arachni 1.2.1 → 1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +66 -0
- data/Gemfile +1 -1
- data/README.md +16 -5
- data/components/checks/active/ldap_injection/errors.txt +1 -0
- data/components/checks/active/source_code_disclosure.rb +1 -1
- data/components/checks/active/unvalidated_redirect.rb +6 -6
- data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
- data/components/checks/passive/grep/captcha.rb +14 -5
- data/components/checks/passive/grep/form_upload.rb +7 -3
- data/components/checks/passive/grep/hsts.rb +3 -3
- data/components/checks/passive/grep/html_objects.rb +2 -3
- data/components/checks/passive/grep/http_only_cookies.rb +2 -3
- data/components/checks/passive/grep/insecure_cookies.rb +1 -1
- data/components/checks/passive/grep/password_autocomplete.rb +2 -2
- data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
- data/components/checks/passive/grep/x_frame_options.rb +2 -2
- data/components/checks/passive/http_put.rb +2 -3
- data/components/path_extractors/comments.rb +3 -3
- data/components/path_extractors/scripts.rb +10 -1
- data/components/plugins/defaults/autothrottle.rb +27 -18
- data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
- data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
- data/components/plugins/login_script.rb +9 -3
- data/components/plugins/proxy.rb +4 -3
- data/components/reporters/html.rb +11 -14
- data/components/reporters/html/default/issue.erb +13 -38
- data/components/reporters/html/default/issue/info.erb +1 -1
- data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
- data/components/reporters/stdout.rb +62 -71
- data/components/reporters/xml.rb +26 -40
- data/components/reporters/xml/schema.xsd +43 -89
- data/lib/arachni/browser.rb +52 -3
- data/lib/arachni/browser/javascript.rb +3 -3
- data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
- data/lib/arachni/browser_cluster.rb +61 -0
- data/lib/arachni/browser_cluster/job.rb +21 -1
- data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/worker.rb +5 -0
- data/lib/arachni/check/auditor.rb +22 -12
- data/lib/arachni/data/framework.rb +13 -1
- data/lib/arachni/data/issues.rb +9 -25
- data/lib/arachni/element/base.rb +9 -3
- data/lib/arachni/element/capabilities/analyzable.rb +2 -6
- data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
- data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
- data/lib/arachni/element/capabilities/auditable.rb +0 -6
- data/lib/arachni/element/capabilities/dom_only.rb +61 -0
- data/lib/arachni/element/capabilities/with_dom.rb +3 -1
- data/lib/arachni/element/cookie.rb +35 -5
- data/lib/arachni/element/cookie/dom.rb +13 -4
- data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
- data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
- data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
- data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
- data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
- data/lib/arachni/element/form.rb +12 -1
- data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
- data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/form/dom.rb +9 -3
- data/lib/arachni/element/header.rb +14 -33
- data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
- data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
- data/lib/arachni/element/input/dom.rb +71 -0
- data/lib/arachni/element/json.rb +2 -0
- data/lib/arachni/element/link.rb +3 -0
- data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link/dom.rb +16 -3
- data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/link_template.rb +3 -5
- data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
- data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link_template/dom.rb +16 -3
- data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/server.rb +3 -5
- data/lib/arachni/element/ui_form.rb +106 -0
- data/lib/arachni/element/ui_form/dom.rb +107 -0
- data/lib/arachni/element/ui_input.rb +62 -0
- data/lib/arachni/element/xml.rb +2 -1
- data/lib/arachni/framework.rb +7 -5
- data/lib/arachni/framework/parts/audit.rb +0 -1
- data/lib/arachni/framework/parts/check.rb +1 -0
- data/lib/arachni/framework/parts/data.rb +4 -0
- data/lib/arachni/framework/parts/state.rb +0 -2
- data/lib/arachni/http/client.rb +17 -6
- data/lib/arachni/http/proxy_server.rb +52 -5
- data/lib/arachni/http/request.rb +1 -1
- data/lib/arachni/issue.rb +34 -179
- data/lib/arachni/issue/severity.rb +2 -0
- data/lib/arachni/option_groups/audit.rb +22 -2
- data/lib/arachni/option_groups/browser_cluster.rb +15 -0
- data/lib/arachni/page.rb +3 -2
- data/lib/arachni/parser.rb +24 -5
- data/lib/arachni/platform/manager.rb +1 -2
- data/lib/arachni/rpc/server/framework.rb +3 -4
- data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
- data/lib/arachni/session.rb +1 -1
- data/lib/arachni/trainer.rb +4 -7
- data/lib/arachni/watir/element.rb +12 -1
- data/lib/version +1 -1
- data/spec/arachni/browser/element_locator_spec.rb +43 -43
- data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
- data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
- data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
- data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
- data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
- data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
- data/spec/arachni/browser/javascript_spec.rb +73 -63
- data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
- data/spec/arachni/browser_cluster/job_spec.rb +68 -48
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
- data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
- data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
- data/spec/arachni/browser_cluster_spec.rb +64 -39
- data/spec/arachni/browser_spec.rb +692 -527
- data/spec/arachni/check/auditor_spec.rb +177 -147
- data/spec/arachni/check/base_spec.rb +33 -33
- data/spec/arachni/check/manager_spec.rb +15 -15
- data/spec/arachni/component/base_spec.rb +8 -8
- data/spec/arachni/component/manager_spec.rb +100 -99
- data/spec/arachni/component/options/address_spec.rb +3 -3
- data/spec/arachni/component/options/base_spec.rb +7 -7
- data/spec/arachni/component/options/bool_spec.rb +9 -9
- data/spec/arachni/component/options/float_spec.rb +6 -6
- data/spec/arachni/component/options/int_spec.rb +5 -5
- data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
- data/spec/arachni/component/options/object_spec.rb +2 -2
- data/spec/arachni/component/options/path_spec.rb +3 -3
- data/spec/arachni/component/options/port_spec.rb +5 -5
- data/spec/arachni/component/options/string_spec.rb +3 -3
- data/spec/arachni/component/options/url_spec.rb +4 -4
- data/spec/arachni/component/utilities_spec.rb +2 -2
- data/spec/arachni/data/framework/rpc_spec.rb +10 -9
- data/spec/arachni/data/framework_spec.rb +65 -46
- data/spec/arachni/data/issues_spec.rb +39 -77
- data/spec/arachni/data/plugins_spec.rb +11 -11
- data/spec/arachni/data/session_spec.rb +6 -6
- data/spec/arachni/data_spec.rb +8 -8
- data/spec/arachni/element/body_spec.rb +10 -10
- data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
- data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
- data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
- data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
- data/spec/arachni/element/cookie/dom_spec.rb +37 -18
- data/spec/arachni/element/cookie_spec.rb +206 -139
- data/spec/arachni/element/form/dom_spec.rb +36 -19
- data/spec/arachni/element/form_spec.rb +210 -187
- data/spec/arachni/element/generic_dom_spec.rb +14 -14
- data/spec/arachni/element/header_spec.rb +35 -17
- data/spec/arachni/element/json_spec.rb +53 -31
- data/spec/arachni/element/link/dom_spec.rb +46 -28
- data/spec/arachni/element/link_spec.rb +58 -40
- data/spec/arachni/element/link_template/dom_spec.rb +47 -29
- data/spec/arachni/element/link_template_spec.rb +79 -61
- data/spec/arachni/element/path_spec.rb +1 -1
- data/spec/arachni/element/server_spec.rb +33 -32
- data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
- data/spec/arachni/element/ui_form_spec.rb +242 -0
- data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
- data/spec/arachni/element/ui_input_spec.rb +136 -0
- data/spec/arachni/element/xml_spec.rb +42 -24
- data/spec/arachni/element_filter_spec.rb +49 -48
- data/spec/arachni/error_spec.rb +3 -3
- data/spec/arachni/framework/parts/audit_spec.rb +64 -63
- data/spec/arachni/framework/parts/browser_spec.rb +16 -16
- data/spec/arachni/framework/parts/check_spec.rb +3 -3
- data/spec/arachni/framework/parts/data_spec.rb +48 -48
- data/spec/arachni/framework/parts/platform_spec.rb +3 -3
- data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
- data/spec/arachni/framework/parts/report_spec.rb +7 -7
- data/spec/arachni/framework/parts/scope_spec.rb +16 -16
- data/spec/arachni/framework/parts/state_spec.rb +68 -69
- data/spec/arachni/framework_spec.rb +39 -31
- data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
- data/spec/arachni/http/client_spec.rb +219 -208
- data/spec/arachni/http/cookie_jar_spec.rb +72 -72
- data/spec/arachni/http/headers_spec.rb +14 -14
- data/spec/arachni/http/proxy_server_spec.rb +43 -42
- data/spec/arachni/http/request_spec.rb +105 -103
- data/spec/arachni/http/response/scope_spec.rb +24 -24
- data/spec/arachni/http/response_spec.rb +50 -49
- data/spec/arachni/issue/severity_spec.rb +10 -9
- data/spec/arachni/issue_spec.rb +71 -369
- data/spec/arachni/option_groups/audit_spec.rb +114 -114
- data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
- data/spec/arachni/option_groups/datastore_spec.rb +6 -6
- data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
- data/spec/arachni/option_groups/http_spec.rb +11 -11
- data/spec/arachni/option_groups/input_spec.rb +31 -27
- data/spec/arachni/option_groups/output_spec.rb +2 -2
- data/spec/arachni/option_groups/paths_spec.rb +17 -17
- data/spec/arachni/option_groups/rpc_spec.rb +2 -2
- data/spec/arachni/option_groups/scope_spec.rb +40 -40
- data/spec/arachni/option_groups/session_spec.rb +6 -5
- data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
- data/spec/arachni/options_spec.rb +46 -45
- data/spec/arachni/page/dom/transition_spec.rb +74 -72
- data/spec/arachni/page/dom_spec.rb +35 -35
- data/spec/arachni/page/scope_spec.rb +15 -15
- data/spec/arachni/page_spec.rb +217 -217
- data/spec/arachni/parser_spec.rb +106 -104
- data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
- data/spec/arachni/platform/list_spec.rb +33 -33
- data/spec/arachni/platform/manager_spec.rb +67 -64
- data/spec/arachni/plugin/base_spec.rb +10 -10
- data/spec/arachni/plugin/manager_spec.rb +38 -37
- data/spec/arachni/report_spec.rb +43 -40
- data/spec/arachni/reporter/base_spec.rb +15 -15
- data/spec/arachni/reporter/manager_spec.rb +4 -4
- data/spec/arachni/reporter/options_spec.rb +6 -6
- data/spec/arachni/rpc/client/base_spec.rb +6 -6
- data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
- data/spec/arachni/rpc/client/instance_spec.rb +6 -6
- data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
- data/spec/arachni/rpc/server/base_spec.rb +5 -5
- data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
- data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
- data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
- data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
- data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
- data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
- data/spec/arachni/rpc/server/framework_spec.rb +90 -85
- data/spec/arachni/rpc/server/instance_spec.rb +126 -107
- data/spec/arachni/rpc/server/output_spec.rb +1 -1
- data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
- data/spec/arachni/ruby/array_spec.rb +42 -42
- data/spec/arachni/ruby/hash_spec.rb +20 -18
- data/spec/arachni/ruby/io_spec.rb +2 -2
- data/spec/arachni/ruby/object_spec.rb +1 -1
- data/spec/arachni/ruby/set_spec.rb +3 -3
- data/spec/arachni/ruby/string_spec.rb +30 -30
- data/spec/arachni/ruby/webrick_spec.rb +2 -2
- data/spec/arachni/scope_spec.rb +1 -1
- data/spec/arachni/session_spec.rb +67 -64
- data/spec/arachni/snapshot_spec.rb +15 -15
- data/spec/arachni/state/audit_spec.rb +11 -11
- data/spec/arachni/state/element_filter_spec.rb +6 -6
- data/spec/arachni/state/framework/rpc_spec.rb +12 -12
- data/spec/arachni/state/framework_spec.rb +125 -121
- data/spec/arachni/state/http_spec.rb +7 -7
- data/spec/arachni/state/options_spec.rb +7 -7
- data/spec/arachni/state/plugins_spec.rb +8 -8
- data/spec/arachni/state_spec.rb +10 -10
- data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
- data/spec/arachni/support/buffer/base_spec.rb +39 -39
- data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
- data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
- data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
- data/spec/arachni/support/cache/preference_spec.rb +4 -4
- data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
- data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
- data/spec/arachni/support/database/hash_spec.rb +44 -43
- data/spec/arachni/support/database/queue_spec.rb +27 -27
- data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
- data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
- data/spec/arachni/support/mixins/observable_spec.rb +6 -6
- data/spec/arachni/support/signature_spec.rb +19 -19
- data/spec/arachni/trainer_spec.rb +39 -39
- data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
- data/spec/arachni/uri/scope_spec.rb +66 -66
- data/spec/arachni/uri_spec.rb +107 -105
- data/spec/arachni/utilities_spec.rb +40 -40
- data/spec/components/checks/active/csrf_spec.rb +8 -8
- data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
- data/spec/components/checks/active/sql_injection_spec.rb +16 -16
- data/spec/components/checks/active/trainer_spec.rb +4 -4
- data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
- data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
- data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
- data/spec/components/checks/active/xss_dom_spec.rb +46 -24
- data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
- data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
- data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
- data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
- data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
- data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
- data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
- data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
- data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
- data/spec/components/checks/passive/webdav_spec.rb +1 -1
- data/spec/components/checks/passive/xst_spec.rb +1 -1
- data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
- data/spec/components/path_extractors/comments_spec.rb +5 -1
- data/spec/components/path_extractors/scripts_spec.rb +5 -2
- data/spec/components/plugins/autologin_spec.rb +22 -22
- data/spec/components/plugins/autothrottle_spec.rb +6 -5
- data/spec/components/plugins/content_types_spec.rb +4 -4
- data/spec/components/plugins/cookie_collector_spec.rb +5 -5
- data/spec/components/plugins/exec_spec.rb +12 -12
- data/spec/components/plugins/form_dicattack_spec.rb +3 -3
- data/spec/components/plugins/headers_collector_spec.rb +8 -8
- data/spec/components/plugins/healthmap_spec.rb +3 -3
- data/spec/components/plugins/http_dicattack_spec.rb +3 -3
- data/spec/components/plugins/login_script_spec.rb +79 -22
- data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
- data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
- data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
- data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
- data/spec/components/plugins/script_spec.rb +1 -1
- data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
- data/spec/components/plugins/vector_collector_spec.rb +2 -2
- data/spec/components/plugins/vector_feed_spec.rb +40 -40
- data/spec/components/plugins/waf_detector_spec.rb +6 -6
- data/spec/components/reporters/json_spec.rb +4 -4
- data/spec/components/reporters/marshal_spec.rb +2 -2
- data/spec/components/reporters/yaml_spec.rb +3 -2
- data/spec/external/wavsep/active/sqli_spec.rb +1 -3
- data/spec/spec_helper.rb +4 -0
- data/spec/support/factories/element/ui_form.rb +14 -0
- data/spec/support/factories/element/ui_input.rb +13 -0
- data/spec/support/factories/issue.rb +0 -13
- data/spec/support/fixtures/report.afr +0 -0
- data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
- data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/pages.rb +2 -2
- data/spec/support/servers/arachni/browser.rb +139 -0
- data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
- data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
- data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
- data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
- data/spec/support/servers/checks/active/trainer_check.rb +7 -7
- data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
- data/spec/support/servers/checks/active/xss_dom.rb +50 -0
- data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
- data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
- data/spec/support/shared/check.rb +10 -12
- data/spec/support/shared/component/options/base.rb +24 -24
- data/spec/support/shared/element/base.rb +25 -25
- data/spec/support/shared/element/capabilities/auditable.rb +116 -140
- data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
- data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
- data/spec/support/shared/element/capabilities/mutable.rb +122 -111
- data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
- data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
- data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
- data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
- data/spec/support/shared/element/capabilities/with_node.rb +4 -6
- data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
- data/spec/support/shared/element/capabilities/with_source.rb +6 -8
- data/spec/support/shared/element/dom.rb +144 -0
- data/spec/support/shared/element/dom/auditable.rb +42 -0
- data/spec/support/shared/element/dom/inputtable.rb +5 -0
- data/spec/support/shared/element/dom/mutable.rb +3 -0
- data/spec/support/shared/element/dom/submittable.rb +119 -0
- data/spec/support/shared/external/wavsep.rb +3 -3
- data/spec/support/shared/fingerprinter.rb +2 -2
- data/spec/support/shared/framework.rb +1 -1
- data/spec/support/shared/http/message.rb +9 -9
- data/spec/support/shared/option_group.rb +17 -17
- data/spec/support/shared/path_extractor.rb +1 -1
- data/spec/support/shared/plugin.rb +2 -2
- data/spec/support/shared/support/cache.rb +57 -57
- data/spec/support/shared/support/lookup.rb +25 -25
- data/ui/cli/framework.rb +22 -11
- data/ui/cli/framework/option_parser.rb +15 -0
- data/ui/cli/option_parser.rb +8 -1
- data/ui/cli/output.rb +2 -1
- metadata +54 -20
- data/components/checks/active/xss_dom_inputs.rb +0 -236
- data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
- data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
- data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -1,12 +1,26 @@
|
|
1
1
|
require 'spec_helper'
|
2
2
|
|
3
3
|
describe Arachni::Element::Link::DOM do
|
4
|
-
|
4
|
+
inputs = { 'param' => '1' }
|
5
|
+
|
6
|
+
it_should_behave_like 'element_dom'
|
7
|
+
|
8
|
+
it_should_behave_like 'with_node'
|
9
|
+
it_should_behave_like 'with_auditor'
|
10
|
+
|
11
|
+
it_should_behave_like 'submittable_dom'
|
12
|
+
it_should_behave_like 'inputtable_dom', inputs: inputs
|
13
|
+
it_should_behave_like 'mutable_dom', inputs: inputs
|
14
|
+
it_should_behave_like 'auditable_dom'
|
5
15
|
|
6
16
|
def auditable_extract_parameters( page )
|
7
17
|
{ 'param' => page.document.css('#container').text }
|
8
18
|
end
|
9
19
|
|
20
|
+
def run
|
21
|
+
auditor.browser_cluster.wait
|
22
|
+
end
|
23
|
+
|
10
24
|
before :each do
|
11
25
|
@framework = Arachni::Framework.new
|
12
26
|
@page = Arachni::Page.from_url( "#{url}/link" )
|
@@ -33,43 +47,43 @@ describe Arachni::Element::Link::DOM do
|
|
33
47
|
|
34
48
|
describe '#type' do
|
35
49
|
it 'returns :link_dom' do
|
36
|
-
subject.type.
|
50
|
+
expect(subject.type).to eq(:link_dom)
|
37
51
|
end
|
38
52
|
end
|
39
53
|
|
40
54
|
describe '.type' do
|
41
55
|
it 'returns :link_dom' do
|
42
|
-
described_class.type.
|
56
|
+
expect(described_class.type).to eq(:link_dom)
|
43
57
|
end
|
44
58
|
end
|
45
59
|
|
46
60
|
describe '#parent' do
|
47
61
|
it 'returns the parent element' do
|
48
|
-
subject.parent.
|
62
|
+
expect(subject.parent).to be_kind_of Arachni::Element::Link
|
49
63
|
end
|
50
64
|
end
|
51
65
|
|
52
66
|
describe '#inputs' do
|
53
67
|
it 'parses query-style inputs from URL fragments' do
|
54
|
-
subject.inputs.
|
68
|
+
expect(subject.inputs).to eq({ 'param' => 'some-name' })
|
55
69
|
end
|
56
70
|
end
|
57
71
|
|
58
72
|
describe '#fragment' do
|
59
73
|
it 'returns the URL fragment' do
|
60
|
-
subject.fragment.
|
74
|
+
expect(subject.fragment).to eq('/test/?param=some-name')
|
61
75
|
end
|
62
76
|
end
|
63
77
|
|
64
78
|
describe '#fragment_path' do
|
65
79
|
it 'returns the path from the URL fragment' do
|
66
|
-
subject.fragment_path.
|
80
|
+
expect(subject.fragment_path).to eq('/test/')
|
67
81
|
end
|
68
82
|
end
|
69
83
|
|
70
84
|
describe '#fragment_query' do
|
71
85
|
it 'returns the query from the URL fragment' do
|
72
|
-
subject.fragment_query.
|
86
|
+
expect(subject.fragment_query).to eq('param=some-name')
|
73
87
|
end
|
74
88
|
end
|
75
89
|
|
@@ -81,17 +95,17 @@ describe Arachni::Element::Link::DOM do
|
|
81
95
|
browser.load subject.page
|
82
96
|
|
83
97
|
element = subject.locate
|
84
|
-
element.
|
98
|
+
expect(element).to be_kind_of Watir::HTMLElement
|
85
99
|
|
86
|
-
parent.class.from_document(
|
100
|
+
expect(parent.class.from_document(
|
87
101
|
parent.url, Nokogiri::HTML(element.html)
|
88
|
-
).first.
|
102
|
+
).first).to eq(parent)
|
89
103
|
|
90
104
|
called = true
|
91
105
|
end
|
92
106
|
|
93
107
|
subject.auditor.browser_cluster.wait
|
94
|
-
called.
|
108
|
+
expect(called).to be_truthy
|
95
109
|
end
|
96
110
|
end
|
97
111
|
|
@@ -106,69 +120,73 @@ describe Arachni::Element::Link::DOM do
|
|
106
120
|
|
107
121
|
subject.trigger
|
108
122
|
|
109
|
-
subject.inputs.
|
123
|
+
expect(subject.inputs).to eq(auditable_extract_parameters( browser.to_page ))
|
110
124
|
called = true
|
111
125
|
end
|
112
126
|
|
113
127
|
subject.auditor.browser_cluster.wait
|
114
|
-
called.
|
128
|
+
expect(called).to be_truthy
|
115
129
|
end
|
116
130
|
|
117
131
|
it 'returns a playable transition' do
|
118
132
|
inputs = { 'param' => 'The.Dude' }
|
119
133
|
subject.update inputs
|
120
134
|
|
121
|
-
|
135
|
+
transitions = []
|
122
136
|
called = false
|
123
137
|
subject.with_browser do |browser|
|
124
138
|
subject.browser = browser
|
125
139
|
browser.load subject.page
|
126
140
|
|
127
|
-
|
141
|
+
transitions = subject.trigger
|
128
142
|
|
129
143
|
page = browser.to_page
|
130
144
|
|
131
|
-
subject.inputs.
|
145
|
+
expect(subject.inputs).to eq(auditable_extract_parameters( page ))
|
132
146
|
called = true
|
133
147
|
end
|
134
148
|
|
135
149
|
subject.auditor.browser_cluster.wait
|
136
|
-
called.
|
150
|
+
expect(called).to be_truthy
|
137
151
|
|
138
152
|
called = false
|
139
153
|
auditor.with_browser do |browser|
|
140
154
|
browser.load subject.page
|
141
|
-
auditable_extract_parameters( browser.to_page ).
|
155
|
+
expect(auditable_extract_parameters( browser.to_page )).to eq(
|
142
156
|
{ 'param' => '' }
|
157
|
+
)
|
158
|
+
|
159
|
+
transitions.each do |transition|
|
160
|
+
transition.play browser
|
161
|
+
end
|
143
162
|
|
144
|
-
|
145
|
-
auditable_extract_parameters( browser.to_page ).should == inputs
|
163
|
+
expect(auditable_extract_parameters( browser.to_page )).to eq(inputs)
|
146
164
|
called = true
|
147
165
|
end
|
148
166
|
auditor.browser_cluster.wait
|
149
|
-
called.
|
167
|
+
expect(called).to be_truthy
|
150
168
|
end
|
151
169
|
end
|
152
170
|
|
153
171
|
describe '.data_from_node' do
|
154
172
|
it 'returns a hash with DOM data' do
|
155
|
-
described_class.data_from_node( subject.node ).
|
173
|
+
expect(described_class.data_from_node( subject.node )).to eq({
|
156
174
|
inputs: {
|
157
175
|
'param' => 'some-name'
|
158
176
|
},
|
159
177
|
fragment: '/test/?param=some-name',
|
160
178
|
fragment_path: '/test/',
|
161
179
|
fragment_query: 'param=some-name'
|
162
|
-
}
|
180
|
+
})
|
163
181
|
end
|
164
182
|
|
165
183
|
it 'decodes inputs' do
|
166
184
|
html = "<a href='#/?stuff%20here=bl%20ah'>Stuff</a>"
|
167
185
|
node = Nokogiri::HTML.fragment(html).children.first
|
168
186
|
|
169
|
-
described_class.data_from_node( node )[:inputs].
|
187
|
+
expect(described_class.data_from_node( node )[:inputs]).to eq({
|
170
188
|
'stuff here' => 'bl ah'
|
171
|
-
}
|
189
|
+
})
|
172
190
|
end
|
173
191
|
|
174
192
|
context 'when there is no URL fragment' do
|
@@ -178,7 +196,7 @@ describe Arachni::Element::Link::DOM do
|
|
178
196
|
end
|
179
197
|
|
180
198
|
it 'return nil' do
|
181
|
-
described_class.data_from_node( node ).
|
199
|
+
expect(described_class.data_from_node( node )).to be_nil
|
182
200
|
end
|
183
201
|
end
|
184
202
|
|
@@ -189,7 +207,7 @@ describe Arachni::Element::Link::DOM do
|
|
189
207
|
end
|
190
208
|
|
191
209
|
it 'return nil' do
|
192
|
-
described_class.data_from_node( node ).
|
210
|
+
expect(described_class.data_from_node( node )).to be_nil
|
193
211
|
end
|
194
212
|
end
|
195
213
|
end
|
@@ -4,11 +4,29 @@ describe Arachni::Element::Link do
|
|
4
4
|
html = '<a href="/stuff#?stuff=blah">Bla</a>'
|
5
5
|
|
6
6
|
it_should_behave_like 'element'
|
7
|
-
it_should_behave_like 'with_node'
|
7
|
+
it_should_behave_like 'with_node'
|
8
8
|
it_should_behave_like 'with_dom', html
|
9
9
|
it_should_behave_like 'refreshable'
|
10
|
+
it_should_behave_like 'with_source'
|
11
|
+
it_should_behave_like 'with_auditor'
|
12
|
+
|
13
|
+
it_should_behave_like 'submittable'
|
14
|
+
it_should_behave_like 'inputtable'
|
15
|
+
it_should_behave_like 'mutable'
|
10
16
|
it_should_behave_like 'auditable'
|
11
17
|
|
18
|
+
before :each do
|
19
|
+
@framework ||= Arachni::Framework.new
|
20
|
+
@auditor = Auditor.new( Arachni::Page.from_url( url ), @framework )
|
21
|
+
end
|
22
|
+
|
23
|
+
after :each do
|
24
|
+
@framework.reset
|
25
|
+
reset_options
|
26
|
+
end
|
27
|
+
|
28
|
+
let(:auditor) { @auditor }
|
29
|
+
|
12
30
|
def auditable_extract_parameters( resource )
|
13
31
|
YAML.load( resource.body )
|
14
32
|
end
|
@@ -31,19 +49,19 @@ describe Arachni::Element::Link do
|
|
31
49
|
end
|
32
50
|
|
33
51
|
it 'is assigned to Arachni::Link for easy access' do
|
34
|
-
Arachni::Link.
|
52
|
+
expect(Arachni::Link).to eq(described_class)
|
35
53
|
end
|
36
54
|
|
37
55
|
describe '#initialize' do
|
38
56
|
describe :action do
|
39
57
|
it 'sets #action' do
|
40
58
|
action = "#{url}stuff"
|
41
|
-
described_class.new( url: url, action: action ).action.
|
59
|
+
expect(described_class.new( url: url, action: action ).action).to eq(action)
|
42
60
|
end
|
43
61
|
|
44
62
|
context 'when nil' do
|
45
63
|
it 'defaults to :url' do
|
46
|
-
described_class.new( url: url ).action.
|
64
|
+
expect(described_class.new( url: url ).action).to eq(url)
|
47
65
|
end
|
48
66
|
end
|
49
67
|
end
|
@@ -72,11 +90,11 @@ describe Arachni::Element::Link do
|
|
72
90
|
end
|
73
91
|
|
74
92
|
it 'removes the URL query' do
|
75
|
-
subject.action.
|
93
|
+
expect(subject.action).to eq(url)
|
76
94
|
end
|
77
95
|
|
78
96
|
it 'merges the URL query parameters with the given :inputs' do
|
79
|
-
subject.inputs.
|
97
|
+
expect(subject.inputs).to eq(query_inputs.merge( option_inputs ))
|
80
98
|
end
|
81
99
|
|
82
100
|
context 'when URL query parameters and :inputs have the same name' do
|
@@ -88,7 +106,7 @@ describe Arachni::Element::Link do
|
|
88
106
|
end
|
89
107
|
|
90
108
|
it 'it gives precedence to the :inputs' do
|
91
|
-
subject.inputs.
|
109
|
+
expect(subject.inputs).to eq(query_inputs.merge( option_inputs ))
|
92
110
|
end
|
93
111
|
end
|
94
112
|
|
@@ -100,9 +118,9 @@ describe Arachni::Element::Link do
|
|
100
118
|
url: url,
|
101
119
|
action: "#{url}/articles/some-stuff/23"
|
102
120
|
)
|
103
|
-
link.action.
|
104
|
-
link.url.
|
105
|
-
link.inputs.
|
121
|
+
expect(link.action).to eq(url + 'articles.php')
|
122
|
+
expect(link.url).to eq(url)
|
123
|
+
expect(link.inputs).to eq({ 'id' => '23' })
|
106
124
|
end
|
107
125
|
end
|
108
126
|
end
|
@@ -111,33 +129,33 @@ describe Arachni::Element::Link do
|
|
111
129
|
context 'when there are no DOM#inputs' do
|
112
130
|
it 'returns nil' do
|
113
131
|
subject.source = '<a href="/stuff">Bla</a>'
|
114
|
-
subject.dom.
|
132
|
+
expect(subject.dom).to be_nil
|
115
133
|
end
|
116
134
|
end
|
117
135
|
|
118
136
|
context 'when there is no #node' do
|
119
137
|
it 'returns nil' do
|
120
138
|
subject.source = nil
|
121
|
-
subject.dom.
|
139
|
+
expect(subject.dom).to be_nil
|
122
140
|
end
|
123
141
|
end
|
124
142
|
end
|
125
143
|
|
126
144
|
describe '#simple' do
|
127
145
|
it 'should return a simplified version as a hash' do
|
128
|
-
subject.simple.
|
146
|
+
expect(subject.simple).to eq({ subject.action => subject.inputs })
|
129
147
|
end
|
130
148
|
end
|
131
149
|
|
132
150
|
describe '#to_s' do
|
133
151
|
it 'returns a URL' do
|
134
|
-
subject.to_s.
|
152
|
+
expect(subject.to_s).to eq("#{subject.action}?name1=value1&name2=value2")
|
135
153
|
end
|
136
154
|
end
|
137
155
|
|
138
156
|
describe '#type' do
|
139
157
|
it 'should be "link"' do
|
140
|
-
subject.type.
|
158
|
+
expect(subject.type).to eq(:link)
|
141
159
|
end
|
142
160
|
end
|
143
161
|
|
@@ -149,7 +167,7 @@ describe Arachni::Element::Link do
|
|
149
167
|
c = subject.dup
|
150
168
|
c.source = '<a href="/stuff#?stuff=blooh">Bla</a>'
|
151
169
|
|
152
|
-
c.coverage_id.
|
170
|
+
expect(c.coverage_id).to eq(e.coverage_id)
|
153
171
|
|
154
172
|
e = subject.dup
|
155
173
|
e.source = '<a href="/stuff#?stuff=blah">Bla</a>'
|
@@ -157,7 +175,7 @@ describe Arachni::Element::Link do
|
|
157
175
|
c = subject.dup
|
158
176
|
c.source = '<a href="/stuff#?stuff2=blooh">Bla</a>'
|
159
177
|
|
160
|
-
c.coverage_id.
|
178
|
+
expect(c.coverage_id).not_to eq(e.coverage_id)
|
161
179
|
end
|
162
180
|
end
|
163
181
|
|
@@ -169,7 +187,7 @@ describe Arachni::Element::Link do
|
|
169
187
|
c = subject.dup
|
170
188
|
c.source = '<a href="/stuff#?stuff=blah">Bla</a>'
|
171
189
|
|
172
|
-
c.id.
|
190
|
+
expect(c.id).to eq(e.id)
|
173
191
|
|
174
192
|
e = subject.dup
|
175
193
|
e.source = '<a href="/stuff#?stuff=blah">Bla</a>'
|
@@ -177,23 +195,23 @@ describe Arachni::Element::Link do
|
|
177
195
|
c = subject.dup
|
178
196
|
c.source = '<a href="/stuff#?stuff=blooh">Bla</a>'
|
179
197
|
|
180
|
-
c.id.
|
198
|
+
expect(c.id).not_to eq(e.id)
|
181
199
|
end
|
182
200
|
end
|
183
201
|
|
184
202
|
describe '#to_rpc_data' do
|
185
203
|
it "does not include 'dom_data'" do
|
186
204
|
subject.source = html
|
187
|
-
subject.dom.
|
205
|
+
expect(subject.dom).to be_truthy
|
188
206
|
|
189
|
-
subject.to_rpc_data.
|
207
|
+
expect(subject.to_rpc_data).not_to include 'dom_data'
|
190
208
|
end
|
191
209
|
end
|
192
210
|
|
193
211
|
describe '.from_document' do
|
194
212
|
context 'when the response does not contain any links' do
|
195
213
|
it 'should return an empty array' do
|
196
|
-
described_class.from_document( '', '' ).
|
214
|
+
expect(described_class.from_document( '', '' )).to be_empty
|
197
215
|
end
|
198
216
|
end
|
199
217
|
context 'when links have actions that are out of scope' do
|
@@ -210,8 +228,8 @@ describe Arachni::Element::Link do
|
|
210
228
|
Arachni::Options.scope.exclude_path_patterns = [/exclude/]
|
211
229
|
|
212
230
|
links = described_class.from_document( url, html )
|
213
|
-
links.size.
|
214
|
-
links.first.action.
|
231
|
+
expect(links.size).to eq(1)
|
232
|
+
expect(links.first.action).to eq(url + 'stuff')
|
215
233
|
end
|
216
234
|
end
|
217
235
|
context 'when the response contains links' do
|
@@ -224,12 +242,12 @@ describe Arachni::Element::Link do
|
|
224
242
|
</html>'
|
225
243
|
|
226
244
|
link = described_class.from_document( url, html ).first
|
227
|
-
link.action.
|
228
|
-
link.url.
|
229
|
-
link.inputs.
|
245
|
+
expect(link.action).to eq(url + 'test2')
|
246
|
+
expect(link.url).to eq(url)
|
247
|
+
expect(link.inputs).to eq({
|
230
248
|
'param_one' => 'value_one',
|
231
249
|
'param_two' => 'value_two'
|
232
|
-
}
|
250
|
+
})
|
233
251
|
end
|
234
252
|
context 'and includes a base attribute' do
|
235
253
|
it 'should return an array of links with adjusted URIs' do
|
@@ -245,12 +263,12 @@ describe Arachni::Element::Link do
|
|
245
263
|
</html>'
|
246
264
|
|
247
265
|
link = described_class.from_document( url, html ).first
|
248
|
-
link.action.
|
249
|
-
link.url.
|
250
|
-
link.inputs.
|
266
|
+
expect(link.action).to eq(base_url + 'test')
|
267
|
+
expect(link.url).to eq(url)
|
268
|
+
expect(link.inputs).to eq({
|
251
269
|
'param_one' => 'value_one',
|
252
270
|
'param_two' => 'value_two'
|
253
|
-
}
|
271
|
+
})
|
254
272
|
end
|
255
273
|
end
|
256
274
|
end
|
@@ -273,7 +291,7 @@ describe Arachni::Element::Link do
|
|
273
291
|
let(:size) { described_class::MAX_SIZE }
|
274
292
|
|
275
293
|
it 'returns empty array' do
|
276
|
-
link.
|
294
|
+
expect(link).to be_nil
|
277
295
|
end
|
278
296
|
end
|
279
297
|
|
@@ -281,7 +299,7 @@ describe Arachni::Element::Link do
|
|
281
299
|
let(:size) { described_class::MAX_SIZE + 1 }
|
282
300
|
|
283
301
|
it 'sets empty value' do
|
284
|
-
link.
|
302
|
+
expect(link).to be_nil
|
285
303
|
end
|
286
304
|
end
|
287
305
|
|
@@ -289,7 +307,7 @@ describe Arachni::Element::Link do
|
|
289
307
|
let(:size) { described_class::MAX_SIZE - 1 }
|
290
308
|
|
291
309
|
it 'leaves the values alone' do
|
292
|
-
link.inputs['param'].
|
310
|
+
expect(link.inputs['param']).not_to be_empty
|
293
311
|
end
|
294
312
|
end
|
295
313
|
end
|
@@ -298,26 +316,26 @@ describe Arachni::Element::Link do
|
|
298
316
|
describe '.encode' do
|
299
317
|
it 'URL-encodes the passed string' do
|
300
318
|
v = '% value\ +=&;'
|
301
|
-
described_class.encode( v ).
|
319
|
+
expect(described_class.encode( v )).to eq('%25%20value%5C%20%2B%3D%26%3B')
|
302
320
|
end
|
303
321
|
end
|
304
322
|
describe '#encode' do
|
305
323
|
it 'URL-encodes the passed string' do
|
306
324
|
v = '% value\ +=&;'
|
307
|
-
subject.encode( v ).
|
325
|
+
expect(subject.encode( v )).to eq(described_class.encode( v ))
|
308
326
|
end
|
309
327
|
end
|
310
328
|
|
311
329
|
describe '.decode' do
|
312
330
|
it 'URL-decodes the passed string' do
|
313
331
|
v = '%25%20value%5C%20%2B%3D%26%3B'
|
314
|
-
described_class.decode( v ).
|
332
|
+
expect(described_class.decode( v )).to eq(URI.decode( v ))
|
315
333
|
end
|
316
334
|
end
|
317
335
|
describe '#decode' do
|
318
336
|
it 'URL-decodes the passed string' do
|
319
337
|
v = '%25%20value%5C%20%2B%3D%26%3B'
|
320
|
-
subject.decode( v ).
|
338
|
+
expect(subject.decode( v )).to eq(described_class.decode( v ))
|
321
339
|
end
|
322
340
|
end
|
323
341
|
|
@@ -327,7 +345,7 @@ describe Arachni::Element::Link do
|
|
327
345
|
url: url + '/?param=val',
|
328
346
|
body: '<a href="test?param_one=value_one¶m_two=value_two"></a>'
|
329
347
|
)
|
330
|
-
described_class.from_response( res ).size.
|
348
|
+
expect(described_class.from_response( res ).size).to eq(2)
|
331
349
|
end
|
332
350
|
end
|
333
351
|
end
|