arachni 1.2.1 → 1.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -23,13 +23,13 @@ describe Arachni::Data::Plugins do
23
23
 
24
24
  subject.store( plugins.create(:distributable), result )
25
25
 
26
- subject.statistics[:names].should == [:distributable]
26
+ expect(subject.statistics[:names]).to eq([:distributable])
27
27
  end
28
28
  end
29
29
 
30
30
  describe '#results' do
31
31
  it 'returns a Hash' do
32
- subject.results.should be_kind_of Hash
32
+ expect(subject.results).to be_kind_of Hash
33
33
  end
34
34
  end
35
35
 
@@ -39,7 +39,7 @@ describe Arachni::Data::Plugins do
39
39
  result = { stuff: 1 }
40
40
 
41
41
  subject.store( plugins.create(:distributable), result )
42
- subject.results[:distributable][:results].should == result
42
+ expect(subject.results[:distributable][:results]).to eq(result)
43
43
  end
44
44
  end
45
45
 
@@ -51,7 +51,7 @@ describe Arachni::Data::Plugins do
51
51
  subject.store( plugins.create(:distributable), 'stuff' => 1 )
52
52
 
53
53
  subject.merge_results( plugins, results )
54
- subject.results[:distributable][:results]['stuff'].should == 3
54
+ expect(subject.results[:distributable][:results]['stuff']).to eq(3)
55
55
  end
56
56
 
57
57
  context 'when a merge error occurs' do
@@ -61,10 +61,10 @@ describe Arachni::Data::Plugins do
61
61
  results = [ distributable: { results: { 'stuff' => 2 } } ]
62
62
  subject.store( plugins.create(:distributable), 'stuff' => 1 )
63
63
 
64
- plugins[:distributable].stub(:merge) { raise }
64
+ allow(plugins[:distributable]).to receive(:merge) { raise }
65
65
 
66
66
  subject.merge_results( plugins, results )
67
- subject.results[:distributable][:results]['stuff'].should == 1
67
+ expect(subject.results[:distributable][:results]['stuff']).to eq(1)
68
68
  end
69
69
  end
70
70
  end
@@ -75,10 +75,10 @@ describe Arachni::Data::Plugins do
75
75
  subject.dump( dump_directory )
76
76
 
77
77
  results_file = "#{dump_directory}/results/distributable"
78
- File.exists?( results_file ).should be_true
79
- subject.results.should == {
78
+ expect(File.exists?( results_file )).to be_truthy
79
+ expect(subject.results).to eq({
80
80
  distributable: Marshal.load( IO.read( results_file ) )
81
- }
81
+ })
82
82
  end
83
83
  end
84
84
 
@@ -87,14 +87,14 @@ describe Arachni::Data::Plugins do
87
87
  subject.store( plugins.create(:distributable), stuff: 1 )
88
88
  subject.dump( dump_directory )
89
89
 
90
- subject.results.should == described_class.load( dump_directory ).results
90
+ expect(subject.results).to eq(described_class.load( dump_directory ).results)
91
91
  end
92
92
  end
93
93
 
94
94
  describe '#clear' do
95
95
  %w(results).each do |method|
96
96
  it "clears ##{method}" do
97
- subject.send(method).should receive(:clear)
97
+ expect(subject.send(method)).to receive(:clear)
98
98
  subject.clear
99
99
  end
100
100
  end
@@ -18,13 +18,13 @@ describe Arachni::Data::Session do
18
18
 
19
19
  describe '#statistics' do
20
20
  it 'returns an empty Hash' do
21
- subject.statistics.should == {}
21
+ expect(subject.statistics).to eq({})
22
22
  end
23
23
  end
24
24
 
25
25
  describe '#configuration' do
26
26
  it 'returns an empty Hash' do
27
- subject.configuration.should == {}
27
+ expect(subject.configuration).to eq({})
28
28
  end
29
29
  end
30
30
 
@@ -34,8 +34,8 @@ describe Arachni::Data::Session do
34
34
  subject.dump( dump_directory )
35
35
 
36
36
  results_file = "#{dump_directory}/configuration"
37
- File.exists?( results_file ).should be_true
38
- subject.configuration.should == { stuff: [1] }
37
+ expect(File.exists?( results_file )).to be_truthy
38
+ expect(subject.configuration).to eq({ stuff: [1] })
39
39
  end
40
40
  end
41
41
 
@@ -44,14 +44,14 @@ describe Arachni::Data::Session do
44
44
  subject.configuration[:stuff] = [1]
45
45
  subject.dump( dump_directory )
46
46
 
47
- subject.configuration.should == described_class.load( dump_directory ).configuration
47
+ expect(subject.configuration).to eq(described_class.load( dump_directory ).configuration)
48
48
  end
49
49
  end
50
50
 
51
51
  describe '#clear' do
52
52
  %w(configuration).each do |method|
53
53
  it "clears ##{method}" do
54
- subject.send(method).should receive(:clear)
54
+ expect(subject.send(method)).to receive(:clear)
55
55
  subject.clear
56
56
  end
57
57
  end
@@ -15,32 +15,32 @@ describe Arachni::Data do
15
15
 
16
16
  describe '#framework' do
17
17
  it "returns an instance of #{described_class::Framework}" do
18
- subject.framework.should be_kind_of described_class::Framework
18
+ expect(subject.framework).to be_kind_of described_class::Framework
19
19
  end
20
20
  end
21
21
 
22
22
  describe '#session' do
23
23
  it "returns an instance of #{described_class::Session}" do
24
- subject.session.should be_kind_of described_class::Session
24
+ expect(subject.session).to be_kind_of described_class::Session
25
25
  end
26
26
  end
27
27
 
28
28
  describe '#issues' do
29
29
  it "returns an instance of #{described_class::Issues}" do
30
- subject.issues.should be_kind_of described_class::Issues
30
+ expect(subject.issues).to be_kind_of described_class::Issues
31
31
  end
32
32
  end
33
33
 
34
34
  describe '#plugins' do
35
35
  it "returns an instance of #{described_class::Plugins}" do
36
- subject.plugins.should be_kind_of described_class::Plugins
36
+ expect(subject.plugins).to be_kind_of described_class::Plugins
37
37
  end
38
38
  end
39
39
 
40
40
  describe '#statistics' do
41
41
  %w(framework issues plugins).each do |name|
42
42
  it "includes :#{name} statistics" do
43
- subject.statistics[name.to_sym].should == subject.send(name).statistics
43
+ expect(subject.statistics[name.to_sym]).to eq(subject.send(name).statistics)
44
44
  end
45
45
  end
46
46
  end
@@ -54,8 +54,8 @@ describe Arachni::Data do
54
54
 
55
55
  new_instance = subject.load( dump_directory ).send(name)
56
56
 
57
- new_instance.should be_kind_of subject.send(name).class
58
- new_instance.object_id.should_not == previous_instance.object_id
57
+ expect(new_instance).to be_kind_of subject.send(name).class
58
+ expect(new_instance.object_id).not_to eq(previous_instance.object_id)
59
59
  end
60
60
  end
61
61
  end
@@ -63,7 +63,7 @@ describe Arachni::Data do
63
63
  describe '#clear' do
64
64
  %w(framework issues plugins session).each do |method|
65
65
  it "clears ##{method}" do
66
- subject.send(method).should receive(:clear)
66
+ expect(subject.send(method)).to receive(:clear)
67
67
  subject.clear
68
68
  end
69
69
  end
@@ -37,21 +37,21 @@ describe Arachni::Element::Body do
37
37
  it 'logs an issue' do
38
38
  auditable.match_and_log( valid_pattern )
39
39
 
40
- logged_issue = Arachni::Data.issues.flatten.first
41
- logged_issue.should be_true
40
+ logged_issue = Arachni::Data.issues.first
41
+ expect(logged_issue).to be_truthy
42
42
 
43
- logged_issue.vector.url.should == Arachni::Utilities.normalize_url( @url )
44
- logged_issue.vector.class.should == Arachni::Element::Body
45
- logged_issue.signature.should == valid_pattern.source
46
- logged_issue.proof.should == 'Match'
47
- logged_issue.trusted.should be_true
43
+ expect(logged_issue.vector.url).to eq(Arachni::Utilities.normalize_url( @url ))
44
+ expect(logged_issue.vector.class).to eq(Arachni::Element::Body)
45
+ expect(logged_issue.signature).to eq(valid_pattern.source)
46
+ expect(logged_issue.proof).to eq('Match')
47
+ expect(logged_issue.trusted).to be_truthy
48
48
  end
49
49
  end
50
50
 
51
51
  context 'and it does not matche the given pattern' do
52
52
  it 'does not log an issue' do
53
53
  auditable.match_and_log( invalid_pattern )
54
- Arachni::Data.issues.should be_empty
54
+ expect(Arachni::Data.issues).to be_empty
55
55
  end
56
56
  end
57
57
  end
@@ -60,8 +60,8 @@ describe Arachni::Element::Body do
60
60
  describe '#dup' do
61
61
  it 'duplicates self' do
62
62
  body = auditable.dup
63
- body.should == auditable
64
- body.object_id.should_not == auditable
63
+ expect(body).to eq(auditable)
64
+ expect(body.object_id).not_to eq(auditable)
65
65
  end
66
66
  end
67
67
 
@@ -22,10 +22,10 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
22
22
  context 'when #differential_analysis_options is' do
23
23
  context 'nil' do
24
24
  it 'skips it' do
25
- subject.differential_analysis_options.should be_nil
25
+ expect(subject.differential_analysis_options).to be_nil
26
26
  dupped = subject.dup
27
- dupped.should == dupped
28
- dupped.differential_analysis_options.should be_nil
27
+ expect(dupped).to eq(dupped)
28
+ expect(dupped.differential_analysis_options).to be_nil
29
29
  end
30
30
  end
31
31
 
@@ -36,9 +36,9 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
36
36
  subject.differential_analysis_options = h
37
37
 
38
38
  dupped = subject.dup
39
- dupped.should == dupped
40
- dupped.differential_analysis_options.should == h
41
- dupped.differential_analysis_options.object_id.should_not == h.object_id
39
+ expect(dupped).to eq(dupped)
40
+ expect(dupped.differential_analysis_options).to eq(h)
41
+ expect(dupped.differential_analysis_options.object_id).not_to eq(h.object_id)
42
42
  end
43
43
  end
44
44
  end
@@ -46,7 +46,7 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
46
46
 
47
47
  describe '#to_rpc_data' do
48
48
  it "does not include 'differential_analysis_options'" do
49
- subject.to_rpc_data.should_not include 'differential_analysis_options'
49
+ expect(subject.to_rpc_data).not_to include 'differential_analysis_options'
50
50
  end
51
51
  end
52
52
 
@@ -64,7 +64,26 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
64
64
  let(:url) { 'http://stuff.com/' }
65
65
 
66
66
  it 'returns false' do
67
- subject.differential_analysis( @opts ).should be_false
67
+ expect(subject.differential_analysis( @opts )).to be_falsey
68
+ end
69
+ end
70
+
71
+ context 'when the inputs are missing default values' do
72
+ it 'skips them' do
73
+ subject.inputs = {
74
+ 'with-value' => 'value',
75
+ 'without-value' => ''
76
+ }
77
+
78
+ submitted = []
79
+
80
+ allow_any_instance_of(subject.class).to receive(:submit) do |instance|
81
+ submitted << instance.affected_input_name
82
+ end
83
+
84
+ subject.differential_analysis( @opts )
85
+
86
+ expect(submitted.uniq).to eq ['with-value']
68
87
  end
69
88
  end
70
89
 
@@ -75,16 +94,16 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
75
94
  subject.differential_analysis( @opts )
76
95
  auditor.http.run
77
96
 
78
- results = Arachni::Data.issues.flatten
79
- results.should be_any
80
- results.first.vector.affected_input_name.should == 'input'
97
+ results = Arachni::Data.issues
98
+ expect(results).to be_any
99
+ expect(results.first.vector.affected_input_name).to eq('input')
81
100
  end
82
101
 
83
102
  it 'adds remarks' do
84
103
  subject.differential_analysis( @opts )
85
104
  auditor.http.run
86
105
 
87
- Arachni::Data.issues.first.variations.first.remarks[:differential_analysis].size.should == 3
106
+ expect(Arachni::Data.issues.first.remarks[:differential_analysis].size).to eq(3)
88
107
  end
89
108
  end
90
109
 
@@ -95,7 +114,7 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
95
114
  subject.differential_analysis( @opts )
96
115
  auditor.http.run
97
116
 
98
- issues.should be_empty
117
+ expect(issues).to be_empty
99
118
  end
100
119
  end
101
120
 
@@ -106,14 +125,14 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
106
125
  subject.differential_analysis( @opts.merge( submit: { timeout: 1_000 } ) )
107
126
  auditor.http.run
108
127
 
109
- issues.should be_empty
128
+ expect(issues).to be_empty
110
129
 
111
130
  Arachni::Element::Capabilities::Auditable.reset
112
131
 
113
132
  subject.differential_analysis( @opts.merge( timeout: 3_000 ) )
114
133
  auditor.http.run
115
134
 
116
- issues.should be_any
135
+ expect(issues).to be_any
117
136
  end
118
137
  end
119
138
 
@@ -124,7 +143,7 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
124
143
  subject.differential_analysis( @opts )
125
144
  auditor.http.run
126
145
 
127
- issues.should be_empty
146
+ expect(issues).to be_empty
128
147
  end
129
148
  end
130
149
 
@@ -135,7 +154,7 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
135
154
  subject.differential_analysis( @opts )
136
155
  auditor.http.run
137
156
 
138
- issues.should be_empty
157
+ expect(issues).to be_empty
139
158
  end
140
159
  end
141
160
 
@@ -146,7 +165,7 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
146
165
  subject.differential_analysis( @opts )
147
166
  auditor.http.run
148
167
 
149
- issues.should be_empty
168
+ expect(issues).to be_empty
150
169
  end
151
170
  end
152
171
 
@@ -157,7 +176,7 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
157
176
  subject.differential_analysis( @opts )
158
177
  auditor.http.run
159
178
 
160
- issues.should be_empty
179
+ expect(issues).to be_empty
161
180
  end
162
181
  end
163
182
 
@@ -168,10 +187,9 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
168
187
  subject.differential_analysis( @opts )
169
188
  auditor.http.run
170
189
 
171
- issues.should be_empty
190
+ expect(issues).to be_empty
172
191
  end
173
192
  end
174
-
175
193
  end
176
194
 
177
195
  end
@@ -1,9 +1,9 @@
1
1
  require 'spec_helper'
2
2
 
3
- describe Arachni::Element::Capabilities::Analyzable::Taint do
3
+ describe Arachni::Element::Capabilities::Analyzable::Signature do
4
4
 
5
5
  before :all do
6
- Arachni::Options.url = @url = web_server_url_for( :taint )
6
+ Arachni::Options.url = @url = web_server_url_for( :signature )
7
7
  Arachni::Options.audit.elements :links
8
8
 
9
9
  @auditor = Auditor.new( Arachni::Page.from_url( @url ), Arachni::Framework.new )
@@ -17,7 +17,7 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
17
17
  @negative.auditor.page = Arachni::Page.from_url( @url )
18
18
  end
19
19
 
20
- describe '#taint_analysis' do
20
+ describe '#signature_analysis' do
21
21
 
22
22
  before do
23
23
  @seed = 'my_seed'
@@ -30,15 +30,15 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
30
30
  url: 'http://stuff.com/',
31
31
  inputs: { 'input' => '' }
32
32
  )
33
- auditable.taint_analysis( @seed ).should be_false
33
+ expect(auditable.signature_analysis( @seed )).to be_falsey
34
34
  end
35
35
  end
36
36
 
37
37
  context 'when called with no opts' do
38
38
  it 'uses the defaults' do
39
- @positive.taint_analysis( @seed )
39
+ @positive.signature_analysis( @seed )
40
40
  @auditor.http.run
41
- issues.size.should == 1
41
+ expect(issues.size).to eq(1)
42
42
  end
43
43
  end
44
44
 
@@ -49,20 +49,20 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
49
49
  php: @seed,
50
50
  }
51
51
 
52
- @positive.taint_analysis( payloads, substring: @seed )
52
+ @positive.signature_analysis( payloads, substring: @seed )
53
53
  @auditor.http.run
54
- issues.size.should == 1
54
+ expect(issues.size).to eq(1)
55
55
  issue = issues.first
56
- issue.platform_name.should == :php
57
- issue.platform_type.should == :languages
56
+ expect(issue.platform_name).to eq(:php)
57
+ expect(issue.platform_type).to eq(:languages)
58
58
  end
59
59
  end
60
60
 
61
61
  context 'when called against non-vulnerable input' do
62
62
  it 'does not log an issue' do
63
- @negative.taint_analysis( @seed )
63
+ @negative.signature_analysis( @seed )
64
64
  @auditor.http.run
65
- issues.should be_empty
65
+ expect(issues).to be_empty
66
66
  end
67
67
  end
68
68
 
@@ -70,25 +70,25 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
70
70
  describe :regexp do
71
71
  context String do
72
72
  it 'tries to match the provided pattern' do
73
- @positive.taint_analysis( @seed,
73
+ @positive.signature_analysis( @seed,
74
74
  regexp: @seed,
75
75
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
76
76
  )
77
77
  @auditor.http.run
78
- issues.size.should == 1
79
- issues.first.vector.seed.should == @seed
78
+ expect(issues.size).to eq(1)
79
+ expect(issues.first.vector.seed).to eq(@seed)
80
80
  end
81
81
  end
82
82
 
83
83
  context Array do
84
84
  it 'tries to match the provided patterns' do
85
- @positive.taint_analysis( @seed,
85
+ @positive.signature_analysis( @seed,
86
86
  regexp: [@seed],
87
87
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
88
88
  )
89
89
  @auditor.http.run
90
- issues.size.should == 1
91
- issues.first.vector.seed.should == @seed
90
+ expect(issues.size).to eq(1)
91
+ expect(issues.first.vector.seed).to eq(@seed)
92
92
  end
93
93
  end
94
94
 
@@ -99,7 +99,7 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
99
99
  php: /#{@seed} p.*/,
100
100
  }
101
101
 
102
- @positive.taint_analysis(
102
+ @positive.signature_analysis(
103
103
  "#{@seed} windows",
104
104
  regexp: regexps.dup,
105
105
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
@@ -107,9 +107,9 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
107
107
 
108
108
  @auditor.http.run
109
109
 
110
- issues.size.should == 1
111
- issues[0].platform_name.should == :windows
112
- issues[0].signature.should == regexps[:windows].source
110
+ expect(issues.size).to eq(1)
111
+ expect(issues[0].platform_name).to eq(:windows)
112
+ expect(issues[0].signature).to eq(regexps[:windows].source)
113
113
  end
114
114
 
115
115
  context 'when the payloads are per platform' do
@@ -134,7 +134,7 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
134
134
  asp: /#{@seed}/
135
135
  }
136
136
 
137
- @positive.taint_analysis(
137
+ @positive.signature_analysis(
138
138
  payloads.dup,
139
139
  regexp: regexps.dup,
140
140
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
@@ -142,13 +142,13 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
142
142
 
143
143
  @auditor.http.run
144
144
 
145
- issues.size.should == 3
145
+ expect(issues.size).to eq(3)
146
146
  payloads.keys.each do |platform|
147
147
  issue = issues.find{ |i| i.platform_name == platform }
148
148
 
149
- issue.vector.seed.should == payloads[platform]
150
- issue.platform_name.should == platform
151
- issue.signature.should == regexps[platform].source
149
+ expect(issue.vector.seed).to eq(payloads[platform])
150
+ expect(issue.platform_name).to eq(platform)
151
+ expect(issue.signature).to eq(regexps[platform].source)
152
152
  end
153
153
  end
154
154
 
@@ -165,7 +165,7 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
165
165
  asp: /#{@seed}/
166
166
  }
167
167
 
168
- @positive.taint_analysis(
168
+ @positive.signature_analysis(
169
169
  payloads.dup,
170
170
  regexp: regexps.dup,
171
171
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
@@ -173,11 +173,11 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
173
173
 
174
174
  @auditor.http.run
175
175
 
176
- issues.size.should == 1
176
+ expect(issues.size).to eq(1)
177
177
  issue = issues.first
178
178
 
179
- issue.platform_name.should == :asp
180
- issue.signature.should == regexps[:asp].source
179
+ expect(issue.platform_name).to eq(:asp)
180
+ expect(issue.signature).to eq(regexps[:asp].source)
181
181
  end
182
182
  end
183
183
  end
@@ -185,12 +185,12 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
185
185
 
186
186
  context 'when the page matches the regexp even before we audit it' do
187
187
  it 'does not log an issue' do
188
- @positive.taint_analysis( 'Inject here',
188
+ @positive.signature_analysis( 'Inject here',
189
189
  regexp: 'Inject he[er]',
190
190
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
191
191
  )
192
192
  @auditor.http.run
193
- issues.should be_empty
193
+ expect(issues).to be_empty
194
194
  end
195
195
  end
196
196
  end
@@ -198,27 +198,27 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
198
198
  describe :substring do
199
199
  context String do
200
200
  it 'tries to match the provided pattern' do
201
- @positive.taint_analysis( @seed,
201
+ @positive.signature_analysis( @seed,
202
202
  substring: @seed,
203
203
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
204
204
  )
205
205
  @auditor.http.run
206
- issues.size.should == 1
207
- issues.first.vector.seed.should == @seed
208
- issues.first.should be_trusted
206
+ expect(issues.size).to eq(1)
207
+ expect(issues.first.vector.seed).to eq(@seed)
208
+ expect(issues.first).to be_trusted
209
209
  end
210
210
  end
211
211
 
212
212
  context Array do
213
213
  it 'tries to match the provided patterns' do
214
- @positive.taint_analysis( @seed,
214
+ @positive.signature_analysis( @seed,
215
215
  substring: [@seed],
216
216
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
217
217
  )
218
218
  @auditor.http.run
219
- issues.size.should == 1
220
- issues.first.vector.seed.should == @seed
221
- issues.first.should be_trusted
219
+ expect(issues.size).to eq(1)
220
+ expect(issues.first.vector.seed).to eq(@seed)
221
+ expect(issues.first).to be_trusted
222
222
  end
223
223
  end
224
224
 
@@ -229,7 +229,7 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
229
229
  php: "#{@seed} p",
230
230
  }
231
231
 
232
- @positive.taint_analysis(
232
+ @positive.signature_analysis(
233
233
  "#{@seed} windows",
234
234
  substring: substrings.dup,
235
235
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
@@ -237,10 +237,10 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
237
237
 
238
238
  @auditor.http.run
239
239
 
240
- issues.size.should == 1
241
- issues[0].platform_name.should == :windows
242
- issues[0].signature.should == substrings[:windows].to_s
243
- issues[0].should be_trusted
240
+ expect(issues.size).to eq(1)
241
+ expect(issues[0].platform_name).to eq(:windows)
242
+ expect(issues[0].signature).to eq(substrings[:windows].to_s)
243
+ expect(issues[0]).to be_trusted
244
244
  end
245
245
 
246
246
  context 'when the payloads are per platform' do
@@ -265,7 +265,7 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
265
265
  asp: @seed
266
266
  }
267
267
 
268
- @positive.taint_analysis(
268
+ @positive.signature_analysis(
269
269
  payloads.dup,
270
270
  substring: substrings.dup,
271
271
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
@@ -273,14 +273,14 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
273
273
 
274
274
  @auditor.http.run
275
275
 
276
- issues.size.should == 3
276
+ expect(issues.size).to eq(3)
277
277
  payloads.keys.each do |platform|
278
278
  issue = issues.find{ |i| i.platform_name == platform }
279
279
 
280
- issue.vector.seed.should == payloads[platform]
281
- issue.platform_name.should == platform
282
- issue.signature.should == substrings[platform].to_s
283
- issue.should be_trusted
280
+ expect(issue.vector.seed).to eq(payloads[platform])
281
+ expect(issue.platform_name).to eq(platform)
282
+ expect(issue.signature).to eq(substrings[platform].to_s)
283
+ expect(issue).to be_trusted
284
284
  end
285
285
  end
286
286
  end
@@ -288,12 +288,12 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
288
288
 
289
289
  context 'when the page includes the substring even before we audit it' do
290
290
  it 'does not log any issues' do
291
- @positive.taint_analysis( 'Inject here',
291
+ @positive.signature_analysis( 'Inject here',
292
292
  regexp: 'Inject here',
293
293
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
294
294
  )
295
295
  @auditor.http.run
296
- issues.should be_empty
296
+ expect(issues).to be_empty
297
297
  end
298
298
  end
299
299
 
@@ -310,7 +310,7 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
310
310
  asp: @seed
311
311
  }
312
312
 
313
- @positive.taint_analysis(
313
+ @positive.signature_analysis(
314
314
  payloads.dup,
315
315
  substring: substrings.dup,
316
316
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
@@ -318,37 +318,37 @@ describe Arachni::Element::Capabilities::Analyzable::Taint do
318
318
 
319
319
  @auditor.http.run
320
320
 
321
- issues.size.should == 1
321
+ expect(issues.size).to eq(1)
322
322
  issue = issues.first
323
323
 
324
- issue.platform_name.should == :asp
325
- issue.signature.should == substrings[:asp].to_s
326
- issue.should be_trusted
324
+ expect(issue.platform_name).to eq(:asp)
325
+ expect(issue.signature).to eq(substrings[:asp].to_s)
326
+ expect(issue).to be_trusted
327
327
  end
328
328
  end
329
329
  end
330
330
 
331
331
  describe :ignore do
332
332
  it 'ignores matches whose response also matches the ignore patterns' do
333
- @positive.taint_analysis( @seed,
333
+ @positive.signature_analysis( @seed,
334
334
  substring: @seed,
335
335
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
336
336
  ignore: @seed
337
337
  )
338
338
  @auditor.http.run
339
- issues.should be_empty
339
+ expect(issues).to be_empty
340
340
  end
341
341
  end
342
342
 
343
343
  describe :longest_word_optimization do
344
344
  it 'optimizes the pattern matching process by first matching against the largest word in the regexp' do
345
- @positive.taint_analysis(
345
+ @positive.signature_analysis(
346
346
  @seed,
347
347
  regexp: @seed,
348
348
  longest_word_optimization: true
349
349
  )
350
350
  @auditor.http.run
351
- issues.should be_any
351
+ expect(issues).to be_any
352
352
  end
353
353
  end
354
354
  end