Skip to content

Commit b8920d6

Browse files
lanshuizhiyuelanshuizhiyue
committed
fix: 修复Burp插件(Legacy/Montoya)中文乱码问题 - 强制使用UTF-8编码处理HTTP请求body和完整报文
1 parent 4e2451f commit b8920d6

File tree

12 files changed

+113
-31
lines changed

12 files changed

+113
-31
lines changed

‎src/burpEx/legacy-api/src/main/java/com/sqlmapwebui/burp/BurpExtender.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
import javax.swing.*;
88
import java.awt.*;
9+
import java.nio.charset.StandardCharsets;
910
import java.io.PrintWriter;
1011
import java.util.ArrayList;
1112
import java.util.List;
@@ -323,7 +324,7 @@ private void sendRequestToBackend(IHttpRequestResponse requestResponse, ScanConf
323324
int bodyOffset = requestInfo.getBodyOffset();
324325
String body = "";
325326
if (bodyOffset < request.length) {
326-
body = new String(request, bodyOffset, request.length - bodyOffset);
327+
body = new String(request, bodyOffset, request.length - bodyOffset, StandardCharsets.UTF_8);
327328
}
328329

329330
StringBuilder headersJson = new StringBuilder("[");

‎src/burpEx/legacy-api/src/main/java/com/sqlmapwebui/burp/RequestDeduplicator.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,15 +154,15 @@ public static String generateFingerprint(IHttpRequestResponse requestResponse, I
154154
int bodyOffset = requestInfo.getBodyOffset();
155155
String body = "";
156156
if (bodyOffset < request.length) {
157-
body = new String(request, bodyOffset, request.length - bodyOffset);
157+
body = new String(request, bodyOffset, request.length - bodyOffset, StandardCharsets.UTF_8);
158158
}
159159
String normalizedBody = normalizeBody(body, getContentType(requestInfo));
160160
sb.append("body:").append(normalizedBody);
161161

162162
} catch (Exception e) {
163163
// 如果解析失败，使用原始请求的hash
164164
byte[] request = requestResponse.getRequest();
165-
sb.append("raw:").append(new String(request));
165+
sb.append("raw:").append(new String(request, StandardCharsets.UTF_8));
166166
}
167167

168168
// 生成MD5哈希作为指纹

‎src/burpEx/legacy-api/src/main/java/com/sqlmapwebui/burp/dialogs/AdvancedScanConfigDialog.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import javax.swing.table.TableRowSorter;
1212
import java.awt.*;
1313
import java.io.PrintWriter;
14+
import java.nio.charset.StandardCharsets;
1415
import java.util.ArrayList;
1516
import java.util.List;
1617
import java.util.Map;
@@ -623,7 +624,7 @@ private void loadRequestToEditor(int index) {
623624
currentRequestEditor.setText(requestEditors.get(index).getText());
624625
} else {
625626
IHttpRequestResponse msg = textMessages.get(index);
626-
String requestText = new String(msg.getRequest());
627+
String requestText = new String(msg.getRequest(), StandardCharsets.UTF_8);
627628
currentRequestEditor.setText(requestText);
628629
// 缓存
629630
while (requestEditors.size() <= index) {
@@ -789,7 +790,7 @@ private void sendWithInjectionMarks(ScanConfig config) {
789790
if (i < requestEditors.size() && requestEditors.get(i) != null) {
790791
markedRequest = requestEditors.get(i).getText();
791792
} else {
792-
markedRequest = new String(msg.getRequest());
793+
markedRequest = new String(msg.getRequest(), StandardCharsets.UTF_8);
793794
}
794795

795796
// 检查是否有标记
@@ -822,7 +823,7 @@ private void sendRequestToBackend(IHttpRequestResponse requestResponse, ScanConf
822823
int bodyOffset = requestInfo.getBodyOffset();
823824
String body = "";
824825
if (bodyOffset < request.length) {
825-
body = new String(request, bodyOffset, request.length - bodyOffset);
826+
body = new String(request, bodyOffset, request.length - bodyOffset, StandardCharsets.UTF_8);
826827
}
827828

828829
// 构建JSON payload

‎src/burpEx/legacy-api/src/main/java/com/sqlmapwebui/burp/dialogs/BatchInjectionMarkDialog.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import javax.swing.table.TableRowSorter;
1111
import java.awt.*;
1212
import java.io.PrintWriter;
13+
import java.nio.charset.StandardCharsets;
1314
import java.util.ArrayList;
1415
import java.util.List;
1516
import java.util.Map;
@@ -458,7 +459,7 @@ private void loadRequestToEditor(int index) {
458459
currentRequestEditor.setText(requestEditors.get(index).getText());
459460
} else {
460461
IHttpRequestResponse msg = textMessages.get(index);
461-
String requestText = new String(msg.getRequest());
462+
String requestText = new String(msg.getRequest(), StandardCharsets.UTF_8);
462463
currentRequestEditor.setText(requestText);
463464
// 缓存
464465
while (requestEditors.size() <= index) {
@@ -537,7 +538,7 @@ private void sendScan() {
537538
if (i < requestEditors.size() && requestEditors.get(i) != null) {
538539
markedRequest = requestEditors.get(i).getText();
539540
} else {
540-
markedRequest = new String(msg.getRequest());
541+
markedRequest = new String(msg.getRequest(), StandardCharsets.UTF_8);
541542
}
542543

543544
// 检查是否有标记

‎src/burpEx/montoya-api/src/main/java/com/sqlmapwebui/burp/BinaryContentDetector.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import java.util.Arrays;
77
import java.util.HashSet;
88
import java.util.Set;
9+
import java.nio.charset.StandardCharsets;
910

1011
/**
1112
* 二进制内容检测器
@@ -215,7 +216,8 @@ private static boolean containsBinaryInMultipart(byte[] body) {
215216
}
216217

217218
try {
218-
String bodyStr = new String(body);
219+
// 使用UTF-8编码解析body，避免编码问题
220+
String bodyStr = new String(body, StandardCharsets.UTF_8);
219221
// 简单检查：如果包含Content-Type: image/、video/、audio/、application/octet-stream等
220222
String lowerBody = bodyStr.toLowerCase();
221223
return lowerBody.contains("content-type: image/") ||

‎src/burpEx/montoya-api/src/main/java/com/sqlmapwebui/burp/HttpRequestUtils.java‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
package com.sqlmapwebui.burp;
2+
3+
import burp.api.montoya.http.message.requests.HttpRequest;
4+
import burp.api.montoya.core.ByteArray;
5+
6+
import java.nio.charset.StandardCharsets;
7+
8+
/**
9+
* HTTP请求处理工具类
10+
*
11+
* 解决 Burp Montoya API 默认使用 ISO-8859-1 编码导致的中文乱码问题。
12+
* 强制使用 UTF-8 编码来正确处理包含中文等非ASCII字符的请求。
13+
*/
14+
public class HttpRequestUtils {
15+
16+
/**
17+
* 获取请求体内容（UTF-8编码）
18+
*
19+
* 注意：Burp的 request.bodyToString() 可能使用 ISO-8859-1 编码，
20+
* 导致中文等 UTF-8 字符出现乱码。此方法强制使用 UTF-8 编码。
21+
*
22+
* @param request HTTP请求对象
23+
* @return UTF-8编码的请求体字符串
24+
*/
25+
public static String getBodyAsUtf8(HttpRequest request) {
26+
if (request == null) {
27+
return "";
28+
}
29+
30+
try {
31+
ByteArray body = request.body();
32+
if (body == null || body.length() == 0) {
33+
return "";
34+
}
35+
36+
byte[] bodyBytes = body.getBytes();
37+
return new String(bodyBytes, StandardCharsets.UTF_8);
38+
} catch (Exception e) {
39+
// 如果获取失败，回退到默认方法
40+
return request.bodyToString();
41+
}
42+
}
43+
44+
/**
45+
* 获取完整的HTTP请求内容（UTF-8编码）
46+
*
47+
* 注意：Burp的 request.toString() 可能使用 ISO-8859-1 编码，
48+
* 导致中文等 UTF-8 字符出现乱码。此方法强制使用 UTF-8 编码。
49+
*
50+
* @param request HTTP请求对象
51+
* @return UTF-8编码的完整HTTP请求字符串
52+
*/
53+
public static String getRequestAsUtf8(HttpRequest request) {
54+
if (request == null) {
55+
return "";
56+
}
57+
58+
try {
59+
ByteArray requestBytes = request.toByteArray();
60+
if (requestBytes == null || requestBytes.length() == 0) {
61+
return "";
62+
}
63+
64+
byte[] bytes = requestBytes.getBytes();
65+
return new String(bytes, StandardCharsets.UTF_8);
66+
} catch (Exception e) {
67+
// 如果获取失败，回退到默认方法
68+
return request.toString();
69+
}
70+
}
71+
}

‎src/burpEx/montoya-api/src/main/java/com/sqlmapwebui/burp/RequestDeduplicator.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -137,14 +137,15 @@ public static String generateFingerprint(HttpRequest request) {
137137
sb.append("query:").append(normalizedQuery).append("|");
138138

139139
// 7. Body参数 (对于POST/PUT等)
140-
String body = request.bodyToString();
140+
// 使用UTF-8编码获取body，避免中文乱码
141+
String body = HttpRequestUtils.getBodyAsUtf8(request);
141142
String normalizedBody = normalizeBody(body, getContentType(request));
142143
sb.append("body:").append(normalizedBody);
143144

144145
} catch (Exception e) {
145146
// 如果解析失败，使用原始URL和body的hash
146147
sb.append("raw:").append(request.url()).append("|");
147-
sb.append("body:").append(request.bodyToString());
148+
sb.append("body:").append(HttpRequestUtils.getBodyAsUtf8(request));
148149
}
149150

150151
// 生成MD5哈希作为指纹

‎src/burpEx/montoya-api/src/main/java/com/sqlmapwebui/burp/SqlmapContextMenuProvider.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,8 @@ private void sendRequestToBackend(HttpRequest request, ScanConfig config) {
263263
try {
264264
String url = request.url();
265265
String method = request.method();
266-
String body = request.bodyToString();
266+
// 使用UTF-8编码获取body，避免中文乱码
267+
String body = HttpRequestUtils.getBodyAsUtf8(request);
267268

268269
// 构建headers列表
269270
List<String> headersList = new ArrayList<>();

‎src/burpEx/montoya-api/src/main/java/com/sqlmapwebui/burp/dialogs/AdvancedScanConfigDialog.java‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -609,19 +609,15 @@ private void loadRequestToEditor(int index) {
609609
currentMarkCountLabel.setText("标记数: -");
610610
currentMarkCountLabel.setForeground(Color.GRAY);
611611
} else {
612-
// 从缓存加载或原始请求
613-
if (index < requestEditors.size() && requestEditors.get(index) != null) {
614-
currentRequestEditor.setText(requestEditors.get(index).getText());
615-
} else {
616-
HttpRequestResponse msg = textMessages.get(index);
617-
currentRequestEditor.setText(msg.request().toString());
618-
// 缓存
619-
while (requestEditors.size() <= index) {
620-
requestEditors.add(null);
621-
}
622-
JTextArea cached = new JTextArea(msg.request().toString());
623-
requestEditors.set(index, cached);
612+
// 使用UTF-8编码获取请求内容，避免中文乱码
613+
HttpRequestResponse msg = textMessages.get(index);
614+
currentRequestEditor.setText(HttpRequestUtils.getRequestAsUtf8(msg.request()));
615+
// 缓存
616+
while (requestEditors.size() <= index) {
617+
requestEditors.add(null);
624618
}
619+
JTextArea cached = new JTextArea(HttpRequestUtils.getRequestAsUtf8(msg.request()));
620+
requestEditors.set(index, cached);
625621
currentRequestEditor.setEditable(true);
626622
currentRequestEditor.setBackground(Color.WHITE);
627623
updateCurrentMarkCount();
@@ -779,7 +775,8 @@ private void sendWithInjectionMarks(ScanConfig config) {
779775
if (i < requestEditors.size() && requestEditors.get(i) != null) {
780776
markedRequest = requestEditors.get(i).getText();
781777
} else {
782-
markedRequest = msg.request().toString();
778+
// 使用UTF-8编码获取请求内容，避免中文乱码
779+
markedRequest = HttpRequestUtils.getRequestAsUtf8(msg.request());
783780
}
784781

785782
// 检查是否有标记
@@ -804,7 +801,8 @@ private void sendRequestToBackend(HttpRequest request, ScanConfig config, String
804801
try {
805802
String url = request.url();
806803
String method = request.method();
807-
String body = request.bodyToString();
804+
// 使用UTF-8编码获取body，避免中文乱码
805+
String body = HttpRequestUtils.getBodyAsUtf8(request);
808806

809807
// 构建headers列表
810808
List<String> headersList = new ArrayList<>();

‎src/burpEx/montoya-api/src/main/java/com/sqlmapwebui/burp/dialogs/BatchInjectionMarkDialog.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -449,13 +449,14 @@ private void loadRequestToEditor(int index) {
449449
if (index < requestEditors.size() && requestEditors.get(index) != null) {
450450
currentRequestEditor.setText(requestEditors.get(index).getText());
451451
} else {
452+
// 使用UTF-8编码获取请求内容，避免中文乱码
452453
HttpRequestResponse msg = textMessages.get(index);
453-
currentRequestEditor.setText(msg.request().toString());
454+
currentRequestEditor.setText(HttpRequestUtils.getRequestAsUtf8(msg.request()));
454455
// 缓存
455456
while (requestEditors.size() <= index) {
456457
requestEditors.add(null);
457458
}
458-
JTextArea cached = new JTextArea(msg.request().toString());
459+
JTextArea cached = new JTextArea(HttpRequestUtils.getRequestAsUtf8(msg.request()));
459460
requestEditors.set(index, cached);
460461
}
461462
currentRequestEditor.setEditable(true);
@@ -528,7 +529,8 @@ private void sendScan() {
528529
if (i < requestEditors.size() && requestEditors.get(i) != null) {
529530
markedRequest = requestEditors.get(i).getText();
530531
} else {
531-
markedRequest = msg.request().toString();
532+
// 使用UTF-8编码获取请求内容，避免中文乱码
533+
markedRequest = HttpRequestUtils.getRequestAsUtf8(msg.request());
532534
}
533535

534536
// 检查是否有标记

0 commit comments

Comments
 (0)