arachni 1.1 → 1.2

data/spec/arachni/browser/javascript/taint_tracer_spec.rb

@@ -1342,6 +1342,21 @@ describe Arachni::Browser::Javascript::TaintTracer do
             event['srcElement'].should == form
             event['type'].should == 'submit'
         end
+
+        it 'is limited to 50' do
+            load 'debug'
+
+            100.times do |i|
+                @browser.javascript.run( subject.stub.function( :log_execution_flow_sink, i ) )
+            end
+
+            sinks = subject.execution_flow_sinks
+            sinks.size.should == 50
+
+            50.times do |i|
+                sinks[i].data.should == [50 + i]
+            end
+        end
     end
 
     describe '#log_data_flow_sink' do
@@ -1373,6 +1388,32 @@ describe Arachni::Browser::Javascript::TaintTracer do
             event['srcElement'].should == form
             event['type'].should == 'submit'
         end
+
+        it 'is limited to 50 per taint' do
+            load 'debug'
+
+            100.times do |i|
+                @browser.javascript.run(
+                    subject.stub.function(
+                        :log_data_flow_sink,
+                        'taint',
+                        {
+                            function: {
+                                name: "f_#{i}"
+                            }
+                        }
+                    )
+                )
+            end
+
+            sinks = subject.data_flow_sinks['taint']
+            sinks.size.should == 50
+
+            50.times do |i|
+                sinks[i].function.name.should == "f_#{i+50}"
+            end
+        end
+
     end
 
     describe '#debugging_data' do

data/spec/arachni/browser/javascript_spec.rb

@@ -18,6 +18,14 @@ describe Arachni::Browser::Javascript do
 
     subject { @browser.javascript }
 
+    describe '.events_for' do
+        it 'returns events for the given element' do
+            described_class::EVENTS_PER_ELEMENT.each do |element, events|
+                described_class.events_for( element ).should == described_class::GLOBAL_EVENTS | events
+            end
+        end
+    end
+
     describe '.select_event_attributes' do
         it 'selects only attributes that are events' do
             attributes = {
@@ -140,25 +148,83 @@ describe Arachni::Browser::Javascript do
     end
 
     describe '#dom_elements_with_events' do
-        it 'returns information about all DOM elements along with their events' do
-            @browser.load @dom_monitor_url + 'elements_with_events'
-            subject.dom_elements_with_events.should == [
-                { 'tag_name' => 'body', 'events' => [], 'attributes' => {} },
-                { 'tag_name'   => 'button',
-                  'events'     =>
-                      [[:click, 'function (my_button_click) {}'],
-                       [:click, 'function (my_button_click2) {}'],
-                       [:onmouseover, 'function (my_button_onmouseover) {}'],
-                       [:onclick, 'handler_1()']],
-                  'attributes' => { 'onclick' => 'handler_1()', 'id' => 'my-button' } },
-                { 'tag_name'   => 'button',
-                  'events'     =>
-                      [[:click, 'function (my_button2_click) {}'], [:onclick, 'handler_2()']],
-                  'attributes' => { 'onclick' => 'handler_2()', 'id' => 'my-button2' } },
-                { 'tag_name'   => 'button',
-                  'events'     => [[:onclick, 'handler_3()']],
-                  'attributes' => { 'onclick' => 'handler_3()', 'id' => 'my-button3' } }
-            ]
+        context 'when using event attributes' do
+            it 'returns information about all DOM elements along with their events' do
+                @browser.load @dom_monitor_url + 'elements_with_events/attributes'
+
+                subject.dom_elements_with_events.should == [
+                    {
+                        'tag_name' => 'body', 'events' => [], 'attributes' => {}
+                    },
+                    {
+                        'tag_name'   => 'button',
+                        'events'     => [
+                            [:onclick, 'handler_1()']
+                        ],
+                        'attributes' => { 'onclick' => 'handler_1()', 'id' => 'my-button' }
+                    },
+                    {
+                        'tag_name'   => 'button',
+                        'events'     => [
+                            [:onclick, 'handler_2()']
+                        ],
+                        'attributes' => { 'onclick' => 'handler_2()', 'id' => 'my-button2' }
+                    },
+                    {
+                        'tag_name'   => 'button',
+                        'events'     => [
+                            [:onclick, 'handler_3()']
+                        ],
+                        'attributes' => { 'onclick' => 'handler_3()', 'id' => 'my-button3' }
+                    }
+                ]
+            end
+        end
+
+        context 'when using event listeners' do
+            it 'returns information about all DOM elements along with their events' do
+                @browser.load @dom_monitor_url + 'elements_with_events/listeners'
+
+                subject.dom_elements_with_events.should == [
+                    {
+                        'tag_name' => 'body', 'events' => [], 'attributes' => {}
+                    },
+                    {
+                        'tag_name'   => 'button',
+                        'events'     => [
+                            [:click, 'function (my_button_click) {}'],
+                            [:click, 'function (my_button_click2) {}'],
+                            [:onmouseover, 'function (my_button_onmouseover) {}']
+                        ],
+                        'attributes' => { 'id' => 'my-button' } },
+                    {
+                        'tag_name'   => 'button',
+                        'events'     => [
+                            [:click, 'function (my_button2_click) {}']
+                        ],
+                        'attributes' => { 'id' => 'my-button2' } },
+                    {
+                        'tag_name'   => 'button',
+                        'events'     => [],
+                        'attributes' => { 'id' => 'my-button3' }
+                    }
+                ]
+            end
+
+            it 'does not include custom events' do
+                @browser.load @dom_monitor_url + 'elements_with_events/listeners/custom'
+
+                subject.dom_elements_with_events.should == [
+                    {
+                        'tag_name' => 'body', 'events' => [], 'attributes' => {}
+                    },
+                    {
+                        'tag_name'   => 'button',
+                        'events'     => [],
+                        'attributes' => { 'id' => 'my-button' }
+                    }
+                ]
+            end
         end
     end
 
@@ -316,71 +382,179 @@ describe Arachni::Browser::Javascript do
     end
 
     describe '#inject' do
-        let(:response) { Arachni::HTTP::Response.new( url: @dom_monitor_url ) }
+        context 'when the response is' do
+            context 'JavaScript' do
+                let(:response) do
+                    Arachni::HTTP::Response.new(
+                        url:     "#{@dom_monitor_url}/jquery.js",
+                        headers: {
+                            'Content-Type' => 'text/javascript'
+                        },
+                        body: <<EOHTML
+                    foo()
+EOHTML
+                    )
+                end
 
-        context 'when the response does not already contain the JS code' do
-            it 'injects the system\'s JS interfaces in the response body' do
-                subject.inject( response )
-                @browser.load response
+                let(:injected) do
+                    r = response.deep_clone
+                    subject.inject( r )
+                    r
+                end
 
-                subject.taint_tracer.initialized.should be_true
-                subject.dom_monitor.initialized.should be_true
-            end
+                let(:taint_tracer_update) do
+                    "#{subject.taint_tracer.stub.function( :update_tracers )};"
+                end
+
+                let(:dom_monitor_update) do
+                    "#{subject.dom_monitor.stub.function( :update_trackers )};"
+                end
 
-            it 'updates the Content-Length' do
-                old_content_length = response.headers['content-length'].to_i
+                it 'inject a TaintTracer.update_tracers() call before the code' do
+                    injected.body.scan( /(.*)foo/m ).flatten.first.should include taint_tracer_update
+                end
 
-                subject.inject( response )
+                it 'inject a DOMMonitor.update_trackers() call before the code' do
+                    injected.body.scan( /(.*)foo/m ).flatten.first.should include dom_monitor_update
+                end
 
-                new_content_length = response.headers['content-length'].to_i
+                it 'appends a semicolon and newline to the body' do
+                    injected.body.should include "#{response.body};\n"
+                end
 
-                new_content_length.should > old_content_length
-                new_content_length.should == response.body.bytesize
-            end
+                it 'updates the Content-Length' do
+                    old_content_length = response.headers['content-length'].to_i
 
-            it 'returns true' do
-                subject.inject( response ).should be_true
+                    subject.inject( response )
+
+                    new_content_length = response.headers['content-length'].to_i
+
+                    new_content_length.should > old_content_length
+                    new_content_length.should == response.body.bytesize
+                end
             end
 
-            context 'when the response body contains script elements' do
-                before { response.body = '<script> // My code and stuff </script>' }
+            context 'HTML' do
+                let(:response) do
+                    Arachni::HTTP::Response.new(
+                        url:     @dom_monitor_url,
+                        headers: {
+                            'Content-Type' => 'text/html'
+                        },
+                        body: <<EOHTML
+                    <body>
+                    </body>
+EOHTML
+                    )
+                end
+
+                it 'updates the Content-Length' do
+                    old_content_length = response.headers['content-length'].to_i
 
-                context 'and a taint has been configured' do
-                    before { subject.taint = 'my_taint' }
+                    subject.inject( response )
 
-                    it 'injects taint tracer update calls at the top of the script' do
+                    new_content_length = response.headers['content-length'].to_i
+
+                    new_content_length.should > old_content_length
+                    new_content_length.should == response.body.bytesize
+                end
+
+                context 'when the response does not already contain the JS code' do
+                    it 'injects the system\'s JS interfaces in the response body' do
+                        subject.inject( response )
+
+                        %w(taint_tracer dom_monitor).each do |name|
+                            src = "#{described_class::SCRIPT_BASE_URL}#{name}.js"
+                            Nokogiri::HTML( response.body ).xpath( "//script[@src='#{src}']" ).should be_any
+                        end
+                    end
+
+                    context 'when the response body contains script elements' do
+                        before { response.body = '<script>// My code and stuff</script>' }
+
+                        it 'injects taint tracer update calls at the top of the script' do
+                            subject.inject( response )
+                            Nokogiri::HTML(response.body).css('script')[-2].to_s.should ==
+                                "<script>
+
+                // Injected by #{described_class}
+                _#{subject.token}TaintTracer.update_tracers();
+                _#{subject.token}DOMMonitor.update_trackers();
+
+// My code and stuff</script>"
+                        end
+
+                        it 'injects taint tracer update calls after the script' do
+                            subject.inject( response )
+                            Nokogiri::HTML(response.body).css('script')[-1].to_s.should ==
+                                "<script type=\"text/javascript\">" +
+                                "_#{subject.token}TaintTracer.update_tracers();" +
+                                "_#{subject.token}DOMMonitor.update_trackers();" +
+                                '</script>'
+                        end
+                    end
+                end
+
+                context 'when the response already contains the JS code' do
+                    it 'updates the taints' do
+                        subject.inject( response )
+
+                        presponse = response.deep_clone
+                        pintializer = subject.taint_tracer.stub.function( :initialize, [] )
+
+                        subject.taint = [ 'taint1', 'taint2' ]
                         subject.inject( response )
-                        Nokogiri::HTML(response.body).css('script')[-2].to_s.should ==
-                            "<script>
-_#{subject.token}TaintTracer.update_tracers(); // Injected by Arachni::Browser::Javascript
- // My code and stuff </script>"
+                        intializer = subject.taint_tracer.stub.function( :initialize, subject.taint )
+
+                        response.body.should == presponse.body.gsub( pintializer, intializer )
                     end
 
-                    it 'injects taint tracer update calls after the script' do
+                    it 'updates the custom code' do
+                        subject.custom_code = 'alert(1);'
                         subject.inject( response )
+
+                        presponse = response.deep_clone
+                        code      = subject.custom_code
+
+                        subject.custom_code = 'alert(2);'
                         subject.inject( response )
-                        Nokogiri::HTML(response.body).css('script')[-1].to_s.should ==
-                            "<script type=\"text/javascript\">_#{subject.token}TaintTracer.update_tracers()</script>"
+
+                        response.body.should == presponse.body.gsub( code, subject.custom_code )
                     end
                 end
             end
         end
+    end
 
-        context 'when the response already contains the JS code' do
-            it 'skips it' do
-                original_response = response.deep_clone
-                subject.inject( response )
-                original_response.should_not == response
+    describe '#javascript?' do
+        context 'when the Content-Type includes javascript' do
+            it 'returns true'
+        end
 
-                updated_response = response.deep_clone
-                subject.inject( response )
-                updated_response.should == response
-            end
+        context 'when the Content-Type does not include javascript' do
+            it 'returns false'
+        end
+    end
 
-            it 'returns false' do
-                subject.inject( response ).should be_true
-                subject.inject( response ).should be_false
-            end
+    describe '#html?' do
+        context 'when the body is empty' do
+            it 'returns false'
+        end
+
+        context 'when the Content-Type does not include text/html' do
+            it 'returns false'
+        end
+
+        context 'when the body does not include HTML identifiers such as' do
+            it 'returns false'
+        end
+
+        context 'when it matches the last loaded URL' do
+            it 'returns true'
+        end
+
+        context 'when it contains markup' do
+            it 'returns true'
         end
     end
 

data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb

@@ -75,15 +75,6 @@ describe Arachni::BrowserCluster::Jobs::ResourceExploration do
                 restored = q.pop
                 restored.should == subject
             end
-
-            it 'dups the page' do
-                q = Arachni::Support::Database::Queue.new
-                q.max_buffer_size = 0
-
-                expect_any_instance_of(Arachni::Page).to receive(:dup)
-
-                q << subject
-            end
         end
     end
 end

data/spec/arachni/browser_cluster_spec.rb

@@ -18,6 +18,24 @@ describe Arachni::BrowserCluster do
     end
 
     describe '#initialize' do
+        it "sets window width to #{Arachni::OptionGroups::BrowserCluster}#screen_width" do
+            Arachni::Options.browser_cluster.screen_width = 100
+
+            @cluster = described_class.new
+            @cluster.workers.each do |browser|
+                browser.javascript.run('return window.innerWidth').should == 100
+            end
+        end
+
+        it "sets window height to #{Arachni::OptionGroups::BrowserCluster}#screen_height" do
+            Arachni::Options.browser_cluster.screen_height = 200
+
+            @cluster = described_class.new
+            @cluster.workers.each do |browser|
+                browser.javascript.run('return window.innerHeight').should == 200
+            end
+        end
+
         describe :pool_size do
             it 'sets the amount of browsers to instantiate' do
                 @cluster = described_class.new( pool_size: 3 )
@@ -31,21 +49,51 @@ describe Arachni::BrowserCluster do
             end
         end
 
-        it "sets window width to #{Arachni::OptionGroups::BrowserCluster}#screen_width" do
-            Arachni::Options.browser_cluster.screen_width = 100
+        describe :on_pop do
+            it 'assigns blocks to be passed each poped job' do
+                cj = nil
+                @cluster = described_class.new(
+                    on_pop: proc do |j|
+                        cj = j
+                    end
+                )
 
-            @cluster = described_class.new
-            @cluster.workers.each do |browser|
-                browser.javascript.run('return window.innerWidth').should == 100
+                @cluster.queue( job ){}
+                @cluster.wait
+
+                cj.id.should == job.id
             end
         end
 
-        it "sets window height to #{Arachni::OptionGroups::BrowserCluster}#screen_height" do
-            Arachni::Options.browser_cluster.screen_height = 200
+        describe :on_queue do
+            it 'assigns blocks to be passed each queued job' do
+                cj = nil
+                @cluster = described_class.new(
+                    on_queue: proc do |j|
+                        cj = j
+                    end
+                )
 
-            @cluster = described_class.new
-            @cluster.workers.each do |browser|
-                browser.javascript.run('return window.innerHeight').should == 200
+                @cluster.queue( job ){}
+
+                cj.id.should == job.id
+                @cluster.wait
+            end
+        end
+
+        describe :on_job_done do
+            it 'assigns blocks to be passed each finished job' do
+                cj = nil
+                @cluster = described_class.new(
+                    on_job_done: proc do |j|
+                        cj = j
+                    end
+                )
+
+                @cluster.queue( job ){}
+                @cluster.wait
+
+                cj.id.should == job.id
             end
         end
     end