arachni 1.1 → 1.2

data/spec/arachni/element/xml_spec.rb

@@ -174,6 +174,26 @@ EOXML
                 subject.should be_nil
             end
         end
+
+        context 'when it is' do
+            context "equal to #{described_class::MAX_SIZE}" do
+                let(:size) { described_class::MAX_SIZE }
+
+                it 'returns nil'
+            end
+
+            context "larger than #{described_class::MAX_SIZE}" do
+                let(:size) { described_class::MAX_SIZE + 1 }
+
+                it 'returns nil'
+            end
+
+            context "smaller than #{described_class::MAX_SIZE}" do
+                let(:size) { described_class::MAX_SIZE - 1 }
+
+                it 'leaves parses it'
+            end
+        end
     end
 
     describe '.parse_inputs' do

data/spec/arachni/framework/parts/audit_spec.rb

@@ -190,13 +190,6 @@ describe Arachni::Framework::Parts::Audit do
             end
         end
 
-        it 'passes the page to #apply_dom_metadata' do
-            page = Arachni::Page.from_url( @url + '/link' )
-
-            subject.should receive(:apply_dom_metadata).with(page)
-            subject.audit_page( page )
-        end
-
         context 'when checks were' do
             context 'ran against the page' do
                 it 'returns true' do
@@ -232,15 +225,14 @@ describe Arachni::Framework::Parts::Audit do
                 Arachni::Framework.new do |f|
                     f.options.url = @url
                     f.options.audit.elements :links, :forms, :cookies
-                    f.checks.load :taint
 
                     f.url_queue_total_size.should == 0
 
                     f.audit_page( Arachni::Page.from_url( @url + '/with_javascript' ) )
 
-                    sleep 0.1 while f.wait_for_browser_cluster?
+                    f.run
 
-                    f.url_queue_total_size.should == 2
+                    f.url_queue_total_size.should == 5
                 end
             end
 
@@ -254,8 +246,8 @@ describe Arachni::Framework::Parts::Audit do
                         f.options.scope.dom_depth_limit = 1
                         f.url_queue_total_size.should == 0
                         f.audit_page( Arachni::Page.from_url( @url + '/with_javascript' ) ).should be_true
-                        sleep 0.1 while f.wait_for_browser_cluster?
-                        f.url_queue_total_size.should == 2
+                        f.run
+                        f.url_queue_total_size.should == 5
 
                         f.reset
 
@@ -268,8 +260,8 @@ describe Arachni::Framework::Parts::Audit do
                         page.dom.push_transition Arachni::Page::DOM::Transition.new( :page, :load )
 
                         f.audit_page( page ).should be_true
-                        sleep 0.1 while f.wait_for_browser_cluster?
-                        f.url_queue_total_size.should == 0
+                        f.run
+                        f.url_queue_total_size.should == 1
                     end
                 end
 
@@ -316,6 +308,11 @@ describe Arachni::Framework::Parts::Audit do
         end
 
         context "when #{Arachni::Options}#platforms" do
+            before do
+                Arachni::Platform::Manager.reset
+                subject.options.paths.fingerprinters = fixtures_path + '/empty/'
+            end
+
             context 'have been provided' do
                 context 'and are supported by the check' do
                     it 'audits it' do
@@ -333,6 +330,7 @@ describe Arachni::Framework::Parts::Audit do
                 context 'and are not supported by the check' do
                     it 'does not audit it' do
                         subject.options.platforms = [:windows]
+
                         subject.options.audit.elements :links, :forms, :cookies
 
                         subject.checks.load :taint

data/spec/arachni/framework/parts/browser_spec.rb

@@ -118,175 +118,4 @@ describe Arachni::Framework::Parts::Browser do
             end
         end
     end
-
-    describe '#apply_dom_metadata' do
-        let(:page) { Factory[:page] }
-        let(:browser_page) { Factory[:page] }
-        let(:check) { subject.checks[:taint] }
-
-        before do
-            subject.checks.load :taint
-
-            subject.browser.stub(:to_page) { browser_page }
-            Arachni::Check::Auditor.stub(:check?) { true }
-            page.stub(:has_script?) { true }
-            page.dom.stub(:depth) { 0 }
-        end
-
-        it 'returns true' do
-            subject.apply_dom_metadata( page ).should be_true
-        end
-
-        it 'applies DOM metadata' do
-            page.should receive(:import_metadata).with( browser_page, :skip_dom )
-
-            subject.apply_dom_metadata( page )
-        end
-
-        it 'clears the #browser buffers' do
-            subject.browser.should receive(:clear_buffers)
-
-            subject.apply_dom_metadata( page )
-        end
-
-        context "when #{Arachni::Page::DOM}#depth is" do
-            context 0 do
-                before do
-                    page.dom.stub(:depth) { 0 }
-                end
-
-                it 'returns true' do
-                    subject.apply_dom_metadata( page ).should be_true
-                end
-            end
-
-            context '> 0' do
-                before do
-                    page.dom.stub(:depth) { 1 }
-                end
-
-                it 'returns false' do
-                    subject.apply_dom_metadata( page ).should be_false
-                end
-            end
-        end
-
-        context "when #{Arachni::Page}#has_script? is" do
-            context false do
-                before do
-                    page.stub(:has_script?) { false }
-                end
-
-                it 'returns false' do
-                    subject.apply_dom_metadata( page ).should be_false
-                end
-            end
-
-            context true do
-                before do
-                    page.stub(:has_script?) { true }
-                end
-
-                it 'returns true' do
-                    subject.apply_dom_metadata( page ).should be_true
-                end
-            end
-        end
-
-        context 'when #use_browsers? is' do
-            context false do
-                before do
-                    subject.stub(:use_browsers?) { false }
-                end
-
-                it 'returns false' do
-                    subject.apply_dom_metadata( page ).should be_false
-                end
-            end
-
-            context true do
-                before do
-                    subject.stub(:use_browsers?) { true }
-                end
-
-                it 'returns true' do
-                    subject.apply_dom_metadata( page ).should be_true
-                end
-            end
-        end
-
-        context "when #{Arachni::Check::Auditor}.check? for [#{Arachni::Element::Form::DOM}, #{Arachni::Element::Cookie::DOM}] is" do
-            before do
-                check.should receive(:check?).with( page, [Arachni::Element::Form::DOM, Arachni::Element::Cookie::DOM] )
-            end
-
-            context false do
-                before do
-                    check.stub(:check?) { false }
-                end
-
-                it 'returns false' do
-                    subject.apply_dom_metadata( page ).should be_false
-                end
-            end
-
-            context true do
-                before do
-                    check.stub(:check?) { true }
-                end
-
-                it 'returns true' do
-                    subject.apply_dom_metadata( page ).should be_true
-                end
-            end
-        end
-
-        context "when #{Arachni::Browser}#to_page returns" do
-            context 'empty page' do
-                before do
-                    subject.browser.stub(:to_page) { Factory[:empty_page] }
-                end
-
-                it 'returns nil' do
-                    subject.apply_dom_metadata( page ).should be_nil
-                end
-            end
-
-            context 'valid page' do
-                before do
-                    subject.browser.stub(:to_page) { browser_page }
-                end
-
-                it 'returns true' do
-                    subject.apply_dom_metadata( page ).should be_true
-                end
-            end
-        end
-
-        context "when #{Arachni::Browser}#to_page raises" do
-            context "#{Selenium::WebDriver::Error::WebDriverError}" do
-                before do
-                    subject.browser.stub(:to_page) do
-                        raise Selenium::WebDriver::Error::WebDriverError
-                    end
-                end
-
-                it 'returns nil' do
-                    subject.apply_dom_metadata( page ).should be_nil
-                end
-            end
-
-            context "#{Watir::Exception::Error}" do
-                before do
-                    subject.browser.stub(:to_page) do
-                        raise Watir::Exception::Error
-                    end
-                end
-
-                it 'returns true' do
-                    subject.apply_dom_metadata( page ).should be_nil
-                end
-            end
-        end
-    end
 end

data/spec/arachni/framework/parts/platform_spec.rb

@@ -36,26 +36,32 @@ describe Arachni::Framework::Parts::Platform do
                     mongodb:    'MongoDB'
                 },
                 'Web servers' => {
-                    apache: 'Apache',
-                    iis:    'IIS',
-                    jetty:  'Jetty',
-                    nginx:  'Nginx',
-                    tomcat: 'TomCat'
+                    apache:   'Apache',
+                    iis:      'IIS',
+                    jetty:    'Jetty',
+                    nginx:    'Nginx',
+                    tomcat:   'TomCat',
+                    gunicorn: 'Gunicorn',
                 },
                 'Programming languages' => {
                     asp:    'ASP',
                     aspx:   'ASP.NET',
-                    jsp:    'JSP',
+                    java:   'Java',
                     perl:   'Perl',
                     php:    'PHP',
                     python: 'Python',
                     ruby:   'Ruby'
                 },
                 'Frameworks' => {
-                    rack: 'Rack'
+                    rack:     'Rack',
+                    django:   'Django',
+                    rails:    'Ruby on Rails',
+                    aspx_mvc: 'ASP.NET MVC',
+                    jsf:      'JavaServer Faces',
+                    cherrypy: 'CherryPy',
+                    cakephp:  'CakePHP'
                 }
             }
-
         end
     end
 

data/spec/arachni/framework/parts/report_spec.rb

@@ -6,7 +6,7 @@ describe Arachni::Framework::Parts::Report do
     describe '#reporters' do
         it 'provides access to the reporter manager' do
             subject.reporters.is_a?( Arachni::Reporter::Manager ).should be_true
-            subject.reporters.available.sort.should == %w(afr foo).sort
+            subject.reporters.available.sort.should == %w(afr foo error).sort
         end
     end
 

data/spec/arachni/framework/parts/state_spec.rb

@@ -483,15 +483,6 @@ describe Arachni::Framework::Parts::State do
             end
         end
 
-        it 'shuts down the #browser' do
-            Arachni::Framework.new do |f|
-                f.options.url = @url + '/elem_combo'
-
-                f.browser.should receive(:shutdown)
-                f.clean_up
-            end
-        end
-
         it 'stops the #plugins' do
             Arachni::Framework.new do |f|
                 f.options.url = @url + '/elem_combo'

data/spec/arachni/http/client/dynamic_404_handlers_spec.rb

@@ -31,6 +31,7 @@ describe Arachni::HTTP::Client::Dynamic404Handler do
                 res = nil
                 client.get( url + 'static/crap' ) { |c_res| res = c_res }
                 client.run
+
                 bool = false
                 subject._404?( res ) { |c_bool| bool = c_bool }
                 client.run
@@ -39,6 +40,18 @@ describe Arachni::HTTP::Client::Dynamic404Handler do
         end
 
         context 'when dealing with a dynamic handler' do
+            context 'which at any point returns non-200' do
+                it 'aborts the check' do
+                    response = client.get( url + 'dynamic/erratic', mode: :sync )
+
+                    check = nil
+                    subject._404?( response ) { |bool| check = bool }
+                    client.run
+
+                    check.should be_nil
+                end
+            end
+
             context 'which includes the requested resource in the response' do
                 it 'returns true' do
                     res = nil
@@ -88,6 +101,12 @@ describe Arachni::HTTP::Client::Dynamic404Handler do
                     end
                 end
             end
+
+            context 'when checking for a resource with a name that includes ~' do
+                context 'and the handler ignores it' do
+                    it 'returns true'
+                end
+            end
         end
 
         context 'when checking for an already checked URL' do

data/spec/arachni/http/client_spec.rb

@@ -345,13 +345,20 @@ describe Arachni::HTTP::Client do
 
         context 'when the cookies option is set' do
             it 'adds those cookies to the CookieJar' do
-                cookie_jar_file = fixtures_path + 'cookies.txt'
-                @opts.http.cookies = Arachni::Utilities.cookies_from_file( '', cookie_jar_file )
+                @opts.http.cookies = {
+                    'cookie1' => 'val1',
+                    'cookie2' => 'val2',
+                }
+
                 subject.cookie_jar.cookies.should be_empty
+
                 subject.reset
+
                 cookies = subject.cookie_jar.cookies
-                cookies.size.should == 4
-                cookies.should == @opts.http.cookies
+                cookies.size.should == 2
+
+                cookies[0].inputs.should == { 'cookie1' => 'val1' }
+                cookies[1].inputs.should == { 'cookie2' => 'val2' }
             end
         end
 
@@ -576,52 +583,136 @@ describe Arachni::HTTP::Client do
             ).request.effective_body.should == "1=%202&%203=4"
         end
 
-        describe :response_max_size do
-            context "when #{Arachni::OptionGroups::HTTP}#response_max_size is specified" do
-                it 'ignores bodies of responses which are larger than specified' do
-                    @opts.http.response_max_size = 0
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync
-                    ).body.should be_empty
+        describe :fingerprint do
+            before do
+                Arachni::Platform::Manager.clear
+            end
 
-                    @opts.http.response_max_size = 1
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync
-                    ).body.should be_empty
+            context 'nil' do
+                it 'performs platform fingerprinting on the response' do
+                    res = nil
+                    subject.request( @url + '/fingerprint.php' ) { |c_res| res = c_res }
+                    subject.run
 
-                    @opts.http.response_max_size = 999999
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync
-                    ).body.should be_empty
+                    res.platforms.to_a.should == [:php]
+                end
+            end
 
-                    @opts.http.response_max_size = 1000000
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync
-                    ).body.should_not be_empty
+            context true do
+                it 'performs platform fingerprinting on the response' do
+                    res = nil
+                    subject.request( @url + '/fingerprint.php', fingerprint: true ) { |c_res| res = c_res }
+                    subject.run
+
+                    res.platforms.to_a.should == [:php]
                 end
             end
 
-            context 'when specified' do
-                it 'ignores bodies of responses which are larger than specified' do
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync,
-                                   response_max_size: 0
-                    ).body.should be_empty
+            context false do
+                it 'does not fingerprint the response' do
+                    res = nil
+                    subject.request( @url + '/fingerprint.php', fingerprint: false ) { |c_res| res = c_res }
+                    subject.run
 
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync,
-                                   response_max_size: 1
-                    ).body.should be_empty
+                    res.platforms.should be_empty
+                end
+            end
+        end
 
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync,
-                                   response_max_size: 999999
-                    ).body.should be_empty
+        describe :response_max_size do
+            context 'when not specified' do
+                context "and #{Arachni::OptionGroups::HTTP}#response_max_size is specified" do
+                    context 'when response bodies are larger that its value' do
+                        it 'ignores them' do
+                            @opts.http.response_max_size = 0
+                            subject.request( @url + '/http_response_max_size',
+                                             mode: :sync
+                            ).body.should be_empty
+
+                            @opts.http.response_max_size = 1
+                            subject.request( @url + '/http_response_max_size',
+                                             mode: :sync
+                            ).body.should be_empty
+
+                            @opts.http.response_max_size = 999999
+                            subject.request( @url + '/http_response_max_size',
+                                             mode: :sync
+                            ).body.should be_empty
+                        end
+                    end
 
-                    subject.request( @url + '/http_response_max_size',
-                                   mode: :sync,
-                                   response_max_size: 1000000
-                    ).body.should_not be_empty
+                    context 'when response bodies are not larger that its value' do
+                        it 'reads them' do
+                            @opts.http.response_max_size = 1000000
+                            subject.request( @url + '/http_response_max_size',
+                                             mode: :sync
+                            ).body.should_not be_empty
+                        end
+                    end
+                end
+            end
+
+            context 'when specified' do
+                context 'when response bodies are larger that its value' do
+                    it 'ignores them' do
+                        subject.request( @url + '/http_response_max_size',
+                                         mode: :sync,
+                                         response_max_size: 0
+                        ).body.should be_empty
+
+                        subject.request( @url + '/http_response_max_size',
+                                         mode: :sync,
+                                         response_max_size: 1
+                        ).body.should be_empty
+
+                        subject.request( @url + '/http_response_max_size',
+                                         mode: :sync,
+                                         response_max_size: 999999
+                        ).body.should be_empty
+                    end
+                end
+
+                context 'when response bodies are not larger that its value' do
+                    it 'reads them' do
+                        subject.request( @url + '/http_response_max_size',
+                                         mode: :sync,
+                                         response_max_size: 1000000
+                        ).body.should_not be_empty
+                    end
+                end
+
+                context 'when the server returns no Content-Length' do
+                    it 'still works' do
+                        r = subject.request( @url + '/http_response_max_size/without_content_length',
+                                         mode: :sync,
+                                         response_max_size: 0
+                        )
+
+                        r.headers.should_not include 'Content-Type'
+                        r.body.should be_empty
+
+                        r = subject.request( @url + '/http_response_max_size/without_content_length',
+                                         mode: :sync,
+                                         response_max_size: 1
+                        )
+                        r.headers.should_not include 'Content-Type'
+                        r.body.should be_empty
+
+                        r = subject.request( @url + '/http_response_max_size/without_content_length',
+                                         mode: :sync,
+                                         response_max_size: 999999
+                        )
+                        r.headers.should_not include 'Content-Type'
+                        r.body.should be_empty
+
+                        r = subject.request( @url + '/http_response_max_size/without_content_length',
+                                         mode: :sync,
+                                         response_max_size: 1000000
+                        )
+
+                        r.headers.should_not include 'Content-Type'
+                        r.body.should_not be_empty
+                    end
                 end
             end
 
@@ -634,6 +725,42 @@ describe Arachni::HTTP::Client do
                     ).body.should_not be_empty
                 end
             end
+
+            it 'works for asynchronous requests' do
+                subject.request( @url + '/http_response_max_size/without_content_length',
+                                     mode: :sync,
+                                     response_max_size: 0
+                ) do |r|
+                    r.headers.should_not include 'Content-Type'
+                    r.body.should be_empty
+                end
+
+                subject.request( @url + '/http_response_max_size/without_content_length',
+                                 mode: :sync,
+                                 response_max_size: 1
+                ) do |r|
+                    r.headers.should_not include 'Content-Type'
+                    r.body.should be_empty
+                end
+
+                subject.request( @url + '/http_response_max_size/without_content_length',
+                                 mode: :sync,
+                                 response_max_size: 999999
+                ) do |r|
+                    r.headers.should_not include 'Content-Type'
+                    r.body.should be_empty
+                end
+
+                subject.request( @url + '/http_response_max_size/without_content_length',
+                                 mode: :sync,
+                                 response_max_size: 1000000
+                ) do |r|
+                    r.headers.should_not include 'Content-Type'
+                    r.body.should_not be_empty
+                end
+
+                subject.run
+            end
         end
 
         describe :no_cookie_jar do
@@ -1151,7 +1278,7 @@ describe Arachni::HTTP::Client do
         end
     end
 
-    describe '#headers' do
+    describe '#header' do
         it 'queues a GET request' do
             body = nil
             headers = { 'name' => 'val' }