arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -6,20 +6,20 @@ describe Arachni::Component::Options::Address do
6
6
  describe '#valid?' do
7
7
  context 'when the value is valid' do
8
8
  it 'returns true' do
9
- described_class.new( '', value: 'localhost' ).should be_true
9
+ expect(described_class.new( '', value: 'localhost' )).to be_truthy
10
10
  end
11
11
  end
12
12
 
13
13
  context 'when the value is not valid' do
14
14
  it 'returns false' do
15
- described_class.new( '', value: 'stuff' ).valid?.should be_false
15
+ expect(described_class.new( '', value: 'stuff' ).valid?).to be_falsey
16
16
  end
17
17
  end
18
18
  end
19
19
 
20
20
  describe '#type' do
21
21
  it 'returns the option type as a string' do
22
- described_class.new( '' ).type.should == :address
22
+ expect(described_class.new( '' ).type).to eq(:address)
23
23
  end
24
24
  end
25
25
 
@@ -5,12 +5,12 @@ describe Arachni::Component::Options::Base do
5
5
 
6
6
  describe '#normalize' do
7
7
  it 'returns the value as is' do
8
- described_class.new( '', value: 'blah' ).normalize.should == 'blah'
8
+ expect(described_class.new( '', value: 'blah' ).normalize).to eq('blah')
9
9
  end
10
10
 
11
11
  context 'when no #value is set' do
12
12
  it 'returns #default' do
13
- described_class.new( '', default: 'test' ).normalize.should == 'test'
13
+ expect(described_class.new( '', default: 'test' ).normalize).to eq('test')
14
14
  end
15
15
  end
16
16
  end
@@ -19,13 +19,13 @@ describe Arachni::Component::Options::Base do
19
19
  context 'when the option is required' do
20
20
  context 'and the value is not empty' do
21
21
  it 'returns true' do
22
- described_class.new( '', required: true, value: 'stuff' ).valid?.should be_true
22
+ expect(described_class.new( '', required: true, value: 'stuff' ).valid?).to be_truthy
23
23
  end
24
24
  end
25
25
 
26
26
  context 'and the value is nil' do
27
27
  it 'returns false' do
28
- described_class.new( '', required: true ).valid?.should be_false
28
+ expect(described_class.new( '', required: true ).valid?).to be_falsey
29
29
  end
30
30
  end
31
31
  end
@@ -33,13 +33,13 @@ describe Arachni::Component::Options::Base do
33
33
  context 'when the option is not required' do
34
34
  context 'and the value is not empty' do
35
35
  it 'returns true' do
36
- described_class.new( '', value: 'true' ).valid?.should be_true
36
+ expect(described_class.new( '', value: 'true' ).valid?).to be_truthy
37
37
  end
38
38
  end
39
39
 
40
40
  context 'and the value is empty' do
41
41
  it 'returns true' do
42
- described_class.new( '' ).valid?.should be_true
42
+ expect(described_class.new( '' ).valid?).to be_truthy
43
43
  end
44
44
  end
45
45
  end
@@ -47,7 +47,7 @@ describe Arachni::Component::Options::Base do
47
47
 
48
48
  describe '#type' do
49
49
  it 'returns the option type' do
50
- described_class.new( '' ).type.should == :abstract
50
+ expect(described_class.new( '' ).type).to eq(:abstract)
51
51
  end
52
52
  end
53
53
  end
@@ -10,34 +10,34 @@ describe Arachni::Component::Options::Bool do
10
10
  context 'when the value is valid' do
11
11
  it 'returns true' do
12
12
  trues.each do |v|
13
- described_class.new( '', value: v ).valid?.should be_true
13
+ expect(described_class.new( '', value: v ).valid?).to be_truthy
14
14
  end
15
15
  end
16
16
  end
17
17
 
18
18
  context 'when the value is not valid' do
19
19
  it 'returns false' do
20
- described_class.new( '', value: 'dds' ).valid?.should be_false
20
+ expect(described_class.new( '', value: 'dds' ).valid?).to be_falsey
21
21
  end
22
22
  end
23
23
  end
24
24
 
25
25
  describe '#normalize' do
26
26
  it 'converts the string input into a boolean value' do
27
- trues.each { |v| described_class.new( '', value: v ).normalize.should be_true }
28
- falses.each { |v| described_class.new( '', value: v ).normalize.should be_false }
27
+ trues.each { |v| expect(described_class.new( '', value: v ).normalize).to be_truthy }
28
+ falses.each { |v| expect(described_class.new( '', value: v ).normalize).to be_falsey }
29
29
  end
30
30
  end
31
31
 
32
32
  describe '#true?' do
33
33
  context 'when the value option represents true' do
34
34
  it 'returns true' do
35
- trues.each { |v| described_class.new( '', value: v ).true?.should be_true }
35
+ trues.each { |v| expect(described_class.new( '', value: v ).true?).to be_truthy }
36
36
  end
37
37
  end
38
38
  context 'when the value option represents false' do
39
39
  it 'returns false' do
40
- falses.each { |v| described_class.new( '', value: v ).true?.should be_false }
40
+ falses.each { |v| expect(described_class.new( '', value: v ).true?).to be_falsey }
41
41
  end
42
42
  end
43
43
  end
@@ -45,19 +45,19 @@ describe Arachni::Component::Options::Bool do
45
45
  describe '#false?' do
46
46
  context 'when the value option represents false' do
47
47
  it 'returns true' do
48
- falses.each { |v| described_class.new( '', value: v ).false?.should be_true }
48
+ falses.each { |v| expect(described_class.new( '', value: v ).false?).to be_truthy }
49
49
  end
50
50
  end
51
51
  context 'when the value option represents true' do
52
52
  it 'returns false' do
53
- trues.each { |v| described_class.new( '', value: v ).false?.should be_false }
53
+ trues.each { |v| expect(described_class.new( '', value: v ).false?).to be_falsey }
54
54
  end
55
55
  end
56
56
  end
57
57
 
58
58
  describe '#type' do
59
59
  it 'returns the option type as a string' do
60
- described_class.new( '' ).type.should == :bool
60
+ expect(described_class.new( '' ).type).to eq(:bool)
61
61
  end
62
62
  end
63
63
 
@@ -9,14 +9,14 @@ describe Arachni::Component::Options::Float do
9
9
  it 'returns true' do
10
10
  ['1', 1, '1.2'].each do |value|
11
11
  subject.value = value
12
- subject.valid?.should be_true
12
+ expect(subject.valid?).to be_truthy
13
13
  end
14
14
  end
15
15
  end
16
16
  context 'when the value is not valid' do
17
17
  it 'returns false' do
18
18
  subject.value = '4d'
19
- subject.valid?.should be_false
19
+ expect(subject.valid?).to be_falsey
20
20
  end
21
21
  end
22
22
  end
@@ -24,19 +24,19 @@ describe Arachni::Component::Options::Float do
24
24
  describe '#normalize' do
25
25
  it 'converts the string input into a boolean value' do
26
26
  subject.value = '5'
27
- subject.normalize.should == 5.0
27
+ expect(subject.normalize).to eq(5.0)
28
28
 
29
29
  subject.value = '5.3'
30
- subject.normalize.should == 5.3
30
+ expect(subject.normalize).to eq(5.3)
31
31
 
32
32
  subject.value = 3
33
- subject.normalize.should == 3.0
33
+ expect(subject.normalize).to eq(3.0)
34
34
  end
35
35
  end
36
36
 
37
37
  describe '#type' do
38
38
  it 'returns the option type as a string' do
39
- subject.type.should == :float
39
+ expect(subject.type).to eq(:float)
40
40
  end
41
41
  end
42
42
 
@@ -9,7 +9,7 @@ describe Arachni::Component::Options::Int do
9
9
  it 'returns true' do
10
10
  ['1', 1, 0, '0'].each do |value|
11
11
  subject.value = value
12
- subject.valid?.should be_true
12
+ expect(subject.valid?).to be_truthy
13
13
  end
14
14
  end
15
15
  end
@@ -18,7 +18,7 @@ describe Arachni::Component::Options::Int do
18
18
  it 'returns false' do
19
19
  %w(sd 4d).each do |value|
20
20
  subject.value = value
21
- subject.valid?.should be_false
21
+ expect(subject.valid?).to be_falsey
22
22
  end
23
23
  end
24
24
  end
@@ -27,16 +27,16 @@ describe Arachni::Component::Options::Int do
27
27
  describe '#normalize' do
28
28
  it 'converts the string input into a boolean value' do
29
29
  subject.value = '5'
30
- subject.normalize.should == 5
30
+ expect(subject.normalize).to eq(5)
31
31
 
32
32
  subject.value = 3
33
- subject.normalize.should == 3
33
+ expect(subject.normalize).to eq(3)
34
34
  end
35
35
  end
36
36
 
37
37
  describe '#type' do
38
38
  it 'returns the option type as a string' do
39
- subject.type.should == :integer
39
+ expect(subject.type).to eq(:integer)
40
40
  end
41
41
  end
42
42
 
@@ -9,7 +9,7 @@ describe Arachni::Component::Options::MultipleChoice do
9
9
  let(:data) { subject.to_rpc_data }
10
10
 
11
11
  it "includes 'choices'" do
12
- data['choices'].should == subject.choices
12
+ expect(data['choices']).to eq(subject.choices)
13
13
  end
14
14
  end
15
15
 
@@ -18,20 +18,20 @@ describe Arachni::Component::Options::MultipleChoice do
18
18
  let(:data) { Arachni::RPC::Serializer.rpc_data( subject ) }
19
19
 
20
20
  it "restores 'choices'" do
21
- restored.choices.should == subject.choices
21
+ expect(restored.choices).to eq(subject.choices)
22
22
  end
23
23
  end
24
24
 
25
25
  describe '#choices' do
26
26
  context 'when no values have been provided' do
27
27
  it 'returns an empty array' do
28
- described_class.new( '' ).choices.should == []
28
+ expect(described_class.new( '' ).choices).to eq([])
29
29
  end
30
30
  end
31
31
 
32
32
  it 'returns an array of possible, predefined, values' do
33
33
  valid_values = %w(1 2 3)
34
- described_class.new( '', choices: valid_values ).choices.should == valid_values
34
+ expect(described_class.new( '', choices: valid_values ).choices).to eq(valid_values)
35
35
  end
36
36
  end
37
37
 
@@ -39,13 +39,13 @@ describe Arachni::Component::Options::MultipleChoice do
39
39
  context 'when the value is valid' do
40
40
  it 'returns true' do
41
41
  subject.value = 1
42
- subject.should be_true
42
+ expect(subject).to be_truthy
43
43
  end
44
44
  end
45
45
  context 'when the value is not valid' do
46
46
  it 'returns false' do
47
47
  subject.value = 4
48
- subject.valid?.should be_false
48
+ expect(subject.valid?).to be_falsey
49
49
  end
50
50
  end
51
51
  end
@@ -53,29 +53,29 @@ describe Arachni::Component::Options::MultipleChoice do
53
53
  describe '#normalize' do
54
54
  it 'returns a String' do
55
55
  subject.value = '3'
56
- subject.normalize.should == '3'
56
+ expect(subject.normalize).to eq('3')
57
57
 
58
58
  subject.value = 3
59
- subject.normalize.should == '3'
59
+ expect(subject.normalize).to eq('3')
60
60
  end
61
61
  end
62
62
 
63
63
  describe '#description' do
64
64
  it 'returns a description including the acceptable values' do
65
- subject.description.include?( 'Blah' ).should be_true
66
- subject.choices.each { |v| subject.description.should include v }
65
+ expect(subject.description.include?( 'Blah' )).to be_truthy
66
+ subject.choices.each { |v| expect(subject.description).to include v }
67
67
  end
68
68
  end
69
69
 
70
70
  describe '#type' do
71
71
  it 'returns the option type as a string' do
72
- subject.type.should == :multiple_choice
72
+ expect(subject.type).to eq(:multiple_choice)
73
73
  end
74
74
  end
75
75
 
76
76
  describe '#to_h' do
77
77
  it 'includes :choices' do
78
- subject.to_h[:choices].should == subject.choices
78
+ expect(subject.to_h[:choices]).to eq(subject.choices)
79
79
  end
80
80
  end
81
81
 
@@ -9,7 +9,7 @@ describe Arachni::Component::Options::Object do
9
9
  it 'returns the value as is' do
10
10
  [1, 'test', :stuff, [:blah]].each do |value|
11
11
  subject.value = value
12
- subject.send(m).should == value
12
+ expect(subject.send(m)).to eq(value)
13
13
  end
14
14
  end
15
15
  end
@@ -17,7 +17,7 @@ describe Arachni::Component::Options::Object do
17
17
 
18
18
  describe '#type' do
19
19
  it 'returns the option type as a string' do
20
- subject.type.should == :object
20
+ expect(subject.type).to eq(:object)
21
21
  end
22
22
  end
23
23
 
@@ -8,21 +8,21 @@ describe Arachni::Component::Options::Path do
8
8
  context 'when the path exists' do
9
9
  it 'returns true' do
10
10
  subject.value = __FILE__
11
- subject.valid?.should be_true
11
+ expect(subject.valid?).to be_truthy
12
12
  end
13
13
  end
14
14
 
15
15
  context 'when the path does not exist' do
16
16
  it 'returns false' do
17
17
  subject.value = __FILE__ + '22'
18
- subject.valid?.should be_false
18
+ expect(subject.valid?).to be_falsey
19
19
  end
20
20
  end
21
21
  end
22
22
 
23
23
  describe '#type' do
24
24
  it 'returns the option type as a string' do
25
- subject.type.should == :path
25
+ expect(subject.type).to eq(:path)
26
26
  end
27
27
  end
28
28
 
@@ -9,10 +9,10 @@ describe Arachni::Component::Options::Port do
9
9
  it 'returns true' do
10
10
  (1..65535).each do |p|
11
11
  subject.value = p
12
- subject.valid?.should be_true
12
+ expect(subject.valid?).to be_truthy
13
13
 
14
14
  subject.value = p.to_s
15
- subject.valid?.should be_true
15
+ expect(subject.valid?).to be_truthy
16
16
  end
17
17
  end
18
18
  end
@@ -20,10 +20,10 @@ describe Arachni::Component::Options::Port do
20
20
  it 'returns false' do
21
21
  ['dd', -1, 0, 9999999].each do |p|
22
22
  subject.value = p
23
- subject.valid?.should be_false
23
+ expect(subject.valid?).to be_falsey
24
24
 
25
25
  subject.value = p.to_s
26
- subject.valid?.should be_false
26
+ expect(subject.valid?).to be_falsey
27
27
  end
28
28
 
29
29
  end
@@ -32,7 +32,7 @@ describe Arachni::Component::Options::Port do
32
32
 
33
33
  describe '#type' do
34
34
  it 'returns the option type as a string' do
35
- subject.type.should == :port
35
+ expect(subject.type).to eq(:port)
36
36
  end
37
37
  end
38
38
 
@@ -8,7 +8,7 @@ describe Arachni::Component::Options::String do
8
8
  it 'returns true' do
9
9
  ['test', 999, true].each do |value|
10
10
  subject.value = value
11
- subject.valid?.should be_true
11
+ expect(subject.valid?).to be_truthy
12
12
  end
13
13
  end
14
14
  end
@@ -16,13 +16,13 @@ describe Arachni::Component::Options::String do
16
16
  describe '#normalize' do
17
17
  it 'returns a string representation of the value' do
18
18
  subject.value = 'test'
19
- subject.normalize.should == 'test'
19
+ expect(subject.normalize).to eq('test')
20
20
  end
21
21
  end
22
22
 
23
23
  describe '#type' do
24
24
  it 'returns the option type as a string' do
25
- subject.type.should == :string
25
+ expect(subject.type).to eq(:string)
26
26
  end
27
27
  end
28
28
 
@@ -7,7 +7,7 @@ describe Arachni::Component::Options::URL do
7
7
  describe '#normalize' do
8
8
  it "returns #{Arachni::URI}" do
9
9
  subject.value = 'http://localhost'
10
- subject.normalize.should == Arachni::URI('http://localhost')
10
+ expect(subject.normalize).to eq(Arachni::URI('http://localhost'))
11
11
  end
12
12
  end
13
13
 
@@ -15,7 +15,7 @@ describe Arachni::Component::Options::URL do
15
15
  context 'when the value is valid' do
16
16
  it 'returns true' do
17
17
  subject.value = 'http://localhost'
18
- subject.valid?.should be_true
18
+ expect(subject.valid?).to be_truthy
19
19
  end
20
20
  end
21
21
 
@@ -23,7 +23,7 @@ describe Arachni::Component::Options::URL do
23
23
  it 'returns false' do
24
24
  ['http://localhost22', 'localhost', 11, '#$#$c3c43', true].each do |value|
25
25
  subject.value = value
26
- subject.valid?.should be_false
26
+ expect(subject.valid?).to be_falsey
27
27
  end
28
28
  end
29
29
  end
@@ -31,7 +31,7 @@ describe Arachni::Component::Options::URL do
31
31
 
32
32
  describe '#type' do
33
33
  it 'returns the option type as a string' do
34
- subject.type.should == :url
34
+ expect(subject.type).to eq(:url)
35
35
  end
36
36
  end
37
37
 
@@ -12,7 +12,7 @@ describe Arachni::Component::Utilities do
12
12
  filename = 'read_file.txt'
13
13
  filepath = File.expand_path( File.dirname( __FILE__ ) ) + '/utilities_spec/' + filename
14
14
 
15
- @utils.read_file( filename ).join( "\n" ).should == IO.read( filepath ).strip
15
+ expect(@utils.read_file( filename ).join( "\n" )).to eq(IO.read( filepath ).strip)
16
16
  end
17
17
 
18
18
  context 'if a block is given' do
@@ -23,7 +23,7 @@ describe Arachni::Component::Utilities do
23
23
  lines = []
24
24
  @utils.read_file( filename ){ |line| lines << line }
25
25
 
26
- lines.join( "\n" ).should == IO.read( filepath ).strip
26
+ expect(lines.join( "\n" )).to eq(IO.read( filepath ).strip)
27
27
  end
28
28
  end
29
29
  end