arachni 1.1 → 1.2

data/spec/arachni/http/headers_spec.rb

@@ -1,6 +1,24 @@
 require 'spec_helper'
 
 describe Arachni::HTTP::Headers do
+
+    context 'when it includes multiple same names that differ in case' do
+        subject do
+            described_class.new( cookies )
+        end
+        let(:cookies) do
+            {
+                'set-cookie' => 'mycookie1=myvalue1',
+                'Set-Cookie' => 'mycookie2=myvalue2',
+                'SET-COOKIE' => 'mycookie3=myvalue3'
+            }
+        end
+
+        it 'merges them into an array' do
+            subject['set-cookie'].should == cookies.values
+        end
+    end
+
     describe '#delete' do
         it 'deleted a header field' do
             h = described_class.new( 'x-my-field' => 'stuff' )

data/spec/arachni/http/request_spec.rb

@@ -98,6 +98,29 @@ describe Arachni::HTTP::Request do
             r.parameters.should == { 'test' => 'blah' }
         end
 
+        describe :fingerprint do
+            context true do
+                it 'enables fingerprinting' do
+                    r = described_class.new( options.merge( fingerprint: true ) )
+                    r.fingerprint?.should be_true
+                end
+            end
+
+            context false do
+                it 'disables fingerprinting' do
+                    r = described_class.new( options.merge( fingerprint: false ) )
+                    r.fingerprint?.should_not be_true
+                end
+            end
+
+            context 'nil' do
+                it 'enables fingerprinting' do
+                    r = described_class.new( options.merge( fingerprint: nil ) )
+                    r.fingerprint?.should be_true
+                end
+            end
+        end
+
         context 'when url is not a String' do
             it 'raises ArgumentError' do
                 raised = false

data/spec/arachni/issue_spec.rb

@@ -242,11 +242,22 @@ describe Arachni::Issue do
     end
 
     describe '#signature=' do
-        it 'assigns a signature as a String' do
-            signature = /test.*/
+        context 'when it is a Regexp' do
+            it 'stores the source' do
+                signature = /test.*/
 
-            empty_issue.signature = signature
-            empty_issue.signature.should == signature.to_s
+                empty_issue.signature = signature
+                empty_issue.signature.should == signature.source
+            end
+        end
+
+        context 'when it is a String' do
+            it 'stores it' do
+                signature = 'stuff'
+
+                empty_issue.signature = signature
+                empty_issue.signature.should == signature
+            end
         end
 
         context 'when no signature has been given' do
@@ -396,7 +407,7 @@ describe Arachni::Issue do
                 remedy_code:     'Sample code on how to fix the issue',
                 tags:            %w(these are a few tags),
                 remarks:         { the_dude: %w(Hey!) },
-                signature:       '(?-mix:some regexp)',
+                signature:       'some regexp',
                 proof:           "string matched by '/some regexp/'",
                 check:           {
                     name:        'Test check',
@@ -523,7 +534,7 @@ describe Arachni::Issue do
                         },
                         response:  issue.response.to_h,
                         remarks:   { the_dude: %w(Hey!) },
-                        signature: '(?-mix:some regexp)',
+                        signature: 'some regexp',
                         proof:     "string matched by '/some regexp/'",
                         trusted:   true,
                         request:   issue.request.to_h,

data/spec/arachni/page_spec.rb

@@ -468,7 +468,7 @@ describe Arachni::Page do
             context 'elements with event attributes' do
                 it 'returns true' do
                     create_page(
-                        body:    '<a onmouseover="doStuff();">Stuff</a>',
+                        body:    '<a onMouseOver="doStuff();">Stuff</a>',
                         headers: { 'content-type' => 'text/html' }
                     ).has_script?.should be_true
                 end
@@ -476,7 +476,7 @@ describe Arachni::Page do
             context 'anchors with javacript: in href' do
                 it 'returns true' do
                     create_page(
-                        body:    '<a href="javascript:doStuff();">Stuff</a>',
+                        body:    '<a href="JavaScript:doStuff();">Stuff</a>',
                         headers: { 'content-type' => 'text/html' }
                     ).has_script?.should be_true
                 end
@@ -497,6 +497,26 @@ describe Arachni::Page do
         end
     end
 
+    describe '#has_elements?' do
+        context 'when the page has any of the given elements' do
+            it 'returns true' do
+                create_page(
+                    body:    '<fOrM></form>',
+                    headers: { 'content-type' => 'text/html' }
+                ).has_elements?( 'form', 'script' ).should be_true
+            end
+        end
+
+        context 'when the page has none of the given elements' do
+            it 'returns false' do
+                create_page(
+                    body:    '<fOrM></form>',
+                    headers: { 'content-type' => 'text/html' }
+                ).has_elements?( 'a', 'script' ).should be_false
+            end
+        end
+    end
+
     describe '#text?' do
         context 'when the HTTP response is text/html' do
             it 'returns true' do

data/spec/arachni/parser_spec.rb

@@ -495,6 +495,11 @@ describe Arachni::Parser do
         it 'returns an array of headers' do
             subject.headers.each { |h| h.class.should == Arachni::Element::Header }
         end
+
+        it 'includes headers from the HTTP request' do
+            subject.response.request.headers['X-Custom-Header'] = 'My-stuff'
+            subject.headers.find { |h| h.name == 'X-Custom-Header' }.should be_true
+        end
     end
 
     describe '#link_vars' do

data/spec/arachni/platform/manager_spec.rb

@@ -74,7 +74,7 @@ describe Arachni::Platform::Manager do
 
     describe '.clear' do
         it 'clear all platforms' do
-            described_class.update( 'http://test/', [:unix, :jsp] )
+            described_class.update( 'http://test/', [:unix, :java] )
             described_class.should be_any
             described_class.clear
             described_class.should be_empty
@@ -94,8 +94,17 @@ describe Arachni::Platform::Manager do
                         context 'and it is text based' do
                             context 'and has not yet been fingerprinted' do
                                 context 'and is within scope' do
-                                    it 'returns true' do
-                                        described_class.fingerprint?( page ).should be_true
+                                    context 'and has a #code of 200' do
+                                        it 'returns true' do
+                                            described_class.fingerprint?( page ).should be_true
+                                        end
+                                    end
+
+                                    context 'and has a non-200 #code' do
+                                        it 'returns false' do
+                                            page.stub(:code) { 404 }
+                                            described_class.fingerprint?( page ).should be_false
+                                        end
                                     end
                                 end
 
@@ -144,6 +153,16 @@ describe Arachni::Platform::Manager do
         it 'returns the given page' do
             described_class.fingerprint( page ).should == page
         end
+
+        context 'even when no platforms have been identified' do
+            it 'marks the page as fingerprinted' do
+                page = Arachni::Page.from_url( web_server_url_for( :auditor ) )
+
+                described_class.fingerprint( page )
+                page.platforms.should be_empty
+                described_class.fingerprint?( page ).should be_false
+            end
+        end
     end
 
     describe '.[]' do
@@ -151,7 +170,7 @@ describe Arachni::Platform::Manager do
             base = 'http://stuff.com/'
             uri  = base + '?stuff=here'
 
-            platforms << :unix << :jsp
+            platforms << :unix << :java
             described_class[uri] = platforms
             described_class[uri].should == platforms
             described_class[base].should == described_class[uri]
@@ -175,7 +194,7 @@ describe Arachni::Platform::Manager do
             base = 'http://stuff.com/'
             uri  = base + '?stuff=here'
 
-            platforms << :unix << :jsp
+            platforms << :unix << :java
 
             described_class[uri] = platforms
             described_class[uri].should == platforms
@@ -183,7 +202,7 @@ describe Arachni::Platform::Manager do
         end
 
         it 'set the platforms for the given URI' do
-            platforms = [:unix, :jsp]
+            platforms = [:unix, :java]
             described_class['http://stuff.com'] = platforms
 
             platforms.each do |platform|
@@ -192,13 +211,23 @@ describe Arachni::Platform::Manager do
         end
 
         it "converts the value to a #{described_class}" do
-            platforms = [:unix, :jsp]
+            platforms = [:unix, :java]
             described_class['http://stuff.com'] = platforms
             platforms.each do |platform|
                 described_class['http://stuff.com'].should be_kind_of described_class
             end
         end
 
+        it 'includes Options.platforms' do
+            Arachni::Options.platforms = [:ruby, :windows]
+            platforms = [:unix, :java]
+
+            described_class['http://stuff.com'] = platforms
+
+            described_class['http://stuff.com'].sort.should ==
+                (Arachni::Options.platforms | platforms).sort
+        end
+
         context 'when invalid platforms are given' do
             it 'raises Arachni::Platform::Error::Invalid' do
                 expect {
@@ -212,8 +241,8 @@ describe Arachni::Platform::Manager do
         context 'with valid platforms' do
             it 'updates self with the given platforms' do
                 described_class['http://test.com/'] << :unix
-                described_class.update( 'http://test.com/', [:jsp] )
-                described_class['http://test.com/'].sort.should == [:unix, :jsp].sort
+                described_class.update( 'http://test.com/', [:java] )
+                described_class['http://test.com/'].sort.should == [:unix, :java].sort
             end
         end
         context 'with invalid platforms' do
@@ -252,19 +281,21 @@ describe Arachni::Platform::Manager do
         end
     end
 
+    describe '#new_from_options' do
+        it 'includes Options.platforms' do
+            Arachni::Options.platforms = [:ruby, :windows]
+            platforms = [:unix, :java]
+
+            described_class.new_from_options( platforms ).sort.should ==
+                (platforms | Arachni::Options.platforms).sort
+        end
+    end
+
     describe '#initialize' do
         it 'initializes the manager with the given platforms' do
-            platforms = [:unix, :jsp, :mysql].sort
+            platforms = [:unix, :java, :mysql].sort
             described_class.new( platforms ).sort.should == platforms
         end
-
-        context 'when there are Options.platforms' do
-            it 'takes them into account' do
-                platforms = [:unix]
-                Arachni::Options.platforms = [:php, :mysql]
-                described_class.new( platforms ).sort.should == (Arachni::Options.platforms | platforms).sort
-            end
-        end
     end
 
     describe '#os' do
@@ -314,7 +345,7 @@ describe Arachni::Platform::Manager do
                 unix: [ 'UNIX stuff' ],
                 php:  [ 'PHP stuff' ]
             }
-            data = applicable_data.merge( jsp:  [ 'JSP stuff' ],
+            data = applicable_data.merge( java:    [ 'JSP stuff' ],
                                           windows: [ 'Windows stuff' ] )
 
             platforms << :unix << :php
@@ -326,7 +357,7 @@ describe Arachni::Platform::Manager do
                 linux: [ 'UNIX stuff' ],
                 bsd:   [ 'UNIX stuff' ],
                 php:   [ 'PHP stuff' ],
-                jsp:   [ 'JSP stuff' ]
+                java:  [ 'JSP stuff' ]
             }
             data = applicable_data.merge( windows: [ 'Windows stuff' ] )
 
@@ -358,7 +389,7 @@ describe Arachni::Platform::Manager do
                         linux:   [ 'Linux stuff' ],
                         php:     [ 'PHP stuff' ]
                     }
-                    data = applicable_data.merge( jsp: [ 'JSP stuff' ],
+                    data = applicable_data.merge( java: [ 'JSP stuff' ],
                                                   windows: [ 'Windows stuff' ] )
 
                     platforms << :linux << :php << :unix
@@ -386,15 +417,16 @@ describe Arachni::Platform::Manager do
                 [:unix, :linux, :bsd, :solaris, :windows,
                  :db2, :emc, :informix, :interbase, :mssql, :mysql,
                  :oracle, :firebird, :maxdb, :pgsql, :sqlite, :apache, :iis, :nginx,
-                 :tomcat, :asp, :aspx, :jsp, :perl, :php, :python, :ruby, :rack,
+                 :tomcat, :asp, :aspx, :java, :perl, :php, :python, :ruby, :rack,
                  :sybase, :frontbase, :ingres, :hsqldb, :access, :jetty, :mongodb,
-                 :aix, :sql, :nosql].sort
+                 :aix, :sql, :nosql, :aspx_mvc, :rails, :django, :gunicorn, :cakephp,
+                 :cherrypy, :jsf].sort
         end
     end
 
     describe '#each' do
         it 'iterates over all applicable platforms' do
-            included_platforms = platforms.update( [:unix, :jsp] ).sort
+            included_platforms = platforms.update( [:unix, :java] ).sort
             included_platforms.should be_any
 
             iterated = []
@@ -408,7 +440,7 @@ describe Arachni::Platform::Manager do
 
     describe '#clear' do
         it 'clear the platforms' do
-            platforms.update( [:unix, :jsp] )
+            platforms.update( [:unix, :java] )
             platforms.should be_any
             platforms.clear
             platforms.should be_empty

data/spec/arachni/reporter/manager_spec.rb

@@ -26,6 +26,32 @@ describe Arachni::Reporter::Manager do
                 reporter.options.should == options.my_symbolize_keys(false)
             end
         end
+
+        context 'when the raise argument is'do
+            context 'not given' do
+                context 'and the report raises an exception' do
+                    it 'does not raise it' do
+                        expect { @reporters.run( :error, report ) }.to_not raise_error
+                    end
+                end
+            end
+
+            context false do
+                context 'and the report raises an exception' do
+                    it 'does not raise it' do
+                        expect { @reporters.run( :error, report, {}, false ) }.to_not raise_error
+                    end
+                end
+            end
+
+            context true do
+                context 'and the report raises an exception' do
+                    it 'does not raise it' do
+                        expect { @reporters.run( :error, report, {}, true ) }.to raise_error
+                    end
+                end
+            end
+        end
     end
 
     describe '#reset' do

data/spec/arachni/rpc/server/active_options_spec.rb

@@ -24,8 +24,11 @@ describe Arachni::RPC::Server::ActiveOptions do
                 },
                 'datastore' => { 'key' => 'val' },
                 'http'      => {
-                    'cookies'       => { 'name' => 'value' },
-                    'cookie_string' => 'name3=value3'
+                    'cookies'       => {
+                        'name'  => 'value',
+                        'name2' => 'value2'
+                    },
+                    'cookie_string' => 'name3=value3;name4=value4'
                 }
             }
 
@@ -44,8 +47,10 @@ describe Arachni::RPC::Server::ActiveOptions do
             h['datastore'].should == opts['datastore']
 
             @instance.service.cookies.map { |c| Arachni::Cookie.from_rpc_data c }.should == [
-                Arachni::Cookie.new( url: opts['url'], inputs: opts['http']['cookies'] ),
-                Arachni::Cookie.new( url: opts['url'], inputs: { name3: 'value3' } )
+                Arachni::Cookie.new( url: opts['url'], inputs: { 'name'  => 'value' } ),
+                Arachni::Cookie.new( url: opts['url'], inputs: { 'name2'  => 'value2' } ),
+                Arachni::Cookie.new( url: opts['url'], inputs: { 'name3'  => 'value3' } ),
+                Arachni::Cookie.new( url: opts['url'], inputs: { 'name4'  => 'value4' } )
             ]
         end
     end

data/spec/arachni/state/framework_spec.rb

@@ -52,8 +52,8 @@ describe Arachni::State::Framework do
             context Symbol do
                 context 'and it exists in #available_status_messages' do
                     it 'pushes the associated message to #status_messages' do
-                        subject.add_status_message :pausing
-                        subject.status_messages.should == [subject.available_status_messages[:pausing]]
+                        subject.add_status_message :suspending
+                        subject.status_messages.should == [subject.available_status_messages[:suspending]]
                     end
                 end
 
@@ -633,12 +633,6 @@ describe Arachni::State::Framework do
                     subject.status.should == :pausing
                 end
 
-                it 'sets the status message to :pausing' do
-                    subject.pause( :a_caller, false )
-                    subject.status_messages.should ==
-                        [subject.available_status_messages[:pausing]]
-                end
-
                 it 'returns true' do
                     subject.pause( :a_caller, false ).should be_true
                 end

data/spec/arachni/support/cache/least_recently_pushed_spec.rb

@@ -0,0 +1,90 @@
+require 'spec_helper'
+
+describe Arachni::Support::Cache::LeastRecentlyPushed do
+    it_behaves_like 'cache'
+
+    it 'prunes itself by removing Least Recently Pushed entries' do
+        subject.max_size = 3
+
+        subject[:k]  = '1'
+        subject[:k2] = '2'
+        subject[:k3] = '3'
+        subject[:k4] = '4'
+        subject.size.should == 3
+
+        subject[:k4].should be_true
+        subject[:k3].should be_true
+        subject[:k2].should be_true
+        subject[:k].should be_nil
+
+        subject.clear
+
+        subject.max_size = 1
+        subject[:k]  = '1'
+        subject[:k2] = '3'
+        subject[:k3] = '4'
+        subject.size.should == 1
+
+        subject[:k3].should be_true
+        subject[:k2].should be_nil
+        subject[:k].should be_nil
+    end
+
+    describe '#[]=' do
+        it 'stores an object' do
+            v = 'val'
+            (subject[:key] = v).should == v
+            subject[:key].should == v
+        end
+        it 'alias of #store' do
+            v = 'val2'
+            subject.store( :key2, v ).should == v
+            subject[:key2].should == v
+        end
+    end
+
+    describe '#[]' do
+        it 'retrieves an object by key' do
+            v = 'val2'
+            subject[:key] = v
+            subject[:key].should == v
+            subject.empty?.should be_false
+        end
+
+        context 'when the key does not exist' do
+            it 'returns nil' do
+                subject[:some_key].should be_nil
+            end
+        end
+    end
+
+    describe '#delete' do
+        context 'when the key exists' do
+            it 'deletes a key and return its value' do
+                v = 'my_val'
+                subject[:my_key] = v
+                subject.delete( :my_key ).should == v
+                subject[:my_key].should be_nil
+                subject.include?( :my_key ).should be_false
+            end
+        end
+        context 'when the key does not exist' do
+            it 'returns nil' do
+                subject.delete( :my_key2 ).should be_nil
+            end
+        end
+    end
+
+    describe '#clear' do
+        it 'empties the cache' do
+            subject[:my_key2] = 'v'
+            subject.size.should > 0
+            subject.empty?.should be_false
+            subject.clear
+
+            subject.size.should == 0
+            subject.empty?.should be_true
+        end
+    end
+
+end