arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -2,9 +2,27 @@ require 'spec_helper'
2
2
 
3
3
  describe Arachni::Element::Cookie do
4
4
  it_should_behave_like 'element'
5
+
5
6
  it_should_behave_like 'with_source'
6
7
  it_should_behave_like 'with_dom'
7
- it_should_behave_like 'auditable', single_input: true
8
+ it_should_behave_like 'with_auditor'
9
+
10
+ it_should_behave_like 'submittable'
11
+ it_should_behave_like 'inputtable', single_input: true
12
+ it_should_behave_like 'mutable', single_input: true
13
+ it_should_behave_like 'auditable'
14
+
15
+ before :each do
16
+ @framework ||= Arachni::Framework.new
17
+ @auditor = Auditor.new( Arachni::Page.from_url( url ), @framework )
18
+ end
19
+
20
+ after :each do
21
+ @framework.reset
22
+ reset_options
23
+ end
24
+
25
+ let(:auditor) { @auditor }
8
26
 
9
27
  def auditable_extract_parameters( resource )
10
28
  YAML.load( resource.body )
@@ -30,14 +48,14 @@ describe Arachni::Element::Cookie do
30
48
  end
31
49
 
32
50
  it 'should be assigned to Arachni::Cookie for easy access' do
33
- Arachni::Cookie.should == described_class
51
+ expect(Arachni::Cookie).to eq(described_class)
34
52
  end
35
53
 
36
54
  context 'when initialized' do
37
55
  context 'with hash key/pair' do
38
56
  describe '#simple' do
39
57
  it 'returns name/val as a key/pair' do
40
- subject.simple.should == inputs
58
+ expect(subject.simple).to eq(inputs)
41
59
  end
42
60
  end
43
61
  end
@@ -47,11 +65,11 @@ describe Arachni::Element::Cookie do
47
65
  let(:data) { subject.to_rpc_data }
48
66
 
49
67
  it "converts initialization_options['expires'] to String" do
50
- data['initialization_options']['expires'].should == subject.expires_at.to_s
68
+ expect(data['initialization_options']['expires']).to eq(subject.expires_at.to_s)
51
69
  end
52
70
 
53
71
  it "converts data['expires'] to String" do
54
- data['data']['expires'].should == subject.expires_at.to_s
72
+ expect(data['data']['expires']).to eq(subject.expires_at.to_s)
55
73
  end
56
74
  end
57
75
 
@@ -60,16 +78,17 @@ describe Arachni::Element::Cookie do
60
78
  let(:data) { Arachni::RPC::Serializer.rpc_data( subject ) }
61
79
 
62
80
  it "restores initialization_options['expires']" do
63
- subject.expires_at.should be_kind_of Time
64
- restored.expires_at.to_s.should == subject.expires_at.to_s
81
+ expect(subject.expires_at).to be_kind_of Time
82
+ expect(restored.expires_at.to_s).to eq(subject.expires_at.to_s)
65
83
  end
66
84
  end
67
85
 
68
86
  describe '#mutations' do
69
87
  describe :parameter_names do
70
88
  it 'creates a new cookie' do
71
- subject.mutations( 'seed', parameter_names: true ).last.inputs.keys.should ==
89
+ expect(subject.mutations( 'seed', parameter_names: true ).last.inputs.keys).to eq(
72
90
  %w(seed)
91
+ )
73
92
  end
74
93
  end
75
94
  describe 'Options.audit.cookies_extensively' do
@@ -81,45 +100,45 @@ describe Arachni::Element::Cookie do
81
100
  c.auditor = a
82
101
 
83
102
 
84
- c.mutations( 'seed' ).map { |e| e.type }.uniq.size.should == 1
103
+ expect(c.mutations( 'seed' ).map { |e| e.type }.uniq.size).to eq(1)
85
104
 
86
105
  mutations = c.mutations( 'seed' ).map { |e| e.inputs }
87
106
 
88
107
  Arachni::Options.audit.cookies_extensively = true
89
- c.mutations( 'seed' ).map { |e| e.type }.uniq.size.should > 1
108
+ expect(c.mutations( 'seed' ).map { |e| e.type }.uniq.size).to be > 1
90
109
  c.mutations( 'seed' ).each do |e|
91
110
  next if e.is_a? described_class
92
111
 
93
- mutations.should include e.audit_options[:submit][:cookies]
112
+ expect(mutations).to include e.audit_options[:submit][:cookies]
94
113
  end
95
114
 
96
115
  Arachni::Options.audit.cookies_extensively = false
97
- c.mutations( 'seed' ).map { |e| e.type }.uniq.size.should == 1
116
+ expect(c.mutations( 'seed' ).map { |e| e.type }.uniq.size).to eq(1)
98
117
  end
99
118
  end
100
119
  end
101
120
 
102
121
  describe '#type' do
103
122
  it 'is "cookie"' do
104
- subject.type.should == :cookie
123
+ expect(subject.type).to eq(:cookie)
105
124
  end
106
125
  end
107
126
 
108
127
  describe '#secure?' do
109
128
  context 'when set' do
110
129
  it 'returns true' do
111
- described_class.new(
130
+ expect(described_class.new(
112
131
  url: url,
113
132
  name: 'mycookie',
114
133
  value: 'myvalue',
115
134
  secure: true
116
- ).secure?.should be_true
135
+ ).secure?).to be_truthy
117
136
  end
118
137
  end
119
138
 
120
139
  context 'when not set' do
121
140
  it 'returns false' do
122
- subject.secure?.should be_false
141
+ expect(subject.secure?).to be_falsey
123
142
  end
124
143
  end
125
144
  end
@@ -127,18 +146,18 @@ describe Arachni::Element::Cookie do
127
146
  describe '#httponly?' do
128
147
  context 'when set' do
129
148
  it 'returns true' do
130
- described_class.new(
149
+ expect(described_class.new(
131
150
  url: url,
132
151
  name: 'mycookie',
133
152
  value: 'myvalue',
134
153
  httponly: true
135
- ).http_only?.should be_true
154
+ ).http_only?).to be_truthy
136
155
  end
137
156
  end
138
157
 
139
158
  context 'when not set' do
140
159
  it 'returns false' do
141
- subject.http_only?.should be_false
160
+ expect(subject.http_only?).to be_falsey
142
161
  end
143
162
  end
144
163
  end
@@ -146,23 +165,23 @@ describe Arachni::Element::Cookie do
146
165
  describe '#session?' do
147
166
  context 'when cookie is session cookie' do
148
167
  it 'returns true' do
149
- described_class.new(
168
+ expect(described_class.new(
150
169
  url: url,
151
170
  name: 'mycookie',
152
171
  value: 'myvalue',
153
172
  httponly: true
154
- ).session?.should be_true
173
+ ).session?).to be_truthy
155
174
  end
156
175
  end
157
176
 
158
177
  context 'when cookie is not session cookie' do
159
178
  it 'returns false' do
160
- described_class.new(
179
+ expect(described_class.new(
161
180
  url: url,
162
181
  name: 'mycookie',
163
182
  value: 'myvalue',
164
183
  expires: Time.now
165
- ).session?.should be_false
184
+ ).session?).to be_falsey
166
185
  end
167
186
  end
168
187
  end
@@ -182,26 +201,26 @@ describe Arachni::Element::Cookie do
182
201
 
183
202
  context 'and has not expired' do
184
203
  it 'returns false' do
185
- described_class.new(
204
+ expect(described_class.new(
186
205
  url: url,
187
206
  name: '',
188
207
  value: '',
189
208
  expires: Time.now + 999999
190
- ).expired?.should be_false
209
+ ).expired?).to be_falsey
191
210
  end
192
211
  end
193
212
  end
194
213
 
195
214
  context 'when not set' do
196
215
  it 'returns false' do
197
- subject.http_only?.should be_false
216
+ expect(subject.http_only?).to be_falsey
198
217
  end
199
218
  end
200
219
  end
201
220
 
202
221
  describe '#data' do
203
222
  it 'returns the cookie data' do
204
- subject.data.should == {
223
+ expect(subject.data).to eq({
205
224
  name: 'mycookie',
206
225
  value: 'myvalue',
207
226
  url: subject.action,
@@ -216,7 +235,7 @@ describe Arachni::Element::Cookie do
216
235
  path: '/submit',
217
236
  domain: '127.0.0.2',
218
237
  httponly: false
219
- }
238
+ })
220
239
  end
221
240
  end
222
241
 
@@ -224,26 +243,72 @@ describe Arachni::Element::Cookie do
224
243
  context 'when there are no #inputs' do
225
244
  it 'returns nil' do
226
245
  subject.inputs = {}
227
- subject.dom.should be_nil
246
+ expect(subject.dom).to be_nil
228
247
  end
229
248
  end
230
249
  end
231
250
 
232
251
  describe '#name' do
233
252
  it 'returns the name of the cookie' do
234
- subject.name.should == 'mycookie'
253
+ expect(subject.name).to eq('mycookie')
235
254
  end
236
255
  end
237
256
 
238
257
  describe '#value' do
239
258
  it 'returns the value of the cookie' do
240
- subject.value.should == 'myvalue'
259
+ expect(subject.value).to eq('myvalue')
241
260
  end
242
261
  end
243
262
 
244
263
  describe '.encode' do
264
+
245
265
  it 'encodes the string in a way that makes is suitable to be included in a cookie header' do
246
- described_class.encode( 'some stuff \'";%=&' ).should == 'some%20stuff%20%27%22%3B%25%3D%26'
266
+ expect(described_class.encode( 'some stuff \'";%=&' )).to eq('some+stuff+\'%22%3B%25=%26')
267
+ end
268
+
269
+ context 'when encoding values' do
270
+ %w(! = ' / : ).each do |character|
271
+ it "preserves '#{character}'" do
272
+ expect(described_class.encode( character )).to eq(character)
273
+ end
274
+ end
275
+
276
+ ['+', ';', '%', "\0", '&', '"', "\n", "\r"].each do |character|
277
+ it "encodes '#{character}'" do
278
+ expect(described_class.encode( character )).to eq("%#{character.unpack('H*')[0]}".upcase)
279
+ end
280
+
281
+ it "encodes space as '+'" do
282
+ expect(described_class.encode( ' ' )).to eq('+')
283
+ end
284
+ end
285
+ end
286
+
287
+ context 'when encoding names' do
288
+ %w(! ' / : ).each do |character|
289
+ it "preserves '#{character}'" do
290
+ expect(described_class.encode( character, true )).to eq(character)
291
+ end
292
+ end
293
+
294
+ ['=', '+', ';', '%', "\0", '&', '"', "\n", "\r"].each do |character|
295
+ it "encodes '#{character}'" do
296
+ expect(described_class.encode( character, true )).to eq("%#{character.unpack('H*')[0]}".upcase)
297
+ end
298
+
299
+ it "encodes space as '+'" do
300
+ expect(described_class.encode( ' ', true )).to eq('+')
301
+ end
302
+ end
303
+ end
304
+ end
305
+
306
+ describe '.decode' do
307
+ it 'delegates to Form.decode' do
308
+ string = 'some stuff'
309
+
310
+ allow(Arachni::Form).to receive(:decode) { 'ret' }.with( string )
311
+ expect(described_class.decode( string )).to eq('ret')
247
312
  end
248
313
  end
249
314
 
@@ -257,9 +322,10 @@ describe Arachni::Element::Cookie do
257
322
  httponly: true
258
323
  )
259
324
 
260
- c.to_set_cookie.should ==
261
- 'blah%3Dha%25=some%20stuff%20%3B; Path=/; Domain=127.0.0.2; Secure; HttpOnly'
262
- described_class.from_set_cookie( url, c.to_set_cookie ).first.should == c
325
+ expect(c.to_set_cookie).to eq(
326
+ 'blah%3Dha%25=some+stuff+%3B; Path=/; Domain=127.0.0.2; Secure; HttpOnly'
327
+ )
328
+ expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
263
329
 
264
330
  c = described_class.new(
265
331
  url: url,
@@ -268,9 +334,10 @@ describe Arachni::Element::Cookie do
268
334
  path: '/stuff'
269
335
  )
270
336
 
271
- described_class.from_set_cookie( url, c.to_set_cookie ).first.should == c
272
- c.to_set_cookie.should ==
273
- 'blah%3Dha%25=some%20stuff%20%3B; Path=/stuff; Domain=127.0.0.2'
337
+ expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
338
+ expect(c.to_set_cookie).to eq(
339
+ 'blah%3Dha%25=some+stuff+%3B; Path=/stuff; Domain=127.0.0.2'
340
+ )
274
341
  end
275
342
  end
276
343
 
@@ -281,7 +348,7 @@ describe Arachni::Element::Cookie do
281
348
  name: 'blah=ha%',
282
349
  value: 'some stuff ;',
283
350
  )
284
- c.to_s.should == 'blah%3Dha%25=some%20stuff%20%3B'
351
+ expect(c.to_s).to eq('blah%3Dha%25=some+stuff+%3B')
285
352
  end
286
353
  end
287
354
 
@@ -293,66 +360,66 @@ describe Arachni::Element::Cookie do
293
360
  value: 'some stuff ;',
294
361
  )
295
362
 
296
- c.inputs.values.first.should == 'some stuff ;'
363
+ expect(c.inputs.values.first).to eq('some stuff ;')
297
364
  end
298
365
  end
299
366
 
300
367
  describe '.from_file' do
301
368
  it 'parses a Netscape cookie_jar file into an array of cookies' do
302
369
  cookies = described_class.from_file( url, fixtures_path + 'cookies.txt' )
303
- cookies.size.should == 4
370
+ expect(cookies.size).to eq(4)
304
371
 
305
372
  cookie = cookies.shift
306
- cookie.action.should == url
307
- cookie.url.should == url
308
- cookie.inputs.should == { 'first_name' => 'first_value' }
309
- cookie.simple.should == { 'first_name' => 'first_value' }
310
- cookie.domain.should == '.domain.com'
311
- cookie.path.should == '/path/to/somewhere'
312
- cookie.secure.should == true
313
- cookie.session?.should == false
314
- cookie.expires.is_a?( Time ).should == true
315
- cookie.name.should == 'first_name'
316
- cookie.value.should == 'first_value'
373
+ expect(cookie.action).to eq(url)
374
+ expect(cookie.url).to eq(url)
375
+ expect(cookie.inputs).to eq({ 'first_name' => 'first_value' })
376
+ expect(cookie.simple).to eq({ 'first_name' => 'first_value' })
377
+ expect(cookie.domain).to eq('.domain.com')
378
+ expect(cookie.path).to eq('/path/to/somewhere')
379
+ expect(cookie.secure).to eq(true)
380
+ expect(cookie.session?).to eq(false)
381
+ expect(cookie.expires.is_a?( Time )).to eq(true)
382
+ expect(cookie.name).to eq('first_name')
383
+ expect(cookie.value).to eq('first_value')
317
384
 
318
385
  cookie = cookies.shift
319
- cookie.action.should == url
320
- cookie.url.should == url
321
- cookie.inputs.should == { 'second_name' => 'second_value' }
322
- cookie.simple.should == { 'second_name' => 'second_value' }
323
- cookie.domain.should == 'another-domain.com'
324
- cookie.path.should == '/'
325
- cookie.secure.should == false
326
- cookie.session?.should == true
327
- cookie.expires.should be_nil
328
- cookie.name.should == 'second_name'
329
- cookie.value.should == 'second_value'
386
+ expect(cookie.action).to eq(url)
387
+ expect(cookie.url).to eq(url)
388
+ expect(cookie.inputs).to eq({ 'second_name' => 'second_value' })
389
+ expect(cookie.simple).to eq({ 'second_name' => 'second_value' })
390
+ expect(cookie.domain).to eq('another-domain.com')
391
+ expect(cookie.path).to eq('/')
392
+ expect(cookie.secure).to eq(false)
393
+ expect(cookie.session?).to eq(true)
394
+ expect(cookie.expires).to be_nil
395
+ expect(cookie.name).to eq('second_name')
396
+ expect(cookie.value).to eq('second_value')
330
397
 
331
398
  cookie = cookies.shift
332
- cookie.action.should == url
333
- cookie.url.should == url
334
- cookie.inputs.should == { 'NAME' => 'OP5jTLV6VhYHADJAbJ1ZR@L8~081210' }
335
- cookie.simple.should == { 'NAME' => 'OP5jTLV6VhYHADJAbJ1ZR@L8~081210' }
336
- cookie.domain.should == '.blah-domain'
337
- cookie.path.should == '/'
338
- cookie.secure.should == false
339
- cookie.session?.should == false
340
- cookie.expires.should == Time.parse( '2020-08-09 16:59:20 +0300' )
341
- cookie.name.should == 'NAME'
342
- cookie.value.should == 'OP5jTLV6VhYHADJAbJ1ZR@L8~081210'
399
+ expect(cookie.action).to eq(url)
400
+ expect(cookie.url).to eq(url)
401
+ expect(cookie.inputs).to eq({ 'NAME' => 'OP5jTLV6VhYHADJAbJ1ZR@L8~081210' })
402
+ expect(cookie.simple).to eq({ 'NAME' => 'OP5jTLV6VhYHADJAbJ1ZR@L8~081210' })
403
+ expect(cookie.domain).to eq('.blah-domain')
404
+ expect(cookie.path).to eq('/')
405
+ expect(cookie.secure).to eq(false)
406
+ expect(cookie.session?).to eq(false)
407
+ expect(cookie.expires).to eq(Time.parse( '2020-08-09 16:59:20 +0300' ))
408
+ expect(cookie.name).to eq('NAME')
409
+ expect(cookie.value).to eq('OP5jTLV6VhYHADJAbJ1ZR@L8~081210')
343
410
 
344
411
  cookie = cookies.shift
345
- cookie.action.should == url
346
- cookie.url.should == url
347
- cookie.inputs.should == { '_superapp_session' => 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg%3D%3D--810acaa3759101ed79740e25de31e0c5bad76cdc' }
348
- cookie.simple.should == { '_superapp_session' => 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg%3D%3D--810acaa3759101ed79740e25de31e0c5bad76cdc' }
349
- cookie.domain.should == '192.168.1.1'
350
- cookie.path.should == '/'
351
- cookie.secure.should == false
352
- cookie.session?.should == true
353
- cookie.expires.should be_nil
354
- cookie.name.should == '_superapp_session'
355
- cookie.value.should == 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg==--810acaa3759101ed79740e25de31e0c5bad76cdc'
412
+ expect(cookie.action).to eq(url)
413
+ expect(cookie.url).to eq(url)
414
+ expect(cookie.inputs).to eq({ '_superapp_session' => 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg%3D%3D--810acaa3759101ed79740e25de31e0c5bad76cdc' })
415
+ expect(cookie.simple).to eq({ '_superapp_session' => 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg%3D%3D--810acaa3759101ed79740e25de31e0c5bad76cdc' })
416
+ expect(cookie.domain).to eq('192.168.1.1')
417
+ expect(cookie.path).to eq('/')
418
+ expect(cookie.secure).to eq(false)
419
+ expect(cookie.session?).to eq(true)
420
+ expect(cookie.expires).to be_nil
421
+ expect(cookie.name).to eq('_superapp_session')
422
+ expect(cookie.value).to eq('BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg==--810acaa3759101ed79740e25de31e0c5bad76cdc')
356
423
  end
357
424
  end
358
425
 
@@ -361,10 +428,10 @@ describe Arachni::Element::Cookie do
361
428
  it 'returns an array of cookies' do
362
429
  response = http.get( url + '/set_cookie', mode: :sync )
363
430
  cookies = described_class.from_response( response )
364
- cookies.size.should == 1
431
+ expect(cookies.size).to eq(1)
365
432
  cookie = cookies.first
366
- cookie.name.should == 'my-cookie'
367
- cookie.value.should == 'my-val'
433
+ expect(cookie.name).to eq('my-cookie')
434
+ expect(cookie.value).to eq('my-val')
368
435
  end
369
436
  end
370
437
  end
@@ -384,27 +451,27 @@ describe Arachni::Element::Cookie do
384
451
  EOHTML
385
452
 
386
453
  cookies = described_class.from_document( 'http://test.com', html )
387
- cookies.size.should == 2
454
+ expect(cookies.size).to eq(2)
388
455
 
389
456
  cookie = cookies.shift
390
- cookie.name.should == 'cookie'
391
- cookie.value.should == 'val'
392
- cookie.expired?.should == false
393
- cookie.session?.should == true
394
- cookie.secure?.should == false
457
+ expect(cookie.name).to eq('cookie')
458
+ expect(cookie.value).to eq('val')
459
+ expect(cookie.expired?).to eq(false)
460
+ expect(cookie.session?).to eq(true)
461
+ expect(cookie.secure?).to eq(false)
395
462
 
396
463
  cookie = cookies.shift
397
- cookie.name.should == 'cookie2'
398
- cookie.value.should == 'val2'
399
- cookie.path.should == '/'
400
- cookie.domain.should == '.foo.com'
401
- cookie.secure?.should == true
402
- cookie.expired?.should == true
464
+ expect(cookie.name).to eq('cookie2')
465
+ expect(cookie.value).to eq('val2')
466
+ expect(cookie.path).to eq('/')
467
+ expect(cookie.domain).to eq('.foo.com')
468
+ expect(cookie.secure?).to eq(true)
469
+ expect(cookie.expired?).to eq(true)
403
470
  end
404
471
  end
405
472
  context 'with an empty string' do
406
473
  it 'returns an empty array' do
407
- described_class.from_document( '', '' ).should be_empty
474
+ expect(described_class.from_document( '', '' )).to be_empty
408
475
  end
409
476
  end
410
477
  end
@@ -419,14 +486,14 @@ describe Arachni::Element::Cookie do
419
486
  }
420
487
 
421
488
  cookies = described_class.from_headers( 'http://test.com', headers )
422
- cookies.size.should == 1
423
- cookies.first.name.should == 'coo@ki e2'
424
- cookies.first.value.should == 'blah val2@'
489
+ expect(cookies.size).to eq(1)
490
+ expect(cookies.first.name).to eq('coo@ki e2')
491
+ expect(cookies.first.value).to eq('blah val2@')
425
492
  end
426
493
  end
427
494
  context 'with an empty string' do
428
495
  it 'returns an empty array' do
429
- described_class.from_headers( '', {} ).should be_empty
496
+ expect(described_class.from_headers( '', {} )).to be_empty
430
497
  end
431
498
  end
432
499
  end
@@ -437,34 +504,34 @@ describe Arachni::Element::Cookie do
437
504
  sc = "SomeCookie=MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA%3D%3D"
438
505
  c1 = described_class.from_set_cookie( 'http://test.com', sc ).first
439
506
 
440
- c1.should == described_class.from_set_cookie( 'http://test.com', sc ).first
507
+ expect(c1).to eq(described_class.from_set_cookie( 'http://test.com', sc ).first)
441
508
 
442
509
  sc2 = "SomeCookie=\"MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA==\""
443
510
  c2 = described_class.from_set_cookie( 'http://test.com', sc2 ).first
444
511
 
445
- c1.should == c2
446
- c1.name.should == 'SomeCookie'
447
- c1.value.should == 'MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA=='
512
+ expect(c1).to eq(c2)
513
+ expect(c1.name).to eq('SomeCookie')
514
+ expect(c1.value).to eq('MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA==')
448
515
 
449
516
  sc3 = "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/stuff; Domain=.foo.com; HttpOnly"
450
517
  cookies = described_class.from_set_cookie( 'http://test.com', sc3 )
451
- cookies.size.should == 1
518
+ expect(cookies.size).to eq(1)
452
519
  cookie = cookies.first
453
- cookie.name.should == 'coo@ki e2'
454
- cookie.value.should == 'blah val2@'
455
- cookie.path.should == '/stuff'
456
- cookie.source.should == sc3
520
+ expect(cookie.name).to eq('coo@ki e2')
521
+ expect(cookie.value).to eq('blah val2@')
522
+ expect(cookie.path).to eq('/stuff')
523
+ expect(cookie.source).to eq(sc3)
457
524
  end
458
525
 
459
526
  context 'when there is no path' do
460
527
  it 'reverts to \'/\'' do
461
528
  sc3 = "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=.foo.com; HttpOnly"
462
529
  cookies = described_class.from_set_cookie( 'http://test.com/stuff', sc3 )
463
- cookies.size.should == 1
530
+ expect(cookies.size).to eq(1)
464
531
  cookie = cookies.first
465
- cookie.name.should == 'coo@ki e2'
466
- cookie.value.should == 'blah val2@'
467
- cookie.path.should == '/'
532
+ expect(cookie.name).to eq('coo@ki e2')
533
+ expect(cookie.value).to eq('blah val2@')
534
+ expect(cookie.path).to eq('/')
468
535
  end
469
536
  end
470
537
 
@@ -476,10 +543,10 @@ describe Arachni::Element::Cookie do
476
543
  let(:size) { described_class::MAX_SIZE }
477
544
 
478
545
  it 'returns empty array' do
479
- described_class.from_set_cookie(
546
+ expect(described_class.from_set_cookie(
480
547
  'http://test.com/stuff',
481
548
  cookie
482
- ).first.value.should be_empty
549
+ ).first.value).to be_empty
483
550
  end
484
551
  end
485
552
 
@@ -487,10 +554,10 @@ describe Arachni::Element::Cookie do
487
554
  let(:size) { described_class::MAX_SIZE + 1 }
488
555
 
489
556
  it 'sets empty value' do
490
- described_class.from_set_cookie(
557
+ expect(described_class.from_set_cookie(
491
558
  'http://test.com/stuff',
492
559
  cookie
493
- ).first.value.should be_empty
560
+ ).first.value).to be_empty
494
561
  end
495
562
  end
496
563
 
@@ -498,10 +565,10 @@ describe Arachni::Element::Cookie do
498
565
  let(:size) { described_class::MAX_SIZE - 1 }
499
566
 
500
567
  it 'leaves the values alone' do
501
- described_class.from_set_cookie(
568
+ expect(described_class.from_set_cookie(
502
569
  'http://test.com/stuff',
503
570
  cookie
504
- ).first.value.should == value
571
+ ).first.value).to eq(value)
505
572
  end
506
573
  end
507
574
  end
@@ -511,26 +578,26 @@ describe Arachni::Element::Cookie do
511
578
  it 'parses cookies formatted as a string' do
512
579
  cookies = described_class.from_string( 'http://owner-url.com',
513
580
  "coo%40ki+e2=blah+val2%40;name=value;name2=value2")
514
- cookies.size.should == 3
581
+ expect(cookies.size).to eq(3)
515
582
 
516
583
  c = cookies.shift
517
- c.name.should == 'coo@ki e2'
518
- c.value.should == 'blah val2@'
584
+ expect(c.name).to eq('coo@ki e2')
585
+ expect(c.value).to eq('blah val2@')
519
586
 
520
587
  c = cookies.shift
521
- c.name.should == 'name'
522
- c.value.should == 'value'
588
+ expect(c.name).to eq('name')
589
+ expect(c.value).to eq('value')
523
590
 
524
591
  c = cookies.shift
525
- c.name.should == 'name2'
526
- c.value.should == 'value2'
592
+ expect(c.name).to eq('name2')
593
+ expect(c.value).to eq('value2')
527
594
  end
528
595
 
529
596
  it 'can handle v1 values' do
530
- described_class.from_string(
597
+ expect(described_class.from_string(
531
598
  'http://owner-url.com',
532
599
  'cookie="blah stuff"'
533
- ).first.value.should == 'blah stuff'
600
+ ).first.value).to eq('blah stuff')
534
601
  end
535
602
 
536
603
  context 'when its value is' do
@@ -541,10 +608,10 @@ describe Arachni::Element::Cookie do
541
608
  let(:size) { described_class::MAX_SIZE }
542
609
 
543
610
  it 'sets empty value' do
544
- described_class.from_string(
611
+ expect(described_class.from_string(
545
612
  'http://owner-url.com',
546
613
  cookie
547
- ).first.value.should be_empty
614
+ ).first.value).to be_empty
548
615
  end
549
616
  end
550
617
 
@@ -552,10 +619,10 @@ describe Arachni::Element::Cookie do
552
619
  let(:size) { described_class::MAX_SIZE + 1 }
553
620
 
554
621
  it 'sets empty value' do
555
- described_class.from_string(
622
+ expect(described_class.from_string(
556
623
  'http://owner-url.com',
557
624
  cookie
558
- ).first.value.should be_empty
625
+ ).first.value).to be_empty
559
626
  end
560
627
  end
561
628
 
@@ -563,10 +630,10 @@ describe Arachni::Element::Cookie do
563
630
  let(:size) { described_class::MAX_SIZE - 1 }
564
631
 
565
632
  it 'leaves the values alone' do
566
- described_class.from_string(
633
+ expect(described_class.from_string(
567
634
  'http://owner-url.com',
568
635
  cookie
569
- ).first.value.should == value
636
+ ).first.value).to eq(value)
570
637
  end
571
638
  end
572
639
  end