arachni 0.4.2 → 0.4.3

data/plugins/vector_feed.rb

@@ -68,7 +68,7 @@ class Arachni::Plugins::VectorFeed < Arachni::Plugin::Base
         page_buffer = []
         print_status "Imported #{feed.size} vectors."
         feed.each do |obj|
-            vector = obj.respond_to?( :value ) ? obj.value : obj
+            vector = (obj.respond_to?( :value ) ? obj.value : obj).symbolize_keys( false )
 
             begin
                 exception_jail{
@@ -104,24 +104,24 @@ class Arachni::Plugins::VectorFeed < Arachni::Plugin::Base
     end
 
     def page?( vector )
-        vector['type'] == 'page'
+        vector[:type] == 'page'
     end
 
     def page_from_body_vector( vector )
         Page.new(
-            code:             Integer( vector['code'] || 200 ),
-            url:              vector['url'] || framework.opts.url.to_s,
-            body:             vector['body'] || '',
-            response_headers: vector['headers'] || {}
+            code:             Integer( vector[:code] || 200 ),
+            url:              vector[:url]      || framework.opts.url.to_s,
+            body:             vector[:body]     || '',
+            response_headers: vector[:headers]  || {}
         )
     end
 
     def hash_to_element( vector )
         owner  = framework.opts.url.to_s
-        action = vector['action']
-        inputs = vector['inputs']
-        method = vector['method'] || 'get'
-        type   = vector['type'] || 'link'
+        action = vector[:action]
+        inputs = vector[:inputs]
+        method = vector[:method] || 'get'
+        type   = vector[:type]   || 'link'
 
         return if !inputs || inputs.empty?
 
@@ -147,7 +147,7 @@ class Arachni::Plugins::VectorFeed < Arachni::Plugin::Base
                     inputs: inputs
                 )
         end
-        (vector['skip'] || []).each { |i| e.immutables << i }
+        (vector[:skip] || []).each { |i| e.immutables << i }
         e
     end
 
@@ -214,7 +214,7 @@ class Arachni::Plugins::VectorFeed < Arachni::Plugin::Base
 
             },
             author:      'Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>',
-            version:     '0.1.2',
+            version:     '0.1.3',
             options:     [
                 Options::Base.new( 'vectors', [false, ' Vector array (for configuration over RPC).'] ),
                 Options::String.new( 'yaml_string', [false, 'A string of YAML serialized vectors (for configuration over RPC).'] ),

data/reports/html.rb

@@ -84,6 +84,7 @@ class Arachni::Reports::HTML < Arachni::Report::Base
 
         def format_issue( hash )
             idx, issue = find_issue_by_hash( hash )
+            return if !issue
             erb :issue, idx: idx, issue: issue
         end
 

data/spec/arachni/audit_store_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../spec_helper'
+require 'spec_helper'
 
 describe Arachni::AuditStore do
 

data/spec/arachni/component/manager_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Manager do
     before( :all ) do
@@ -128,32 +128,12 @@ describe Arachni::Component::Manager do
         end
 
         context 'when a component is not found' do
-            it 'raises an exception' do
+            it 'raises Arachni::Component::Error::NotFound' do
                 trigger = proc { @components.load :houa }
 
-                raised = false
-                begin
-                    trigger.call
-                rescue Arachni::Error
-                    raised = true
-                end
-                raised.should be_true
-
-                raised = false
-                begin
-                    trigger.call
-                rescue Arachni::Component::Error
-                    raised = true
-                end
-                raised.should be_true
-
-                raised = false
-                begin
-                    trigger.call
-                rescue Arachni::Component::Error::NotFound
-                    raised = true
-                end
-                raised.should be_true
+                expect { trigger.call }.to raise_error Arachni::Error
+                expect { trigger.call }.to raise_error Arachni::Component::Error
+                expect { trigger.call }.to raise_error Arachni::Component::Error::NotFound
             end
         end
     end
@@ -327,7 +307,7 @@ describe Arachni::Component::Manager do
         end
 
         context 'with invalid options' do
-            it 'raises an exception' do
+            it 'raises Arachni::Component::Options::Error::Invalid' do
                 trigger = proc do
                     begin
                         c = 'with_options'
@@ -338,37 +318,10 @@ describe Arachni::Component::Manager do
                     end
                 end
 
-                raised = false
-                begin
-                    trigger.call
-                rescue Arachni::Error
-                    raised = true
-                end
-                raised.should be_true
-
-                raised = false
-                begin
-                    trigger.call
-                rescue Arachni::Component::Error
-                    raised = true
-                end
-                raised.should be_true
-
-                raised = false
-                begin
-                    trigger.call
-                rescue Arachni::Component::Options::Error
-                    raised = true
-                end
-                raised.should be_true
-
-                raised = false
-                begin
-                    trigger.call
-                rescue Arachni::Component::Options::Error::Invalid
-                    raised = true
-                end
-                raised.should be_true
+                expect { trigger.call }.to raise_error Arachni::Error
+                expect { trigger.call }.to raise_error Arachni::Component::Error
+                expect { trigger.call }.to raise_error Arachni::Component::Options::Error
+                expect { trigger.call }.to raise_error Arachni::Component::Options::Error::Invalid
             end
         end
     end

data/spec/arachni/component/options/address_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Address do
     before( :all ) do

data/spec/arachni/component/options/base_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Base do
     before( :all ) do

data/spec/arachni/component/options/bool_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Bool do
     before( :all ) do

data/spec/arachni/component/options/enum_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Enum do
     before( :all ) do

data/spec/arachni/component/options/float_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Float do
     before( :all ) do

data/spec/arachni/component/options/int_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Int do
     before( :all ) do

data/spec/arachni/component/options/path_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Path do
     before( :all ) do

data/spec/arachni/component/options/port_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::Port do
     before( :all ) do

data/spec/arachni/component/options/string_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::String do
     before( :all ) do

data/spec/arachni/component/options/url_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Component::Options::URL do
     before( :all ) do

data/spec/arachni/element/base_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Element::Base do
     before( :all ) do
@@ -8,12 +8,23 @@ describe Arachni::Element::Base do
         @e = Arachni::Element::Base.new( @url, @raw )
     end
 
-    it 'should have the assigned URL' do
-        @e.url.should == @url
+    describe '#url' do
+        it 'returns the assigned URL' do
+            @e.url.should == @url
+        end
     end
 
-    it 'should have the assigned raw data' do
-        @e.raw.should == @raw
+    describe '#raw' do
+        it 'returns the raw data' do
+            @e.raw.should == @raw
+        end
+    end
+
+    describe '#platforms' do
+        it 'returns platforms for the given element' do
+            @e.action = @url
+            @e.platforms.should be_kind_of Arachni::Platform::Manager
+        end
     end
 
     describe '#url=' do

data/spec/arachni/element/body_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Element::BODY do
     describe 'Arachni::Element::BODY' do

data/spec/arachni/element/capabilities/auditable/rdiff_spec.rb

@@ -1,10 +1,10 @@
-require_relative '../../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Element::Capabilities::Auditable::RDiff do
 
     before :all do
-        @url     = server_url_for( :rdiff )
-        @auditor = Auditor.new
+        Arachni::Options.url = @url = web_server_url_for( :rdiff )
+        @auditor = Auditor.new( nil, Arachni::Framework.new )
     end
 
     describe '#rdiff_analysis' do
@@ -17,6 +17,13 @@ describe Arachni::Element::Capabilities::Auditable::RDiff do
             issues.clear
         end
 
+        context 'when the element action matches a skip rule' do
+            it 'returns false' do
+                auditable = Arachni::Element::Link.new( 'http://stuff.com/', @params )
+                auditable.rdiff_analysis( @opts ).should be_false
+            end
+        end
+
         context 'when response behavior suggests a vuln' do
             it 'logs an issue' do
                 auditable = Arachni::Element::Link.new( @url + '/true', @params )
@@ -38,6 +45,7 @@ describe Arachni::Element::Capabilities::Auditable::RDiff do
                 auditable.rdiff_analysis( @opts )
                 @auditor.http.run
                 @auditor.http.run
+
                 issues.should be_empty
             end
         end

data/spec/arachni/element/capabilities/auditable/taint_spec.rb

@@ -1,10 +1,10 @@
-require_relative '../../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Element::Capabilities::Auditable::Taint do
 
     before :all do
-        @url = server_url_for( :taint )
-        @auditor = Auditor.new
+        Arachni::Options.url = @url = web_server_url_for( :taint )
+        @auditor = Auditor.new( nil, Arachni::Framework.new )
 
         @positive = Arachni::Element::Link.new( @url, 'input' => '' )
         @positive.auditor = @auditor
@@ -22,6 +22,14 @@ describe Arachni::Element::Capabilities::Auditable::Taint do
             Arachni::Framework.reset
          end
 
+        context 'when the element action matches a skip rule' do
+            it 'returns false' do
+                auditable = Arachni::Element::Link.new( 'http://stuff.com/',
+                                                        { 'input' => '' } )
+                auditable.taint_analysis( @seed ).should be_false
+            end
+        end
+
         context 'when called with no opts' do
             it 'uses the defaults' do
                 @positive.taint_analysis( @seed )
@@ -30,6 +38,22 @@ describe Arachni::Element::Capabilities::Auditable::Taint do
             end
         end
 
+        context 'when the payloads are per platform' do
+            it 'assigns the platform of the payload to the issue' do
+                payloads = {
+                    windows: 'blah',
+                    php:     @seed,
+                }
+
+                @positive.taint_analysis( payloads, substring: @seed )
+                @auditor.http.run
+                issues.size.should == 1
+                issue = issues.first
+                issue.platform.should == :php
+                issue.platform_type.should == :languages
+            end
+        end
+
         context 'when called against non-vulnerable input' do
             it 'does not log an issue' do
                 @negative.taint_analysis( @seed )

data/spec/arachni/element/capabilities/auditable/timeout_spec.rb

@@ -1,10 +1,10 @@
-require_relative '../../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Element::Capabilities::Auditable::Timeout do
 
     before :all do
-        @url     = server_url_for( :timeout )
-        @auditor = Auditor.new
+        Arachni::Options.url = @url = web_server_url_for( :timeout )
+        @auditor = Auditor.new( nil, Arachni::Framework.new )
 
         inputs = { 'sleep' => '' }
 
@@ -52,6 +52,35 @@ describe Arachni::Element::Capabilities::Auditable::Timeout do
             issues.clear
         end
 
+        context 'when the element action matches a skip rule' do
+            it 'returns false' do
+                auditable = Arachni::Element::Link.new( 'http://stuff.com/',
+                                                        { 'input' => '' } )
+                auditable.timeout_analysis( '__TIME__', @timeout_opts.merge( timeout: 2000 ) ).should be_false
+            end
+        end
+
+        context 'when the payloads are per platform' do
+            it 'assigns the platform of the payload to the issue' do
+                payloads = {
+                    windows: '__TIME__',
+                    php:     'seed',
+                }
+
+                @positive.timeout_analysis( payloads,
+                    @timeout_opts.merge(
+                        timeout_divider: 1000,
+                        timeout: 2000
+                    )
+                )
+                @run.call
+
+                issue = issues.first
+                issue.platform.should == :windows
+                issue.platform_type.should == :os
+            end
+        end
+
         describe :timeout_divider do
             context 'when set' do
                 it 'modifies the final timeout value' do

data/spec/arachni/element/capabilities/mutable_spec.rb

@@ -1,4 +1,4 @@
-require_relative '../../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Element::Capabilities::Mutable do
     before( :all ) do

data/spec/arachni/element/cookie_spec.rb

@@ -1,10 +1,10 @@
-require_relative '../../spec_helper'
+require 'spec_helper'
 
 describe Arachni::Element::Cookie do
-    it_should_behave_like 'auditable', url: server_url_for( :cookie ), single_input: true
+    it_should_behave_like 'auditable', url: web_server_url_for( :cookie ), single_input: true
 
     before( :all ) do
-        @url = server_url_for( :cookie ) + '/'
+        @url = web_server_url_for( :cookie ) + '/'
         @raw = { 'mycookie' => 'myvalue' }
         @c = Arachni::Element::Cookie.new( @url, @raw )
         @http = Arachni::HTTP.instance
@@ -216,7 +216,7 @@ describe Arachni::Element::Cookie do
 
     describe '.from_file' do
         it 'parses a Netscape cookiejar file into an array of cookies' do
-            cookies =  Arachni::Element::Cookie.from_file( @url, spec_path + 'fixtures/cookies.txt' )
+            cookies =  Arachni::Element::Cookie.from_file( @url, fixtures_path + 'cookies.txt' )
             cookies.size.should == 4
 
             cookie = cookies.shift
@@ -363,11 +363,25 @@ describe Arachni::Element::Cookie do
             c1.name.should == 'SomeCookie'
             c1.value.should == 'MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA=='
 
-            sc3 = "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly"
+            sc3 = "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/stuff; Domain=.foo.com; HttpOnly"
             cookies = Arachni::Element::Cookie.from_set_cookie( 'http://test.com', sc3 )
             cookies.size.should == 1
-            cookies.first.name.should == 'coo@ki e2'
-            cookies.first.value.should == 'blah val2@'
+            cookie = cookies.first
+            cookie.name.should == 'coo@ki e2'
+            cookie.value.should == 'blah val2@'
+            cookie.path.should == '/stuff'
+        end
+
+        context 'when there is no path' do
+            it 'reverts to \'/\'' do
+                sc3 = "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=.foo.com; HttpOnly"
+                cookies = Arachni::Element::Cookie.from_set_cookie( 'http://test.com/stuff', sc3 )
+                cookies.size.should == 1
+                cookie = cookies.first
+                cookie.name.should == 'coo@ki e2'
+                cookie.value.should == 'blah val2@'
+                cookie.path.should == '/'
+            end
         end
     end