arachni 0.4.5.2 → 0.4.6

data/spec/arachni/rpc/server/dispatcher_spec.rb

@@ -47,6 +47,13 @@ describe Arachni::RPC::Server::Dispatcher do
     end
 
     describe '#dispatch' do
+        context 'when Options#rpc_external_address has been set' do
+            it 'advertises that address' do
+                address = '9.9.9.9'
+                dispatcher = dispatcher_light_spawn( rpc_external_address: address )
+                dispatcher.dispatch['url'].should start_with "#{address}:"
+            end
+        end
         context 'when not a Grid member' do
             it 'returns valid Instance info' do
                 info = dispatcher_light_spawn.dispatch
@@ -197,6 +204,14 @@ describe Arachni::RPC::Server::Dispatcher do
             stats['node'].delete( 'score' ).should == dispatcher.workload_score
             stats['node'].keys.should == @node_info_keys
         end
+
+        context 'when Options#rpc_external_address has been set' do
+            it 'advertises that address' do
+                address = '9.9.9.9'
+                dispatcher = dispatcher_light_spawn( rpc_external_address: address )
+                dispatcher.stats['node']['url'].should start_with "#{address}:"
+            end
+        end
     end
 
     describe '#log' do

data/spec/arachni/ruby/array_spec.rb

@@ -73,6 +73,17 @@ describe Array do
         end
     end
 
+    describe '#recode' do
+        it 'recursively converts String data to UTF8' do
+            recoded = [
+                "\xE2\x9C\x93",
+                [ "\xE2\x9C\x93" ]
+            ].recode
+            recoded.first.should == "\u2713"
+            recoded.last.should == ["\u2713"]
+        end
+    end
+
     describe '#chunk' do
         it 'splits the array into chunks' do
             chunks = @arr.chunk( 5 )

data/spec/arachni/ruby/hash_spec.rb

@@ -44,7 +44,7 @@ describe Hash do
 
     describe '#symbolize_keys' do
         it 'recursively converts keys to symbols' do
-            with_strings.symbolize_keys.should ==with_symbols
+            with_strings.symbolize_keys.should == with_symbols
         end
 
         context 'when the recursive is set to false' do
@@ -61,10 +61,37 @@ describe Hash do
         end
     end
 
+    describe '#recode' do
+        it 'recursively converts String data to UTF8' do
+            recoded = {
+                blah: "\xE2\x9C\x93",
+                blah2: {
+                    blah3: "\xE2\x9C\x93"
+                }
+            }.recode
+            recoded[:blah].should == "\u2713"
+            recoded[:blah2][:blah3].should == "\u2713"
+        end
+    end
+
     describe '#downcase' do
         it 'converts keys and values to lower-case strings' do
             { Stuff: 'VaLue', 'BlAh' => 'VaLUe 2' }.downcase.should ==
                 { 'stuff' => 'value', 'blah' => 'value 2' }
         end
     end
+
+    describe '#find_symbol_keys_recursively' do
+        it 'returns all symbol keys from self and children hashes' do
+            {
+                stuff: 'VaLue',
+                stuff2: {
+                    stuff3: {
+                        stuff4: 'Blah'
+                    }
+                }
+            }.find_symbol_keys_recursively.sort.should ==
+                [:stuff, :stuff2, :stuff3, :stuff4].sort
+        end
+    end
 end

data/spec/arachni/ruby/string_spec.rb

@@ -16,19 +16,21 @@ describe String do
             END
 
             str.rdiff( str2 ).should == "                This is the  test.\n" +
-                "                Not really sure what else to put here"
+                '                Not really sure what else to put here'
         end
     end
 
     describe '#diff_ratio' do
         context 'when the strings are identical' do
             it 'returns 0.0' do
+                ''.diff_ratio( '' ).should == 0
                 'test'.diff_ratio( 'test' ).should == 0
                 'test this'.diff_ratio( 'test this' ).should == 0
             end
         end
         context 'when the strings completely different' do
             it 'returns 1.0' do
+                ''.diff_ratio( 'toast' ).should == 1
                 'test'.diff_ratio( 'toast' ).should == 1
                 'test this'.diff_ratio( 'toast that' ).should == 1
             end
@@ -106,4 +108,15 @@ describe String do
         end
     end
 
+    describe '#longest_word' do
+        it 'returns the longest word' do
+            'o tw longest'.longest_word.should == 'longest'
+        end
+    end
+
+    describe '#shortest_word' do
+        it 'returns the longest word' do
+            'o tw longest'.shortest_word.should == 'o'
+        end
+    end
 end

data/spec/arachni/session_spec.rb

@@ -259,6 +259,45 @@ describe Arachni::Session do
     end
 
     describe '#ensure_logged_in' do
+        context 'when the login is successful' do
+            it 'returns true' do
+                s = new_session
+                s.set_login_check @url + '/with_nonce', 'logged-in user'
+                s.login_form = s.find_login_form( url: @url + '/nonce_login' ).
+                    update( username: 'nonce_john', password: 'nonce_doe' )
+
+                s.logged_in?.should be_false
+                s.ensure_logged_in
+                s.logged_in?.should be_true
+            end
+        end
+
+        context 'when the login fails' do
+            it 'returns false' do
+                s = new_session
+                s.set_login_check @url + '/with_nonce', 'logged-in user'
+                s.login_form = s.find_login_form( url: @url + '/nonce_login' ).
+                    update( username: '1', password: '2' )
+
+                s.logged_in?.should be_false
+                s.ensure_logged_in
+                s.logged_in?.should be_false
+            end
+        end
+
+        context 'when the login attempt fails' do
+            it 'retries 5 times' do
+                s = new_session
+                s.set_login_check @url, 'logged-in user'
+                s.login_form = s.find_login_form( url: @url + '/disappearing_login' ).
+                    update( username: 'john', password: 'doe' )
+
+                s.logged_in?.should be_false
+                s.ensure_logged_in
+                s.logged_in?.should be_true
+            end
+        end
+
         context 'when there is no login capability' do
             it 'returns nil' do
                 s = new_session

data/spec/arachni/spider_spec.rb

@@ -191,11 +191,30 @@ describe Arachni::Spider do
         end
 
         context 'Options.exclude_pages' do
-            it 'skips pages which match the configured patterns' do
-                @opts.exclude_pages = /skip me/i
-                @opts.url = @url + '/skip'
+            it 'skips pages which match the configured patterns (but not the seed URL)' do
+                @opts.exclude_pages = /skip-me/i
+                @opts.url = "#{@url}skip"
 
-                Arachni::Spider.new.run.should be_empty
+                Arachni::Spider.new.run.should == [@opts.url, "#{@url}follow-me"]
+            end
+        end
+
+        context 'Options.exclude' do
+            it 'skips paths which match the configured patterns (but not the seed URL)' do
+                @opts.exclude = /skip-me/i
+                @opts.url = "#{@url}skip"
+
+                Arachni::Spider.new.run.should == [@opts.url, "#{@url}follow-me"]
+            end
+        end
+
+        context 'Options.include' do
+            it 'skips paths which do not match the configured patterns (but not the seed URL)' do
+                @opts.include = /include-me/i
+                @opts.url = "#{@url}include"
+
+                Arachni::Spider.new.run.sort.should ==
+                    [@opts.url, "#{@url}include-me/1", "#{@url}include-me/2"].sort
             end
         end
 
@@ -425,16 +444,6 @@ describe Arachni::Spider do
                 end
             end
         end
-
-        #context 'when called after the crawl has finished' do
-        #    it 'should wake the crawler up after pushing the new paths' do
-        #        s = Arachni::Spider.new
-        #        s.run
-        #        s.done?.should be_true
-        #        s.push( '/a_pushed_path' )
-        #        s.done?.should be_false
-        #    end
-        #end
     end
 
     describe '#done?' do

data/spec/arachni/{module → support}/key_filler.rb

@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe Arachni::Module::KeyFiller do
+describe Arachni::Support::KeyFiller do
 
     describe '#fill' do
         it 'fills in all inputs with appropriate seed values' do
@@ -29,7 +29,7 @@ describe Arachni::Module::KeyFiller do
             }
         end
 
-        context 'when there is a default value' do
+        context 'when there is a value' do
             it 'skips it' do
                 with_values = {
                     'stuff' => 'blah'
@@ -37,6 +37,24 @@ describe Arachni::Module::KeyFiller do
                 described_class.fill( with_values ) == with_values
             end
         end
+
+        context 'when no match is found' do
+            it 'uses "1"' do
+                with_values = {
+                    'stuff' => ''
+                }
+                described_class.fill( with_values )['stuff'] == '1'
+            end
+
+            context 'and a default value has been provided' do
+                it 'uses it' do
+                    with_values = {
+                        'stuff' => ''
+                    }
+                    described_class.fill( with_values, 'myval' )['stuff'] == 'myval'
+                end
+            end
+        end
     end
 
 end

data/spec/arachni/support/signature_spec.rb

@@ -0,0 +1,158 @@
+require 'spec_helper'
+
+describe Arachni::Support::Signature do
+    def string_with_noise
+        <<-END
+                This #{rand(999999)} is a test.
+                Not #{rand(999999)} really sure what #{rand(999999)} else to put here...
+                #{rand(999999)}
+        END
+    end
+
+    def different_string_with_noise
+        <<-END
+                This #{rand(999999)} is a different test.
+        END
+    end
+
+    let(:signature) { described_class.new( string_with_noise ) }
+
+    describe '#initialize' do
+        describe 'option' do
+            describe :threshold do
+                it 'sets the maximum difference in tokens when performing comparisons' do
+                    seed1 = 'test this here 1'
+                    seed2 = 'test that here 2'
+
+                    s  = described_class.new( seed1, threshold: 1 )
+                    s1 = described_class.new( seed2 )
+                    s.should_not be_similar s1
+
+                    s  = described_class.new( seed1, threshold: 2 )
+                    s1 = described_class.new( seed2 )
+                    s.should_not be_similar s1
+
+                    s  = described_class.new( seed1, threshold: 5 )
+                    s1 = described_class.new( seed2 )
+                    s.should be_similar s1
+
+                    s  = described_class.new( seed1, threshold: 6 )
+                    s1 = described_class.new( seed2 )
+                    s.should be_similar s1
+                end
+
+                context 'when not a number' do
+                    it 'raises ArgumentError' do
+                        expect do
+                            described_class.new( 'test', threshold: 'stuff' )
+                        end.to raise_error ArgumentError
+                    end
+                end
+            end
+        end
+    end
+
+    describe '#refine' do
+        it 'removes noise from the signature' do
+            string_with_noise.should_not == string_with_noise
+
+            signature1 = described_class.new( string_with_noise )
+
+            10.times{ signature1 = signature1.refine( string_with_noise ) }
+
+            signature2 = described_class.new( string_with_noise )
+            10.times{ signature2 = signature2.refine( string_with_noise ) }
+
+            signature1.should == signature2
+        end
+
+        it 'returns a new signature instance' do
+            signature1 = described_class.new( string_with_noise )
+            signature1.refine( string_with_noise ).object_id.should_not == signature1.object_id
+        end
+    end
+
+    describe '#refine!' do
+        it 'destructively removes noise from the signature' do
+            string_with_noise.should_not == string_with_noise
+
+            signature1 = described_class.new( string_with_noise )
+            10.times{ signature1.refine!( string_with_noise ) }
+
+            signature2 = described_class.new( string_with_noise )
+            10.times{ signature2.refine!( string_with_noise ) }
+
+            signature1.should == signature2
+        end
+
+        it 'returns self' do
+            signature = described_class.new( string_with_noise )
+            signature.refine!( string_with_noise ).object_id.should == signature.object_id
+        end
+    end
+
+    describe '#distance' do
+        it 'returns the Levenshtein distance between signature tokens' do
+            signature1 = described_class.new( string_with_noise )
+            signature2 = described_class.new( string_with_noise )
+            signature3 = described_class.new( different_string_with_noise )
+            signature4 = described_class.new( different_string_with_noise )
+
+            signature1.distance( signature2 ).should == 4
+            signature2.distance( signature2 ).should == 0
+
+            signature3.distance( signature4 ).should == 1
+            signature4.distance( signature4 ).should == 0
+            signature1.distance( signature3 ).should == 93
+        end
+    end
+
+    describe '#differences' do
+        it 'returns amount of differences between signature tokens' do
+            signature1 = described_class.new( string_with_noise )
+            signature2 = described_class.new( string_with_noise )
+            signature3 = described_class.new( different_string_with_noise )
+            signature4 = described_class.new( different_string_with_noise )
+
+            signature1.differences( signature2 ).should == 8
+            signature2.differences( signature2 ).should == 0
+
+            signature3.differences( signature4 ).should == 2
+            signature4.differences( signature4 ).should == 0
+            signature1.differences( signature3 ).should == 14
+        end
+    end
+
+    describe '#==' do
+        context 'when the signature are identical' do
+            it 'returns true' do
+                signature1 = described_class.new( string_with_noise )
+                10.times{ signature1.refine!( string_with_noise ) }
+
+                signature2 = described_class.new( string_with_noise )
+                10.times{ signature2.refine!( string_with_noise ) }
+
+                signature1.should == signature2
+            end
+        end
+
+        context 'when the signature are not identical' do
+            it 'returns false' do
+                signature1 = described_class.new( string_with_noise )
+                10.times{ signature1.refine!( string_with_noise ) }
+
+                signature2 = described_class.new( different_string_with_noise )
+                10.times{ signature2.refine!( different_string_with_noise ) }
+
+                signature1.should_not == signature2
+            end
+        end
+    end
+
+    describe '#dup' do
+        it 'returns a duplicate instance' do
+            signature.dup.should == signature
+            signature.dup.object_id.should_not == signature.object_id
+        end
+    end
+end

data/spec/arachni/trainer_spec.rb

@@ -64,6 +64,37 @@ describe Arachni::Trainer do
         @trainer   = @framework.trainer
     end
 
+    context 'when Options.fingerprint? is' do
+        context true do
+            it 'fingerprints the page' do
+                Arachni::Options.no_fingerprinting = false
+                Arachni::Options.fingerprint?.should be_true
+
+                @framework.pages.should be_empty
+
+                Arachni::HTTP.request( @url + '/fingerprint', train: true )
+                @framework.run
+
+                @framework.pages.size.should == 1
+                @framework.pages.first.platforms.to_a.should == [:php]
+            end
+        end
+
+        context false do
+            it 'does not fingerprint the page' do
+                Arachni::Options.no_fingerprinting = true
+                Arachni::Options.fingerprint?.should be_false
+
+                @framework.pages.should be_empty
+
+                Arachni::HTTP.request( @url + '/fingerprint', train: true )
+                @framework.run
+
+                @framework.pages.should be_empty
+            end
+        end
+    end
+
     describe 'HTTP requests with "train" set to' do
         describe 'nil' do
             it 'skips the Trainer' do