Minor update

Author: stamparm

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.153"
+VERSION = "1.10.7.154"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

lib/parse/html.py

@@ -9,6 +9,7 @@
 
 from xml.sax.handler import ContentHandler
 
+from lib.core.common import singleTimeWarnMessage
 from lib.core.common import urldecode
 from lib.core.common import parseXmlFile
 from lib.core.data import kb
@@ -86,7 +87,12 @@ def htmlParser(page):
             handler._markAsErrorPage()
         return retVal
 
-    parseXmlFile(xmlfile, handler)
+    try:
+        parseXmlFile(xmlfile, handler)
+    except Exception:
+        # DBMS fingerprinting from the error page is best-effort - a broken or third-party-patched
+        # xml.sax (e.g. a modified stdlib on some distros) must not abort the whole scan (see #6086)
+        singleTimeWarnMessage("unable to parse the response page for DBMS-specific error messages")
 
     if handler.dbms and handler.dbms not in kb.htmlFp:
         kb.lastParserStatus = handler.dbms