arachni 1.2.1 → 1.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -75,7 +75,8 @@ describe Arachni::Check::Auditor do
75
75
  Arachni::Element::Cookie, Arachni::Element::Cookie::DOM,
76
76
  Arachni::Element::Header, Arachni::Element::LinkTemplate,
77
77
  Arachni::Element::LinkTemplate::DOM, Arachni::Element::JSON,
78
- Arachni::Element::XML
78
+ Arachni::Element::XML, Arachni::Element::UIInput, Arachni::Element::UIInput::DOM,
79
+ Arachni::Element::UIForm, Arachni::Element::UIForm::DOM
79
80
  ]
80
81
 
81
82
  let(:auditor) { AuditorTest.new( @framework ) }
@@ -86,28 +87,28 @@ describe Arachni::Check::Auditor do
86
87
 
87
88
  describe '.has_timeout_candidates?' do
88
89
  it "delegates to #{Arachni::Element::Capabilities::Analyzable}.has_timeout_candidates?" do
89
- Arachni::Element::Capabilities::Analyzable.should receive(:has_timeout_candidates?)
90
+ expect(Arachni::Element::Capabilities::Analyzable).to receive(:has_timeout_candidates?)
90
91
  described_class.has_timeout_candidates?
91
92
  end
92
93
  end
93
94
 
94
95
  describe '.timeout_audit_run' do
95
96
  it "delegates to #{Arachni::Element::Capabilities::Analyzable}.timeout_audit_run" do
96
- Arachni::Element::Capabilities::Analyzable.should receive(:timeout_audit_run)
97
+ expect(Arachni::Element::Capabilities::Analyzable).to receive(:timeout_audit_run)
97
98
  described_class.timeout_audit_run
98
99
  end
99
100
  end
100
101
 
101
102
  describe '#preferred' do
102
103
  it 'returns an empty array' do
103
- subject.preferred.should == []
104
+ expect(subject.preferred).to eq([])
104
105
  end
105
106
  end
106
107
 
107
108
  describe '#max_issues' do
108
109
  it 'returns the maximum amount of issues the auditor is allowed to log' do
109
110
  subject.class.info[:max_issues] = 1
110
- subject.max_issues.should == 1
111
+ expect(subject.max_issues).to eq(1)
111
112
  end
112
113
  end
113
114
 
@@ -115,20 +116,20 @@ describe Arachni::Check::Auditor do
115
116
  it 'increments the issue counter' do
116
117
  i = subject.class.issue_counter
117
118
  subject.increment_issue_counter
118
- subject.class.issue_counter.should == i + 1
119
+ expect(subject.class.issue_counter).to eq(i + 1)
119
120
  end
120
121
  end
121
122
 
122
123
  describe '#issue_limit_reached?' do
123
124
  it 'returns false' do
124
- subject.issue_limit_reached?.should be_false
125
+ expect(subject.issue_limit_reached?).to be_falsey
125
126
  end
126
127
 
127
128
  context 'when the issue counter reaches the limit' do
128
129
  it 'returns true' do
129
130
  subject.class.info[:max_issues] = 1
130
131
  subject.increment_issue_counter
131
- subject.issue_limit_reached?.should be_true
132
+ expect(subject.issue_limit_reached?).to be_truthy
132
133
  end
133
134
  end
134
135
  end
@@ -136,7 +137,7 @@ describe Arachni::Check::Auditor do
136
137
  describe '#audited' do
137
138
  it 'marks the given task as audited' do
138
139
  subject.audited 'stuff'
139
- subject.audited?( 'stuff' ).should be_true
140
+ expect(subject.audited?( 'stuff' )).to be_truthy
140
141
  end
141
142
  end
142
143
 
@@ -144,19 +145,19 @@ describe Arachni::Check::Auditor do
144
145
  context 'when elements have been provided' do
145
146
  it 'restricts the check' do
146
147
  page = Arachni::Page.from_data( url: url, body: 'stuff' )
147
- page.stub(:has_script?) { true }
148
+ allow(page).to receive(:has_script?) { true }
148
149
  auditor.class.info[:elements] =
149
150
  element_classes + [Arachni::Element::Body, Arachni::Element::GenericDOM]
150
151
 
151
- auditor.class.check?( page, Arachni::Element::GenericDOM ).should be_true
152
- auditor.class.check?( page, Arachni::Element::Body ).should be_true
152
+ expect(auditor.class.check?( page, Arachni::Element::GenericDOM )).to be_truthy
153
+ expect(auditor.class.check?( page, Arachni::Element::Body )).to be_truthy
153
154
 
154
155
  element_classes.each do |element|
155
- auditor.class.check?( page, element ).should be_false
156
+ expect(auditor.class.check?( page, element )).to be_falsey
156
157
  end
157
158
 
158
- auditor.class.check?( page, element_classes ).should be_false
159
- auditor.class.check?( page, element_classes + [Arachni::Element::Body] ).should be_true
159
+ expect(auditor.class.check?( page, element_classes )).to be_falsey
160
+ expect(auditor.class.check?( page, element_classes + [Arachni::Element::Body] )).to be_truthy
160
161
  end
161
162
  end
162
163
 
@@ -166,14 +167,14 @@ describe Arachni::Check::Auditor do
166
167
  context 'and page with a non-empty body' do
167
168
  it 'returns true' do
168
169
  p = Arachni::Page.from_data( url: url, body: 'stuff' )
169
- auditor.class.check?( p ).should be_true
170
+ expect(auditor.class.check?( p )).to be_truthy
170
171
  end
171
172
  end
172
173
 
173
174
  context 'and page with an empty body' do
174
175
  it 'returns false' do
175
176
  p = Arachni::Page.from_data( url: url, body: '' )
176
- auditor.class.check?( p ).should be_false
177
+ expect(auditor.class.check?( p )).to be_falsey
177
178
  end
178
179
  end
179
180
  end
@@ -185,15 +186,15 @@ describe Arachni::Check::Auditor do
185
186
  context 'and Page#has_script? is' do
186
187
  context true do
187
188
  it 'returns true' do
188
- page.stub(:has_script?) { true }
189
- auditor.class.check?( page ).should be_true
189
+ allow(page).to receive(:has_script?) { true }
190
+ expect(auditor.class.check?( page )).to be_truthy
190
191
  end
191
192
  end
192
193
 
193
194
  context false do
194
195
  it 'returns false' do
195
- page.stub(:has_script?) { false }
196
- auditor.class.check?( page ).should be_false
196
+ allow(page).to receive(:has_script?) { false }
197
+ expect(auditor.class.check?( page )).to be_falsey
197
198
  end
198
199
  end
199
200
  end
@@ -206,8 +207,8 @@ describe Arachni::Check::Auditor do
206
207
  url: url,
207
208
  "#{element.type}s".gsub( '_dom', '').to_sym => [Factory[element.type]]
208
209
  )
209
- p.dom.stub(:depth) { 1 }
210
- p.stub(:has_script?) { true }
210
+ allow(p.dom).to receive(:depth) { 1 }
211
+ allow(p).to receive(:has_script?) { true }
211
212
  p
212
213
  end
213
214
  before(:each) { auditor.class.info[:elements] = [element] }
@@ -232,15 +233,15 @@ describe Arachni::Check::Auditor do
232
233
  context 'and Page::DOM#depth is' do
233
234
  context '0' do
234
235
  it 'returns false' do
235
- page.dom.stub(:depth) { 0 }
236
- auditor.class.check?( page ).should be_false
236
+ allow(page.dom).to receive(:depth) { 0 }
237
+ expect(auditor.class.check?( page )).to be_falsey
237
238
  end
238
239
  end
239
240
 
240
241
  context '> 0' do
241
242
  it 'returns true' do
242
- page.dom.stub(:depth) { 1 }
243
- auditor.class.check?( page ).should be_true
243
+ allow(page.dom).to receive(:depth) { 1 }
244
+ expect(auditor.class.check?( page )).to be_truthy
244
245
  end
245
246
  end
246
247
  end
@@ -248,22 +249,26 @@ describe Arachni::Check::Auditor do
248
249
  context 'and Page#has_script? is' do
249
250
  context true do
250
251
  it 'returns true' do
251
- page.stub(:has_script?) { true }
252
- auditor.class.check?( page ).should be_true
252
+ allow(page).to receive(:has_script?) { true }
253
+ expect(auditor.class.check?( page )).to be_truthy
253
254
  end
254
255
  end
255
256
 
256
257
  context false do
257
258
  it 'returns false' do
258
- page.stub(:has_script?) { false }
259
- auditor.class.check?( page ).should be_false
259
+ allow(page).to receive(:has_script?) { false }
260
+ expect(auditor.class.check?( page )).to be_falsey
260
261
  end
261
262
  end
262
263
  end
263
-
264
+ elsif element == Arachni::Element::UIInput ||
265
+ element == Arachni::Element::UIForm
266
+ it 'returns false' do
267
+ expect(auditor.class.check?( page )).to be_falsey
268
+ end
264
269
  else
265
270
  it 'returns true' do
266
- auditor.class.check?( page ).should be_true
271
+ expect(auditor.class.check?( page )).to be_truthy
267
272
  end
268
273
  end
269
274
  end
@@ -275,7 +280,13 @@ describe Arachni::Check::Auditor do
275
280
 
276
281
  it 'returns true' do
277
282
  auditor.class.info[:elements] = e
278
- auditor.class.check?( page ).should be_true
283
+ expect(auditor.class.check?( page )).to be_truthy
284
+ end
285
+
286
+ elsif element == Arachni::Element::UIInput ||
287
+ element == Arachni::Element::UIForm
288
+ it 'returns false' do
289
+ expect(auditor.class.check?( page )).to be_falsey
279
290
  end
280
291
 
281
292
  elsif element == Arachni::Element::Cookie &&
@@ -284,17 +295,17 @@ describe Arachni::Check::Auditor do
284
295
  context 'and Page#has_script? is' do
285
296
  context true do
286
297
  it 'returns true' do
287
- page.stub(:has_script?) { true }
298
+ allow(page).to receive(:has_script?) { true }
288
299
  auditor.class.info[:elements] = e
289
- auditor.class.check?( page ).should be_true
300
+ expect(auditor.class.check?( page )).to be_truthy
290
301
  end
291
302
  end
292
303
 
293
304
  context false do
294
305
  it 'returns false' do
295
- page.stub(:has_script?) { false }
306
+ allow(page).to receive(:has_script?) { false }
296
307
  auditor.class.info[:elements] = e
297
- auditor.class.check?( page ).should be_false
308
+ expect(auditor.class.check?( page )).to be_falsey
298
309
  end
299
310
  end
300
311
  end
@@ -304,12 +315,12 @@ describe Arachni::Check::Auditor do
304
315
  e == Arachni::Element::Form
305
316
  it 'returns true' do
306
317
  auditor.class.info[:elements] = e
307
- auditor.class.check?( page ).should be_true
318
+ expect(auditor.class.check?( page )).to be_truthy
308
319
  end
309
320
  else
310
321
  it 'returns false' do
311
322
  auditor.class.info[:elements] = e
312
- auditor.class.check?( page ).should be_false
323
+ expect(auditor.class.check?( page )).to be_falsey
313
324
  end
314
325
  end
315
326
  end
@@ -320,7 +331,7 @@ describe Arachni::Check::Auditor do
320
331
  context "and the check supports #{e ? e : 'everything'}" do
321
332
  it 'returns true' do
322
333
  auditor.class.info[:elements] = e
323
- auditor.class.check?( page ).should be_true
334
+ expect(auditor.class.check?( page )).to be_truthy
324
335
  end
325
336
  end
326
337
  end
@@ -333,7 +344,7 @@ describe Arachni::Check::Auditor do
333
344
  context "and the page contains #{element}" do
334
345
  context "and the check only supports #{element}" do
335
346
  it 'returns false' do
336
- auditor.class.check?( page ).should be_false
347
+ expect(auditor.class.check?( page )).to be_falsey
337
348
  end
338
349
  end
339
350
 
@@ -341,7 +352,7 @@ describe Arachni::Check::Auditor do
341
352
  context "and the check supports #{e ? e : 'everything'}" do
342
353
  it 'returns true' do
343
354
  auditor.class.info[:elements] = e
344
- auditor.class.check?( page ).should be_true
355
+ expect(auditor.class.check?( page )).to be_truthy
345
356
  end
346
357
  end
347
358
  end
@@ -357,9 +368,9 @@ describe Arachni::Check::Auditor do
357
368
  received = nil
358
369
  b = proc {}
359
370
 
360
- Arachni::Element::Server.any_instance.stub(:log_remote_file_if_exists) { |args, &block| received = [args, block]}
371
+ allow_any_instance_of(Arachni::Element::Server).to receive(:log_remote_file_if_exists) { |instance, args, &block| received = [args, block]}
361
372
 
362
- subject.log_remote_file_if_exists( *sent, &b ).should == received
373
+ expect(subject.log_remote_file_if_exists( *sent, &b )).to eq(received)
363
374
  end
364
375
  end
365
376
 
@@ -369,31 +380,31 @@ describe Arachni::Check::Auditor do
369
380
  received = nil
370
381
  b = proc {}
371
382
 
372
- Arachni::Element::Body.any_instance.stub(:match_and_log) { |args, &block| received = [args, block]}
383
+ allow_any_instance_of(Arachni::Element::Body).to receive(:match_and_log) { |instance, args, &block| received = [args, block]}
373
384
 
374
- subject.match_and_log( *sent, &b ).should == received
385
+ expect(subject.match_and_log( *sent, &b )).to eq(received)
375
386
  end
376
387
  end
377
388
 
378
389
  describe '#log_remote_file' do
379
390
  let(:page) { Arachni::Page.from_url @url }
380
- let(:issue) { Arachni::Data.issues.last.variations.last }
391
+ let(:issue) { Arachni::Data.issues.last }
381
392
  let(:vector) { Arachni::Element::Server.new( page.url ) }
382
393
 
383
394
  context 'given a' do
384
395
  describe Arachni::Page do
385
396
  it 'logs it' do
386
397
  subject.log_remote_file( page )
387
- issue.page.should == page
388
- issue.vector.should == vector
398
+ expect(issue.page).to eq(page)
399
+ expect(issue.vector).to eq(vector)
389
400
  end
390
401
  end
391
402
 
392
403
  describe Arachni::HTTP::Response do
393
404
  it "logs it as a #{Arachni::Page}" do
394
405
  subject.log_remote_file( page.response )
395
- issue.page.should == page
396
- issue.vector.should == vector
406
+ expect(issue.page).to eq(page)
407
+ expect(issue.vector).to eq(vector)
397
408
  end
398
409
  end
399
410
  end
@@ -403,13 +414,16 @@ describe Arachni::Check::Auditor do
403
414
  before(:each) do
404
415
  Arachni::Options.audit.link_templates = /link-template\/input\/(?<input>.+)/
405
416
  auditor.load_page_from "#{@url}each_candidate_element"
406
- auditor.page.jsons = [Factory[:json]]
407
- auditor.page.xmls = [Factory[:xml]]
417
+
418
+ auditor.page.jsons = [Factory[:json]]
419
+ auditor.page.xmls = [Factory[:xml]]
420
+ auditor.page.ui_inputs = [Factory[:ui_input]]
421
+ auditor.page.ui_forms = [Factory[:ui_form]]
408
422
  end
409
423
 
410
424
  it 'sets the auditor' do
411
425
  auditor.each_candidate_element [ Arachni::Link ] do |element|
412
- element.auditor.should == auditor
426
+ expect(element.auditor).to eq(auditor)
413
427
  end
414
428
  end
415
429
 
@@ -420,8 +434,8 @@ describe Arachni::Check::Auditor do
420
434
  elements << element
421
435
  end
422
436
 
423
- elements.should == (auditor.page.links | auditor.page.headers).
424
- select { |e| e.inputs.any? }
437
+ expect(elements).to eq((auditor.page.links | auditor.page.headers).
438
+ select { |e| e.inputs.any? })
425
439
  end
426
440
 
427
441
  context 'and are not supported' do
@@ -441,23 +455,27 @@ describe Arachni::Check::Auditor do
441
455
  elements << element
442
456
  end
443
457
 
444
- auditor.class.elements.should == [Arachni::Link, Arachni::Form]
445
- elements.should == (auditor.page.links | auditor.page.forms).
446
- select { |e| e.inputs.any? }
458
+ expect(auditor.class.elements).to eq([Arachni::Link, Arachni::Form])
459
+ expect(elements).to eq((auditor.page.links | auditor.page.forms).
460
+ select { |e| e.inputs.any? })
447
461
  end
448
462
 
449
463
  context 'and no types are specified by the check' do
450
- it 'provides all types of elements'do
464
+ it 'provides all types of elements but :inputs and :ui_forms'do
451
465
  auditor.class.info[:elements].clear
452
466
 
467
+ expected_elements = Arachni::Page::ELEMENTS
468
+ expected_elements.delete :ui_inputs
469
+ expected_elements.delete :ui_forms
470
+
453
471
  elements = []
454
472
  auditor.each_candidate_element do |element|
455
473
  elements << element
456
474
  end
457
475
 
458
- elements.map { |e| "#{e.type}s".to_sym }.uniq.should == Arachni::Page::ELEMENTS
459
- elements.should == (auditor.page.elements).
460
- select { |e| e.inputs.any? }
476
+ expect(elements.map { |e| "#{e.type}s".to_sym }.uniq).to eq(Arachni::Page::ELEMENTS)
477
+ expect(elements).to eq((auditor.page.elements).
478
+ select { |e| e.inputs.any? })
461
479
  end
462
480
  end
463
481
  end
@@ -467,13 +485,16 @@ describe Arachni::Check::Auditor do
467
485
  before(:each) do
468
486
  Arachni::Options.audit.link_templates = /dom-link-template\/input\/(?<input>.+)/
469
487
  auditor.load_page_from "#{@url}each_candidate_dom_element"
488
+
489
+ auditor.page.ui_inputs = [Factory[:ui_input]]
490
+ auditor.page.ui_forms = [Factory[:ui_form]]
470
491
  end
471
492
 
472
493
  it 'sets the auditor' do
473
494
  auditor.class.info[:elements].clear
474
495
 
475
496
  auditor.each_candidate_dom_element do |element|
476
- element.auditor.should == auditor
497
+ expect(element.auditor).to eq(auditor)
477
498
  end
478
499
  end
479
500
 
@@ -484,8 +505,8 @@ describe Arachni::Check::Auditor do
484
505
  elements << element
485
506
  end
486
507
 
487
- elements.should be_any
488
- elements.should == auditor.page.links.select { |l| l.dom }.map(&:dom)
508
+ expect(elements).to be_any
509
+ expect(elements).to eq(auditor.page.links.select { |l| l.dom }.map(&:dom))
489
510
  end
490
511
 
491
512
  context 'and are not supported' do
@@ -499,14 +520,14 @@ describe Arachni::Check::Auditor do
499
520
  context 'when types have not been provided' do
500
521
  it 'provides the types of elements specified by the check' do
501
522
  auditor.class.info[:elements] = [Arachni::Form::DOM]
502
- auditor.class.elements.should == [Arachni::Form::DOM]
523
+ expect(auditor.class.elements).to eq([Arachni::Form::DOM])
503
524
 
504
525
  elements = []
505
526
  auditor.each_candidate_dom_element do |element|
506
527
  elements << element
507
528
  end
508
529
 
509
- elements.should == auditor.page.forms.map(&:dom)
530
+ expect(elements).to eq(auditor.page.forms.map(&:dom))
510
531
  end
511
532
 
512
533
  context 'and no types are specified by the check' do
@@ -518,10 +539,12 @@ describe Arachni::Check::Auditor do
518
539
  elements << element
519
540
  end
520
541
 
521
- elements.should ==
542
+ expect(elements).to eq(
522
543
  (auditor.page.links.select { |l| l.dom } |
523
544
  auditor.page.forms | auditor.page.cookies |
524
- auditor.page.link_templates).map(&:dom)
545
+ auditor.page.link_templates | auditor.page.ui_inputs |
546
+ auditor.page.ui_forms).map(&:dom)
547
+ )
525
548
  end
526
549
  end
527
550
  end
@@ -533,11 +556,11 @@ describe Arachni::Check::Auditor do
533
556
  it 'passes it to the given block' do
534
557
  worker = nil
535
558
 
536
- auditor.with_browser_cluster do |cluster|
559
+ expect(auditor.with_browser_cluster do |cluster|
537
560
  worker = cluster
538
- end.should be_true
561
+ end).to be_truthy
539
562
 
540
- worker.should == @framework.browser_cluster
563
+ expect(worker).to eq(@framework.browser_cluster)
541
564
  end
542
565
  end
543
566
  end
@@ -549,12 +572,12 @@ describe Arachni::Check::Auditor do
549
572
  it 'passes a BrowserCluster::Worker to the given block' do
550
573
  worker = nil
551
574
 
552
- auditor.with_browser do |browser|
575
+ expect(auditor.with_browser do |browser|
553
576
  worker = browser
554
- end.should be_true
577
+ end).to be_truthy
555
578
  @framework.browser_cluster.wait
556
579
 
557
- worker.should be_kind_of Arachni::BrowserCluster::Worker
580
+ expect(worker).to be_kind_of Arachni::BrowserCluster::Worker
558
581
  end
559
582
  end
560
583
  end
@@ -563,8 +586,8 @@ describe Arachni::Check::Auditor do
563
586
  describe '#skip?' do
564
587
  context 'when there is no Arachni::Page#element_audit_whitelist' do
565
588
  it 'returns false' do
566
- auditor.page.element_audit_whitelist.should be_empty
567
- auditor.skip?( auditor.page.elements.first ).should be_false
589
+ expect(auditor.page.element_audit_whitelist).to be_empty
590
+ expect(auditor.skip?( auditor.page.elements.first )).to be_falsey
568
591
  end
569
592
  end
570
593
 
@@ -572,14 +595,14 @@ describe Arachni::Check::Auditor do
572
595
  context 'and the element is in it' do
573
596
  it 'returns false' do
574
597
  auditor.page.update_element_audit_whitelist auditor.page.elements.first
575
- auditor.skip?( auditor.page.elements.first ).should be_false
598
+ expect(auditor.skip?( auditor.page.elements.first )).to be_falsey
576
599
  end
577
600
  end
578
601
 
579
602
  context 'and the element is not in it' do
580
603
  it 'returns true' do
581
604
  auditor.page.update_element_audit_whitelist auditor.page.elements.first
582
- auditor.skip?( auditor.page.elements.last ).should be_true
605
+ expect(auditor.skip?( auditor.page.elements.last )).to be_truthy
583
606
  end
584
607
  end
585
608
  end
@@ -595,7 +618,12 @@ describe Arachni::Check::Auditor do
595
618
 
596
619
  describe '#create_issue' do
597
620
  it 'creates an issue' do
598
- auditor.class.create_issue( vector: issue.vector ).should == issue
621
+ expect(
622
+ auditor.class.create_issue(
623
+ proof: issue.proof,
624
+ vector: issue.vector
625
+ )
626
+ ).to eq(issue)
599
627
  end
600
628
  end
601
629
 
@@ -603,11 +631,11 @@ describe Arachni::Check::Auditor do
603
631
  it 'logs an issue' do
604
632
  auditor.log_issue( issue_data )
605
633
 
606
- logged_issue = Arachni::Data.issues.flatten.first
634
+ logged_issue = Arachni::Data.issues.first
607
635
 
608
- logged_issue.to_h.tap do |h|
636
+ expect(logged_issue.to_h.tap do |h|
609
637
  h[:page][:dom][:transitions].each { |t| t.delete :time }
610
- end.should eq issue.to_h.merge( referring_page: {
638
+ end).to eq issue.to_h.merge( referring_page: {
611
639
  body: auditor.page.body,
612
640
  dom: auditor.page.dom.to_h.tap do |h|
613
641
  h.delete :skip_states
@@ -618,20 +646,20 @@ describe Arachni::Check::Auditor do
618
646
  it 'assigns a #referring_page' do
619
647
  auditor.log_issue( issue_data )
620
648
 
621
- logged_issue = Arachni::Data.issues.flatten.first
622
- logged_issue.referring_page.should == auditor.page
649
+ logged_issue = Arachni::Data.issues.first
650
+ expect(logged_issue.referring_page).to eq(auditor.page)
623
651
  end
624
652
 
625
653
  it 'returns the issue' do
626
- auditor.log_issue( issue_data ).should be_kind_of Arachni::Issue
654
+ expect(auditor.log_issue( issue_data )).to be_kind_of Arachni::Issue
627
655
  end
628
656
 
629
657
  context 'when #issue_limit_reached?' do
630
658
  it 'does not log the issue' do
631
- subject.stub(:issue_limit_reached?) { true }
659
+ allow(subject).to receive(:issue_limit_reached?) { true }
632
660
 
633
- auditor.log_issue( issue_data ).should be_false
634
- Arachni::Data.issues.should be_empty
661
+ expect(auditor.log_issue( issue_data )).to be_falsey
662
+ expect(Arachni::Data.issues).to be_empty
635
663
  end
636
664
  end
637
665
  end
@@ -640,12 +668,12 @@ describe Arachni::Check::Auditor do
640
668
  it 'preserves the given remarks' do
641
669
  auditor.log( issue_data )
642
670
 
643
- logged_issue = Arachni::Data.issues.flatten.first
644
- logged_issue.remarks.first.should be_any
671
+ logged_issue = Arachni::Data.issues.first
672
+ expect(logged_issue.remarks.first).to be_any
645
673
  end
646
674
 
647
675
  it 'returns the issue' do
648
- auditor.log( issue_data ).should be_kind_of Arachni::Issue
676
+ expect(auditor.log( issue_data )).to be_kind_of Arachni::Issue
649
677
  end
650
678
 
651
679
  context 'when given a page' do
@@ -653,14 +681,16 @@ describe Arachni::Check::Auditor do
653
681
 
654
682
  it 'includes response data' do
655
683
  auditor.log( issue_data )
656
- Arachni::Data.issues.flatten.first.response.should ==
684
+ expect(Arachni::Data.issues.first.response).to eq(
657
685
  issue_data[:page].response
686
+ )
658
687
  end
659
688
 
660
689
  it 'includes request data' do
661
690
  auditor.log( issue_data )
662
- Arachni::Data.issues.flatten.first.request.should ==
691
+ expect(Arachni::Data.issues.first.request).to eq(
663
692
  issue_data[:page].request
693
+ )
664
694
  end
665
695
  end
666
696
 
@@ -669,10 +699,10 @@ describe Arachni::Check::Auditor do
669
699
  issue_data.delete(:page)
670
700
  auditor.log( issue_data )
671
701
 
672
- issue = Arachni::Data.issues.flatten.first
673
- issue.page.body.should == auditor.page.body
674
- issue.response.should == auditor.page.response
675
- issue.request.should == auditor.page.request
702
+ issue = Arachni::Data.issues.first
703
+ expect(issue.page.body).to eq(auditor.page.body)
704
+ expect(issue.response).to eq(auditor.page.response)
705
+ expect(issue.request).to eq(auditor.page.request)
676
706
  end
677
707
  end
678
708
  end
@@ -690,7 +720,7 @@ describe Arachni::Check::Auditor do
690
720
  auditor.load_page_from( @url + '/link' )
691
721
  auditor.audit( @seed )
692
722
  @framework.http.run
693
- Arachni::Data.issues.size.should == 1
723
+ expect(Arachni::Data.issues.size).to eq(1)
694
724
  end
695
725
  end
696
726
 
@@ -699,10 +729,10 @@ describe Arachni::Check::Auditor do
699
729
  auditor.load_page_from( @url + '/link' )
700
730
  auditor.audit( { unix: @seed }, substring: @seed )
701
731
  @framework.http.run
702
- Arachni::Data.issues.size.should == 1
703
- issue = Arachni::Data.issues.flatten.first
704
- issue.platform_name.should == :unix
705
- issue.platform_type.should == :os
732
+ expect(Arachni::Data.issues.size).to eq(1)
733
+ issue = Arachni::Data.issues.first
734
+ expect(issue.platform_name).to eq(:unix)
735
+ expect(issue.platform_type).to eq(:os)
706
736
  end
707
737
  end
708
738
 
@@ -721,13 +751,13 @@ describe Arachni::Check::Auditor do
721
751
  end
722
752
 
723
753
  auditor.audit( @seed ){}
724
- $audit_called.should == auditor.page.elements.map(&:class)
754
+ expect($audit_called).to eq(auditor.page.elements.map(&:class))
725
755
  end
726
756
  end
727
757
 
728
758
  context 'when called without a block' do
729
- it 'delegates to #audit_taint' do
730
- auditor.should receive(:audit_taint).with( @seed, described_class::OPTIONS )
759
+ it 'delegates to #audit_signature' do
760
+ expect(auditor).to receive(:audit_signature).with( @seed, described_class::OPTIONS )
731
761
  auditor.audit( @seed )
732
762
  end
733
763
  end
@@ -744,10 +774,10 @@ describe Arachni::Check::Auditor do
744
774
  elements: [ Arachni::Element::Link ]
745
775
  )
746
776
  @framework.http.run
747
- Arachni::Data.issues.size.should == 1
748
- issue = Arachni::Data.issues.flatten.first
749
- issue.vector.class.should == Arachni::Element::Link
750
- issue.vector.affected_input_name.should == 'link_input'
777
+ expect(Arachni::Data.issues.size).to eq(1)
778
+ issue = Arachni::Data.issues.first
779
+ expect(issue.vector.class).to eq(Arachni::Element::Link)
780
+ expect(issue.vector.affected_input_name).to eq('link_input')
751
781
  end
752
782
  end
753
783
  describe 'Arachni::Element::Form' do
@@ -757,10 +787,10 @@ describe Arachni::Check::Auditor do
757
787
  elements: [ Arachni::Element::Form ]
758
788
  )
759
789
  @framework.http.run
760
- Arachni::Data.issues.size.should == 1
761
- issue = Arachni::Data.issues.flatten.first
762
- issue.vector.class.should == Arachni::Element::Form
763
- issue.vector.affected_input_name.should == 'form_input'
790
+ expect(Arachni::Data.issues.size).to eq(1)
791
+ issue = Arachni::Data.issues.first
792
+ expect(issue.vector.class).to eq(Arachni::Element::Form)
793
+ expect(issue.vector.affected_input_name).to eq('form_input')
764
794
  end
765
795
  end
766
796
  describe 'Arachni::Element::Cookie' do
@@ -770,10 +800,10 @@ describe Arachni::Check::Auditor do
770
800
  elements: [ Arachni::Element::Cookie ]
771
801
  )
772
802
  @framework.http.run
773
- Arachni::Data.issues.size.should == 1
774
- issue = Arachni::Data.issues.flatten.first
775
- issue.vector.class.should == Arachni::Element::Cookie
776
- issue.vector.affected_input_name.should == 'cookie_input'
803
+ expect(Arachni::Data.issues.size).to eq(1)
804
+ issue = Arachni::Data.issues.first
805
+ expect(issue.vector.class).to eq(Arachni::Element::Cookie)
806
+ expect(issue.vector.affected_input_name).to eq('cookie_input')
777
807
  end
778
808
  it 'maintains the session while auditing cookies' do
779
809
  auditor.load_page_from( @url + '/session' )
@@ -782,10 +812,10 @@ describe Arachni::Check::Auditor do
782
812
  elements: [ Arachni::Element::Cookie ]
783
813
  )
784
814
  @framework.http.run
785
- Arachni::Data.issues.size.should == 1
786
- issue = Arachni::Data.issues.flatten.first
787
- issue.vector.class.should == Arachni::Element::Cookie
788
- issue.vector.affected_input_name.should == 'vulnerable'
815
+ expect(Arachni::Data.issues.size).to eq(1)
816
+ issue = Arachni::Data.issues.first
817
+ expect(issue.vector.class).to eq(Arachni::Element::Cookie)
818
+ expect(issue.vector.affected_input_name).to eq('vulnerable')
789
819
  end
790
820
 
791
821
  end
@@ -796,10 +826,10 @@ describe Arachni::Check::Auditor do
796
826
  elements: [ Arachni::Element::Header ]
797
827
  )
798
828
  @framework.http.run
799
- Arachni::Data.issues.size.should == 1
800
- issue = Arachni::Data.issues.flatten.first
801
- issue.vector.class.should == Arachni::Element::Header
802
- issue.vector.affected_input_name.should == 'Referer'
829
+ expect(Arachni::Data.issues.size).to eq(1)
830
+ issue = Arachni::Data.issues.first
831
+ expect(issue.vector.class).to eq(Arachni::Element::Header)
832
+ expect(issue.vector.affected_input_name).to eq('Referer')
803
833
  end
804
834
  end
805
835
 
@@ -809,7 +839,7 @@ describe Arachni::Check::Auditor do
809
839
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
810
840
  )
811
841
  @framework.http.run
812
- Arachni::Data.issues.size.should == 4
842
+ expect(Arachni::Data.issues.size).to eq(4)
813
843
  end
814
844
  end
815
845
  end
@@ -834,9 +864,9 @@ describe Arachni::Check::Auditor do
834
864
  @framework.http.run
835
865
  end
836
866
 
837
- Arachni::Data.issues.flatten.find do |i|
867
+ expect(Arachni::Data.issues.all.find do |i|
838
868
  i.vector.affected_input_name == 'you_made_it'
839
- end.should be_true
869
+ end).to be_truthy
840
870
  end
841
871
  end
842
872
 
@@ -859,10 +889,10 @@ describe Arachni::Check::Auditor do
859
889
  @framework.http.run
860
890
  end
861
891
 
862
- issue = issues.flatten.first
863
- issue.should be_true
864
- issue.vector.class.should == Arachni::Element::Form
865
- issue.vector.affected_input_name.should == 'you_made_it'
892
+ issue = issues.first
893
+ expect(issue).to be_truthy
894
+ expect(issue.vector.class).to eq(Arachni::Element::Form)
895
+ expect(issue.vector.affected_input_name).to eq('you_made_it')
866
896
  end
867
897
  end
868
898
 
@@ -881,29 +911,29 @@ describe Arachni::Check::Auditor do
881
911
  auditor = Arachni::Check::Base.new( page, @framework )
882
912
  auditor.audit( @seed, submit: { train: false } )
883
913
  @framework.http.run
884
- updated_pages.should be_empty
914
+ expect(updated_pages).to be_empty
885
915
  end
886
916
  end
887
917
  end
888
918
  end
889
919
  end
890
920
 
891
- describe '#audit_taint' do
892
- it "delegates to #{Arachni::Element::Capabilities::Analyzable::Taint}#taint_analysis" do
921
+ describe '#audit_signature' do
922
+ it "delegates to #{Arachni::Element::Capabilities::Analyzable::Signature}#signature_analysis" do
893
923
  auditor.load_page_from( @url + '/link' )
894
924
 
895
- $audit_taint_called = []
925
+ $audit_signature_called = []
896
926
  auditor.page.elements.each do |element|
897
927
  element.class.class_eval do
898
- def taint_analysis( *args, &block )
899
- $audit_taint_called << self.class if $audit_taint_called
928
+ def signature_analysis( *args, &block )
929
+ $audit_signature_called << self.class if $audit_signature_called
900
930
  super( *args, &block )
901
931
  end
902
932
  end
903
933
  end
904
934
 
905
- auditor.audit_taint( 'seed' )
906
- $audit_taint_called.should == auditor.page.elements.map(&:class)
935
+ auditor.audit_signature( 'seed' )
936
+ expect($audit_signature_called).to eq(auditor.page.elements.map(&:class))
907
937
  end
908
938
  end
909
939
 
@@ -922,7 +952,7 @@ describe Arachni::Check::Auditor do
922
952
  end
923
953
 
924
954
  auditor.audit_differential( { false: '0', pairs: { '1' => '2' } } )
925
- $audit_differential_called.should == auditor.page.elements.map(&:class)
955
+ expect($audit_differential_called).to eq(auditor.page.elements.map(&:class))
926
956
  end
927
957
  end
928
958
 
@@ -941,7 +971,7 @@ describe Arachni::Check::Auditor do
941
971
  end
942
972
 
943
973
  auditor.audit_timeout( 'seed', timeout: 1 )
944
- $audit_timeout_called.should == auditor.page.elements.map(&:class)
974
+ expect($audit_timeout_called).to eq(auditor.page.elements.map(&:class))
945
975
  end
946
976
  end
947
977
 
@@ -1113,7 +1143,7 @@ describe Arachni::Check::Auditor do
1113
1143
  true
1114
1144
  end
1115
1145
  auditor.browser_cluster.wait
1116
- calls.should == 1
1146
+ expect(calls).to eq(1)
1117
1147
  end
1118
1148
  end
1119
1149
 
@@ -1125,7 +1155,7 @@ describe Arachni::Check::Auditor do
1125
1155
  false
1126
1156
  end
1127
1157
  auditor.browser_cluster.wait
1128
- calls.should > 1
1158
+ expect(calls).to be > 1
1129
1159
  end
1130
1160
  end
1131
1161
  end