From 7a6433b9efc6473f3f857de9308153e1b9d06974 Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Mon, 4 May 2020 12:25:46 +0200 Subject: [PATCH] Proper implementation for #4184 --- lib/core/common.py | 12 ++++++++---- lib/core/settings.py | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/lib/core/common.py b/lib/core/common.py index 6ca246f7a..c8222d28b 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -675,17 +675,21 @@ def paramToDict(place, parameters=None): elif isinstance(current, dict): for key in current.keys(): value = current[key] - if isinstance(value, (list, tuple, set, dict)): - if value: - walk(head, value) - elif isinstance(value, (bool, int, float, six.string_types)): + if isinstance(value, (bool, int, float, six.string_types)) or value in (None, []): original = current[key] if isinstance(value, bool): current[key] = "%s%s" % (getUnicode(value).lower(), BOUNDED_INJECTION_MARKER) + elif value is None: + current[key] = "%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER) + elif value == []: + current[key] = ["%s%s" % (randomInt(), BOUNDED_INJECTION_MARKER)] else: current[key] = "%s%s" % (value, BOUNDED_INJECTION_MARKER) candidates["%s (%s)" % (parameter, key)] = re.sub(r"\b(%s\s*=\s*)%s" % (re.escape(parameter), re.escape(testableParameters[parameter])), r"\g<1>%s" % json.dumps(deserialized, separators=(',', ':') if ", " not in testableParameters[parameter] else None), parameters) current[key] = original + elif isinstance(value, (list, tuple, set, dict)): + if value: + walk(head, value) deserialized = json.loads(testableParameters[parameter]) walk(deserialized) diff --git a/lib/core/settings.py b/lib/core/settings.py index b0ab91c15..37fa380c8 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -18,7 +18,7 @@ from lib.core.enums import OS from thirdparty.six import unichr as _unichr # sqlmap version (...) -VERSION = "1.4.5.2" +VERSION = "1.4.5.3" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)