diff --git a/lib/core/settings.py b/lib/core/settings.py index f85e6741e..165bd26ee 100755 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -717,6 +717,9 @@ METASPLOIT_SESSION_TIMEOUT = 120 # Reference: http://www.postgresql.org/docs/9.0/static/catalog-pg-largeobject.html LOBLKSIZE = 2048 +# Replacement for non-ALNUM chars in variables +EVALCODE_NONALNUM_REP = "_%s_" # %s to be changed for hex(ord(char)) + # Suffix used to mark variables having keyword names EVALCODE_KEYWORD_SUFFIX = "_KEYWORD" diff --git a/lib/request/connect.py b/lib/request/connect.py index 3ef84ca08..1e989076d 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -84,6 +84,7 @@ from lib.core.settings import BOUNDARY_BACKSLASH_MARKER from lib.core.settings import DEFAULT_CONTENT_TYPE from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import DEFAULT_GET_POST_DELIMITER +from lib.core.settings import EVALCODE_NONALNUM_REP from lib.core.settings import EVALCODE_KEYWORD_SUFFIX from lib.core.settings import HTTP_ACCEPT_HEADER_VALUE from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE @@ -1018,6 +1019,8 @@ class Connect(object): variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals()} originals = {} keywords = keyword.kwlist + regex_nonalnum = '(%s)' % \ + (EVALCODE_NONALNUM_REP % '0x([0-9a-f]{1,2})') if not get and PLACE.URI in conf.parameters: query = urlparse.urlsplit(uri).query or "" @@ -1028,7 +1031,18 @@ class Connect(object): for part in item.split(delimiter): if '=' in part: name, value = part.split('=', 1) - name = re.sub(r"[^\w]", "", name.strip()) + # modify non-alnum delimiters already in name + for p in re.findall(regex_nonalnum, name): + b = EVALCODE_NONALNUM_REP % hex(ord(p[0][0])) + e = EVALCODE_NONALNUM_REP % hex(ord(p[0][-1])) + name = name.replace( + p[0], "%s%s%s" % (b, p[0][1:-1], e)) + # modify non-alnum characters + name = "".join( + c if re.search(r"^\w$", c) + else EVALCODE_NONALNUM_REP % hex(ord(c)) + for c in name) + # modify keywords if name in keywords: name = "%s%s" % (name, EVALCODE_KEYWORD_SUFFIX) value = urldecode(value, convall=True, plusspace=(item==post and kb.postSpaceToPlus)) @@ -1068,10 +1082,17 @@ class Connect(object): evaluateCode(conf.evalCode, variables) for variable in variables.keys(): + original = variable + value = variables[variable] + # restore non-alnum characters + for p in re.findall(regex_nonalnum, variable): + variable = variable.replace(p[0], chr(int(p[1], 16))) + # restore keywords if variable.endswith(EVALCODE_KEYWORD_SUFFIX): - value = variables[variable] - del variables[variable] - variables[variable.replace(EVALCODE_KEYWORD_SUFFIX, "")] = value + variable = variable.replace(EVALCODE_KEYWORD_SUFFIX, "") + if variable != original: + del variables[original] + variables[variable] = value uri = variables["uri"]