[pull] master from sqlmapproject:master

lib/core/common.py

@@ -1529,6 +1529,8 @@ def cleanQuery(query):
 
     >>> cleanQuery("select id from users")
     'SELECT id FROM users'
+    >>> cleanQuery("select a from selected where b='from'")
+    "SELECT a FROM selected WHERE b='from'"
     """
 
     retVal = query
@@ -1544,10 +1546,11 @@ def cleanQuery(query):
             if not candidate or candidate.lower() not in queryLower:
                 continue
 
-            queryMatch = re.search(r"(?i)\b(%s)\b" % candidate, query)
-
-            if queryMatch and "sys_exec" not in query:
-                retVal = retVal.replace(queryMatch.group(1), candidate.upper())
+            if "sys_exec" not in query:
+                # NOTE: the leading branch consumes whole quoted parts (hence keeping keyword-alike data
+                # and case sensitive quoted identifiers intact), while the keyword itself is switched only
+                # at word boundaries (e.g. 'selected' must not turn into 'SELECTed')
+                retVal = re.sub(r"(?i)('[^']*'|\"[^\"]*\")|\b%s\b" % candidate, lambda match: match.group(1) or candidate.upper(), retVal)
 
     return retVal
 

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.8.53"
+VERSION = "1.10.8.55"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

lib/parse/payloads.py

@@ -71,7 +71,10 @@ def parseXmlNode(node):
                 for gchild in progeny:
                     if gchild.tag in test[child.tag]:
                         prevtext = test[child.tag][gchild.tag]
-                        test[child.tag][gchild.tag] = [prevtext, gchild.text]
+                        if isinstance(prevtext, list):
+                            prevtext.append(gchild.text)
+                        else:
+                            test[child.tag][gchild.tag] = [prevtext, gchild.text]
                     else:
                         test[child.tag][gchild.tag] = gchild.text