?= Date: Mon, 20 Jul 2026 22:19:57 +0200 Subject: [PATCH] Adding some guard blocks when people fool around with their environment --- lib/core/settings.py | 2 +- lib/parse/banner.py | 23 ++++++++++++++--------- lib/parse/headers.py | 9 +++++++-- 3 files changed, 22 insertions(+), 12 deletions(-) diff --git a/lib/core/settings.py b/lib/core/settings.py index f3edf814d..b3bade0bc 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from lib.core.enums import OS from thirdparty import six # sqlmap version (...) -VERSION = "1.10.7.154" +VERSION = "1.10.7.155" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/parse/banner.py b/lib/parse/banner.py index c4eef8c27..b735f6eae 100644 --- a/lib/parse/banner.py +++ b/lib/parse/banner.py @@ -12,6 +12,7 @@ from xml.sax.handler import ContentHandler from lib.core.common import Backend from lib.core.common import parseXmlFile from lib.core.common import sanitizeStr +from lib.core.common import singleTimeWarnMessage from lib.core.data import kb from lib.core.data import paths from lib.core.enums import DBMS @@ -103,13 +104,17 @@ def bannerParser(banner): if not xmlfile: return - if Backend.isDbms(DBMS.MSSQL): - handler = MSSQLBannerHandler(banner, kb.bannerFp) - parseXmlFile(xmlfile, handler) + try: + if Backend.isDbms(DBMS.MSSQL): + handler = MSSQLBannerHandler(banner, kb.bannerFp) + parseXmlFile(xmlfile, handler) - handler = FingerprintHandler(banner, kb.bannerFp) - parseXmlFile(paths.GENERIC_XML, handler) - else: - handler = FingerprintHandler(banner, kb.bannerFp) - parseXmlFile(xmlfile, handler) - parseXmlFile(paths.GENERIC_XML, handler) + handler = FingerprintHandler(banner, kb.bannerFp) + parseXmlFile(paths.GENERIC_XML, handler) + else: + handler = FingerprintHandler(banner, kb.bannerFp) + parseXmlFile(xmlfile, handler) + parseXmlFile(paths.GENERIC_XML, handler) + except Exception: + # best-effort banner fingerprinting - a broken/patched xml.sax must not abort the scan (see #6086) + singleTimeWarnMessage("unable to parse the DBMS banner for version fingerprinting") diff --git a/lib/parse/headers.py b/lib/parse/headers.py index 0a47a0985..0bebf9db8 100644 --- a/lib/parse/headers.py +++ b/lib/parse/headers.py @@ -8,6 +8,7 @@ See the file 'LICENSE' for copying permission import os from lib.core.common import parseXmlFile +from lib.core.common import singleTimeWarnMessage from lib.core.data import kb from lib.core.data import paths from lib.parse.handler import FingerprintHandler @@ -32,5 +33,9 @@ def headersParser(headers): for header, xmlfile in kb.headerPaths.items(): if header in headers: handler = FingerprintHandler(headers[header], kb.headersFp) - parseXmlFile(xmlfile, handler) - parseXmlFile(paths.GENERIC_XML, handler) + try: + parseXmlFile(xmlfile, handler) + parseXmlFile(paths.GENERIC_XML, handler) + except Exception: + # best-effort header fingerprinting - a broken/patched xml.sax must not abort the scan (see #6086) + singleTimeWarnMessage("unable to parse the response headers for technology fingerprinting")