This patch resolves an error in lswww.py where UNICODE/extended ASCII strings cannot be sent to the victim because Python recognizes them as being out of bounds (>d127). The patch switches the attack string to UNICODE so that it may be sent.
def inzone(self,url):
"""Make sure the url is under the root url"""
+ temp=self.root
+ if isinstance(temp, unicode):
+ self.root=str(temp.encode("iso8859-15"))
if(url.find(self.root,0)==0):
return 0
else:
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Fix UNICODE/ASCII error
Logged In: NO
A better patch that would prevent a new patch for some of the other modules would be:
*** powerfuzzer/lswww.py Fri Jun 27 18:14:08 2008
--- powerfuzzer2/lswww.py Thu Jul 24 13:11:34 2008
***************
*** 370,375 ****
--- 370,378 ----
def inzone(self,url):
"""Make sure the url is under the root url"""
+ temp=self.root
+ if isinstance(temp, unicode):
+ self.root=str(temp.encode("iso8859-15"))
if(url.find(self.root,0)==0):
return 0
else: