arachni 1.0.6 → 1.1

data/spec/arachni/framework/parts/audit_spec.rb

@@ -184,12 +184,19 @@ describe Arachni::Framework::Parts::Audit do
 
                 f.audit_page page
 
-                responses.sort.should ==
+                responses.should ==
                     %w(http://localhost/test3 http://localhost/test
-                        http://localhost/test2).sort
+                        http://localhost/test2)
             end
         end
 
+        it 'passes the page to #apply_dom_metadata' do
+            page = Arachni::Page.from_url( @url + '/link' )
+
+            subject.should receive(:apply_dom_metadata).with(page)
+            subject.audit_page( page )
+        end
+
         context 'when checks were' do
             context 'ran against the page' do
                 it 'returns true' do
@@ -215,7 +222,7 @@ describe Arachni::Framework::Parts::Audit do
 
                     f.audit_page( Arachni::Page.from_url( @url + '/with_javascript' ) )
 
-                    sleep 0.1 while f.wait_for_browser?
+                    sleep 0.1 while f.wait_for_browser_cluster?
 
                     f.page_queue_total_size.should > 0
                 end
@@ -231,7 +238,7 @@ describe Arachni::Framework::Parts::Audit do
 
                     f.audit_page( Arachni::Page.from_url( @url + '/with_javascript' ) )
 
-                    sleep 0.1 while f.wait_for_browser?
+                    sleep 0.1 while f.wait_for_browser_cluster?
 
                     f.url_queue_total_size.should == 2
                 end
@@ -247,7 +254,7 @@ describe Arachni::Framework::Parts::Audit do
                         f.options.scope.dom_depth_limit = 1
                         f.url_queue_total_size.should == 0
                         f.audit_page( Arachni::Page.from_url( @url + '/with_javascript' ) ).should be_true
-                        sleep 0.1 while f.wait_for_browser?
+                        sleep 0.1 while f.wait_for_browser_cluster?
                         f.url_queue_total_size.should == 2
 
                         f.reset
@@ -261,7 +268,7 @@ describe Arachni::Framework::Parts::Audit do
                         page.dom.push_transition Arachni::Page::DOM::Transition.new( :page, :load )
 
                         f.audit_page( page ).should be_true
-                        sleep 0.1 while f.wait_for_browser?
+                        sleep 0.1 while f.wait_for_browser_cluster?
                         f.url_queue_total_size.should == 0
                     end
                 end

data/spec/arachni/framework/parts/browser_spec.rb

@@ -4,23 +4,289 @@ describe Arachni::Framework::Parts::Browser do
     include_examples 'framework'
 
     describe '#browser_cluster' do
-        it "returns #{Arachni::BrowserCluster}" do
-            subject.browser_cluster.should be_kind_of Arachni::BrowserCluster
+        context 'when #use_browsers? is' do
+            context true do
+                before do
+                    subject.stub(:use_browsers?) { true }
+                end
+
+                it "returns #{Arachni::BrowserCluster}" do
+                    subject.browser_cluster.should be_kind_of Arachni::BrowserCluster
+                end
+            end
+
+            context false do
+                before do
+                    subject.stub(:use_browsers?) { false }
+                end
+
+                it 'returns nil' do
+                    subject.browser_cluster.should be_nil
+                end
+            end
+        end
+    end
+
+    describe '#use_browsers?' do
+        context "when #{Arachni::OptionGroups::BrowserCluster}#pool_size is" do
+            context 0 do
+                before do
+                    subject.options.browser_cluster.pool_size = 0
+                end
+
+                it 'returns false' do
+                    subject.use_browsers?.should be_false
+                end
+            end
+
+            context '> 0' do
+                before do
+                    subject.options.browser_cluster.pool_size = 1
+                end
+
+                it 'returns true' do
+                    subject.use_browsers?.should be_true
+                end
+            end
         end
 
-        context "when #{Arachni::OptionGroups::BrowserCluster}#pool_size" do
-            it 'returns nil' do
-                subject.options.browser_cluster.pool_size = 0
-                subject.browser_cluster.should be_nil
+        context "when #{Arachni::OptionGroups::Scope}#dom_depth_limit is" do
+            context 0 do
+                before do
+                    subject.options.scope.dom_depth_limit = 0
+                end
+
+                it 'returns false' do
+                    subject.use_browsers?.should be_false
+                end
+            end
+
+            context '> 0' do
+                before do
+                    subject.options.scope.dom_depth_limit = 1
+                end
+
+                it 'returns true' do
+                    subject.use_browsers?.should be_true
+                end
             end
         end
 
-        context "when #{Arachni::OptionGroups::Scope}#dom_depth_limit" do
-            it 'returns nil' do
-                subject.options.scope.dom_depth_limit = 0
-                subject.browser_cluster.should be_nil
+        context 'when #host_has_browser? is' do
+            context true do
+                before do
+                    subject.stub(:use_browsers?) { true }
+                end
+
+                it 'returns true' do
+                    subject.use_browsers?.should be_true
+                end
+            end
+
+            context false do
+                before do
+                    subject.stub(:host_has_browser?) { false }
+                end
+
+                it 'returns false' do
+                    subject.use_browsers?.should be_false
+                end
             end
         end
     end
 
+    describe '#host_has_browser?' do
+        context "when #{Arachni::Browser}.has_executable? is" do
+            context true do
+                before do
+                    Arachni::Browser.stub(:has_executable?) { true }
+                end
+
+                it 'returns true' do
+                    subject.host_has_browser?.should be_true
+                end
+            end
+
+            context false do
+                before do
+                    Arachni::Browser.stub(:has_executable?) { false }
+                end
+
+                it 'returns false' do
+                    subject.host_has_browser?.should be_false
+                end
+            end
+        end
+    end
+
+    describe '#apply_dom_metadata' do
+        let(:page) { Factory[:page] }
+        let(:browser_page) { Factory[:page] }
+        let(:check) { subject.checks[:taint] }
+
+        before do
+            subject.checks.load :taint
+
+            subject.browser.stub(:to_page) { browser_page }
+            Arachni::Check::Auditor.stub(:check?) { true }
+            page.stub(:has_script?) { true }
+            page.dom.stub(:depth) { 0 }
+        end
+
+        it 'returns true' do
+            subject.apply_dom_metadata( page ).should be_true
+        end
+
+        it 'applies DOM metadata' do
+            page.should receive(:import_metadata).with( browser_page, :skip_dom )
+
+            subject.apply_dom_metadata( page )
+        end
+
+        it 'clears the #browser buffers' do
+            subject.browser.should receive(:clear_buffers)
+
+            subject.apply_dom_metadata( page )
+        end
+
+        context "when #{Arachni::Page::DOM}#depth is" do
+            context 0 do
+                before do
+                    page.dom.stub(:depth) { 0 }
+                end
+
+                it 'returns true' do
+                    subject.apply_dom_metadata( page ).should be_true
+                end
+            end
+
+            context '> 0' do
+                before do
+                    page.dom.stub(:depth) { 1 }
+                end
+
+                it 'returns false' do
+                    subject.apply_dom_metadata( page ).should be_false
+                end
+            end
+        end
+
+        context "when #{Arachni::Page}#has_script? is" do
+            context false do
+                before do
+                    page.stub(:has_script?) { false }
+                end
+
+                it 'returns false' do
+                    subject.apply_dom_metadata( page ).should be_false
+                end
+            end
+
+            context true do
+                before do
+                    page.stub(:has_script?) { true }
+                end
+
+                it 'returns true' do
+                    subject.apply_dom_metadata( page ).should be_true
+                end
+            end
+        end
+
+        context 'when #use_browsers? is' do
+            context false do
+                before do
+                    subject.stub(:use_browsers?) { false }
+                end
+
+                it 'returns false' do
+                    subject.apply_dom_metadata( page ).should be_false
+                end
+            end
+
+            context true do
+                before do
+                    subject.stub(:use_browsers?) { true }
+                end
+
+                it 'returns true' do
+                    subject.apply_dom_metadata( page ).should be_true
+                end
+            end
+        end
+
+        context "when #{Arachni::Check::Auditor}.check? for [#{Arachni::Element::Form::DOM}, #{Arachni::Element::Cookie::DOM}] is" do
+            before do
+                check.should receive(:check?).with( page, [Arachni::Element::Form::DOM, Arachni::Element::Cookie::DOM] )
+            end
+
+            context false do
+                before do
+                    check.stub(:check?) { false }
+                end
+
+                it 'returns false' do
+                    subject.apply_dom_metadata( page ).should be_false
+                end
+            end
+
+            context true do
+                before do
+                    check.stub(:check?) { true }
+                end
+
+                it 'returns true' do
+                    subject.apply_dom_metadata( page ).should be_true
+                end
+            end
+        end
+
+        context "when #{Arachni::Browser}#to_page returns" do
+            context 'empty page' do
+                before do
+                    subject.browser.stub(:to_page) { Factory[:empty_page] }
+                end
+
+                it 'returns nil' do
+                    subject.apply_dom_metadata( page ).should be_nil
+                end
+            end
+
+            context 'valid page' do
+                before do
+                    subject.browser.stub(:to_page) { browser_page }
+                end
+
+                it 'returns true' do
+                    subject.apply_dom_metadata( page ).should be_true
+                end
+            end
+        end
+
+        context "when #{Arachni::Browser}#to_page raises" do
+            context "#{Selenium::WebDriver::Error::WebDriverError}" do
+                before do
+                    subject.browser.stub(:to_page) do
+                        raise Selenium::WebDriver::Error::WebDriverError
+                    end
+                end
+
+                it 'returns nil' do
+                    subject.apply_dom_metadata( page ).should be_nil
+                end
+            end
+
+            context "#{Watir::Exception::Error}" do
+                before do
+                    subject.browser.stub(:to_page) do
+                        raise Watir::Exception::Error
+                    end
+                end
+
+                it 'returns true' do
+                    subject.apply_dom_metadata( page ).should be_nil
+                end
+            end
+        end
+    end
 end

data/spec/arachni/framework/parts/state_spec.rb

@@ -274,7 +274,7 @@ describe Arachni::Framework::Parts::State do
 
             Arachni::Framework.restore( @snapshot ) do |f|
                 f.options.to_h.should == options_hash.merge( checks: ['taint'] )
-                f.browser_job_skip_states.should be_any
+                f.browser_cluster_job_skip_states.should be_any
             end
         end
 
@@ -294,7 +294,7 @@ describe Arachni::Framework::Parts::State do
             end
 
             Arachni::Framework.restore( @snapshot ) do |f|
-                f.browser_job_skip_states.should be_any
+                f.browser_cluster_job_skip_states.should be_any
             end
         end
 
@@ -474,6 +474,24 @@ describe Arachni::Framework::Parts::State do
     end
 
     describe '#clean_up' do
+        it 'shuts down the #browser_cluster' do
+            Arachni::Framework.new do |f|
+                f.options.url = @url + '/elem_combo'
+
+                f.browser_cluster.should receive(:shutdown)
+                f.clean_up
+            end
+        end
+
+        it 'shuts down the #browser' do
+            Arachni::Framework.new do |f|
+                f.options.url = @url + '/elem_combo'
+
+                f.browser.should receive(:shutdown)
+                f.clean_up
+            end
+        end
+
         it 'stops the #plugins' do
             Arachni::Framework.new do |f|
                 f.options.url = @url + '/elem_combo'

data/spec/arachni/http/client/dynamic_404_handlers_spec.rb

@@ -0,0 +1,274 @@
+require 'spec_helper'
+
+describe Arachni::HTTP::Client::Dynamic404Handler do
+
+    before( :all ) do
+        @url = web_server_url_for( :dynamic_404_handler )
+    end
+    after do
+        Arachni::HTTP::Client.reset
+    end
+
+    subject { client.dynamic_404_handler }
+    let(:client) { Arachni::HTTP::Client }
+    let(:url) { "#{@url}/" }
+
+    describe '#_404?' do
+        context 'when not dealing with a not-found response' do
+            it 'returns false' do
+                res = nil
+                client.get( url + 'not' ) { |c_res| res = c_res }
+                client.run
+                bool = false
+                subject._404?( res ) { |c_bool| bool = c_bool }
+                client.run
+                bool.should be_false
+            end
+        end
+
+        context 'when dealing with a static handler' do
+            it 'returns true' do
+                res = nil
+                client.get( url + 'static/crap' ) { |c_res| res = c_res }
+                client.run
+                bool = false
+                subject._404?( res ) { |c_bool| bool = c_bool }
+                client.run
+                bool.should be_true
+            end
+        end
+
+        context 'when dealing with a dynamic handler' do
+            context 'which includes the requested resource in the response' do
+                it 'returns true' do
+                    res = nil
+                    client.get( url + 'dynamic/crap' ) { |c_res| res = c_res }
+                    client.run
+                    bool = false
+                    subject._404?( res ) { |c_bool| bool = c_bool }
+                    client.run
+                    bool.should be_true
+                end
+            end
+            context 'which includes constantly changing text in the response' do
+                it 'returns true' do
+                    res = nil
+                    client.get( url + 'random/crap' ) { |c_res| res = c_res }
+                    client.run
+                    bool = false
+                    subject._404?( res ) { |c_bool| bool = c_bool }
+                    client.run
+                    bool.should be_true
+                end
+            end
+            context 'which returns a combination of the above' do
+                it 'returns true' do
+                    res = nil
+                    client.get( url + 'combo/crap' ) { |c_res| res = c_res }
+                    client.run
+                    bool = false
+                    subject._404?( res ) { |c_bool| bool = c_bool }
+                    client.run
+                    bool.should be_true
+                end
+            end
+
+            context 'when checking for a resource with a name and extension' do
+                context 'and the handler is extension-sensitive' do
+                    it 'returns true' do
+                        res = nil
+                        client.get( url + 'advanced/sensitive-ext/blah.html2' ) { |c_res| res = c_res }
+                        client.run
+
+                        bool = false
+                        subject._404?( res ) { |c_bool| bool = c_bool }
+                        client.run
+
+                        bool.should be_true
+                    end
+                end
+            end
+        end
+
+        context 'when checking for an already checked URL' do
+            it 'returns the cached result' do
+                res = nil
+                client.get( url + 'static/crap' ) { |c_res| res = c_res }
+                client.run
+
+                bool = false
+                subject._404?( res ) { |c_bool| bool = c_bool }
+                client.run
+                bool.should be_true
+
+                fingerprints = 0
+                client.on_complete do
+                    fingerprints += 1
+                end
+
+                res = nil
+                client.get( url + 'static/crap' ) { |c_res| res = c_res }
+                client.run
+                fingerprints.should > 0
+
+                overhead = 0
+                client.on_complete do
+                    overhead += 1
+                end
+
+                bool = false
+                subject._404?( res ) { |c_bool| bool = c_bool }
+                client.run
+                bool.should be_true
+
+                overhead.should == 0
+            end
+        end
+
+        context "when the signature cache exceeds #{described_class::CACHE_SIZE} entries" do
+            it 'it is pruned as soon as possible' do
+                subject.signatures.should be_empty
+
+                (2 * described_class::CACHE_SIZE).times do |i|
+                    client.get( url + "static/#{i}/test" ) do |response|
+                        subject._404?( response ) {}
+                    end
+                end
+                client.run
+
+                subject.signatures.size.should == described_class::CACHE_SIZE
+            end
+        end
+    end
+
+    describe '#checked_and_static?' do
+        let(:url) { super() + 'combo/crap' }
+        let(:path) { client.get_path( url ) }
+
+        context 'when the page has been fingerprinted' do
+            context 'and it has a custom handler' do
+                it 'returns false' do
+                    client.get( url ) do |response|
+                        subject._404?( response ) {}
+                    end
+                    client.run
+
+                    subject.checked_and_static?( path ).should be_false
+                end
+            end
+
+            context 'and it does not have a custom handler' do
+                it 'returns true' do
+                    client.get( @url ) do |response|
+                        subject._404?( response ) {}
+                    end
+                    client.run
+
+                    subject.checked_and_static?( client.get_path( @url ) ).should be_true
+                end
+            end
+        end
+
+        context 'when the page has not been fingerprinted' do
+            it 'returns false' do
+                subject.checked_and_static?( path ).should be_false
+            end
+        end
+    end
+
+    describe '#checked?' do
+        let(:url) { super() + 'combo/crap' }
+
+        context 'when the page has been fingerprinted' do
+            context 'and it has a dynamic handler' do
+                it 'returns true' do
+                    client.get( url ) do |response|
+                        subject._404?( response ) {}
+                    end
+                    client.run
+
+                    subject.checked?( url ).should be_true
+                end
+            end
+
+            context 'and it has a static handler' do
+                it 'returns true' do
+                    client.get( @url ) do |response|
+                        subject._404?( response ) {}
+                    end
+                    client.run
+
+                    subject.checked?( @url ).should be_true
+                end
+            end
+        end
+
+        context 'when the page has not been fingerprinted' do
+            it 'returns false' do
+                subject.checked?( url ).should be_false
+            end
+        end
+    end
+
+    describe 'needs_check?' do
+        context 'when #checked?' do
+            context false do
+                before(:each) { subject.stub(:checked?) { false } }
+
+                it 'returns true' do
+                    subject.needs_check?( @url ).should be_true
+                end
+
+                context 'and #checked_and_static?' do
+                    context false do
+                        before(:each) { subject.stub(:checked_and_static?) { false } }
+
+                        it 'returns true' do
+                            subject.needs_check?( @url ).should be_true
+                        end
+                    end
+
+                    context true do
+                        before(:each) { subject.stub(:checked_and_static?) { true } }
+
+                        it 'returns true' do
+                            subject.needs_check?( @url ).should be_true
+                        end
+                    end
+                end
+            end
+
+            context true do
+                before(:each) { subject.stub(:checked?) { true } }
+
+                it 'returns true' do
+                    subject.needs_check?( @url ).should be_true
+                end
+
+                context 'and #checked_and_static?' do
+                    context true do
+                        before(:each) { subject.stub(:checked_and_static?) { true } }
+
+                        it 'returns false' do
+                            subject.needs_check?( @url ).should be_false
+                        end
+                    end
+
+                    context false do
+                        before(:each) { subject.stub(:checked_and_static?) { false } }
+
+                        it 'returns true' do
+                            subject.needs_check?( @url ).should be_true
+                        end
+                    end
+                end
+            end
+        end
+    end
+
+    describe '.info' do
+        it 'returns a hash with an output name' do
+            described_class.info[:name].should == 'Dynamic404Handler'
+        end
+    end
+end