Handle empty string and keys without value in postData. resolves #1548 (#1550)

This commit is contained in:
eZ4RK0
2025-10-01 05:56:57 +02:00
committed by GitHub
parent 0d889cb0b2
commit a916d93779

View File

@@ -403,10 +403,10 @@ def _evil_logic(req: V1RequestBase, driver: WebDriver, method: str) -> Challenge
def _post_request(req: V1RequestBase, driver: WebDriver): def _post_request(req: V1RequestBase, driver: WebDriver):
post_form = f'<form id="hackForm" action="{req.url}" method="POST">' post_form = f'<form id="hackForm" action="{req.url}" method="POST">'
query_string = req.postData if req.postData[0] != '?' else req.postData[1:] query_string = req.postData if req.postData and req.postData[0] != '?' else req.postData[1:] if req.postData else ''
pairs = query_string.split('&') pairs = query_string.split('&')
for pair in pairs: for pair in pairs:
parts = pair.split('=') parts = pair.split('=', 1)
# noinspection PyBroadException # noinspection PyBroadException
try: try:
name = unquote(parts[0]) name = unquote(parts[0])
@@ -416,9 +416,9 @@ def _post_request(req: V1RequestBase, driver: WebDriver):
continue continue
# noinspection PyBroadException # noinspection PyBroadException
try: try:
value = unquote(parts[1]) value = unquote(parts[1]) if len(parts) > 1 else ''
except Exception: except Exception:
value = parts[1] value = parts[1] if len(parts) > 1 else ''
post_form += f'<input type="text" name="{escape(quote(name))}" value="{escape(quote(value))}"><br>' post_form += f'<input type="text" name="{escape(quote(name))}" value="{escape(quote(value))}"><br>'
post_form += '</form>' post_form += '</form>'
html_content = f""" html_content = f"""