arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -1,12 +1,26 @@
1
1
  require 'spec_helper'
2
2
 
3
3
  describe Arachni::Element::Link::DOM do
4
- it_should_behave_like 'element_dom', inputs: { 'param' => '1' }
4
+ inputs = { 'param' => '1' }
5
+
6
+ it_should_behave_like 'element_dom'
7
+
8
+ it_should_behave_like 'with_node'
9
+ it_should_behave_like 'with_auditor'
10
+
11
+ it_should_behave_like 'submittable_dom'
12
+ it_should_behave_like 'inputtable_dom', inputs: inputs
13
+ it_should_behave_like 'mutable_dom', inputs: inputs
14
+ it_should_behave_like 'auditable_dom'
5
15
 
6
16
  def auditable_extract_parameters( page )
7
17
  { 'param' => page.document.css('#container').text }
8
18
  end
9
19
 
20
+ def run
21
+ auditor.browser_cluster.wait
22
+ end
23
+
10
24
  before :each do
11
25
  @framework = Arachni::Framework.new
12
26
  @page = Arachni::Page.from_url( "#{url}/link" )
@@ -33,43 +47,43 @@ describe Arachni::Element::Link::DOM do
33
47
 
34
48
  describe '#type' do
35
49
  it 'returns :link_dom' do
36
- subject.type.should == :link_dom
50
+ expect(subject.type).to eq(:link_dom)
37
51
  end
38
52
  end
39
53
 
40
54
  describe '.type' do
41
55
  it 'returns :link_dom' do
42
- described_class.type.should == :link_dom
56
+ expect(described_class.type).to eq(:link_dom)
43
57
  end
44
58
  end
45
59
 
46
60
  describe '#parent' do
47
61
  it 'returns the parent element' do
48
- subject.parent.should be_kind_of Arachni::Element::Link
62
+ expect(subject.parent).to be_kind_of Arachni::Element::Link
49
63
  end
50
64
  end
51
65
 
52
66
  describe '#inputs' do
53
67
  it 'parses query-style inputs from URL fragments' do
54
- subject.inputs.should == { 'param' => 'some-name' }
68
+ expect(subject.inputs).to eq({ 'param' => 'some-name' })
55
69
  end
56
70
  end
57
71
 
58
72
  describe '#fragment' do
59
73
  it 'returns the URL fragment' do
60
- subject.fragment.should == '/test/?param=some-name'
74
+ expect(subject.fragment).to eq('/test/?param=some-name')
61
75
  end
62
76
  end
63
77
 
64
78
  describe '#fragment_path' do
65
79
  it 'returns the path from the URL fragment' do
66
- subject.fragment_path.should == '/test/'
80
+ expect(subject.fragment_path).to eq('/test/')
67
81
  end
68
82
  end
69
83
 
70
84
  describe '#fragment_query' do
71
85
  it 'returns the query from the URL fragment' do
72
- subject.fragment_query.should == 'param=some-name'
86
+ expect(subject.fragment_query).to eq('param=some-name')
73
87
  end
74
88
  end
75
89
 
@@ -81,17 +95,17 @@ describe Arachni::Element::Link::DOM do
81
95
  browser.load subject.page
82
96
 
83
97
  element = subject.locate
84
- element.should be_kind_of Watir::HTMLElement
98
+ expect(element).to be_kind_of Watir::HTMLElement
85
99
 
86
- parent.class.from_document(
100
+ expect(parent.class.from_document(
87
101
  parent.url, Nokogiri::HTML(element.html)
88
- ).first.should == parent
102
+ ).first).to eq(parent)
89
103
 
90
104
  called = true
91
105
  end
92
106
 
93
107
  subject.auditor.browser_cluster.wait
94
- called.should be_true
108
+ expect(called).to be_truthy
95
109
  end
96
110
  end
97
111
 
@@ -106,69 +120,73 @@ describe Arachni::Element::Link::DOM do
106
120
 
107
121
  subject.trigger
108
122
 
109
- subject.inputs.should == auditable_extract_parameters( browser.to_page )
123
+ expect(subject.inputs).to eq(auditable_extract_parameters( browser.to_page ))
110
124
  called = true
111
125
  end
112
126
 
113
127
  subject.auditor.browser_cluster.wait
114
- called.should be_true
128
+ expect(called).to be_truthy
115
129
  end
116
130
 
117
131
  it 'returns a playable transition' do
118
132
  inputs = { 'param' => 'The.Dude' }
119
133
  subject.update inputs
120
134
 
121
- transition = nil
135
+ transitions = []
122
136
  called = false
123
137
  subject.with_browser do |browser|
124
138
  subject.browser = browser
125
139
  browser.load subject.page
126
140
 
127
- transition = subject.trigger
141
+ transitions = subject.trigger
128
142
 
129
143
  page = browser.to_page
130
144
 
131
- subject.inputs.should == auditable_extract_parameters( page )
145
+ expect(subject.inputs).to eq(auditable_extract_parameters( page ))
132
146
  called = true
133
147
  end
134
148
 
135
149
  subject.auditor.browser_cluster.wait
136
- called.should be_true
150
+ expect(called).to be_truthy
137
151
 
138
152
  called = false
139
153
  auditor.with_browser do |browser|
140
154
  browser.load subject.page
141
- auditable_extract_parameters( browser.to_page ).should ==
155
+ expect(auditable_extract_parameters( browser.to_page )).to eq(
142
156
  { 'param' => '' }
157
+ )
158
+
159
+ transitions.each do |transition|
160
+ transition.play browser
161
+ end
143
162
 
144
- transition.play browser
145
- auditable_extract_parameters( browser.to_page ).should == inputs
163
+ expect(auditable_extract_parameters( browser.to_page )).to eq(inputs)
146
164
  called = true
147
165
  end
148
166
  auditor.browser_cluster.wait
149
- called.should be_true
167
+ expect(called).to be_truthy
150
168
  end
151
169
  end
152
170
 
153
171
  describe '.data_from_node' do
154
172
  it 'returns a hash with DOM data' do
155
- described_class.data_from_node( subject.node ).should == {
173
+ expect(described_class.data_from_node( subject.node )).to eq({
156
174
  inputs: {
157
175
  'param' => 'some-name'
158
176
  },
159
177
  fragment: '/test/?param=some-name',
160
178
  fragment_path: '/test/',
161
179
  fragment_query: 'param=some-name'
162
- }
180
+ })
163
181
  end
164
182
 
165
183
  it 'decodes inputs' do
166
184
  html = "<a href='#/?stuff%20here=bl%20ah'>Stuff</a>"
167
185
  node = Nokogiri::HTML.fragment(html).children.first
168
186
 
169
- described_class.data_from_node( node )[:inputs].should == {
187
+ expect(described_class.data_from_node( node )[:inputs]).to eq({
170
188
  'stuff here' => 'bl ah'
171
- }
189
+ })
172
190
  end
173
191
 
174
192
  context 'when there is no URL fragment' do
@@ -178,7 +196,7 @@ describe Arachni::Element::Link::DOM do
178
196
  end
179
197
 
180
198
  it 'return nil' do
181
- described_class.data_from_node( node ).should be_nil
199
+ expect(described_class.data_from_node( node )).to be_nil
182
200
  end
183
201
  end
184
202
 
@@ -189,7 +207,7 @@ describe Arachni::Element::Link::DOM do
189
207
  end
190
208
 
191
209
  it 'return nil' do
192
- described_class.data_from_node( node ).should be_nil
210
+ expect(described_class.data_from_node( node )).to be_nil
193
211
  end
194
212
  end
195
213
  end
@@ -4,11 +4,29 @@ describe Arachni::Element::Link do
4
4
  html = '<a href="/stuff#?stuff=blah">Bla</a>'
5
5
 
6
6
  it_should_behave_like 'element'
7
- it_should_behave_like 'with_node', html
7
+ it_should_behave_like 'with_node'
8
8
  it_should_behave_like 'with_dom', html
9
9
  it_should_behave_like 'refreshable'
10
+ it_should_behave_like 'with_source'
11
+ it_should_behave_like 'with_auditor'
12
+
13
+ it_should_behave_like 'submittable'
14
+ it_should_behave_like 'inputtable'
15
+ it_should_behave_like 'mutable'
10
16
  it_should_behave_like 'auditable'
11
17
 
18
+ before :each do
19
+ @framework ||= Arachni::Framework.new
20
+ @auditor = Auditor.new( Arachni::Page.from_url( url ), @framework )
21
+ end
22
+
23
+ after :each do
24
+ @framework.reset
25
+ reset_options
26
+ end
27
+
28
+ let(:auditor) { @auditor }
29
+
12
30
  def auditable_extract_parameters( resource )
13
31
  YAML.load( resource.body )
14
32
  end
@@ -31,19 +49,19 @@ describe Arachni::Element::Link do
31
49
  end
32
50
 
33
51
  it 'is assigned to Arachni::Link for easy access' do
34
- Arachni::Link.should == described_class
52
+ expect(Arachni::Link).to eq(described_class)
35
53
  end
36
54
 
37
55
  describe '#initialize' do
38
56
  describe :action do
39
57
  it 'sets #action' do
40
58
  action = "#{url}stuff"
41
- described_class.new( url: url, action: action ).action.should == action
59
+ expect(described_class.new( url: url, action: action ).action).to eq(action)
42
60
  end
43
61
 
44
62
  context 'when nil' do
45
63
  it 'defaults to :url' do
46
- described_class.new( url: url ).action.should == url
64
+ expect(described_class.new( url: url ).action).to eq(url)
47
65
  end
48
66
  end
49
67
  end
@@ -72,11 +90,11 @@ describe Arachni::Element::Link do
72
90
  end
73
91
 
74
92
  it 'removes the URL query' do
75
- subject.action.should == url
93
+ expect(subject.action).to eq(url)
76
94
  end
77
95
 
78
96
  it 'merges the URL query parameters with the given :inputs' do
79
- subject.inputs.should == query_inputs.merge( option_inputs )
97
+ expect(subject.inputs).to eq(query_inputs.merge( option_inputs ))
80
98
  end
81
99
 
82
100
  context 'when URL query parameters and :inputs have the same name' do
@@ -88,7 +106,7 @@ describe Arachni::Element::Link do
88
106
  end
89
107
 
90
108
  it 'it gives precedence to the :inputs' do
91
- subject.inputs.should == query_inputs.merge( option_inputs )
109
+ expect(subject.inputs).to eq(query_inputs.merge( option_inputs ))
92
110
  end
93
111
  end
94
112
 
@@ -100,9 +118,9 @@ describe Arachni::Element::Link do
100
118
  url: url,
101
119
  action: "#{url}/articles/some-stuff/23"
102
120
  )
103
- link.action.should == url + 'articles.php'
104
- link.url.should == url
105
- link.inputs.should == { 'id' => '23' }
121
+ expect(link.action).to eq(url + 'articles.php')
122
+ expect(link.url).to eq(url)
123
+ expect(link.inputs).to eq({ 'id' => '23' })
106
124
  end
107
125
  end
108
126
  end
@@ -111,33 +129,33 @@ describe Arachni::Element::Link do
111
129
  context 'when there are no DOM#inputs' do
112
130
  it 'returns nil' do
113
131
  subject.source = '<a href="/stuff">Bla</a>'
114
- subject.dom.should be_nil
132
+ expect(subject.dom).to be_nil
115
133
  end
116
134
  end
117
135
 
118
136
  context 'when there is no #node' do
119
137
  it 'returns nil' do
120
138
  subject.source = nil
121
- subject.dom.should be_nil
139
+ expect(subject.dom).to be_nil
122
140
  end
123
141
  end
124
142
  end
125
143
 
126
144
  describe '#simple' do
127
145
  it 'should return a simplified version as a hash' do
128
- subject.simple.should == { subject.action => subject.inputs }
146
+ expect(subject.simple).to eq({ subject.action => subject.inputs })
129
147
  end
130
148
  end
131
149
 
132
150
  describe '#to_s' do
133
151
  it 'returns a URL' do
134
- subject.to_s.should == "#{subject.action}?name1=value1&name2=value2"
152
+ expect(subject.to_s).to eq("#{subject.action}?name1=value1&name2=value2")
135
153
  end
136
154
  end
137
155
 
138
156
  describe '#type' do
139
157
  it 'should be "link"' do
140
- subject.type.should == :link
158
+ expect(subject.type).to eq(:link)
141
159
  end
142
160
  end
143
161
 
@@ -149,7 +167,7 @@ describe Arachni::Element::Link do
149
167
  c = subject.dup
150
168
  c.source = '<a href="/stuff#?stuff=blooh">Bla</a>'
151
169
 
152
- c.coverage_id.should == e.coverage_id
170
+ expect(c.coverage_id).to eq(e.coverage_id)
153
171
 
154
172
  e = subject.dup
155
173
  e.source = '<a href="/stuff#?stuff=blah">Bla</a>'
@@ -157,7 +175,7 @@ describe Arachni::Element::Link do
157
175
  c = subject.dup
158
176
  c.source = '<a href="/stuff#?stuff2=blooh">Bla</a>'
159
177
 
160
- c.coverage_id.should_not == e.coverage_id
178
+ expect(c.coverage_id).not_to eq(e.coverage_id)
161
179
  end
162
180
  end
163
181
 
@@ -169,7 +187,7 @@ describe Arachni::Element::Link do
169
187
  c = subject.dup
170
188
  c.source = '<a href="/stuff#?stuff=blah">Bla</a>'
171
189
 
172
- c.id.should == e.id
190
+ expect(c.id).to eq(e.id)
173
191
 
174
192
  e = subject.dup
175
193
  e.source = '<a href="/stuff#?stuff=blah">Bla</a>'
@@ -177,23 +195,23 @@ describe Arachni::Element::Link do
177
195
  c = subject.dup
178
196
  c.source = '<a href="/stuff#?stuff=blooh">Bla</a>'
179
197
 
180
- c.id.should_not == e.id
198
+ expect(c.id).not_to eq(e.id)
181
199
  end
182
200
  end
183
201
 
184
202
  describe '#to_rpc_data' do
185
203
  it "does not include 'dom_data'" do
186
204
  subject.source = html
187
- subject.dom.should be_true
205
+ expect(subject.dom).to be_truthy
188
206
 
189
- subject.to_rpc_data.should_not include 'dom_data'
207
+ expect(subject.to_rpc_data).not_to include 'dom_data'
190
208
  end
191
209
  end
192
210
 
193
211
  describe '.from_document' do
194
212
  context 'when the response does not contain any links' do
195
213
  it 'should return an empty array' do
196
- described_class.from_document( '', '' ).should be_empty
214
+ expect(described_class.from_document( '', '' )).to be_empty
197
215
  end
198
216
  end
199
217
  context 'when links have actions that are out of scope' do
@@ -210,8 +228,8 @@ describe Arachni::Element::Link do
210
228
  Arachni::Options.scope.exclude_path_patterns = [/exclude/]
211
229
 
212
230
  links = described_class.from_document( url, html )
213
- links.size.should == 1
214
- links.first.action.should == url + 'stuff'
231
+ expect(links.size).to eq(1)
232
+ expect(links.first.action).to eq(url + 'stuff')
215
233
  end
216
234
  end
217
235
  context 'when the response contains links' do
@@ -224,12 +242,12 @@ describe Arachni::Element::Link do
224
242
  </html>'
225
243
 
226
244
  link = described_class.from_document( url, html ).first
227
- link.action.should == url + 'test2'
228
- link.url.should == url
229
- link.inputs.should == {
245
+ expect(link.action).to eq(url + 'test2')
246
+ expect(link.url).to eq(url)
247
+ expect(link.inputs).to eq({
230
248
  'param_one' => 'value_one',
231
249
  'param_two' => 'value_two'
232
- }
250
+ })
233
251
  end
234
252
  context 'and includes a base attribute' do
235
253
  it 'should return an array of links with adjusted URIs' do
@@ -245,12 +263,12 @@ describe Arachni::Element::Link do
245
263
  </html>'
246
264
 
247
265
  link = described_class.from_document( url, html ).first
248
- link.action.should == base_url + 'test'
249
- link.url.should == url
250
- link.inputs.should == {
266
+ expect(link.action).to eq(base_url + 'test')
267
+ expect(link.url).to eq(url)
268
+ expect(link.inputs).to eq({
251
269
  'param_one' => 'value_one',
252
270
  'param_two' => 'value_two'
253
- }
271
+ })
254
272
  end
255
273
  end
256
274
  end
@@ -273,7 +291,7 @@ describe Arachni::Element::Link do
273
291
  let(:size) { described_class::MAX_SIZE }
274
292
 
275
293
  it 'returns empty array' do
276
- link.should be_nil
294
+ expect(link).to be_nil
277
295
  end
278
296
  end
279
297
 
@@ -281,7 +299,7 @@ describe Arachni::Element::Link do
281
299
  let(:size) { described_class::MAX_SIZE + 1 }
282
300
 
283
301
  it 'sets empty value' do
284
- link.should be_nil
302
+ expect(link).to be_nil
285
303
  end
286
304
  end
287
305
 
@@ -289,7 +307,7 @@ describe Arachni::Element::Link do
289
307
  let(:size) { described_class::MAX_SIZE - 1 }
290
308
 
291
309
  it 'leaves the values alone' do
292
- link.inputs['param'].should_not be_empty
310
+ expect(link.inputs['param']).not_to be_empty
293
311
  end
294
312
  end
295
313
  end
@@ -298,26 +316,26 @@ describe Arachni::Element::Link do
298
316
  describe '.encode' do
299
317
  it 'URL-encodes the passed string' do
300
318
  v = '% value\ +=&;'
301
- described_class.encode( v ).should == '%25%20value%5C%20%2B%3D%26%3B'
319
+ expect(described_class.encode( v )).to eq('%25%20value%5C%20%2B%3D%26%3B')
302
320
  end
303
321
  end
304
322
  describe '#encode' do
305
323
  it 'URL-encodes the passed string' do
306
324
  v = '% value\ +=&;'
307
- subject.encode( v ).should == described_class.encode( v )
325
+ expect(subject.encode( v )).to eq(described_class.encode( v ))
308
326
  end
309
327
  end
310
328
 
311
329
  describe '.decode' do
312
330
  it 'URL-decodes the passed string' do
313
331
  v = '%25%20value%5C%20%2B%3D%26%3B'
314
- described_class.decode( v ).should == URI.decode( v )
332
+ expect(described_class.decode( v )).to eq(URI.decode( v ))
315
333
  end
316
334
  end
317
335
  describe '#decode' do
318
336
  it 'URL-decodes the passed string' do
319
337
  v = '%25%20value%5C%20%2B%3D%26%3B'
320
- subject.decode( v ).should == described_class.decode( v )
338
+ expect(subject.decode( v )).to eq(described_class.decode( v ))
321
339
  end
322
340
  end
323
341
 
@@ -327,7 +345,7 @@ describe Arachni::Element::Link do
327
345
  url: url + '/?param=val',
328
346
  body: '<a href="test?param_one=value_one&param_two=value_two"></a>'
329
347
  )
330
- described_class.from_response( res ).size.should == 2
348
+ expect(described_class.from_response( res ).size).to eq(2)
331
349
  end
332
350
  end
333
351
  end