arachni 1.2.1 → 1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +66 -0
- data/Gemfile +1 -1
- data/README.md +16 -5
- data/components/checks/active/ldap_injection/errors.txt +1 -0
- data/components/checks/active/source_code_disclosure.rb +1 -1
- data/components/checks/active/unvalidated_redirect.rb +6 -6
- data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
- data/components/checks/passive/grep/captcha.rb +14 -5
- data/components/checks/passive/grep/form_upload.rb +7 -3
- data/components/checks/passive/grep/hsts.rb +3 -3
- data/components/checks/passive/grep/html_objects.rb +2 -3
- data/components/checks/passive/grep/http_only_cookies.rb +2 -3
- data/components/checks/passive/grep/insecure_cookies.rb +1 -1
- data/components/checks/passive/grep/password_autocomplete.rb +2 -2
- data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
- data/components/checks/passive/grep/x_frame_options.rb +2 -2
- data/components/checks/passive/http_put.rb +2 -3
- data/components/path_extractors/comments.rb +3 -3
- data/components/path_extractors/scripts.rb +10 -1
- data/components/plugins/defaults/autothrottle.rb +27 -18
- data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
- data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
- data/components/plugins/login_script.rb +9 -3
- data/components/plugins/proxy.rb +4 -3
- data/components/reporters/html.rb +11 -14
- data/components/reporters/html/default/issue.erb +13 -38
- data/components/reporters/html/default/issue/info.erb +1 -1
- data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
- data/components/reporters/stdout.rb +62 -71
- data/components/reporters/xml.rb +26 -40
- data/components/reporters/xml/schema.xsd +43 -89
- data/lib/arachni/browser.rb +52 -3
- data/lib/arachni/browser/javascript.rb +3 -3
- data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
- data/lib/arachni/browser_cluster.rb +61 -0
- data/lib/arachni/browser_cluster/job.rb +21 -1
- data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/worker.rb +5 -0
- data/lib/arachni/check/auditor.rb +22 -12
- data/lib/arachni/data/framework.rb +13 -1
- data/lib/arachni/data/issues.rb +9 -25
- data/lib/arachni/element/base.rb +9 -3
- data/lib/arachni/element/capabilities/analyzable.rb +2 -6
- data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
- data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
- data/lib/arachni/element/capabilities/auditable.rb +0 -6
- data/lib/arachni/element/capabilities/dom_only.rb +61 -0
- data/lib/arachni/element/capabilities/with_dom.rb +3 -1
- data/lib/arachni/element/cookie.rb +35 -5
- data/lib/arachni/element/cookie/dom.rb +13 -4
- data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
- data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
- data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
- data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
- data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
- data/lib/arachni/element/form.rb +12 -1
- data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
- data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/form/dom.rb +9 -3
- data/lib/arachni/element/header.rb +14 -33
- data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
- data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
- data/lib/arachni/element/input/dom.rb +71 -0
- data/lib/arachni/element/json.rb +2 -0
- data/lib/arachni/element/link.rb +3 -0
- data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link/dom.rb +16 -3
- data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/link_template.rb +3 -5
- data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
- data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link_template/dom.rb +16 -3
- data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/server.rb +3 -5
- data/lib/arachni/element/ui_form.rb +106 -0
- data/lib/arachni/element/ui_form/dom.rb +107 -0
- data/lib/arachni/element/ui_input.rb +62 -0
- data/lib/arachni/element/xml.rb +2 -1
- data/lib/arachni/framework.rb +7 -5
- data/lib/arachni/framework/parts/audit.rb +0 -1
- data/lib/arachni/framework/parts/check.rb +1 -0
- data/lib/arachni/framework/parts/data.rb +4 -0
- data/lib/arachni/framework/parts/state.rb +0 -2
- data/lib/arachni/http/client.rb +17 -6
- data/lib/arachni/http/proxy_server.rb +52 -5
- data/lib/arachni/http/request.rb +1 -1
- data/lib/arachni/issue.rb +34 -179
- data/lib/arachni/issue/severity.rb +2 -0
- data/lib/arachni/option_groups/audit.rb +22 -2
- data/lib/arachni/option_groups/browser_cluster.rb +15 -0
- data/lib/arachni/page.rb +3 -2
- data/lib/arachni/parser.rb +24 -5
- data/lib/arachni/platform/manager.rb +1 -2
- data/lib/arachni/rpc/server/framework.rb +3 -4
- data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
- data/lib/arachni/session.rb +1 -1
- data/lib/arachni/trainer.rb +4 -7
- data/lib/arachni/watir/element.rb +12 -1
- data/lib/version +1 -1
- data/spec/arachni/browser/element_locator_spec.rb +43 -43
- data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
- data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
- data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
- data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
- data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
- data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
- data/spec/arachni/browser/javascript_spec.rb +73 -63
- data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
- data/spec/arachni/browser_cluster/job_spec.rb +68 -48
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
- data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
- data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
- data/spec/arachni/browser_cluster_spec.rb +64 -39
- data/spec/arachni/browser_spec.rb +692 -527
- data/spec/arachni/check/auditor_spec.rb +177 -147
- data/spec/arachni/check/base_spec.rb +33 -33
- data/spec/arachni/check/manager_spec.rb +15 -15
- data/spec/arachni/component/base_spec.rb +8 -8
- data/spec/arachni/component/manager_spec.rb +100 -99
- data/spec/arachni/component/options/address_spec.rb +3 -3
- data/spec/arachni/component/options/base_spec.rb +7 -7
- data/spec/arachni/component/options/bool_spec.rb +9 -9
- data/spec/arachni/component/options/float_spec.rb +6 -6
- data/spec/arachni/component/options/int_spec.rb +5 -5
- data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
- data/spec/arachni/component/options/object_spec.rb +2 -2
- data/spec/arachni/component/options/path_spec.rb +3 -3
- data/spec/arachni/component/options/port_spec.rb +5 -5
- data/spec/arachni/component/options/string_spec.rb +3 -3
- data/spec/arachni/component/options/url_spec.rb +4 -4
- data/spec/arachni/component/utilities_spec.rb +2 -2
- data/spec/arachni/data/framework/rpc_spec.rb +10 -9
- data/spec/arachni/data/framework_spec.rb +65 -46
- data/spec/arachni/data/issues_spec.rb +39 -77
- data/spec/arachni/data/plugins_spec.rb +11 -11
- data/spec/arachni/data/session_spec.rb +6 -6
- data/spec/arachni/data_spec.rb +8 -8
- data/spec/arachni/element/body_spec.rb +10 -10
- data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
- data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
- data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
- data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
- data/spec/arachni/element/cookie/dom_spec.rb +37 -18
- data/spec/arachni/element/cookie_spec.rb +206 -139
- data/spec/arachni/element/form/dom_spec.rb +36 -19
- data/spec/arachni/element/form_spec.rb +210 -187
- data/spec/arachni/element/generic_dom_spec.rb +14 -14
- data/spec/arachni/element/header_spec.rb +35 -17
- data/spec/arachni/element/json_spec.rb +53 -31
- data/spec/arachni/element/link/dom_spec.rb +46 -28
- data/spec/arachni/element/link_spec.rb +58 -40
- data/spec/arachni/element/link_template/dom_spec.rb +47 -29
- data/spec/arachni/element/link_template_spec.rb +79 -61
- data/spec/arachni/element/path_spec.rb +1 -1
- data/spec/arachni/element/server_spec.rb +33 -32
- data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
- data/spec/arachni/element/ui_form_spec.rb +242 -0
- data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
- data/spec/arachni/element/ui_input_spec.rb +136 -0
- data/spec/arachni/element/xml_spec.rb +42 -24
- data/spec/arachni/element_filter_spec.rb +49 -48
- data/spec/arachni/error_spec.rb +3 -3
- data/spec/arachni/framework/parts/audit_spec.rb +64 -63
- data/spec/arachni/framework/parts/browser_spec.rb +16 -16
- data/spec/arachni/framework/parts/check_spec.rb +3 -3
- data/spec/arachni/framework/parts/data_spec.rb +48 -48
- data/spec/arachni/framework/parts/platform_spec.rb +3 -3
- data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
- data/spec/arachni/framework/parts/report_spec.rb +7 -7
- data/spec/arachni/framework/parts/scope_spec.rb +16 -16
- data/spec/arachni/framework/parts/state_spec.rb +68 -69
- data/spec/arachni/framework_spec.rb +39 -31
- data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
- data/spec/arachni/http/client_spec.rb +219 -208
- data/spec/arachni/http/cookie_jar_spec.rb +72 -72
- data/spec/arachni/http/headers_spec.rb +14 -14
- data/spec/arachni/http/proxy_server_spec.rb +43 -42
- data/spec/arachni/http/request_spec.rb +105 -103
- data/spec/arachni/http/response/scope_spec.rb +24 -24
- data/spec/arachni/http/response_spec.rb +50 -49
- data/spec/arachni/issue/severity_spec.rb +10 -9
- data/spec/arachni/issue_spec.rb +71 -369
- data/spec/arachni/option_groups/audit_spec.rb +114 -114
- data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
- data/spec/arachni/option_groups/datastore_spec.rb +6 -6
- data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
- data/spec/arachni/option_groups/http_spec.rb +11 -11
- data/spec/arachni/option_groups/input_spec.rb +31 -27
- data/spec/arachni/option_groups/output_spec.rb +2 -2
- data/spec/arachni/option_groups/paths_spec.rb +17 -17
- data/spec/arachni/option_groups/rpc_spec.rb +2 -2
- data/spec/arachni/option_groups/scope_spec.rb +40 -40
- data/spec/arachni/option_groups/session_spec.rb +6 -5
- data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
- data/spec/arachni/options_spec.rb +46 -45
- data/spec/arachni/page/dom/transition_spec.rb +74 -72
- data/spec/arachni/page/dom_spec.rb +35 -35
- data/spec/arachni/page/scope_spec.rb +15 -15
- data/spec/arachni/page_spec.rb +217 -217
- data/spec/arachni/parser_spec.rb +106 -104
- data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
- data/spec/arachni/platform/list_spec.rb +33 -33
- data/spec/arachni/platform/manager_spec.rb +67 -64
- data/spec/arachni/plugin/base_spec.rb +10 -10
- data/spec/arachni/plugin/manager_spec.rb +38 -37
- data/spec/arachni/report_spec.rb +43 -40
- data/spec/arachni/reporter/base_spec.rb +15 -15
- data/spec/arachni/reporter/manager_spec.rb +4 -4
- data/spec/arachni/reporter/options_spec.rb +6 -6
- data/spec/arachni/rpc/client/base_spec.rb +6 -6
- data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
- data/spec/arachni/rpc/client/instance_spec.rb +6 -6
- data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
- data/spec/arachni/rpc/server/base_spec.rb +5 -5
- data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
- data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
- data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
- data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
- data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
- data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
- data/spec/arachni/rpc/server/framework_spec.rb +90 -85
- data/spec/arachni/rpc/server/instance_spec.rb +126 -107
- data/spec/arachni/rpc/server/output_spec.rb +1 -1
- data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
- data/spec/arachni/ruby/array_spec.rb +42 -42
- data/spec/arachni/ruby/hash_spec.rb +20 -18
- data/spec/arachni/ruby/io_spec.rb +2 -2
- data/spec/arachni/ruby/object_spec.rb +1 -1
- data/spec/arachni/ruby/set_spec.rb +3 -3
- data/spec/arachni/ruby/string_spec.rb +30 -30
- data/spec/arachni/ruby/webrick_spec.rb +2 -2
- data/spec/arachni/scope_spec.rb +1 -1
- data/spec/arachni/session_spec.rb +67 -64
- data/spec/arachni/snapshot_spec.rb +15 -15
- data/spec/arachni/state/audit_spec.rb +11 -11
- data/spec/arachni/state/element_filter_spec.rb +6 -6
- data/spec/arachni/state/framework/rpc_spec.rb +12 -12
- data/spec/arachni/state/framework_spec.rb +125 -121
- data/spec/arachni/state/http_spec.rb +7 -7
- data/spec/arachni/state/options_spec.rb +7 -7
- data/spec/arachni/state/plugins_spec.rb +8 -8
- data/spec/arachni/state_spec.rb +10 -10
- data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
- data/spec/arachni/support/buffer/base_spec.rb +39 -39
- data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
- data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
- data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
- data/spec/arachni/support/cache/preference_spec.rb +4 -4
- data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
- data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
- data/spec/arachni/support/database/hash_spec.rb +44 -43
- data/spec/arachni/support/database/queue_spec.rb +27 -27
- data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
- data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
- data/spec/arachni/support/mixins/observable_spec.rb +6 -6
- data/spec/arachni/support/signature_spec.rb +19 -19
- data/spec/arachni/trainer_spec.rb +39 -39
- data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
- data/spec/arachni/uri/scope_spec.rb +66 -66
- data/spec/arachni/uri_spec.rb +107 -105
- data/spec/arachni/utilities_spec.rb +40 -40
- data/spec/components/checks/active/csrf_spec.rb +8 -8
- data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
- data/spec/components/checks/active/sql_injection_spec.rb +16 -16
- data/spec/components/checks/active/trainer_spec.rb +4 -4
- data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
- data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
- data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
- data/spec/components/checks/active/xss_dom_spec.rb +46 -24
- data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
- data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
- data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
- data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
- data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
- data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
- data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
- data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
- data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
- data/spec/components/checks/passive/webdav_spec.rb +1 -1
- data/spec/components/checks/passive/xst_spec.rb +1 -1
- data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
- data/spec/components/path_extractors/comments_spec.rb +5 -1
- data/spec/components/path_extractors/scripts_spec.rb +5 -2
- data/spec/components/plugins/autologin_spec.rb +22 -22
- data/spec/components/plugins/autothrottle_spec.rb +6 -5
- data/spec/components/plugins/content_types_spec.rb +4 -4
- data/spec/components/plugins/cookie_collector_spec.rb +5 -5
- data/spec/components/plugins/exec_spec.rb +12 -12
- data/spec/components/plugins/form_dicattack_spec.rb +3 -3
- data/spec/components/plugins/headers_collector_spec.rb +8 -8
- data/spec/components/plugins/healthmap_spec.rb +3 -3
- data/spec/components/plugins/http_dicattack_spec.rb +3 -3
- data/spec/components/plugins/login_script_spec.rb +79 -22
- data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
- data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
- data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
- data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
- data/spec/components/plugins/script_spec.rb +1 -1
- data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
- data/spec/components/plugins/vector_collector_spec.rb +2 -2
- data/spec/components/plugins/vector_feed_spec.rb +40 -40
- data/spec/components/plugins/waf_detector_spec.rb +6 -6
- data/spec/components/reporters/json_spec.rb +4 -4
- data/spec/components/reporters/marshal_spec.rb +2 -2
- data/spec/components/reporters/yaml_spec.rb +3 -2
- data/spec/external/wavsep/active/sqli_spec.rb +1 -3
- data/spec/spec_helper.rb +4 -0
- data/spec/support/factories/element/ui_form.rb +14 -0
- data/spec/support/factories/element/ui_input.rb +13 -0
- data/spec/support/factories/issue.rb +0 -13
- data/spec/support/fixtures/report.afr +0 -0
- data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
- data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/pages.rb +2 -2
- data/spec/support/servers/arachni/browser.rb +139 -0
- data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
- data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
- data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
- data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
- data/spec/support/servers/checks/active/trainer_check.rb +7 -7
- data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
- data/spec/support/servers/checks/active/xss_dom.rb +50 -0
- data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
- data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
- data/spec/support/shared/check.rb +10 -12
- data/spec/support/shared/component/options/base.rb +24 -24
- data/spec/support/shared/element/base.rb +25 -25
- data/spec/support/shared/element/capabilities/auditable.rb +116 -140
- data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
- data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
- data/spec/support/shared/element/capabilities/mutable.rb +122 -111
- data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
- data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
- data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
- data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
- data/spec/support/shared/element/capabilities/with_node.rb +4 -6
- data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
- data/spec/support/shared/element/capabilities/with_source.rb +6 -8
- data/spec/support/shared/element/dom.rb +144 -0
- data/spec/support/shared/element/dom/auditable.rb +42 -0
- data/spec/support/shared/element/dom/inputtable.rb +5 -0
- data/spec/support/shared/element/dom/mutable.rb +3 -0
- data/spec/support/shared/element/dom/submittable.rb +119 -0
- data/spec/support/shared/external/wavsep.rb +3 -3
- data/spec/support/shared/fingerprinter.rb +2 -2
- data/spec/support/shared/framework.rb +1 -1
- data/spec/support/shared/http/message.rb +9 -9
- data/spec/support/shared/option_group.rb +17 -17
- data/spec/support/shared/path_extractor.rb +1 -1
- data/spec/support/shared/plugin.rb +2 -2
- data/spec/support/shared/support/cache.rb +57 -57
- data/spec/support/shared/support/lookup.rb +25 -25
- data/ui/cli/framework.rb +22 -11
- data/ui/cli/framework/option_parser.rb +15 -0
- data/ui/cli/option_parser.rb +8 -1
- data/ui/cli/output.rb +2 -1
- metadata +54 -20
- data/components/checks/active/xss_dom_inputs.rb +0 -236
- data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
- data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
- data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
|
@@ -27,20 +27,20 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
27
27
|
|
|
28
28
|
describe '#class' do
|
|
29
29
|
it "returns #{described_class}" do
|
|
30
|
-
subject.class.
|
|
30
|
+
expect(subject.class).to eq(described_class)
|
|
31
31
|
end
|
|
32
32
|
end
|
|
33
33
|
|
|
34
34
|
describe '#initialized' do
|
|
35
35
|
it 'returns true' do
|
|
36
|
-
subject.initialized.
|
|
36
|
+
expect(subject.initialized).to be_truthy
|
|
37
37
|
end
|
|
38
38
|
end
|
|
39
39
|
|
|
40
40
|
it 'adds _arachni_events property to elements holding the tracked events' do
|
|
41
41
|
load '/elements_with_events/listeners'
|
|
42
42
|
|
|
43
|
-
javascript.run( "return document.getElementById('my-button')._arachni_events").
|
|
43
|
+
expect(javascript.run( "return document.getElementById('my-button')._arachni_events")).to eq([
|
|
44
44
|
[
|
|
45
45
|
'click',
|
|
46
46
|
'function (my_button_click) {}'
|
|
@@ -53,42 +53,42 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
53
53
|
'onmouseover',
|
|
54
54
|
'function (my_button_onmouseover) {}'
|
|
55
55
|
]
|
|
56
|
-
]
|
|
56
|
+
])
|
|
57
57
|
|
|
58
|
-
javascript.run( "return document.getElementById('my-button2')._arachni_events").
|
|
58
|
+
expect(javascript.run( "return document.getElementById('my-button2')._arachni_events")).to eq([
|
|
59
59
|
[
|
|
60
60
|
'click',
|
|
61
61
|
'function (my_button2_click) {}'
|
|
62
62
|
]
|
|
63
|
-
]
|
|
63
|
+
])
|
|
64
64
|
|
|
65
|
-
javascript.run( "return document.getElementById('my-button3')._arachni_events").
|
|
65
|
+
expect(javascript.run( "return document.getElementById('my-button3')._arachni_events")).to be_nil
|
|
66
66
|
end
|
|
67
67
|
|
|
68
68
|
describe '#digest' do
|
|
69
69
|
it 'returns a string digest of the current DOM tree' do
|
|
70
70
|
load '/digest'
|
|
71
|
-
subject.digest.
|
|
71
|
+
expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://javascri' <<
|
|
72
72
|
'pt.browser.arachni/' <<'taint_tracer.js><SCRIPT src' <<
|
|
73
73
|
'=http://javascript.browser.arachni/dom_monitor.js><SCRIPT>' <<
|
|
74
74
|
'<BODY onload=void();><DIV id=my-id-div><DIV class=my-class' <<
|
|
75
75
|
'-div><STRONG><EM><I><B><STRONG><SCRIPT><SCRIPT type=text/' <<
|
|
76
|
-
'javascript><A href=#stuff>'
|
|
76
|
+
'javascript><A href=#stuff>')
|
|
77
77
|
end
|
|
78
78
|
|
|
79
79
|
it 'does not include <p> elements' do
|
|
80
80
|
load '/digest/p'
|
|
81
|
-
subject.digest.
|
|
81
|
+
expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://javascript' <<
|
|
82
82
|
'.browser.arachni/taint_tracer.js><SCRIPT src=http://' <<
|
|
83
|
-
'javascript.browser.arachni/dom_monitor.js><SCRIPT><BODY><STRONG>'
|
|
83
|
+
'javascript.browser.arachni/dom_monitor.js><SCRIPT><BODY><STRONG>')
|
|
84
84
|
end
|
|
85
85
|
|
|
86
86
|
it "does not include 'data-arachni-id' attributes" do
|
|
87
87
|
load '/digest/data-arachni-id'
|
|
88
|
-
subject.digest.
|
|
88
|
+
expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://javascript' <<
|
|
89
89
|
'.browser.arachni/taint_tracer.js><SCRIPT src=http://' <<
|
|
90
90
|
'javascript.browser.arachni/dom_monitor.js><SCRIPT><BODY><DIV ' <<
|
|
91
|
-
'id=my-id-div><DIV class=my-class-div>'
|
|
91
|
+
'id=my-id-div><DIV class=my-class-div>')
|
|
92
92
|
end
|
|
93
93
|
end
|
|
94
94
|
|
|
@@ -96,7 +96,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
96
96
|
it 'keeps track of setTimeout() timers' do
|
|
97
97
|
load '/timeouts'
|
|
98
98
|
|
|
99
|
-
subject.timeouts.
|
|
99
|
+
expect(subject.timeouts).to eq([
|
|
100
100
|
[
|
|
101
101
|
"function (name, value) {\n document.cookie = name + \"=post-\" + value;\n }",
|
|
102
102
|
1000, 'timeout1', 1000
|
|
@@ -109,16 +109,16 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
109
109
|
"function (name, value) {\n document.cookie = name + \"=post-\" + value;\n }",
|
|
110
110
|
2000, 'timeout3', 2000
|
|
111
111
|
]
|
|
112
|
-
]
|
|
112
|
+
])
|
|
113
113
|
|
|
114
|
-
@browser.load_delay.
|
|
115
|
-
@browser.cookies.size.
|
|
116
|
-
@browser.cookies.map { |c| c.to_s }.sort.
|
|
114
|
+
expect(@browser.load_delay).to eq(2000)
|
|
115
|
+
expect(@browser.cookies.size).to eq(4)
|
|
116
|
+
expect(@browser.cookies.map { |c| c.to_s }.sort).to eq([
|
|
117
117
|
'timeout3=post-2000',
|
|
118
118
|
'timeout2=post-1500',
|
|
119
119
|
'timeout1=post-1000',
|
|
120
120
|
'timeout=pre'
|
|
121
|
-
].sort
|
|
121
|
+
].sort)
|
|
122
122
|
end
|
|
123
123
|
end
|
|
124
124
|
|
|
@@ -126,19 +126,19 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
126
126
|
it 'keeps track of setInterval() timers' do
|
|
127
127
|
load '/intervals'
|
|
128
128
|
|
|
129
|
-
subject.intervals.
|
|
129
|
+
expect(subject.intervals).to eq([
|
|
130
130
|
[
|
|
131
131
|
"function (name, value) {\n document.cookie = name + \"=post-\" + value;\n }",
|
|
132
132
|
2000, 'timeout1', 2000
|
|
133
133
|
]
|
|
134
|
-
]
|
|
134
|
+
])
|
|
135
135
|
|
|
136
136
|
sleep 2
|
|
137
|
-
@browser.cookies.size.
|
|
138
|
-
@browser.cookies.map { |c| c.to_s }.sort.
|
|
137
|
+
expect(@browser.cookies.size).to eq(2)
|
|
138
|
+
expect(@browser.cookies.map { |c| c.to_s }.sort).to eq([
|
|
139
139
|
'timeout1=post-2000',
|
|
140
140
|
'timeout=pre'
|
|
141
|
-
].sort
|
|
141
|
+
].sort)
|
|
142
142
|
end
|
|
143
143
|
end
|
|
144
144
|
|
|
@@ -146,7 +146,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
146
146
|
it 'skips non visible elements' do
|
|
147
147
|
load '/elements_with_events/with-hidden'
|
|
148
148
|
|
|
149
|
-
subject.elements_with_events.
|
|
149
|
+
expect(subject.elements_with_events).to eq([
|
|
150
150
|
{
|
|
151
151
|
'tag_name' => 'html',
|
|
152
152
|
'events' => [],
|
|
@@ -170,14 +170,14 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
170
170
|
'id' => 'my-button'
|
|
171
171
|
}
|
|
172
172
|
}
|
|
173
|
-
]
|
|
173
|
+
])
|
|
174
174
|
end
|
|
175
175
|
|
|
176
176
|
context 'when it has a dot delimited custom event' do
|
|
177
177
|
it 'retains the first part' do
|
|
178
178
|
load '/elements_with_events/custom-dot-delimited'
|
|
179
179
|
|
|
180
|
-
subject.elements_with_events.
|
|
180
|
+
expect(subject.elements_with_events).to eq([
|
|
181
181
|
{
|
|
182
182
|
"tag_name" => "html",
|
|
183
183
|
"events" => [],
|
|
@@ -203,7 +203,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
203
203
|
"id" => "my-button"
|
|
204
204
|
}
|
|
205
205
|
}
|
|
206
|
-
]
|
|
206
|
+
])
|
|
207
207
|
end
|
|
208
208
|
end
|
|
209
209
|
|
|
@@ -212,7 +212,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
212
212
|
it 'returns information about all DOM elements along with their events' do
|
|
213
213
|
load '/elements_with_events/attributes'
|
|
214
214
|
|
|
215
|
-
subject.elements_with_events.
|
|
215
|
+
expect(subject.elements_with_events).to eq([
|
|
216
216
|
{ 'tag_name' => 'html', 'events' => [], 'attributes' => {}
|
|
217
217
|
},
|
|
218
218
|
{
|
|
@@ -233,7 +233,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
233
233
|
'events' => [],
|
|
234
234
|
'attributes' => { 'onclick' => 'handler_3()', 'id' => 'my-button3' }
|
|
235
235
|
}
|
|
236
|
-
]
|
|
236
|
+
])
|
|
237
237
|
end
|
|
238
238
|
end
|
|
239
239
|
|
|
@@ -241,7 +241,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
241
241
|
it 'returns information about all DOM elements along with their events' do
|
|
242
242
|
load '/elements_with_events/listeners'
|
|
243
243
|
|
|
244
|
-
subject.elements_with_events.
|
|
244
|
+
expect(subject.elements_with_events).to eq([
|
|
245
245
|
{ 'tag_name' => 'html', 'events' => [], 'attributes' => {}
|
|
246
246
|
},
|
|
247
247
|
{
|
|
@@ -268,7 +268,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
268
268
|
'events' => [],
|
|
269
269
|
'attributes' => { 'id' => 'my-button3' }
|
|
270
270
|
}
|
|
271
|
-
]
|
|
271
|
+
])
|
|
272
272
|
end
|
|
273
273
|
end
|
|
274
274
|
|
|
@@ -277,7 +277,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
277
277
|
it 'returns information about all DOM elements along with their events' do
|
|
278
278
|
load '/elements_with_events/jQuery.on'
|
|
279
279
|
|
|
280
|
-
subject.elements_with_events.
|
|
280
|
+
expect(subject.elements_with_events).to eq([
|
|
281
281
|
{
|
|
282
282
|
'tag_name' => 'html',
|
|
283
283
|
'events' => [],
|
|
@@ -302,14 +302,14 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
302
302
|
'id' => 'my-button'
|
|
303
303
|
}
|
|
304
304
|
}
|
|
305
|
-
]
|
|
305
|
+
])
|
|
306
306
|
end
|
|
307
307
|
|
|
308
308
|
context 'when using a selector' do
|
|
309
309
|
it 'assigns the events to elements that match it' do
|
|
310
310
|
load '/elements_with_events/jQuery.on-selector'
|
|
311
311
|
|
|
312
|
-
subject.elements_with_events.
|
|
312
|
+
expect(subject.elements_with_events).to eq([
|
|
313
313
|
{
|
|
314
314
|
"tag_name" => "html",
|
|
315
315
|
"events" => [],
|
|
@@ -361,7 +361,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
361
361
|
"id" => "my-button-2"
|
|
362
362
|
}
|
|
363
363
|
}
|
|
364
|
-
]
|
|
364
|
+
])
|
|
365
365
|
|
|
366
366
|
end
|
|
367
367
|
end
|
|
@@ -370,7 +370,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
370
370
|
it 'returns information about all DOM elements along with their events' do
|
|
371
371
|
load '/elements_with_events/jQuery.on-object-types'
|
|
372
372
|
|
|
373
|
-
subject.elements_with_events.
|
|
373
|
+
expect(subject.elements_with_events).to eq([
|
|
374
374
|
{
|
|
375
375
|
"tag_name" => "html",
|
|
376
376
|
"events" => [],
|
|
@@ -400,7 +400,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
400
400
|
"id" => "my-button"
|
|
401
401
|
}
|
|
402
402
|
}
|
|
403
|
-
]
|
|
403
|
+
])
|
|
404
404
|
|
|
405
405
|
end
|
|
406
406
|
|
|
@@ -408,7 +408,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
408
408
|
it 'assigns the events to elements that match it' do
|
|
409
409
|
load '/elements_with_events/jQuery.on-object-types-selector'
|
|
410
410
|
|
|
411
|
-
pp subject.elements_with_events.
|
|
411
|
+
pp expect(subject.elements_with_events).to eq([
|
|
412
412
|
{
|
|
413
413
|
"tag_name" => "html",
|
|
414
414
|
"events" => [],
|
|
@@ -451,7 +451,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
451
451
|
"id" => "my-button-2"
|
|
452
452
|
}
|
|
453
453
|
}
|
|
454
|
-
]
|
|
454
|
+
])
|
|
455
455
|
|
|
456
456
|
end
|
|
457
457
|
end
|
|
@@ -462,7 +462,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
462
462
|
it 'returns information about all DOM elements along with their events' do
|
|
463
463
|
load '/elements_with_events/jQuery.delegate'
|
|
464
464
|
|
|
465
|
-
subject.elements_with_events.
|
|
465
|
+
expect(subject.elements_with_events).to eq([
|
|
466
466
|
{
|
|
467
467
|
"tag_name" => "html",
|
|
468
468
|
"events" => [],
|
|
@@ -494,7 +494,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
494
494
|
"id" => "my-button"
|
|
495
495
|
}
|
|
496
496
|
}
|
|
497
|
-
]
|
|
497
|
+
])
|
|
498
498
|
|
|
499
499
|
end
|
|
500
500
|
|
|
@@ -502,7 +502,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
502
502
|
it 'returns information about all DOM elements along with their events' do
|
|
503
503
|
load '/elements_with_events/jQuery.delegate'
|
|
504
504
|
|
|
505
|
-
subject.elements_with_events.
|
|
505
|
+
expect(subject.elements_with_events).to eq([
|
|
506
506
|
{
|
|
507
507
|
"tag_name" => "html",
|
|
508
508
|
"events" => [],
|
|
@@ -534,7 +534,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
|
|
|
534
534
|
"id" => "my-button"
|
|
535
535
|
}
|
|
536
536
|
}
|
|
537
|
-
]
|
|
537
|
+
])
|
|
538
538
|
end
|
|
539
539
|
end
|
|
540
540
|
end
|
|
@@ -24,47 +24,50 @@ describe Arachni::Browser::Javascript::Proxy::Stub do
|
|
|
24
24
|
let(:data) { { 'test' => [1,'2'] } }
|
|
25
25
|
|
|
26
26
|
it 'writes property getters' do
|
|
27
|
-
subject.my_property.
|
|
27
|
+
expect(subject.my_property).to eq("#{@proxy.js_object}.my_property")
|
|
28
28
|
end
|
|
29
29
|
|
|
30
30
|
it 'writes function calls' do
|
|
31
|
-
subject.my_function( data ).
|
|
31
|
+
expect(subject.my_function( data )).to eq(
|
|
32
32
|
"#{@proxy.js_object}.my_function(#{data.to_json})"
|
|
33
|
+
)
|
|
33
34
|
end
|
|
34
35
|
|
|
35
36
|
describe '#property' do
|
|
36
37
|
it 'writes property getters' do
|
|
37
|
-
subject.property(:my_property).
|
|
38
|
+
expect(subject.property(:my_property)).to eq("#{@proxy.js_object}.my_property")
|
|
38
39
|
end
|
|
39
40
|
end
|
|
40
41
|
|
|
41
42
|
describe '#function' do
|
|
42
43
|
it 'writes function calls' do
|
|
43
|
-
subject.function(:my_function, data).
|
|
44
|
+
expect(subject.function(:my_function, data)).to eq(
|
|
44
45
|
"#{@proxy.js_object}.my_function(#{data.to_json})"
|
|
46
|
+
)
|
|
45
47
|
end
|
|
46
48
|
|
|
47
49
|
it 'writes property setters' do
|
|
48
|
-
subject.function(:my_property=, 3).
|
|
50
|
+
expect(subject.function(:my_property=, 3)).to eq("#{@proxy.js_object}.my_property=3")
|
|
49
51
|
end
|
|
50
52
|
end
|
|
51
53
|
|
|
52
54
|
describe '#write' do
|
|
53
55
|
it 'writes property getters' do
|
|
54
|
-
subject.write(:my_property).
|
|
56
|
+
expect(subject.write(:my_property)).to eq("#{@proxy.js_object}.my_property")
|
|
55
57
|
end
|
|
56
58
|
|
|
57
59
|
it 'writes property setters' do
|
|
58
|
-
subject.write(:my_property=, 3).
|
|
60
|
+
expect(subject.write(:my_property=, 3)).to eq("#{@proxy.js_object}.my_property=3")
|
|
59
61
|
end
|
|
60
62
|
|
|
61
63
|
it 'writes function calls' do
|
|
62
|
-
subject.write(:my_function, data).
|
|
64
|
+
expect(subject.write(:my_function, data)).to eq(
|
|
63
65
|
"#{@proxy.js_object}.my_function(#{data.to_json})"
|
|
66
|
+
)
|
|
64
67
|
end
|
|
65
68
|
|
|
66
69
|
it 'automatically detects function calls' do
|
|
67
|
-
subject.write(:my_function).
|
|
70
|
+
expect(subject.write(:my_function)).to eq("#{@proxy.js_object}.my_function()")
|
|
68
71
|
end
|
|
69
72
|
end
|
|
70
73
|
|
|
@@ -72,19 +75,19 @@ describe Arachni::Browser::Javascript::Proxy::Stub do
|
|
|
72
75
|
context 'when the JS object supports the given' do
|
|
73
76
|
context 'property' do
|
|
74
77
|
it 'returns true' do
|
|
75
|
-
subject.respond_to?(:my_property).
|
|
78
|
+
expect(subject.respond_to?(:my_property)).to be_truthy
|
|
76
79
|
end
|
|
77
80
|
|
|
78
81
|
context 'setter' do
|
|
79
82
|
it 'returns true' do
|
|
80
|
-
subject.respond_to?(:my_property=).
|
|
83
|
+
expect(subject.respond_to?(:my_property=)).to be_truthy
|
|
81
84
|
end
|
|
82
85
|
end
|
|
83
86
|
end
|
|
84
87
|
|
|
85
88
|
context 'function' do
|
|
86
89
|
it 'returns true' do
|
|
87
|
-
subject.respond_to?(:my_function).
|
|
90
|
+
expect(subject.respond_to?(:my_function)).to be_truthy
|
|
88
91
|
end
|
|
89
92
|
end
|
|
90
93
|
end
|
|
@@ -92,12 +95,12 @@ describe Arachni::Browser::Javascript::Proxy::Stub do
|
|
|
92
95
|
context 'when the JS object does not support the given' do
|
|
93
96
|
context 'property' do
|
|
94
97
|
it 'returns true' do
|
|
95
|
-
subject.respond_to?(:my_stuff).
|
|
98
|
+
expect(subject.respond_to?(:my_stuff)).to be_falsey
|
|
96
99
|
end
|
|
97
100
|
|
|
98
101
|
context 'setter' do
|
|
99
102
|
it 'returns true' do
|
|
100
|
-
subject.respond_to?(:my_stuff=).
|
|
103
|
+
expect(subject.respond_to?(:my_stuff=)).to be_falsey
|
|
101
104
|
end
|
|
102
105
|
end
|
|
103
106
|
end
|
|
@@ -20,44 +20,44 @@ describe Arachni::Browser::Javascript::Proxy do
|
|
|
20
20
|
let(:data) { { 'test' => [1,'2'] } }
|
|
21
21
|
|
|
22
22
|
it 'accesses properties' do
|
|
23
|
-
subject.my_property.
|
|
23
|
+
expect(subject.my_property).to be_nil
|
|
24
24
|
end
|
|
25
25
|
|
|
26
26
|
it 'sets properties' do
|
|
27
27
|
subject.my_property = data
|
|
28
|
-
subject.my_property.
|
|
28
|
+
expect(subject.my_property).to eq(data)
|
|
29
29
|
end
|
|
30
30
|
|
|
31
31
|
it 'calls functions' do
|
|
32
|
-
subject.my_function.
|
|
33
|
-
subject.my_function( 1, '2', data ).
|
|
32
|
+
expect(subject.my_function).to eq([nil, nil, nil])
|
|
33
|
+
expect(subject.my_function( 1, '2', data )).to eq([1, '2', data])
|
|
34
34
|
end
|
|
35
35
|
|
|
36
36
|
describe '#class' do
|
|
37
37
|
it "returns #{described_class}" do
|
|
38
|
-
subject.class.
|
|
38
|
+
expect(subject.class).to eq(described_class)
|
|
39
39
|
end
|
|
40
40
|
end
|
|
41
41
|
|
|
42
42
|
describe '#stub' do
|
|
43
43
|
it 'returns the Stub instance' do
|
|
44
|
-
subject.stub.to_s.
|
|
44
|
+
expect(subject.stub.to_s).to end_with 'ProxyTest>'
|
|
45
45
|
end
|
|
46
46
|
end
|
|
47
47
|
|
|
48
48
|
describe '#javascript' do
|
|
49
49
|
it 'returns the Javascript instance' do
|
|
50
|
-
subject.javascript.
|
|
50
|
+
expect(subject.javascript).to be_kind_of Arachni::Browser::Javascript
|
|
51
51
|
end
|
|
52
52
|
end
|
|
53
53
|
|
|
54
54
|
describe '#js_object' do
|
|
55
55
|
it 'returns the JS-side object of the proxied object' do
|
|
56
|
-
subject.js_object.
|
|
56
|
+
expect(subject.js_object).to eq("_#{@javascript.token}ProxyTest")
|
|
57
57
|
|
|
58
58
|
js_object = @javascript.run( "return #{subject.js_object}" )
|
|
59
|
-
js_object.
|
|
60
|
-
js_object['my_function'].
|
|
59
|
+
expect(js_object).to include 'my_property'
|
|
60
|
+
expect(js_object['my_function']).to start_with 'function ('
|
|
61
61
|
end
|
|
62
62
|
end
|
|
63
63
|
|
|
@@ -65,44 +65,44 @@ describe Arachni::Browser::Javascript::Proxy do
|
|
|
65
65
|
context 'when dealing with setters' do
|
|
66
66
|
context 'for existing properties' do
|
|
67
67
|
it 'returns true' do
|
|
68
|
-
subject.function?( :my_function= ).
|
|
69
|
-
subject.function?( :my_property= ).
|
|
68
|
+
expect(subject.function?( :my_function= )).to be_truthy
|
|
69
|
+
expect(subject.function?( :my_property= )).to be_truthy
|
|
70
70
|
end
|
|
71
71
|
end
|
|
72
72
|
|
|
73
73
|
context 'for nonexistent properties' do
|
|
74
74
|
it 'returns false' do
|
|
75
|
-
subject.function?( :stuff= ).
|
|
75
|
+
expect(subject.function?( :stuff= )).to be_falsey
|
|
76
76
|
end
|
|
77
77
|
end
|
|
78
78
|
end
|
|
79
79
|
|
|
80
80
|
context 'when the specified property is a function' do
|
|
81
81
|
it 'returns true' do
|
|
82
|
-
subject.function?( :my_function ).
|
|
82
|
+
expect(subject.function?( :my_function )).to be_truthy
|
|
83
83
|
end
|
|
84
84
|
end
|
|
85
85
|
|
|
86
86
|
context 'when the specified property is not a function' do
|
|
87
87
|
it 'returns false' do
|
|
88
|
-
subject.function?( :my_property ).
|
|
88
|
+
expect(subject.function?( :my_property )).to be_falsey
|
|
89
89
|
end
|
|
90
90
|
end
|
|
91
91
|
end
|
|
92
92
|
|
|
93
93
|
describe '#call' do
|
|
94
94
|
it 'accesses properties' do
|
|
95
|
-
subject.call(:my_property).
|
|
95
|
+
expect(subject.call(:my_property)).to be_nil
|
|
96
96
|
end
|
|
97
97
|
|
|
98
98
|
it 'sets properties' do
|
|
99
99
|
subject.call(:my_property=, data)
|
|
100
|
-
subject.call(:my_property).
|
|
100
|
+
expect(subject.call(:my_property)).to eq(data)
|
|
101
101
|
end
|
|
102
102
|
|
|
103
103
|
it 'calls functions' do
|
|
104
|
-
subject.call(:my_function).
|
|
105
|
-
subject.call(:my_function, 1, '2', data ).
|
|
104
|
+
expect(subject.call(:my_function)).to eq([nil, nil, nil])
|
|
105
|
+
expect(subject.call(:my_function, 1, '2', data )).to eq([1, '2', data])
|
|
106
106
|
end
|
|
107
107
|
end
|
|
108
108
|
|
|
@@ -110,19 +110,19 @@ describe Arachni::Browser::Javascript::Proxy do
|
|
|
110
110
|
context 'when the JS object supports the given' do
|
|
111
111
|
context 'property' do
|
|
112
112
|
it 'returns true' do
|
|
113
|
-
subject.respond_to?(:my_property).
|
|
113
|
+
expect(subject.respond_to?(:my_property)).to be_truthy
|
|
114
114
|
end
|
|
115
115
|
|
|
116
116
|
context 'setter' do
|
|
117
117
|
it 'returns true' do
|
|
118
|
-
subject.respond_to?(:my_property=).
|
|
118
|
+
expect(subject.respond_to?(:my_property=)).to be_truthy
|
|
119
119
|
end
|
|
120
120
|
end
|
|
121
121
|
end
|
|
122
122
|
|
|
123
123
|
context 'function' do
|
|
124
124
|
it 'returns true' do
|
|
125
|
-
subject.respond_to?(:my_function).
|
|
125
|
+
expect(subject.respond_to?(:my_function)).to be_truthy
|
|
126
126
|
end
|
|
127
127
|
end
|
|
128
128
|
end
|
|
@@ -130,12 +130,12 @@ describe Arachni::Browser::Javascript::Proxy do
|
|
|
130
130
|
context 'when the JS object does not support the given' do
|
|
131
131
|
context 'property' do
|
|
132
132
|
it 'returns true' do
|
|
133
|
-
subject.respond_to?(:my_stuff).
|
|
133
|
+
expect(subject.respond_to?(:my_stuff)).to be_falsey
|
|
134
134
|
end
|
|
135
135
|
|
|
136
136
|
context 'setter' do
|
|
137
137
|
it 'returns true' do
|
|
138
|
-
subject.respond_to?(:my_stuff=).
|
|
138
|
+
expect(subject.respond_to?(:my_stuff=)).to be_falsey
|
|
139
139
|
end
|
|
140
140
|
end
|
|
141
141
|
end
|