arachni 1.0.6 → 1.1

data/lib/arachni/element/json/capabilities/inputtable.rb

@@ -0,0 +1,139 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class JSON
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::Inputtable} with {JSON}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Inputtable
+    include Arachni::Element::Capabilities::Inputtable
+
+    # Overrides {Arachni::Element::Capabilities::Inputtable#inputs=} to allow
+    # for non-string data of variable depth.
+    #
+    # @param    (see Arachni::Element::Capabilities::Inputtable#inputs=)
+    # @return   (see Arachni::Element::Capabilities::Inputtable#inputs=)
+    # @raise    (see Arachni::Element::Capabilities::Inputtable#inputs=)
+    #
+    # @see  Arachni::Element::Capabilities::Inputtable#inputs=
+    def inputs=( h )
+        h = h.my_stringify_keys
+
+        @inputs = h
+        update h
+        @inputs.freeze
+        self.inputs
+    end
+
+    # Overrides {Capabilities::Inputtable#[]} to allow for non-string data
+    # of variable depth.
+    #
+    # @param    [Array<String>, String]    name
+    #   Name of the input whose value to retrieve.
+    #
+    #   If the `name` is an `Array`, it will be treated as a path to the location
+    #   of the input.
+    #
+    # @return   [Object]
+    #
+    # @see  Capabilities::Inputtable#[]
+    def []( name )
+        key, data = find( name )
+        data[key]
+    end
+
+    # Overrides {Capabilities::Inputtable#[]=} to allow for non-string data
+    # of variable depth.
+    #
+    # @param    [Array<String>, String]    name
+    #   Name of the input whose value to set.
+    #
+    #   If the `name` is an `Array`, it will be treated as a path to the location
+    #   of the input.
+    # @param    [Object]    value
+    #   Value to set.
+    #
+    # @return   [Object]
+    #   `value`
+    #
+    # @see  Capabilities::Inputtable#[]=
+    def []=( name, value )
+        @inputs = @inputs.dup
+        key, data = find( name )
+
+        fail_if_invalid( [key].flatten.last, value )
+
+        data[key] = value
+        @inputs.freeze
+        value
+    end
+
+    # Overrides {Capabilities::Inputtable#update} to allow for non-string data
+    # of variable depth.
+    #
+    # @param    (see Capabilities::Inputtable#update)
+    # @return   (see Capabilities::Inputtable#update)
+    # @raise    (see Capabilities::Inputtable#update)
+    #
+    # @see  Capabilities::Inputtable#update
+    def update( hash )
+        traverse_data hash do |path, value|
+            self[path] = value
+        end
+        self
+    end
+
+    private
+
+    def find( path )
+        data = @inputs
+        path = [path].flatten
+
+        while path.size > 1
+            k = path.shift
+            k = k.to_s if k.is_a? Symbol
+
+            data = data[k]
+        end
+
+        k = path.shift
+        k = k.to_s if k.is_a? Symbol
+
+        [k, data]
+    end
+
+    def traverse_inputs( &block )
+        traverse_data( @inputs, &block )
+    end
+
+    def traverse_data( data, path = [], &handler )
+        case data
+            when Hash
+                data.each do |k, v|
+                    traverse_data( v, path + [k], &handler )
+                end
+
+            when Array
+                data.each.with_index do |v, i|
+                    traverse_data( v, path + [i], &handler )
+                end
+
+            else
+                handler.call path, data
+        end
+    end
+
+end
+
+end
+end
+end

data/lib/arachni/element/json/capabilities/mutable.rb

@@ -0,0 +1,121 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class JSON
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::Mutable} with {JSON}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Mutable
+    include Arachni::Element::Capabilities::Mutable
+
+    # Overrides {Arachni::Element::Capabilities::Mutable#affected_input_name=}
+    # to allow for non-string data of variable depth.
+    #
+    # @param    [Array<String>, String]    name
+    #   Sets the name of the fuzzed input.
+    #
+    #   If the `name` is an `Array`, it will be treated as a path to the location
+    #   of the input.
+    #
+    # @see  Capabilities::Mutable#affected_input_name=
+    def affected_input_name=( name )
+        if name.is_a?( Array ) && name.size == 1
+            name = name.first
+        end
+
+        @affected_input_name = name
+    end
+
+    # @note (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    #
+    # Overrides {Arachni::Element::Capabilities::Mutable#each_mutation} to allow
+    # for auditing of non-string data of variable depth.
+    #
+    # @param    (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    # @yield    (see Arachni::Element::Capabilities::Mutable#each_mutation)
+    #
+    # @see  Arachni::Element::Capabilities::Mutable#each_mutation
+    def each_mutation( payload, options = {}, &block )
+        return if self.inputs.empty?
+
+        if !valid_input_data?( payload )
+            print_debug_level_2 "Payload not supported by #{self}: #{payload.inspect}"
+            return
+        end
+
+        print_debug_trainer( options )
+        print_debug_formatting( options )
+
+        options   = prepare_mutation_options( options )
+        generated = Arachni::Support::LookUp::HashSet.new( hasher: :mutable_id )
+
+        if options[:parameter_values]
+            options[:format].each do |format|
+                traverse_inputs do |path, value|
+                    next if immutable_input?( path )
+
+                    create_and_yield_if_unique( generated, {}, payload, path,
+                                                format_str( payload, format, value.to_s ), format, &block
+                    )
+                end
+            end
+        end
+
+        if options[:with_extra_parameter]
+            if valid_input_name?( EXTRA_NAME )
+                each_formatted_payload( payload, options[:format] ) do |format, formatted_payload|
+                    elem                     = self.dup
+                    elem.affected_input_name = EXTRA_NAME
+                    elem.inputs              =
+                        elem.inputs.merge( EXTRA_NAME => formatted_payload )
+                    elem.seed                = payload
+                    elem.format              = format
+
+                    yield_if_unique( elem, generated, &block )
+                end
+            else
+                print_debug_level_2 'Extra name not supported as input name by' <<
+                                        " #{audit_id}: #{payload.inspect}"
+            end
+        end
+
+        if options[:parameter_names]
+            if valid_input_name_data?( payload )
+                elem                     = self.dup
+                elem.affected_input_name = FUZZ_NAME
+                elem.inputs              = elem.inputs.merge( payload => FUZZ_NAME_VALUE )
+                elem.seed                = payload
+
+                yield_if_unique( elem, generated, &block )
+            else
+                print_debug_level_2 'Payload not supported as input name by' <<
+                                        " #{audit_id}: #{payload.inspect}"
+            end
+        end
+
+        nil
+    end
+
+    private
+
+    def immutable_input?( path )
+        [path].flatten.each do |name|
+            return true if immutables.include?( name )
+        end
+        false
+    end
+
+end
+
+end
+end
+end

data/lib/arachni/element/link.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -7,7 +7,6 @@
 =end
 
 require_relative 'base'
-require_relative 'capabilities/with_node'
 
 module Arachni::Element
 
@@ -17,10 +16,18 @@ module Arachni::Element
 class Link < Base
     require_relative 'link/dom'
 
-    include Capabilities::WithNode
+    # Load and include all link-specific capability overrides.
+    lib = "#{File.dirname( __FILE__ )}/#{File.basename(__FILE__, '.rb')}/capabilities/**/*.rb"
+    Dir.glob( lib ).each { |f| require f }
+
+    # Generic element capabilities.
+    include Arachni::Element::Capabilities::Analyzable
+    include Arachni::Element::Capabilities::Refreshable
+
+    # Link-specific overrides.
     include Capabilities::WithDOM
-    include Capabilities::Analyzable
-    include Capabilities::Refreshable
+    include Capabilities::Submittable
+    include Capabilities::Auditable
 
     # @param    [Hash]    options
     # @option   options [String]    :url
@@ -37,33 +44,12 @@ class Link < Base
         @default_inputs = self.inputs.dup.freeze
     end
 
-    # @return   [DOM]
-    def dom
-        return @dom if @dom
-        return if !dom_data
-
-        super
-    end
-
     # @return   [Hash]
     #   Simple representation of self in the form of `{ {#action} => {#inputs} }`.
     def simple
         { self.action => self.inputs }
     end
 
-    # @note Will {Arachni::Options.rewrite} the `url`.
-    # @note Will update the {#inputs} from the URL query.
-    #
-    # @param   (see Capabilities::Submittable#action=)
-    #
-    # @return  (see Capabilities::Submittable#action=)
-    def action=( url )
-        rewritten   = uri_parse( url ).rewrite
-        self.inputs = rewritten.query_parameters.merge( self.inputs || {} )
-
-        super rewritten.without_query
-    end
-
     # @return   [String]
     #   Absolute URL with a merged version of {#action} and {#inputs} as a query.
     def to_s
@@ -98,10 +84,6 @@ class Link < Base
         self.class.decode( *args )
     end
 
-    def coverage_id
-        dom_data ? "#{super}:#{dom_data[:inputs].keys.sort}" : super
-    end
-
     def id
         dom_data ? "#{super}:#{dom_data[:inputs].sort_by { |k,_| k }}" : super
     end
@@ -150,13 +132,13 @@ class Link < Base
                 new(
                     url:    url.freeze,
                     action: href.freeze,
-                    html:   link.to_html.freeze
+                    source: link.to_html.freeze
                 )
             end.compact
         end
 
         def encode_query_params( param )
-            encode( encode( param ), '=' )
+            encode( encode( param.recode ), '=' )
         end
 
         def encode( *args )
@@ -171,14 +153,6 @@ class Link < Base
 
     private
 
-    def dom_data
-        return @dom_data if @dom_data
-        return if @dom_data == false
-        return if !node
-
-        @dom_data ||= (DOM.data_from_node( node ) || false)
-    end
-
     def http_request( opts, &block )
         self.method != :get ?
             http.post( self.action, opts, &block ) :

data/lib/arachni/element/link/capabilities/auditable.rb

@@ -0,0 +1,27 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Link
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::Auditable} with {Link}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Auditable
+    include Arachni::Element::Capabilities::Auditable
+
+    def coverage_id
+        dom_data ? "#{super}:#{dom_data[:inputs].keys.sort}" : super
+    end
+
+end
+end
+end
+end

data/lib/arachni/element/link/capabilities/submittable.rb

@@ -0,0 +1,37 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Link
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::Submittable} with {Link}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module Submittable
+    include Arachni::Element::Capabilities::Submittable
+
+    # @note Will {Arachni::Options.rewrite} the `url`.
+    # @note Will update the {#inputs} from the URL query.
+    #
+    # @param   (see Arachni::Element::Capabilities::Submittable#action=)
+    #
+    # @return  (see Arachni::Element::Capabilities::Submittable#action=)
+    def action=( url )
+        rewritten   = uri_parse( url ).rewrite
+        self.inputs = rewritten.query_parameters.merge( self.inputs || {} )
+
+        super rewritten.without_query
+    end
+
+end
+end
+end
+end
+

data/lib/arachni/element/link/capabilities/with_dom.rb

@@ -0,0 +1,43 @@
+=begin
+    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+module Arachni::Element
+class Link
+module Capabilities
+
+# Extends {Arachni::Element::Capabilities::WithDOM} with {Link}-specific
+# functionality.
+#
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+module WithDOM
+    include Arachni::Element::Capabilities::WithNode
+    include Arachni::Element::Capabilities::WithDOM
+
+    # @return   [DOM]
+    def dom
+        return @dom if @dom
+        return if !dom_data
+
+        super
+    end
+
+    private
+
+    def dom_data
+        return @dom_data if @dom_data
+        return if @dom_data == false
+        return if !node
+
+        @dom_data ||= (self.class::DOM.data_from_node( node ) || false)
+    end
+
+end
+
+end
+end
+end