fix regarding proper string isinstance checking (including unicode)

lib/core/common.py

@@ -149,7 +149,7 @@ def formatDBMSfp(versions=None):
     if ( not versions or versions == [None] ) and kb.dbmsVersion and kb.dbmsVersion[0] != "Unknown":
         versions = kb.dbmsVersion
 
-    if isinstance(versions, str):
+    if isinstance(versions, basestring):
         return "%s %s" % (kb.dbms, versions)
     elif isinstance(versions, (list, set, tuple)):
         return "%s %s" % (kb.dbms, " and ".join([version for version in versions]))
@@ -848,7 +848,7 @@ def parseUnionPage(output, expression, partial=False, condition=None, sort=True)
     else:
         data = output
 
-    if len(data) == 1 and isinstance(data[0], str):
+    if len(data) == 1 and isinstance(data[0], basestring):
         data = data[0]
 
     return data
@@ -1019,7 +1019,7 @@ def normalizePath(path):
 def safeStringFormat(formatStr, params):
     retVal = formatStr.replace("%d", "%s")
 
-    if isinstance(params, str):
+    if isinstance(params, basestring):
         retVal = retVal.replace("%s", params)
     else:
         count = 0

lib/core/dump.py

@@ -90,7 +90,7 @@ class Dump:
                 pass
 
         for element in elements:
-            if isinstance(element, str):
+            if isinstance(element, basestring):
                 self.__write("[*] %s" % element)
             elif isinstance(element, (list, tuple, set)):
                 self.__write("[*] " + ", ".join(str(e) for e in element))

lib/core/option.py

@@ -1011,7 +1011,7 @@ def __saveCmdline():
                 elif datatype == "string":
                     value = ""
 
-            if isinstance(value, str):
+            if isinstance(value, basestring):
                 value = value.replace("\n", "\n ")
 
             config.set(family, option, value)

lib/core/session.py

@@ -193,7 +193,7 @@ def setStacked():
                   not kb.resumedQueries[conf.url].has_key("Stacked queries") )
                 )
 
-    if not isinstance(kb.stackedTest, str):
+    if not isinstance(kb.stackedTest, basestring):
         return
 
     if condition:

lib/core/shell.py

@@ -45,7 +45,7 @@ def queriesForAutoCompletion():
     autoComplQueries = {}
 
     for _, query in queries[kb.dbms].items():
-        if isinstance(query, str) and len(query) > 1:
+        if isinstance(query, basestring) and len(query) > 1:
             autoComplQuery = query
         elif isinstance(query, dict) and "inband" in query:
             autoComplQuery = query["inband"]["query"]

lib/request/inject.py

@@ -376,7 +376,7 @@ def getValue(expression, blind=True, inband=True, fromUser=False, expected=None,
     kb.unionFalseCond = oldParamFalseCond
     kb.unionNegative  = oldParamNegative
 
-    if value and isinstance(value, str):
+    if value and isinstance(value, basestring):
         value = value.strip()
 
     return value

lib/takeover/metasploit.py

@@ -179,7 +179,7 @@ class Metasploit:
         return self.__skeletonSelection("SMB port", self.__msfSMBPortsList)
 
     def __selectEncoder(self, encode=True):
-        if isinstance(encode, str):
+        if isinstance(encode, basestring):
             return encode
 
         elif kb.os == "Windows" and encode:

lib/takeover/udf.py

@@ -227,7 +227,7 @@ class UDF:
         while True:
             udfCount = readInput(msg, default=1)
 
-            if isinstance(udfCount, str) and udfCount.isdigit():
+            if isinstance(udfCount, basestring) and udfCount.isdigit():
                 udfCount = int(udfCount)
 
                 if udfCount <= 0:
@@ -267,7 +267,7 @@ class UDF:
             while True:
                 parCount = readInput(msg, default=default)
 
-                if isinstance(parCount, str) and parCount.isdigit() and int(parCount) >= 0:
+                if isinstance(parCount, basestring) and parCount.isdigit() and int(parCount) >= 0:
                     parCount = int(parCount)
                     break
 
@@ -284,7 +284,7 @@ class UDF:
                 while True:
                     parType = readInput(msg, default=defaultType)
 
-                    if isinstance(parType, str) and parType.isdigit():
+                    if isinstance(parType, basestring) and parType.isdigit():
                         logger.warn("you need to specify the data-type of the parameter")
 
                     else:
@@ -297,7 +297,7 @@ class UDF:
             while True:
                 retType = readInput(msg, default=defaultType)
 
-                if isinstance(retType, str) and retType.isdigit():
+                if isinstance(retType, basestring) and retType.isdigit():
                     logger.warn("you need to specify the data-type of the return value")
                 else:
                     self.udfs[udfName]["return"] = retType
@@ -328,7 +328,7 @@ class UDF:
 
                 if choice and choice[0] in ( "q", "Q" ):
                     break
-                elif isinstance(choice, str) and choice.isdigit() and int(choice) > 0 and int(choice) <= len(udfList):
+                elif isinstance(choice, basestring) and choice.isdigit() and int(choice) > 0 and int(choice) <= len(udfList):
                     choice = int(choice)
                     break
                 elif isinstance(choice, int) and choice > 0 and choice <= len(udfList):

lib/techniques/blind/inference.py

@@ -58,20 +58,20 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
 
     if "LENGTH(" in expression or "LEN(" in expression:
         firstChar = 0
-    elif conf.firstChar is not None and ( isinstance(conf.firstChar, int) or ( isinstance(conf.firstChar, str) and conf.firstChar.isdigit() ) ):
+    elif conf.firstChar is not None and ( isinstance(conf.firstChar, int) or ( isinstance(conf.firstChar, basestring) and conf.firstChar.isdigit() ) ):
         firstChar = int(conf.firstChar) - 1
     elif firstChar is None:
         firstChar = 0
-    elif ( isinstance(firstChar, str) and firstChar.isdigit() ) or isinstance(firstChar, int):
+    elif ( isinstance(firstChar, basestring) and firstChar.isdigit() ) or isinstance(firstChar, int):
         firstChar = int(firstChar) - 1
 
     if "LENGTH(" in expression or "LEN(" in expression:
         lastChar = 0
-    elif conf.lastChar is not None and ( isinstance(conf.lastChar, int) or ( isinstance(conf.lastChar, str) and conf.lastChar.isdigit() ) ):
+    elif conf.lastChar is not None and ( isinstance(conf.lastChar, int) or ( isinstance(conf.lastChar, basestring) and conf.lastChar.isdigit() ) ):
         lastChar = int(conf.lastChar)
     elif lastChar in ( None, "0" ):
         lastChar = 0
-    elif ( isinstance(lastChar, str) and lastChar.isdigit() ) or isinstance(lastChar, int):
+    elif ( isinstance(lastChar, basestring) and lastChar.isdigit() ) or isinstance(lastChar, int):
         lastChar = int(lastChar)
 
     if kb.dbmsDetected:
@@ -335,7 +335,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
         # can mean that the connection to the target url was lost
         if None in value:
             for v in value:
-                if isinstance(v, str) and v is not None:
+                if isinstance(v, basestring) and v is not None:
                     partialValue += v
 
             if partialValue:
@@ -345,7 +345,7 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None
             finalValue = "".join(value)
             infoMsg = "\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), finalValue)
 
-        if isinstance(finalValue, str) and len(finalValue) > 0:
+        if isinstance(finalValue, basestring) and len(finalValue) > 0:
             dataToSessionFile(replaceNewlineTabs(finalValue))
 
         if conf.verbose >= 1 and not showEta and infoMsg:

plugins/dbms/mssqlserver/enumeration.py

@@ -159,7 +159,7 @@ class Enumeration(GenericEnumeration):
                     values = inject.getValue(query, blind=False)
 
                     if values:
-                        if isinstance(values, str):
+                        if isinstance(values, basestring):
                             values = [ values ]
 
                         for foundTbl in values:
@@ -244,7 +244,7 @@ class Enumeration(GenericEnumeration):
                     values = inject.getValue(query, blind=False)
 
                     if values:
-                        if isinstance(values, str):
+                        if isinstance(values, basestring):
                             values = [ values ]
 
                         for foundTbl in values:

plugins/dbms/oracle/enumeration.py

@@ -217,7 +217,7 @@ class Enumeration(GenericEnumeration):
                     values = inject.getValue(query, blind=False)
 
                     if values:
-                        if isinstance(values, str):
+                        if isinstance(values, basestring):
                             values = [ values ]
 
                         for foundTbl in values:

plugins/generic/enumeration.py

@@ -718,7 +718,7 @@ class Enumeration:
 
             if value:
                 if kb.dbms == "SQLite":
-                    if isinstance(value, str):
+                    if isinstance(value, basestring):
                         value = [[ "SQLite", value ]]
                     elif isinstance(value, (list, tuple, set)):
                         newValue = []
@@ -1040,7 +1040,7 @@ class Enumeration:
             entries = inject.getValue(query, blind=False, dump=True)
 
             if entries:
-                if isinstance(entries, str):
+                if isinstance(entries, basestring):
                     entries = [ entries ]
 
                 entriesCount = len(entries)
@@ -1053,7 +1053,7 @@ class Enumeration:
                         kb.data.dumpedTable[column] = { "length": 0, "values": [] }
 
                     for entry in entries:
-                        if isinstance(entry, str):
+                        if isinstance(entry, basestring):
                             colEntry = entry
                         else:
                             colEntry = entry[index]
@@ -1295,7 +1295,7 @@ class Enumeration:
                 values = inject.getValue(query, blind=False)
 
                 if values:
-                    if isinstance(values, str):
+                    if isinstance(values, basestring):
                         values = [ values ]
 
                     for value in values:
@@ -1380,7 +1380,7 @@ class Enumeration:
                 values = inject.getValue(query, blind=False)
 
                 if values:
-                    if isinstance(values, str):
+                    if isinstance(values, basestring):
                         values = [ values ]
 
                     for foundDb, foundTbl in values:
@@ -1501,7 +1501,7 @@ class Enumeration:
                 values = inject.getValue(query, blind=False)
 
                 if values:
-                    if isinstance(values, str):
+                    if isinstance(values, basestring):
                         values = [ values ]
 
                     for foundDb, foundTbl in values:

plugins/generic/takeover.py

@@ -114,7 +114,7 @@ class Takeover(Abstraction, Metasploit, Registry, Miscellaneous):
                 while True:
                     choice = readInput(msg, default=1)
 
-                    if isinstance(choice, str) and choice.isdigit() and int(choice) in ( 1, 2 ):
+                    if isinstance(choice, basestring) and choice.isdigit() and int(choice) in ( 1, 2 ):
                         choice = int(choice)
                         break