arachni 1.0.6 → 1.1

data/spec/arachni/uri_spec.rb

@@ -292,6 +292,26 @@ describe Arachni::URI do
         end
     end
 
+    describe '.full_and_absolute?' do
+        context 'when given a nil URL' do
+            it 'returns false' do
+                described_class.full_and_absolute?( nil ).should be_false
+            end
+        end
+
+        context 'when given an non absolute URL' do
+            it 'returns false' do
+                described_class.full_and_absolute?( '433' ).should be_false
+            end
+        end
+
+        context 'when given an absolute URL' do
+            it 'returns true' do
+                described_class.full_and_absolute?( 'http://stuff/' ).should be_true
+            end
+        end
+    end
+
     describe '#initialize' do
         context String do
             it 'normalizes and parse the string' do
@@ -513,12 +533,33 @@ describe Arachni::URI do
         end
     end
 
+    describe '#resource_name' do
+        context 'when there is no file name' do
+            it 'returns nil' do
+                described_class.new( 'http://stuff.com/' ).resource_name.should be_nil
+            end
+        end
+
+        it 'returns the file name of the resource' do
+            uri = 'http://test.com/direct.ory/resource.php?param=1&param2=2'
+            described_class.new( uri ).resource_name.should == 'resource.php'
+            described_class.new( 'http://stuff.com/test/' ).resource_name.should == 'test'
+        end
+    end
+
     describe '#resource_extension' do
         context 'when there is no extension' do
             it 'returns nil' do
                 described_class.new( 'http://stuff.com/test' ).resource_extension.should be_nil
             end
         end
+
+        context 'when there are multiple periods' do
+            it 'returns the last one' do
+                described_class.new( 'http://stuff.com/test.1.2' ).resource_extension.should == '2'
+            end
+        end
+
         it 'returns the extension of the resource' do
             uri = "http://test.com/direct.ory/resource.php?param=1&param2=2"
             described_class.new( uri ).resource_extension.should == 'php'

data/spec/arachni/utilities_spec.rb

@@ -54,7 +54,8 @@ describe Arachni::Utilities do
         uri_encode:              [Arachni::URI, :encode],
         uri_decode:              [Arachni::URI, :decode],
         normalize_url:           [Arachni::URI, :normalize],
-        to_absolute:             [Arachni::URI, :to_absolute]
+        to_absolute:             [Arachni::URI, :to_absolute],
+        full_and_absolute_url?:  [Arachni::URI, :full_and_absolute?]
     }.each do |m, (klass, delegated)|
         describe "##{m}" do
             it "delegates to #{klass}.#{delegated}" do

data/spec/components/checks/active/code_injection_spec.rb

@@ -9,16 +9,56 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
-    def issue_count_per_platform
+    def issue_count_per_element_per_platform
         {
-            php:    8,
-            perl:   8,
-            python: 4,
-            asp:    8,
-            ruby:   8
+            php:    {
+                Element::Form         => 4,
+                Element::Link         => 4,
+                Element::Cookie       => 4,
+                Element::Header       => 4,
+                Element::LinkTemplate => 4,
+                Element::JSON         => 4,
+                Element::XML          => 8
+            },
+            perl:    {
+                Element::Form         => 4,
+                Element::Link         => 4,
+                Element::Cookie       => 4,
+                Element::Header       => 4,
+                Element::LinkTemplate => 4,
+                Element::JSON         => 4,
+                Element::XML          => 8
+            },
+            python:  {
+                Element::Form         => 2,
+                Element::Link         => 2,
+                Element::Cookie       => 2,
+                Element::Header       => 2,
+                Element::LinkTemplate => 2,
+                Element::JSON         => 2,
+                Element::XML          => 4
+            },
+            asp:    {
+                Element::Form         => 4,
+                Element::Link         => 4,
+                Element::Cookie       => 4,
+                Element::Header       => 4,
+                Element::LinkTemplate => 4,
+                Element::JSON         => 4,
+                Element::XML          => 8
+            },
+            ruby:    {
+                Element::Form         => 4,
+                Element::Link         => 4,
+                Element::Cookie       => 4,
+                Element::Header       => 4,
+                Element::LinkTemplate => 4,
+                Element::JSON         => 4,
+                Element::XML          => 8
+            }
         }
     end
 

data/spec/components/checks/active/code_injection_timing_spec.rb

@@ -9,7 +9,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -18,7 +18,9 @@ describe name_from_filename do
             Element::Link         => 4,
             Element::Cookie       => 4,
             Element::Header       => 3,
-            Element::LinkTemplate => 4
+            Element::LinkTemplate => 4,
+            Element::JSON         => 4,
+            Element::XML          => 8
         }
     end
 

data/spec/components/checks/active/file_inclusion_spec.rb

@@ -9,7 +9,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -19,35 +19,45 @@ describe name_from_filename do
                 Element::Link         => 16,
                 Element::Cookie       => 16,
                 Element::Header       => 8,
-                Element::LinkTemplate => 8
+                Element::LinkTemplate => 8,
+                Element::JSON         => 16,
+                Element::XML          => 32
             },
             windows: {
                 Element::Form         => 96,
                 Element::Link         => 96,
                 Element::Cookie       => 96,
                 Element::Header       => 48,
-                Element::LinkTemplate => 48
+                Element::LinkTemplate => 48,
+                Element::JSON         => 96,
+                Element::XML          => 192
             },
             tomcat:  {
                 Element::Form         => 8,
                 Element::Link         => 8,
                 Element::Cookie       => 8,
                 Element::Header       => 4,
-                Element::LinkTemplate => 4
+                Element::LinkTemplate => 4,
+                Element::JSON         => 8,
+                Element::XML          => 16
             },
             php:  {
                 Element::Form         => 120,
                 Element::Link         => 120,
                 Element::Cookie       => 120,
                 Element::Header       => 60,
-                Element::LinkTemplate => 60
+                Element::LinkTemplate => 60,
+                Element::JSON         => 120,
+                Element::XML          => 240
             },
             perl:  {
                 Element::Form         => 120,
                 Element::Link         => 120,
                 Element::Cookie       => 120,
                 Element::Header       => 60,
-                Element::LinkTemplate => 60
+                Element::LinkTemplate => 60,
+                Element::JSON         => 120,
+                Element::XML          => 240
             }
         }
     end

data/spec/components/checks/active/ldap_injection_spec.rb

@@ -5,12 +5,21 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
-    def issue_count
-        current_check.error_strings.size
-    end
+    def issue_count_per_element
+        i = current_check.error_strings.size
 
+        {
+            Element::Form         => i,
+            Element::Link         => i,
+            Element::Cookie       => i,
+            Element::Header       => i,
+            Element::LinkTemplate => i,
+            Element::JSON         => i,
+            Element::XML          => i * 2
+        }
+    end
     easy_test
 end

data/spec/components/checks/active/no_sql_injection_spec.rb

@@ -9,7 +9,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -19,7 +19,9 @@ describe name_from_filename do
                 Element::Link         => 2,
                 Element::Cookie       => 1,
                 Element::Header       => 1,
-                Element::LinkTemplate => 1
+                Element::LinkTemplate => 1,
+                Element::JSON         => 2,
+                Element::XML          => 2
             }
         }
     end

data/spec/components/checks/active/os_cmd_injection_spec.rb

@@ -9,27 +9,31 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
         h = {}
         [:unix, :bsd, :aix].each do |platform|
             h[platform] = {
-                Element::Form         => 22,
-                Element::Link         => 22,
-                Element::Cookie       => 22,
-                Element::Header       => 19,
-                Element::LinkTemplate => 21
+                Element::Form         => 11,
+                Element::Link         => 11,
+                Element::Cookie       => 11,
+                Element::Header       => 8,
+                Element::LinkTemplate => 10,
+                Element::JSON         => 11,
+                Element::XML          => 22
             }
         end
 
         h[:windows] = {
-            Element::Form         => 44,
-            Element::Link         => 44,
-            Element::Cookie       => 44,
-            Element::Header       => 38,
-            Element::LinkTemplate => 44
+            Element::Form         => 22,
+            Element::Link         => 22,
+            Element::Cookie       => 22,
+            Element::Header       => 16,
+            Element::LinkTemplate => 22,
+            Element::JSON         => 22,
+            Element::XML          => 44
         }
 
         h

data/spec/components/checks/active/os_cmd_injection_timing_spec.rb

@@ -9,7 +9,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -18,7 +18,9 @@ describe name_from_filename do
             Element::Link         => 14,
             Element::Cookie       => 14,
             Element::Header       => 14,
-            Element::LinkTemplate => 14
+            Element::LinkTemplate => 14,
+            Element::JSON         => 14,
+            Element::XML          => 28
         }
     end
 

data/spec/components/checks/active/path_traversal_spec.rb

@@ -9,7 +9,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -19,22 +19,28 @@ describe name_from_filename do
                 Element::Link         => 112,
                 Element::Cookie       => 112,
                 Element::Header       => 56,
-                Element::LinkTemplate => 8
+                Element::LinkTemplate => 8,
+                Element::JSON         => 168,
+                Element::XML          => 224
             },
             windows: {
                 Element::Form         => 336,
                 Element::Link         => 336,
                 Element::Cookie       => 336,
                 Element::Header       => 168,
-                Element::LinkTemplate => 24
+                Element::LinkTemplate => 24,
+                Element::JSON         => 504,
+                Element::XML          => 672
             },
             tomcat:  {
                 Element::Form         => 8,
                 Element::Link         => 8,
                 Element::Cookie       => 8,
                 Element::Header       => 4,
-                Element::LinkTemplate => 0
-            },
+                Element::LinkTemplate => 0,
+                Element::JSON         => 12,
+                Element::XML          => 16
+            }
         }
     end
 

data/spec/components/checks/active/response_splitting_spec.rb

@@ -5,7 +5,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -14,7 +14,9 @@ describe name_from_filename do
             Element::Link         => 4,
             Element::Cookie       => 4,
             Element::Header       => 2,
-            Element::LinkTemplate => 4
+            Element::LinkTemplate => 4,
+            Element::JSON         => 4,
+            Element::XML          => 8
         }
     end
 

data/spec/components/checks/active/rfi_spec.rb

@@ -4,7 +4,8 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
+          Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -12,7 +13,9 @@ describe name_from_filename do
             Element::Form   => 12,
             Element::Link   => 12,
             Element::Cookie => 12,
-            Element::Header => 6
+            Element::Header => 6,
+            Element::JSON   => 12,
+            Element::XML    => 24
         }
     end
 

data/spec/components/checks/active/source_code_disclosure_spec.rb

@@ -9,16 +9,18 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
         {
             Element::Form         => 6,
             Element::Link         => 6,
-            Element::Cookie       => 6,
-            Element::Header       => 6,
-            Element::LinkTemplate => 5
+            Element::Cookie       => 4,
+            Element::Header       => 3,
+            Element::LinkTemplate => 5,
+            Element::JSON         => 6,
+            Element::XML          => 16
         }
     end
 

data/spec/components/checks/active/sql_injection_spec.rb

@@ -4,13 +4,14 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.platforms
-        [:access, :db2, :emc, :firebird, :frontbase, :hsqldb, :informix, :ingres,
-         :interbase, :maxdb, :mssql, :mysql, :oracle, :pgsql, :sqlite, :sybase]
+        [:access, :db2, :emc, :firebird, :frontbase, :hsqldb,
+         :informix, :ingres, :interbase, :maxdb, :mssql, :mysql, :oracle,
+         :pgsql, :sqlite, :sybase]
     end
 
     def self.elements
         [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate ]
+          Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -20,119 +21,144 @@ describe name_from_filename do
                 Element::Link         => 12,
                 Element::Cookie       => 6,
                 Element::Header       => 6,
-                Element::LinkTemplate => 6
-            },
-            coldfusion: {
-                Element::Form         => 4,
-                Element::Link         => 4,
-                Element::Cookie       => 2,
-                Element::Header       => 2,
-                Element::LinkTemplate => 2
+                Element::LinkTemplate => 6,
+                Element::JSON         => 12,
+                Element::XML          => 12
             },
             db2:        {
                 Element::Form         => 16,
                 Element::Link         => 16,
                 Element::Cookie       => 8,
                 Element::Header       => 8,
-                Element::LinkTemplate => 8
+                Element::LinkTemplate => 8,
+                Element::JSON         => 16,
+                Element::XML          => 16
             },
             emc:        {
                 Element::Form         => 8,
                 Element::Link         => 8,
                 Element::Cookie       => 4,
                 Element::Header       => 4,
-                Element::LinkTemplate => 4
+                Element::LinkTemplate => 4,
+                Element::JSON         => 8,
+                Element::XML          => 8
             },
             firebird:   {
                 Element::Form         => 4,
                 Element::Link         => 4,
                 Element::Cookie       => 2,
                 Element::Header       => 2,
-                Element::LinkTemplate => 2
+                Element::LinkTemplate => 2,
+                Element::JSON         => 4,
+                Element::XML          => 4
             },
             frontbase:  {
                 Element::Form         => 4,
                 Element::Link         => 4,
                 Element::Cookie       => 2,
                 Element::Header       => 2,
-                Element::LinkTemplate => 2
+                Element::LinkTemplate => 2,
+                Element::JSON         => 4,
+                Element::XML          => 4
             },
             hsqldb:     {
                 Element::Form         => 4,
                 Element::Link         => 4,
                 Element::Cookie       => 2,
                 Element::Header       => 2,
-                Element::LinkTemplate => 2
+                Element::LinkTemplate => 2,
+                Element::JSON         => 4,
+                Element::XML          => 4
             },
             informix:   {
                 Element::Form         => 12,
                 Element::Link         => 12,
                 Element::Cookie       => 6,
                 Element::Header       => 6,
-                Element::LinkTemplate => 6
+                Element::LinkTemplate => 6,
+                Element::JSON         => 12,
+                Element::XML          => 12
             },
             ingres:     {
                 Element::Form         => 12,
                 Element::Link         => 12,
                 Element::Cookie       => 6,
                 Element::Header       => 6,
-                Element::LinkTemplate => 6
+                Element::LinkTemplate => 6,
+                Element::JSON         => 12,
+                Element::XML          => 12
             },
             interbase:  {
                 Element::Form         => 8,
                 Element::Link         => 8,
                 Element::Cookie       => 4,
                 Element::Header       => 4,
-                Element::LinkTemplate => 4
+                Element::LinkTemplate => 4,
+                Element::JSON         => 8,
+                Element::XML          => 8
             },
             maxdb:      {
                 Element::Form         => 4,
                 Element::Link         => 4,
                 Element::Cookie       => 2,
                 Element::Header       => 2,
-                Element::LinkTemplate => 2
+                Element::LinkTemplate => 2,
+                Element::JSON         => 4,
+                Element::XML          => 4
             },
             mssql:      {
                 Element::Form         => 86,
                 Element::Link         => 86,
                 Element::Cookie       => 42,
                 Element::Header       => 42,
-                Element::LinkTemplate => 42
+                Element::LinkTemplate => 42,
+                Element::JSON         => 86,
+                Element::XML          => 84
             },
             mysql:      {
                 Element::Form         => 52,
                 Element::Link         => 52,
                 Element::Cookie       => 26,
                 Element::Header       => 26,
-                Element::LinkTemplate => 26
+                Element::LinkTemplate => 26,
+                Element::JSON         => 52,
+                Element::XML          => 52
             },
             oracle:     {
                 Element::Form         => 20,
                 Element::Link         => 20,
                 Element::Cookie       => 10,
                 Element::Header       => 10,
-                Element::LinkTemplate => 10
+                Element::LinkTemplate => 10,
+                Element::JSON         => 20,
+                Element::XML          => 20
             },
             pgsql:      {
                 Element::Form         => 36,
                 Element::Link         => 36,
                 Element::Cookie       => 18,
                 Element::Header       => 18,
-                Element::LinkTemplate => 18
+                Element::LinkTemplate => 18,
+                Element::JSON         => 36,
+                Element::XML          => 36
             },
             sqlite:     {
                 Element::Form         => 16,
                 Element::Link         => 16,
                 Element::Cookie       => 8,
                 Element::Header       => 8,
-                Element::LinkTemplate => 8
+                Element::LinkTemplate => 8,
+                Element::JSON         => 16,
+                Element::XML          => 16
             },
             sybase:     {
                 Element::Form         => 12,
                 Element::Link         => 12,
                 Element::Cookie       => 6,
                 Element::Header       => 6,
-                Element::LinkTemplate => 6
+                Element::LinkTemplate => 6,
+                Element::JSON         => 12,
+                Element::XML          => 12
             }
         }
     end