arachni 1.2.1 → 1.3

data/lib/arachni/issue/severity.rb

@@ -32,3 +32,5 @@ module Severity
 end
 end
 end
+
+Arachni::Severity = Arachni::Issue::Severity

data/lib/arachni/option_groups/audit.rb

@@ -147,6 +147,22 @@ class Audit < Arachni::OptionGroup
     #   Audit XML request inputs.
     attr_accessor :xmls
 
+    # @note Default is `false`.
+    #
+    # @return    [Bool]
+    #   Audit DOM inputs.
+    attr_accessor :ui_inputs
+    alias :ui_input_doms  :ui_inputs
+    alias :ui_input_doms=  :ui_inputs=
+
+    # @note Default is `false`.
+    #
+    # @return    [Bool]
+    #   Audit DOM UI forms -- i.e. combination or orphan inputs and buttons.
+    attr_accessor :ui_forms
+    alias :ui_form_doms  :ui_forms
+    alias :ui_form_doms=  :ui_forms=
+
     set_defaults(
         parameter_values:        true,
         exclude_vector_patterns: [],
@@ -235,6 +251,10 @@ class Audit < Arachni::OptionGroup
     #   * `:forms`
     #   * `:cookies`
     #   * `:headers`
+    #   * `:ui_inputs`
+    #   * `:ui_forms`
+    #   * `:xmls`
+    #   * `:jsons`
     #
     # @return   [Bool]
     #
@@ -250,8 +270,8 @@ class Audit < Arachni::OptionGroup
 
     [:links, :forms, :cookies, :headers, :cookies_extensively,
      :with_both_http_methods, :link_doms, :form_doms, :cookie_doms,
-     :jsons, :xmls, :parameter_values, :parameter_names, :with_extra_parameter
-    ].each do |attribute|
+     :jsons, :xmls, :ui_inputs, :ui_input_doms, :ui_forms, :ui_form_doms,
+     :parameter_values, :parameter_names, :with_extra_parameter].each do |attribute|
         define_method "#{attribute}?" do
             !!send( attribute )
         end

data/lib/arachni/option_groups/browser_cluster.rb

@@ -13,6 +13,10 @@ module Arachni::OptionGroups
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class BrowserCluster < Arachni::OptionGroup
 
+    # @return   [Hash]
+    #   Data to be set in the browser's `localStorage`.
+    attr_accessor :local_storage
+
     # @return   [Hash<Regexp,String>]
     #   When the page URL matched the key `Regexp`, wait until the `String` CSS
     #   selector in the value matches an element.
@@ -43,6 +47,7 @@ class BrowserCluster < Arachni::OptionGroup
     attr_accessor :screen_height
 
     set_defaults(
+        local_storage:       {},
         wait_for_elements:   {},
         pool_size:           6,
         job_timeout:         25,
@@ -52,6 +57,16 @@ class BrowserCluster < Arachni::OptionGroup
         screen_height:       1200
     )
 
+    def local_storage=( data )
+        data ||= {}
+
+        if !data.is_a?( Hash )
+            fail ArgumentError, "Expected data to be Hash, got #{data.class} instead."
+        end
+
+        @local_storage = data
+    end
+
     def css_to_wait_for( url )
         wait_for_elements.map do |pattern, css|
             next if !(url =~ pattern)

data/lib/arachni/page.rb

@@ -101,7 +101,8 @@ class Page
     end
 
     ELEMENTS = [
-        :links, :forms, :cookies, :headers, :link_templates, :jsons, :xmls
+        :links, :forms, :cookies, :headers, :link_templates, :jsons, :xmls,
+        :ui_inputs, :ui_forms
     ]
 
     METADATA = [ :nonce_name, :skip_dom ]
@@ -274,7 +275,7 @@ class Page
         @has_javascript = nil
         clear_cache
 
-        @body = string.to_s.dup.freeze
+        @body = string.to_s.dup.recode.freeze
     end
 
     ELEMENTS.each do |type|

data/lib/arachni/parser.rb

@@ -244,6 +244,16 @@ class Parser
         @link_vars ||= parsed.rewrite.query_parameters.freeze
     end
 
+    # Dummy method, only the {Browser#to_page browser} can fill this in.
+    def ui_inputs
+        []
+    end
+
+    # Dummy method, only the {Browser#to_page browser} can fill this in.
+    def ui_forms
+        []
+    end
+
     # @return   [Array<Element::Cookie>]
     #   Cookies from HTTP headers and response body.
     def cookies
@@ -320,16 +330,25 @@ class Parser
     #   Paths.
     def run_extractors
         begin
-            self.class.extractors.available.map do |name|
+            unsanitized_paths = Set.new
+            self.class.extractors.available.each do |name|
                 exception_jail false do
-                    self.class.extractors[name].new(
+                    unsanitized_paths.merge self.class.extractors[name].new(
                         document: document,
                         html:     body
                     ).run
                 end
-            end.flatten.uniq.compact.
-                map { |path| to_absolute( path ) }.compact.uniq.
-                reject { |path| skip?( path ) }
+            end
+
+            sanitized_paths = Set.new
+            unsanitized_paths.map do |path|
+                abs = to_absolute( path )
+                next if !abs || skip?( abs )
+
+                sanitized_paths << abs
+            end
+
+            sanitized_paths.to_a
         rescue => e
             print_exception e
             []

data/lib/arachni/platform/manager.rb

@@ -167,7 +167,7 @@ class Manager
         rack:     'Rack',
         django:   'Django',
         cakephp:  'CakePHP',
-        nette:  'Nette Framework',
+        nette:    'Nette',
         symfony:  'Symfony',
         rails:    'Ruby on Rails',
         aspx_mvc: 'ASP.NET MVC',
@@ -175,7 +175,6 @@ class Manager
         cherrypy: 'CherryPy'
     }
 
-    # Amount of
     PLATFORM_CACHE_SIZE = 1000
 
     def self.synchronize( &block )

data/lib/arachni/rpc/server/framework.rb

@@ -206,12 +206,11 @@ class Framework < ::Arachni::Framework
     end
 
     # @return  [Array<Hash>]
-    #   First variations of all discovered issues with generic info filled in
-    #   from the parent as {Arachni::Issue#to_rpc_data RPC data}.
+    #   Issues as {Arachni::Issue#to_rpc_data RPC data}.
     #
     # @private
     def issues
-        Data.issues.map { |issue| issue.variations.first.to_solo( issue ).to_rpc_data }
+        Data.issues.sort.map(&:to_rpc_data)
     end
 
     # @return   [Array<Hash>]
@@ -219,7 +218,7 @@ class Framework < ::Arachni::Framework
     #
     # @see #issues
     def issues_as_hash
-        Data.issues.map { |issue| issue.variations.first.to_solo( issue ).to_h }
+        Data.issues.sort.map(&:to_h)
     end
 
     # @return   [String]

data/lib/arachni/rpc/server/framework/multi_instance.rb

@@ -100,7 +100,8 @@ module MultiInstance
 
         data = {
             status: status,
-            busy:   running?
+            busy:   running?,
+            seed:   Utilities.random_seed
         }
 
         if include_issues

data/lib/arachni/session.rb

@@ -278,7 +278,7 @@ class Session
         http.get( Options.session.check_url, http_options ) do |response|
             bool = !!response.body.match( Options.session.check_pattern )
 
-            print_debug "Login check done: #{bool}"
+            print_debug "Login check done: #{bool}\n#{response}"
             block.call( bool ) if block
         end
 

data/lib/arachni/trainer.rb

@@ -127,18 +127,15 @@ class Trainer
 
         [ :forms, :links ].each { |type| has_new_elements ||= has_new?( incoming_page, type ) }
 
+        incoming_page.paths.each do |path|
+            @framework.push_to_url_queue( path )
+        end
+
         if has_new_elements
             @trainings_per_url[incoming_page.url] += 1
 
             notify_on_new_page incoming_page
             @framework.push_to_page_queue( incoming_page )
-
-        # If the page is pushed, paths will be extracted eventually, if not, we
-        # need to do it now.
-        else
-            incoming_page.paths.each do |path|
-                @framework.push_to_url_queue( path )
-            end
         end
 
         incoming_page.clear_cache

data/lib/arachni/watir/element.rb

@@ -10,7 +10,18 @@ module Watir
 class Element
 
     def opening_tag
-        html.match( /<#{tag_name}.*?>/im )[0]
+        browser.execute_script(
+            %Q[
+                var s = '<' + arguments[0].tagName.toLowerCase();
+                var attrs = arguments[0].attributes;
+                for( var l = 0; l < attrs.length; ++l ) {
+                    s += ' ' + attrs[l].name + '="' + attrs[l].value.replace( '"', '\"' ) + '"';
+                }
+                s += '>'
+                return s;
+            ],
+            self
+        )
     end
 
     def events

data/lib/version

@@ -1 +1 @@
-1.2.1
+1.3

data/spec/arachni/browser/element_locator_spec.rb

@@ -25,7 +25,7 @@ describe Arachni::Browser::ElementLocator do
     subject { described_class.new options }
 
     it "supports #{Arachni::RPC::Serializer}" do
-        subject.should == Arachni::RPC::Serializer.deep_clone( subject )
+        expect(subject).to eq(Arachni::RPC::Serializer.deep_clone( subject ))
     end
 
     describe '#to_rpc_data' do
@@ -33,7 +33,7 @@ describe Arachni::Browser::ElementLocator do
 
         %w(tag_name attributes).each do |attribute|
             it "includes '#{attribute}'" do
-                data[attribute].should == subject.send( attribute )
+                expect(data[attribute]).to eq(subject.send( attribute ))
             end
         end
     end
@@ -44,7 +44,7 @@ describe Arachni::Browser::ElementLocator do
 
         %w(tag_name attributes).each do |attribute|
             it "restores '#{attribute}'" do
-                restored.send( attribute ).should == subject.send( attribute )
+                expect(restored.send( attribute )).to eq(subject.send( attribute ))
             end
         end
     end
@@ -52,10 +52,10 @@ describe Arachni::Browser::ElementLocator do
     describe '.from_html' do
         it 'fills in locator data from HTML code' do
             l = described_class.from_html( '<a href="/test/">Click me</a>' )
-            l.tag_name.should == :a
-            l.attributes.should == {
+            expect(l.tag_name).to eq(:a)
+            expect(l.attributes).to eq({
                 'href' => '/test/'
-            }
+            })
         end
     end
 
@@ -64,27 +64,27 @@ describe Arachni::Browser::ElementLocator do
             l = described_class.from_node(
                 Nokogiri::HTML.fragment( '<a href="/test/">Click me</a>' ).children.first
             )
-            l.tag_name.should == :a
-            l.attributes.should == {
+            expect(l.tag_name).to eq(:a)
+            expect(l.attributes).to eq({
                 'href' => '/test/'
-            }
+            })
         end
     end
 
     describe '#initialize' do
         describe :tag_name do
             it 'sets #tag_name' do
-                described_class.new( tag_name: :a ).tag_name.should == :a
+                expect(described_class.new( tag_name: :a ).tag_name).to eq(:a)
             end
 
             it 'converts it to a Sybmol' do
-                described_class.new( tag_name: 'a' ).tag_name.should == :a
+                expect(described_class.new( tag_name: 'a' ).tag_name).to eq(:a)
             end
         end
 
         describe :attributes do
             it 'sets #attributes' do
-                described_class.new( attributes: attributes ).attributes.should == attributes
+                expect(described_class.new( attributes: attributes ).attributes).to eq(attributes)
             end
         end
     end
@@ -95,14 +95,14 @@ describe Arachni::Browser::ElementLocator do
 
             l = described_class.new( tag_name: :a, attributes: { href: '#stuff'} )
             element = l.locate( browser )
-            element.should be_kind_of Watir::HTMLElement
-            element.exists?.should be_true
+            expect(element).to be_kind_of Watir::HTMLElement
+            expect(element.exists?).to be_truthy
         end
 
         context 'when the element cannot be located' do
             it "returns a #{Watir} locator" do
                 browser.load "#{url}/digest"
-                subject.locate( browser ).exists?.should be_false
+                expect(subject.locate( browser ).exists?).to be_falsey
             end
         end
     end
@@ -110,30 +110,30 @@ describe Arachni::Browser::ElementLocator do
     describe '#css' do
         context 'when there are no attributes' do
             it 'returns a CSS locator with just the tag name' do
-                described_class.new( tag_name: :a ).css.should == 'a'
+                expect(described_class.new( tag_name: :a ).css).to eq('a')
             end
         end
 
         context 'when there is an attribute' do
             it 'returns a CSS locator with the attribute' do
-                described_class.new(
+                expect(described_class.new(
                     tag_name: :a,
                     attributes: {
                         stuff: 'blah'
                     }
-                ).css.should == 'a[stuff="blah"]'
+                ).css).to eq('a[stuff="blah"]')
             end
         end
 
         context 'when there are multiple attributes' do
             it 'returns a CSS locator with the attributes' do
-                described_class.new(
+                expect(described_class.new(
                     tag_name: :a,
                     attributes: {
                         stuff:  'blah',
                         stuff2: 'blah2'
                     }
-                ).css.should == 'a[stuff="blah"][stuff2="blah2"]'
+                ).css).to eq('a[stuff="blah"][stuff2="blah2"]')
             end
         end
     end
@@ -142,13 +142,13 @@ describe Arachni::Browser::ElementLocator do
         it 'sets #tag_name' do
             l = described_class.new
             l.tag_name = tag_name
-            l.tag_name.should == tag_name
+            expect(l.tag_name).to eq(tag_name)
         end
 
         it 'converts the arguments to a Symbol' do
             l = described_class.new
             l.tag_name = tag_name.to_s
-            l.tag_name.should == tag_name.to_sym
+            expect(l.tag_name).to eq(tag_name.to_sym)
         end
     end
 
@@ -156,71 +156,71 @@ describe Arachni::Browser::ElementLocator do
         it 'sets #attributes' do
             l = described_class.new
             l.attributes = attributes
-            l.attributes.should == attributes
+            expect(l.attributes).to eq(attributes)
         end
 
         it 'converts the keys and values to strings' do
             l = described_class.new
             l.attributes = attributes.
                 inject({}) { |h, (k,v)| h[k.to_sym] = v.to_sym; h }
-            l.attributes.should == attributes
+            expect(l.attributes).to eq(attributes)
         end
 
         it 'freezes the keys and values' do
             l = described_class.new
             l.attributes = attributes
             l.attributes.each do |k, v|
-                k.should be_frozen
-                v.should be_frozen
+                expect(k).to be_frozen
+                expect(v).to be_frozen
             end
         end
 
         it 'freezes the hash' do
             l = described_class.new
             l.attributes = attributes
-            l.attributes.should be_frozen
+            expect(l.attributes).to be_frozen
         end
     end
 
     describe '#locatable_attributes' do
         it 'returns attributes that can be used to locate the element' do
-            described_class.new(
+            expect(described_class.new(
                 tag_name: :a,
                 attributes: attributes.merge(
                     'custom-attr' => 'blah',
                     'data-id' => 'blah'
                 )
-            ).locatable_attributes.should == { id: 'my-id', data_id: 'blah' }
+            ).locatable_attributes).to eq({ id: 'my-id', data_id: 'blah' })
         end
     end
 
     describe '#to_s' do
         it 'converts it to an HTML opening tag' do
-            subject.to_s.should == '<a id="my-id" class="my-class">'
-            described_class.new( tag_name: tag_name ).to_s.should == '<a>'
+            expect(subject.to_s).to eq('<a id="my-id" class="my-class">')
+            expect(described_class.new( tag_name: tag_name ).to_s).to eq('<a>')
         end
     end
 
     describe '#inspect' do
         it 'is aliased to #to_s' do
-            subject.to_s.should == subject.inspect
+            expect(subject.to_s).to eq(subject.inspect)
         end
     end
 
     describe '#to_hash' do
         it 'converts it to a Hash' do
-            subject.to_hash.should == options
+            expect(subject.to_hash).to eq(options)
         end
 
         it 'is aliased to #to_h' do
-            subject.to_h.should == subject.to_hash
+            expect(subject.to_h).to eq(subject.to_hash)
         end
     end
 
     describe '#dup' do
         it 'duplicates self' do
-            subject.dup.should == subject
-            subject.dup.object_id.should_not == subject.object_id
+            expect(subject.dup).to eq(subject)
+            expect(subject.dup.object_id).not_to eq(subject.object_id)
         end
     end
 
@@ -228,20 +228,20 @@ describe Arachni::Browser::ElementLocator do
         context 'when the #tag_name changes' do
             it 'changes' do
                 hash = subject.hash
-                hash.should == subject.hash
+                expect(hash).to eq(subject.hash)
 
                 subject.tag_name = 'stuff'
-                hash.should_not == subject.hash
+                expect(hash).not_to eq(subject.hash)
             end
         end
 
         context 'when the #attributes change' do
             it 'changes' do
                 hash = subject.hash
-                hash.should == subject.hash
+                expect(hash).to eq(subject.hash)
 
                 subject.attributes = { 1 => 2 }
-                hash.should_not == subject.hash
+                expect(hash).not_to eq(subject.hash)
             end
         end
     end
@@ -249,8 +249,8 @@ describe Arachni::Browser::ElementLocator do
     describe '#==' do
         context 'when the objects are equal' do
             it 'returns true' do
-                subject.should == subject
-                subject.dup.should == subject
+                expect(subject).to eq(subject)
+                expect(subject.dup).to eq(subject)
             end
         end
 
@@ -258,7 +258,7 @@ describe Arachni::Browser::ElementLocator do
             it 'returns false' do
                 dup = subject.dup
                 dup.tag_name = 'stuff'
-                dup.should_not == subject
+                expect(dup).not_to eq(subject)
             end
         end
     end