From 13e293c73326a03118734fb3500f77cd5a217c96 Mon Sep 17 00:00:00 2001 From: Rohith Kumar Ankam <70012972+rohitkumarankam@users.noreply.github.com> Date: Tue, 9 Jan 2024 11:58:33 +0530 Subject: [PATCH] Improved file field handling in Multipart forms --- lib/core/target.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/core/target.py b/lib/core/target.py index 52f8fc9a7..67fbf2f26 100644 --- a/lib/core/target.py +++ b/lib/core/target.py @@ -226,7 +226,7 @@ def _setRequestParams(): if not (kb.processUserMarks and kb.customInjectionMark in conf.data): conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) conf.data = conf.data.replace(kb.customInjectionMark, ASTERISK_MARKER) - conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P[^\"'\r\n]+)[\"']?).+?)((%s)--)" % ("\r\n" if "\r\n" in conf.data else '\n'), functools.partial(process, repl=r"\g<1>%s\g<4>" % kb.customInjectionMark), conf.data) + conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"']?(?P[^\"'\r\n]+)[\"']?).+?)((%s)--)" % ("\r\n" if "\r\n" in conf.data else '\n'), lambda match: match.group(1) + (kb.customInjectionMark if 'filename' not in match.group(0) else '') + match.group(4), conf.data) if not kb.postHint: if kb.customInjectionMark in conf.data: # later processed