diff --git a/lib/core/common.py b/lib/core/common.py index 7bc0a488a0e..fb4ec825dde 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -1529,6 +1529,8 @@ def cleanQuery(query): >>> cleanQuery("select id from users") 'SELECT id FROM users' + >>> cleanQuery("select a from selected where b='from'") + "SELECT a FROM selected WHERE b='from'" """ retVal = query @@ -1544,10 +1546,11 @@ def cleanQuery(query): if not candidate or candidate.lower() not in queryLower: continue - queryMatch = re.search(r"(?i)\b(%s)\b" % candidate, query) - - if queryMatch and "sys_exec" not in query: - retVal = retVal.replace(queryMatch.group(1), candidate.upper()) + if "sys_exec" not in query: + # NOTE: the leading branch consumes whole quoted parts (hence keeping keyword-alike data + # and case sensitive quoted identifiers intact), while the keyword itself is switched only + # at word boundaries (e.g. 'selected' must not turn into 'SELECTed') + retVal = re.sub(r"(?i)('[^']*'|\"[^\"]*\")|\b%s\b" % candidate, lambda match: match.group(1) or candidate.upper(), retVal) return retVal diff --git a/lib/core/settings.py b/lib/core/settings.py index b1e3ca7dd69..6872a9a3f28 100644 --- a/lib/core/settings.py +++ b/lib/core/settings.py @@ -20,7 +20,7 @@ from thirdparty import six # sqlmap version (...) -VERSION = "1.10.8.53" +VERSION = "1.10.8.55" TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable" TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34} VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE) diff --git a/lib/parse/payloads.py b/lib/parse/payloads.py index 24ee83e1a6d..a84ac1dbc38 100644 --- a/lib/parse/payloads.py +++ b/lib/parse/payloads.py @@ -71,7 +71,10 @@ def parseXmlNode(node): for gchild in progeny: if gchild.tag in test[child.tag]: prevtext = test[child.tag][gchild.tag] - test[child.tag][gchild.tag] = [prevtext, gchild.text] + if isinstance(prevtext, list): + prevtext.append(gchild.text) + else: + test[child.tag][gchild.tag] = [prevtext, gchild.text] else: test[child.tag][gchild.tag] = gchild.text