arachni 1.2.1 → 1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +66 -0
- data/Gemfile +1 -1
- data/README.md +16 -5
- data/components/checks/active/ldap_injection/errors.txt +1 -0
- data/components/checks/active/source_code_disclosure.rb +1 -1
- data/components/checks/active/unvalidated_redirect.rb +6 -6
- data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
- data/components/checks/passive/grep/captcha.rb +14 -5
- data/components/checks/passive/grep/form_upload.rb +7 -3
- data/components/checks/passive/grep/hsts.rb +3 -3
- data/components/checks/passive/grep/html_objects.rb +2 -3
- data/components/checks/passive/grep/http_only_cookies.rb +2 -3
- data/components/checks/passive/grep/insecure_cookies.rb +1 -1
- data/components/checks/passive/grep/password_autocomplete.rb +2 -2
- data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
- data/components/checks/passive/grep/x_frame_options.rb +2 -2
- data/components/checks/passive/http_put.rb +2 -3
- data/components/path_extractors/comments.rb +3 -3
- data/components/path_extractors/scripts.rb +10 -1
- data/components/plugins/defaults/autothrottle.rb +27 -18
- data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
- data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
- data/components/plugins/login_script.rb +9 -3
- data/components/plugins/proxy.rb +4 -3
- data/components/reporters/html.rb +11 -14
- data/components/reporters/html/default/issue.erb +13 -38
- data/components/reporters/html/default/issue/info.erb +1 -1
- data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
- data/components/reporters/stdout.rb +62 -71
- data/components/reporters/xml.rb +26 -40
- data/components/reporters/xml/schema.xsd +43 -89
- data/lib/arachni/browser.rb +52 -3
- data/lib/arachni/browser/javascript.rb +3 -3
- data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
- data/lib/arachni/browser_cluster.rb +61 -0
- data/lib/arachni/browser_cluster/job.rb +21 -1
- data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/worker.rb +5 -0
- data/lib/arachni/check/auditor.rb +22 -12
- data/lib/arachni/data/framework.rb +13 -1
- data/lib/arachni/data/issues.rb +9 -25
- data/lib/arachni/element/base.rb +9 -3
- data/lib/arachni/element/capabilities/analyzable.rb +2 -6
- data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
- data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
- data/lib/arachni/element/capabilities/auditable.rb +0 -6
- data/lib/arachni/element/capabilities/dom_only.rb +61 -0
- data/lib/arachni/element/capabilities/with_dom.rb +3 -1
- data/lib/arachni/element/cookie.rb +35 -5
- data/lib/arachni/element/cookie/dom.rb +13 -4
- data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
- data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
- data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
- data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
- data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
- data/lib/arachni/element/form.rb +12 -1
- data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
- data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/form/dom.rb +9 -3
- data/lib/arachni/element/header.rb +14 -33
- data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
- data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
- data/lib/arachni/element/input/dom.rb +71 -0
- data/lib/arachni/element/json.rb +2 -0
- data/lib/arachni/element/link.rb +3 -0
- data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link/dom.rb +16 -3
- data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/link_template.rb +3 -5
- data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
- data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link_template/dom.rb +16 -3
- data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/server.rb +3 -5
- data/lib/arachni/element/ui_form.rb +106 -0
- data/lib/arachni/element/ui_form/dom.rb +107 -0
- data/lib/arachni/element/ui_input.rb +62 -0
- data/lib/arachni/element/xml.rb +2 -1
- data/lib/arachni/framework.rb +7 -5
- data/lib/arachni/framework/parts/audit.rb +0 -1
- data/lib/arachni/framework/parts/check.rb +1 -0
- data/lib/arachni/framework/parts/data.rb +4 -0
- data/lib/arachni/framework/parts/state.rb +0 -2
- data/lib/arachni/http/client.rb +17 -6
- data/lib/arachni/http/proxy_server.rb +52 -5
- data/lib/arachni/http/request.rb +1 -1
- data/lib/arachni/issue.rb +34 -179
- data/lib/arachni/issue/severity.rb +2 -0
- data/lib/arachni/option_groups/audit.rb +22 -2
- data/lib/arachni/option_groups/browser_cluster.rb +15 -0
- data/lib/arachni/page.rb +3 -2
- data/lib/arachni/parser.rb +24 -5
- data/lib/arachni/platform/manager.rb +1 -2
- data/lib/arachni/rpc/server/framework.rb +3 -4
- data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
- data/lib/arachni/session.rb +1 -1
- data/lib/arachni/trainer.rb +4 -7
- data/lib/arachni/watir/element.rb +12 -1
- data/lib/version +1 -1
- data/spec/arachni/browser/element_locator_spec.rb +43 -43
- data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
- data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
- data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
- data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
- data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
- data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
- data/spec/arachni/browser/javascript_spec.rb +73 -63
- data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
- data/spec/arachni/browser_cluster/job_spec.rb +68 -48
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
- data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
- data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
- data/spec/arachni/browser_cluster_spec.rb +64 -39
- data/spec/arachni/browser_spec.rb +692 -527
- data/spec/arachni/check/auditor_spec.rb +177 -147
- data/spec/arachni/check/base_spec.rb +33 -33
- data/spec/arachni/check/manager_spec.rb +15 -15
- data/spec/arachni/component/base_spec.rb +8 -8
- data/spec/arachni/component/manager_spec.rb +100 -99
- data/spec/arachni/component/options/address_spec.rb +3 -3
- data/spec/arachni/component/options/base_spec.rb +7 -7
- data/spec/arachni/component/options/bool_spec.rb +9 -9
- data/spec/arachni/component/options/float_spec.rb +6 -6
- data/spec/arachni/component/options/int_spec.rb +5 -5
- data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
- data/spec/arachni/component/options/object_spec.rb +2 -2
- data/spec/arachni/component/options/path_spec.rb +3 -3
- data/spec/arachni/component/options/port_spec.rb +5 -5
- data/spec/arachni/component/options/string_spec.rb +3 -3
- data/spec/arachni/component/options/url_spec.rb +4 -4
- data/spec/arachni/component/utilities_spec.rb +2 -2
- data/spec/arachni/data/framework/rpc_spec.rb +10 -9
- data/spec/arachni/data/framework_spec.rb +65 -46
- data/spec/arachni/data/issues_spec.rb +39 -77
- data/spec/arachni/data/plugins_spec.rb +11 -11
- data/spec/arachni/data/session_spec.rb +6 -6
- data/spec/arachni/data_spec.rb +8 -8
- data/spec/arachni/element/body_spec.rb +10 -10
- data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
- data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
- data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
- data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
- data/spec/arachni/element/cookie/dom_spec.rb +37 -18
- data/spec/arachni/element/cookie_spec.rb +206 -139
- data/spec/arachni/element/form/dom_spec.rb +36 -19
- data/spec/arachni/element/form_spec.rb +210 -187
- data/spec/arachni/element/generic_dom_spec.rb +14 -14
- data/spec/arachni/element/header_spec.rb +35 -17
- data/spec/arachni/element/json_spec.rb +53 -31
- data/spec/arachni/element/link/dom_spec.rb +46 -28
- data/spec/arachni/element/link_spec.rb +58 -40
- data/spec/arachni/element/link_template/dom_spec.rb +47 -29
- data/spec/arachni/element/link_template_spec.rb +79 -61
- data/spec/arachni/element/path_spec.rb +1 -1
- data/spec/arachni/element/server_spec.rb +33 -32
- data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
- data/spec/arachni/element/ui_form_spec.rb +242 -0
- data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
- data/spec/arachni/element/ui_input_spec.rb +136 -0
- data/spec/arachni/element/xml_spec.rb +42 -24
- data/spec/arachni/element_filter_spec.rb +49 -48
- data/spec/arachni/error_spec.rb +3 -3
- data/spec/arachni/framework/parts/audit_spec.rb +64 -63
- data/spec/arachni/framework/parts/browser_spec.rb +16 -16
- data/spec/arachni/framework/parts/check_spec.rb +3 -3
- data/spec/arachni/framework/parts/data_spec.rb +48 -48
- data/spec/arachni/framework/parts/platform_spec.rb +3 -3
- data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
- data/spec/arachni/framework/parts/report_spec.rb +7 -7
- data/spec/arachni/framework/parts/scope_spec.rb +16 -16
- data/spec/arachni/framework/parts/state_spec.rb +68 -69
- data/spec/arachni/framework_spec.rb +39 -31
- data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
- data/spec/arachni/http/client_spec.rb +219 -208
- data/spec/arachni/http/cookie_jar_spec.rb +72 -72
- data/spec/arachni/http/headers_spec.rb +14 -14
- data/spec/arachni/http/proxy_server_spec.rb +43 -42
- data/spec/arachni/http/request_spec.rb +105 -103
- data/spec/arachni/http/response/scope_spec.rb +24 -24
- data/spec/arachni/http/response_spec.rb +50 -49
- data/spec/arachni/issue/severity_spec.rb +10 -9
- data/spec/arachni/issue_spec.rb +71 -369
- data/spec/arachni/option_groups/audit_spec.rb +114 -114
- data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
- data/spec/arachni/option_groups/datastore_spec.rb +6 -6
- data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
- data/spec/arachni/option_groups/http_spec.rb +11 -11
- data/spec/arachni/option_groups/input_spec.rb +31 -27
- data/spec/arachni/option_groups/output_spec.rb +2 -2
- data/spec/arachni/option_groups/paths_spec.rb +17 -17
- data/spec/arachni/option_groups/rpc_spec.rb +2 -2
- data/spec/arachni/option_groups/scope_spec.rb +40 -40
- data/spec/arachni/option_groups/session_spec.rb +6 -5
- data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
- data/spec/arachni/options_spec.rb +46 -45
- data/spec/arachni/page/dom/transition_spec.rb +74 -72
- data/spec/arachni/page/dom_spec.rb +35 -35
- data/spec/arachni/page/scope_spec.rb +15 -15
- data/spec/arachni/page_spec.rb +217 -217
- data/spec/arachni/parser_spec.rb +106 -104
- data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
- data/spec/arachni/platform/list_spec.rb +33 -33
- data/spec/arachni/platform/manager_spec.rb +67 -64
- data/spec/arachni/plugin/base_spec.rb +10 -10
- data/spec/arachni/plugin/manager_spec.rb +38 -37
- data/spec/arachni/report_spec.rb +43 -40
- data/spec/arachni/reporter/base_spec.rb +15 -15
- data/spec/arachni/reporter/manager_spec.rb +4 -4
- data/spec/arachni/reporter/options_spec.rb +6 -6
- data/spec/arachni/rpc/client/base_spec.rb +6 -6
- data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
- data/spec/arachni/rpc/client/instance_spec.rb +6 -6
- data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
- data/spec/arachni/rpc/server/base_spec.rb +5 -5
- data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
- data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
- data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
- data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
- data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
- data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
- data/spec/arachni/rpc/server/framework_spec.rb +90 -85
- data/spec/arachni/rpc/server/instance_spec.rb +126 -107
- data/spec/arachni/rpc/server/output_spec.rb +1 -1
- data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
- data/spec/arachni/ruby/array_spec.rb +42 -42
- data/spec/arachni/ruby/hash_spec.rb +20 -18
- data/spec/arachni/ruby/io_spec.rb +2 -2
- data/spec/arachni/ruby/object_spec.rb +1 -1
- data/spec/arachni/ruby/set_spec.rb +3 -3
- data/spec/arachni/ruby/string_spec.rb +30 -30
- data/spec/arachni/ruby/webrick_spec.rb +2 -2
- data/spec/arachni/scope_spec.rb +1 -1
- data/spec/arachni/session_spec.rb +67 -64
- data/spec/arachni/snapshot_spec.rb +15 -15
- data/spec/arachni/state/audit_spec.rb +11 -11
- data/spec/arachni/state/element_filter_spec.rb +6 -6
- data/spec/arachni/state/framework/rpc_spec.rb +12 -12
- data/spec/arachni/state/framework_spec.rb +125 -121
- data/spec/arachni/state/http_spec.rb +7 -7
- data/spec/arachni/state/options_spec.rb +7 -7
- data/spec/arachni/state/plugins_spec.rb +8 -8
- data/spec/arachni/state_spec.rb +10 -10
- data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
- data/spec/arachni/support/buffer/base_spec.rb +39 -39
- data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
- data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
- data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
- data/spec/arachni/support/cache/preference_spec.rb +4 -4
- data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
- data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
- data/spec/arachni/support/database/hash_spec.rb +44 -43
- data/spec/arachni/support/database/queue_spec.rb +27 -27
- data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
- data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
- data/spec/arachni/support/mixins/observable_spec.rb +6 -6
- data/spec/arachni/support/signature_spec.rb +19 -19
- data/spec/arachni/trainer_spec.rb +39 -39
- data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
- data/spec/arachni/uri/scope_spec.rb +66 -66
- data/spec/arachni/uri_spec.rb +107 -105
- data/spec/arachni/utilities_spec.rb +40 -40
- data/spec/components/checks/active/csrf_spec.rb +8 -8
- data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
- data/spec/components/checks/active/sql_injection_spec.rb +16 -16
- data/spec/components/checks/active/trainer_spec.rb +4 -4
- data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
- data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
- data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
- data/spec/components/checks/active/xss_dom_spec.rb +46 -24
- data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
- data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
- data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
- data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
- data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
- data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
- data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
- data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
- data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
- data/spec/components/checks/passive/webdav_spec.rb +1 -1
- data/spec/components/checks/passive/xst_spec.rb +1 -1
- data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
- data/spec/components/path_extractors/comments_spec.rb +5 -1
- data/spec/components/path_extractors/scripts_spec.rb +5 -2
- data/spec/components/plugins/autologin_spec.rb +22 -22
- data/spec/components/plugins/autothrottle_spec.rb +6 -5
- data/spec/components/plugins/content_types_spec.rb +4 -4
- data/spec/components/plugins/cookie_collector_spec.rb +5 -5
- data/spec/components/plugins/exec_spec.rb +12 -12
- data/spec/components/plugins/form_dicattack_spec.rb +3 -3
- data/spec/components/plugins/headers_collector_spec.rb +8 -8
- data/spec/components/plugins/healthmap_spec.rb +3 -3
- data/spec/components/plugins/http_dicattack_spec.rb +3 -3
- data/spec/components/plugins/login_script_spec.rb +79 -22
- data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
- data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
- data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
- data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
- data/spec/components/plugins/script_spec.rb +1 -1
- data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
- data/spec/components/plugins/vector_collector_spec.rb +2 -2
- data/spec/components/plugins/vector_feed_spec.rb +40 -40
- data/spec/components/plugins/waf_detector_spec.rb +6 -6
- data/spec/components/reporters/json_spec.rb +4 -4
- data/spec/components/reporters/marshal_spec.rb +2 -2
- data/spec/components/reporters/yaml_spec.rb +3 -2
- data/spec/external/wavsep/active/sqli_spec.rb +1 -3
- data/spec/spec_helper.rb +4 -0
- data/spec/support/factories/element/ui_form.rb +14 -0
- data/spec/support/factories/element/ui_input.rb +13 -0
- data/spec/support/factories/issue.rb +0 -13
- data/spec/support/fixtures/report.afr +0 -0
- data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
- data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/pages.rb +2 -2
- data/spec/support/servers/arachni/browser.rb +139 -0
- data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
- data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
- data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
- data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
- data/spec/support/servers/checks/active/trainer_check.rb +7 -7
- data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
- data/spec/support/servers/checks/active/xss_dom.rb +50 -0
- data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
- data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
- data/spec/support/shared/check.rb +10 -12
- data/spec/support/shared/component/options/base.rb +24 -24
- data/spec/support/shared/element/base.rb +25 -25
- data/spec/support/shared/element/capabilities/auditable.rb +116 -140
- data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
- data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
- data/spec/support/shared/element/capabilities/mutable.rb +122 -111
- data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
- data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
- data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
- data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
- data/spec/support/shared/element/capabilities/with_node.rb +4 -6
- data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
- data/spec/support/shared/element/capabilities/with_source.rb +6 -8
- data/spec/support/shared/element/dom.rb +144 -0
- data/spec/support/shared/element/dom/auditable.rb +42 -0
- data/spec/support/shared/element/dom/inputtable.rb +5 -0
- data/spec/support/shared/element/dom/mutable.rb +3 -0
- data/spec/support/shared/element/dom/submittable.rb +119 -0
- data/spec/support/shared/external/wavsep.rb +3 -3
- data/spec/support/shared/fingerprinter.rb +2 -2
- data/spec/support/shared/framework.rb +1 -1
- data/spec/support/shared/http/message.rb +9 -9
- data/spec/support/shared/option_group.rb +17 -17
- data/spec/support/shared/path_extractor.rb +1 -1
- data/spec/support/shared/plugin.rb +2 -2
- data/spec/support/shared/support/cache.rb +57 -57
- data/spec/support/shared/support/lookup.rb +25 -25
- data/ui/cli/framework.rb +22 -11
- data/ui/cli/framework/option_parser.rb +15 -0
- data/ui/cli/option_parser.rb +8 -1
- data/ui/cli/output.rb +2 -1
- metadata +54 -20
- data/components/checks/active/xss_dom_inputs.rb +0 -236
- data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
- data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
- data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -1,12 +1,26 @@
|
|
1
1
|
require 'spec_helper'
|
2
2
|
|
3
3
|
describe Arachni::Element::LinkTemplate::DOM do
|
4
|
+
inputs = { 'param' => 'some-name' }
|
5
|
+
|
4
6
|
it_should_behave_like 'element_dom'
|
5
7
|
|
8
|
+
it_should_behave_like 'with_node'
|
9
|
+
it_should_behave_like 'with_auditor'
|
10
|
+
|
11
|
+
it_should_behave_like 'submittable_dom'
|
12
|
+
it_should_behave_like 'inputtable_dom', inputs: inputs
|
13
|
+
it_should_behave_like 'mutable_dom', inputs: inputs
|
14
|
+
it_should_behave_like 'auditable_dom'
|
15
|
+
|
6
16
|
def auditable_extract_parameters( page )
|
7
17
|
{ 'param' => page.document.css('#container').text }
|
8
18
|
end
|
9
19
|
|
20
|
+
def run
|
21
|
+
auditor.browser_cluster.wait
|
22
|
+
end
|
23
|
+
|
10
24
|
before :each do
|
11
25
|
@framework = Arachni::Framework.new
|
12
26
|
@page = Arachni::Page.from_url( url )
|
@@ -38,43 +52,43 @@ describe Arachni::Element::LinkTemplate::DOM do
|
|
38
52
|
end
|
39
53
|
|
40
54
|
let(:mutable) do
|
41
|
-
|
55
|
+
subject.dup
|
42
56
|
end
|
43
57
|
|
44
58
|
describe '#type' do
|
45
59
|
it 'returns :link_dom' do
|
46
|
-
subject.type.
|
60
|
+
expect(subject.type).to eq(:link_template_dom)
|
47
61
|
end
|
48
62
|
end
|
49
63
|
|
50
64
|
describe '.type' do
|
51
65
|
it 'returns :link_dom' do
|
52
|
-
described_class.type.
|
66
|
+
expect(described_class.type).to eq(:link_template_dom)
|
53
67
|
end
|
54
68
|
end
|
55
69
|
|
56
70
|
describe '#extract_inputs' do
|
57
71
|
it "delegates to #{Arachni::Element::LinkTemplate}.extract_inputs" do
|
58
|
-
Arachni::Element::LinkTemplate.
|
59
|
-
subject.extract_inputs( 'blah' ).
|
72
|
+
allow(Arachni::Element::LinkTemplate).to receive(:extract_inputs) { |arg| "#{arg}1" }
|
73
|
+
expect(subject.extract_inputs( 'blah' )).to eq('blah1')
|
60
74
|
end
|
61
75
|
end
|
62
76
|
|
63
77
|
describe '#parent' do
|
64
78
|
it 'returns the parent element' do
|
65
|
-
subject.parent.
|
79
|
+
expect(subject.parent).to be_kind_of Arachni::Element::LinkTemplate
|
66
80
|
end
|
67
81
|
end
|
68
82
|
|
69
83
|
describe '#inputs' do
|
70
84
|
it 'parses query-style inputs from URL fragments' do
|
71
|
-
subject.inputs.
|
85
|
+
expect(subject.inputs).to eq({ 'param' => 'some-name' })
|
72
86
|
end
|
73
87
|
end
|
74
88
|
|
75
89
|
describe '#fragment' do
|
76
90
|
it 'returns the URL fragment' do
|
77
|
-
subject.fragment.
|
91
|
+
expect(subject.fragment).to eq('/param/some-name')
|
78
92
|
end
|
79
93
|
end
|
80
94
|
|
@@ -86,17 +100,17 @@ describe Arachni::Element::LinkTemplate::DOM do
|
|
86
100
|
browser.load subject.page
|
87
101
|
|
88
102
|
element = subject.locate
|
89
|
-
element.
|
103
|
+
expect(element).to be_kind_of Watir::HTMLElement
|
90
104
|
|
91
|
-
parent.class.from_document(
|
105
|
+
expect(parent.class.from_document(
|
92
106
|
parent.url, Nokogiri::HTML(element.html)
|
93
|
-
).first.
|
107
|
+
).first).to eq(parent)
|
94
108
|
|
95
109
|
called = true
|
96
110
|
end
|
97
111
|
|
98
112
|
subject.auditor.browser_cluster.wait
|
99
|
-
called.
|
113
|
+
expect(called).to be_truthy
|
100
114
|
end
|
101
115
|
end
|
102
116
|
|
@@ -111,53 +125,57 @@ describe Arachni::Element::LinkTemplate::DOM do
|
|
111
125
|
|
112
126
|
subject.trigger
|
113
127
|
|
114
|
-
subject.inputs.
|
128
|
+
expect(subject.inputs).to eq(auditable_extract_parameters( browser.to_page ))
|
115
129
|
called = true
|
116
130
|
end
|
117
131
|
|
118
132
|
subject.auditor.browser_cluster.wait
|
119
|
-
called.
|
133
|
+
expect(called).to be_truthy
|
120
134
|
end
|
121
135
|
|
122
136
|
it 'returns a playable transition' do
|
123
137
|
inputs = { 'param' => 'The.Dude' }
|
124
138
|
subject.update inputs
|
125
139
|
|
126
|
-
|
140
|
+
transitions = []
|
127
141
|
called = false
|
128
142
|
subject.with_browser do |browser|
|
129
143
|
subject.browser = browser
|
130
144
|
browser.load subject.page
|
131
145
|
|
132
|
-
|
146
|
+
transitions = subject.trigger
|
133
147
|
|
134
148
|
page = browser.to_page
|
135
149
|
|
136
|
-
subject.inputs.
|
150
|
+
expect(subject.inputs).to eq(auditable_extract_parameters( page ))
|
137
151
|
called = true
|
138
152
|
end
|
139
153
|
|
140
154
|
subject.auditor.browser_cluster.wait
|
141
|
-
called.
|
155
|
+
expect(called).to be_truthy
|
142
156
|
|
143
157
|
called = false
|
144
158
|
auditor.with_browser do |browser|
|
145
159
|
browser.load subject.page
|
146
|
-
auditable_extract_parameters( browser.to_page ).
|
160
|
+
expect(auditable_extract_parameters( browser.to_page )).to eq(
|
147
161
|
{ 'param' => '' }
|
162
|
+
)
|
163
|
+
|
164
|
+
transitions.each do |transition|
|
165
|
+
transition.play browser
|
166
|
+
end
|
148
167
|
|
149
|
-
|
150
|
-
auditable_extract_parameters( browser.to_page ).should == inputs
|
168
|
+
expect(auditable_extract_parameters( browser.to_page )).to eq(inputs)
|
151
169
|
called = true
|
152
170
|
end
|
153
171
|
auditor.browser_cluster.wait
|
154
|
-
called.
|
172
|
+
expect(called).to be_truthy
|
155
173
|
end
|
156
174
|
end
|
157
175
|
|
158
176
|
describe '.to_rpc_data' do
|
159
177
|
it 'converts the #template to a string' do
|
160
|
-
subject.to_rpc_data['template'].
|
178
|
+
expect(subject.to_rpc_data['template']).to eq(subject.template.source)
|
161
179
|
end
|
162
180
|
end
|
163
181
|
|
@@ -166,22 +184,22 @@ describe Arachni::Element::LinkTemplate::DOM do
|
|
166
184
|
let(:data) { described_class.data_from_node( node ) }
|
167
185
|
|
168
186
|
it 'returns a hash with DOM data' do
|
169
|
-
data.
|
187
|
+
expect(data).to eq({
|
170
188
|
inputs: {
|
171
189
|
'param' => 'some-name'
|
172
190
|
},
|
173
191
|
template: /param\/(?<param>.+)/,
|
174
192
|
fragment: '/param/some-name'
|
175
|
-
}
|
193
|
+
})
|
176
194
|
end
|
177
195
|
|
178
196
|
it 'decodes the fragment before extracting inputs' do
|
179
197
|
html = "<a href='#/param/bl%20ah'>Stuff</a>"
|
180
198
|
node = Nokogiri::HTML.fragment(html).children.first
|
181
199
|
|
182
|
-
described_class.data_from_node( node )[:inputs].
|
200
|
+
expect(described_class.data_from_node( node )[:inputs]).to eq({
|
183
201
|
'param' => 'bl ah'
|
184
|
-
}
|
202
|
+
})
|
185
203
|
end
|
186
204
|
|
187
205
|
context 'when there is no URL fragment' do
|
@@ -191,7 +209,7 @@ describe Arachni::Element::LinkTemplate::DOM do
|
|
191
209
|
end
|
192
210
|
|
193
211
|
it 'return nil' do
|
194
|
-
described_class.data_from_node( node ).
|
212
|
+
expect(described_class.data_from_node( node )).to be_nil
|
195
213
|
end
|
196
214
|
end
|
197
215
|
|
@@ -202,7 +220,7 @@ describe Arachni::Element::LinkTemplate::DOM do
|
|
202
220
|
end
|
203
221
|
|
204
222
|
it 'return nil' do
|
205
|
-
described_class.data_from_node( node ).
|
223
|
+
expect(described_class.data_from_node( node )).to be_nil
|
206
224
|
end
|
207
225
|
end
|
208
226
|
end
|
@@ -4,10 +4,27 @@ describe Arachni::Element::LinkTemplate do
|
|
4
4
|
html = "<a href='http://test.com/#/param/val'>stuff</a>"
|
5
5
|
|
6
6
|
it_should_behave_like 'element'
|
7
|
-
it_should_behave_like 'with_node'
|
7
|
+
it_should_behave_like 'with_node'
|
8
8
|
it_should_behave_like 'with_dom', html
|
9
|
+
it_should_behave_like 'with_source'
|
10
|
+
it_should_behave_like 'with_auditor'
|
11
|
+
|
12
|
+
it_should_behave_like 'submittable'
|
13
|
+
it_should_behave_like 'inputtable'
|
14
|
+
it_should_behave_like 'mutable'
|
9
15
|
it_should_behave_like 'auditable'
|
10
16
|
|
17
|
+
before :each do
|
18
|
+
@framework ||= Arachni::Framework.new
|
19
|
+
@auditor = Auditor.new( Arachni::Page.from_url( url ), @framework )
|
20
|
+
end
|
21
|
+
|
22
|
+
after :each do
|
23
|
+
@framework.reset
|
24
|
+
end
|
25
|
+
|
26
|
+
let(:auditor) { @auditor }
|
27
|
+
|
11
28
|
before :each do
|
12
29
|
Arachni::Options.audit.link_templates = /param\/(?<param>\w+)/
|
13
30
|
end
|
@@ -27,7 +44,8 @@ describe Arachni::Element::LinkTemplate do
|
|
27
44
|
subject do
|
28
45
|
described_class.new(
|
29
46
|
url: url_with_inputs,
|
30
|
-
template: template
|
47
|
+
template: template,
|
48
|
+
source: html
|
31
49
|
)
|
32
50
|
end
|
33
51
|
let(:inputtable) do
|
@@ -48,29 +66,29 @@ describe Arachni::Element::LinkTemplate do
|
|
48
66
|
describe :options do
|
49
67
|
describe :template do
|
50
68
|
it 'sets the #template' do
|
51
|
-
described_class.new(
|
69
|
+
expect(described_class.new(
|
52
70
|
url: url_with_inputs,
|
53
71
|
template: template
|
54
|
-
).template.
|
72
|
+
).template).to eq(template)
|
55
73
|
end
|
56
74
|
end
|
57
75
|
|
58
76
|
describe :inputs do
|
59
77
|
it 'sets the #inputs' do
|
60
|
-
described_class.new(
|
78
|
+
expect(described_class.new(
|
61
79
|
url: url_with_inputs,
|
62
80
|
inputs: inputs,
|
63
81
|
template: template
|
64
|
-
).inputs.
|
82
|
+
).inputs).to eq(inputs)
|
65
83
|
end
|
66
84
|
end
|
67
85
|
|
68
86
|
context 'when no :inputs are provided' do
|
69
87
|
it 'uses the given :template to extract them' do
|
70
|
-
described_class.new(
|
88
|
+
expect(described_class.new(
|
71
89
|
url: url_with_inputs,
|
72
90
|
template: template
|
73
|
-
).inputs.
|
91
|
+
).inputs).to eq(inputs)
|
74
92
|
end
|
75
93
|
|
76
94
|
context 'when no :template is provided' do
|
@@ -78,8 +96,8 @@ describe Arachni::Element::LinkTemplate do
|
|
78
96
|
Arachni::Options.audit.link_templates = template
|
79
97
|
|
80
98
|
l = described_class.new( url: url_with_inputs )
|
81
|
-
l.inputs.
|
82
|
-
l.template.
|
99
|
+
expect(l.inputs).to eq(inputs)
|
100
|
+
expect(l.template).to eq(template)
|
83
101
|
end
|
84
102
|
end
|
85
103
|
end
|
@@ -88,39 +106,39 @@ describe Arachni::Element::LinkTemplate do
|
|
88
106
|
|
89
107
|
describe '#simple' do
|
90
108
|
it 'returns a simple hash representation' do
|
91
|
-
subject.simple.
|
109
|
+
expect(subject.simple).to eq({
|
92
110
|
subject.action => subject.inputs
|
93
|
-
}
|
111
|
+
})
|
94
112
|
end
|
95
113
|
end
|
96
114
|
|
97
115
|
describe '#valid_input_name?' do
|
98
116
|
context 'when the name can be found in the #template named captures' do
|
99
117
|
it 'returns true' do
|
100
|
-
subject.template.names.
|
118
|
+
expect(subject.template.names).to be_any
|
101
119
|
|
102
120
|
subject.template.names.each do |name|
|
103
|
-
subject.valid_input_name?( name ).
|
121
|
+
expect(subject.valid_input_name?( name )).to be_truthy
|
104
122
|
end
|
105
123
|
end
|
106
124
|
end
|
107
125
|
|
108
126
|
context 'when the name cannot be found in the #template named captures' do
|
109
127
|
it 'returns false' do
|
110
|
-
subject.valid_input_name?( 'stuff' ).
|
128
|
+
expect(subject.valid_input_name?( 'stuff' )).to be_falsey
|
111
129
|
end
|
112
130
|
end
|
113
131
|
end
|
114
132
|
|
115
133
|
describe '#valid_input_data?' do
|
116
134
|
it 'returns true' do
|
117
|
-
subject.valid_input_data?( 'stuff' ).
|
135
|
+
expect(subject.valid_input_data?( 'stuff' )).to be_truthy
|
118
136
|
end
|
119
137
|
|
120
138
|
described_class::INVALID_INPUT_DATA.each do |invalid_data|
|
121
139
|
context "when the value contains #{invalid_data.inspect}" do
|
122
140
|
it 'returns false' do
|
123
|
-
subject.valid_input_data?( "stuff #{invalid_data}" ).
|
141
|
+
expect(subject.valid_input_data?( "stuff #{invalid_data}" )).to be_falsey
|
124
142
|
end
|
125
143
|
end
|
126
144
|
end
|
@@ -130,28 +148,28 @@ describe Arachni::Element::LinkTemplate do
|
|
130
148
|
context 'when there are no DOM#inputs' do
|
131
149
|
it 'returns nil' do
|
132
150
|
subject.source = '<a href="/stuff">Bla</a>'
|
133
|
-
subject.dom.
|
151
|
+
expect(subject.dom).to be_nil
|
134
152
|
end
|
135
153
|
end
|
136
154
|
|
137
155
|
context 'when there is no #node' do
|
138
156
|
it 'returns nil' do
|
139
157
|
subject.source = nil
|
140
|
-
subject.dom.
|
158
|
+
expect(subject.dom).to be_nil
|
141
159
|
end
|
142
160
|
end
|
143
161
|
end
|
144
162
|
|
145
163
|
describe '#to_s' do
|
146
164
|
it 'returns the updated link' do
|
147
|
-
inputtable.to_s.
|
165
|
+
expect(inputtable.to_s).to eq(inputtable.action)
|
148
166
|
|
149
167
|
inputtable.inputs = {
|
150
168
|
'input1' => 'new value 1',
|
151
169
|
'input2' => 'new value 2'
|
152
170
|
}
|
153
171
|
|
154
|
-
inputtable.to_s.
|
172
|
+
expect(inputtable.to_s).to eq("#{url}input1/new%20value%201/input2/new%20value%202")
|
155
173
|
end
|
156
174
|
end
|
157
175
|
|
@@ -163,7 +181,7 @@ describe Arachni::Element::LinkTemplate do
|
|
163
181
|
c = subject.dup
|
164
182
|
c.source ="<a href='http://test.com/#/param/val2'>stuff</a>"
|
165
183
|
|
166
|
-
c.coverage_id.
|
184
|
+
expect(c.coverage_id).to eq(e.coverage_id)
|
167
185
|
|
168
186
|
e = subject.dup
|
169
187
|
e.source ="<a href='http://test.com/#/param/val'>stuff</a>"
|
@@ -173,7 +191,7 @@ describe Arachni::Element::LinkTemplate do
|
|
173
191
|
c = subject.dup
|
174
192
|
c.source ="<a href='http://test.com/#/param2/val'>stuff</a>"
|
175
193
|
|
176
|
-
c.coverage_id.
|
194
|
+
expect(c.coverage_id).not_to eq(e.coverage_id)
|
177
195
|
end
|
178
196
|
end
|
179
197
|
|
@@ -185,7 +203,7 @@ describe Arachni::Element::LinkTemplate do
|
|
185
203
|
c = subject.dup
|
186
204
|
c.source ="<a href='http://test.com/#/param/val'>stuff</a>"
|
187
205
|
|
188
|
-
c.id.
|
206
|
+
expect(c.id).to eq(e.id)
|
189
207
|
|
190
208
|
e = subject.dup
|
191
209
|
e.source ="<a href='http://test.com/#/param/val'>stuff</a>"
|
@@ -193,7 +211,7 @@ describe Arachni::Element::LinkTemplate do
|
|
193
211
|
c = subject.dup
|
194
212
|
c.source ="<a href='http://test.com/#/param/val1'>stuff</a>"
|
195
213
|
|
196
|
-
c.id.
|
214
|
+
expect(c.id).not_to eq(e.id)
|
197
215
|
|
198
216
|
e = subject.dup
|
199
217
|
e.source ="<a href='http://test.com/#/param/val'>stuff</a>"
|
@@ -201,35 +219,35 @@ describe Arachni::Element::LinkTemplate do
|
|
201
219
|
c = subject.dup
|
202
220
|
c.source ="<a href='http://test.com/#/param2/val'>stuff</a>"
|
203
221
|
|
204
|
-
c.id.
|
222
|
+
expect(c.id).not_to eq(e.id)
|
205
223
|
end
|
206
224
|
end
|
207
225
|
|
208
226
|
describe '#to_rpc_data' do
|
209
227
|
it "does not include 'dom_data'" do
|
210
228
|
subject.source = html
|
211
|
-
subject.dom.
|
229
|
+
expect(subject.dom).to be_truthy
|
212
230
|
|
213
|
-
subject.to_rpc_data.
|
231
|
+
expect(subject.to_rpc_data).not_to include 'dom_data'
|
214
232
|
end
|
215
233
|
end
|
216
234
|
|
217
235
|
describe '.encode' do
|
218
236
|
it 'URL-encodes the passed string' do
|
219
|
-
described_class.encode( 'test/;' ).
|
237
|
+
expect(described_class.encode( 'test/;' )).to eq('test%2F%3B')
|
220
238
|
end
|
221
239
|
end
|
222
240
|
|
223
241
|
describe '.decode' do
|
224
242
|
it 'URL-decodes the passed string' do
|
225
243
|
v = '%25+value%5C+%2B%3D%26%3B'
|
226
|
-
described_class.decode( v ).
|
244
|
+
expect(described_class.decode( v )).to eq(URI.decode( v ))
|
227
245
|
end
|
228
246
|
end
|
229
247
|
describe '#decode' do
|
230
248
|
it 'URL-decodes the passed string' do
|
231
249
|
v = '%25+value%5C+%2B%3D%26%3B'
|
232
|
-
subject.decode( v ).
|
250
|
+
expect(subject.decode( v )).to eq(described_class.decode( v ))
|
233
251
|
end
|
234
252
|
end
|
235
253
|
|
@@ -239,11 +257,11 @@ describe Arachni::Element::LinkTemplate do
|
|
239
257
|
templates = [/input1\/(?<input1>\w+)\/input2\/(?<input2>\w+)/]
|
240
258
|
|
241
259
|
template, inputs = described_class.extract_inputs( url, templates )
|
242
|
-
templates.
|
243
|
-
inputs.
|
260
|
+
expect(templates).to eq([template])
|
261
|
+
expect(inputs).to eq({
|
244
262
|
'input1' => 'value1',
|
245
263
|
'input2' => 'value2'
|
246
|
-
}
|
264
|
+
})
|
247
265
|
end
|
248
266
|
|
249
267
|
it 'decodes the input values' do
|
@@ -251,15 +269,15 @@ describe Arachni::Element::LinkTemplate do
|
|
251
269
|
templates = [/input1\/(?<input1>.+)\/input2\/(?<input2>.+)/]
|
252
270
|
|
253
271
|
_, inputs = described_class.extract_inputs( url, templates )
|
254
|
-
inputs.
|
272
|
+
expect(inputs).to eq({
|
255
273
|
'input1' => 'val ue1',
|
256
274
|
'input2' => 'val ue2'
|
257
|
-
}
|
275
|
+
})
|
258
276
|
end
|
259
277
|
|
260
278
|
context 'when no URL is given' do
|
261
279
|
it 'returns an empty array' do
|
262
|
-
described_class.extract_inputs( nil ).
|
280
|
+
expect(described_class.extract_inputs( nil )).to eq([])
|
263
281
|
end
|
264
282
|
end
|
265
283
|
|
@@ -271,12 +289,12 @@ describe Arachni::Element::LinkTemplate do
|
|
271
289
|
Arachni::Options.audit.link_templates = templates
|
272
290
|
|
273
291
|
template, inputs = described_class.extract_inputs( url )
|
274
|
-
inputs.
|
292
|
+
expect(inputs).to eq({
|
275
293
|
'input1' => 'value1',
|
276
294
|
'input2' => 'value2'
|
277
|
-
}
|
295
|
+
})
|
278
296
|
|
279
|
-
[templates].
|
297
|
+
expect([templates]).to eq([Arachni::Options.audit.link_templates])
|
280
298
|
end
|
281
299
|
end
|
282
300
|
|
@@ -285,14 +303,14 @@ describe Arachni::Element::LinkTemplate do
|
|
285
303
|
url = "#{url}input3/value1/input4/value2"
|
286
304
|
templates = [/input1\/(?<input1>\w+)\/input2\/(?<input2>\w+)/]
|
287
305
|
|
288
|
-
described_class.extract_inputs( url, templates ).
|
306
|
+
expect(described_class.extract_inputs( url, templates )).to eq([])
|
289
307
|
end
|
290
308
|
end
|
291
309
|
end
|
292
310
|
|
293
311
|
describe '.type' do
|
294
312
|
it 'returns :link_template' do
|
295
|
-
described_class.type.
|
313
|
+
expect(described_class.type).to eq(:link_template)
|
296
314
|
end
|
297
315
|
end
|
298
316
|
|
@@ -309,11 +327,11 @@ describe Arachni::Element::LinkTemplate do
|
|
309
327
|
)
|
310
328
|
|
311
329
|
link = described_class.from_response( response ).first
|
312
|
-
link.action.
|
313
|
-
link.url.
|
314
|
-
link.inputs.
|
330
|
+
expect(link.action).to eq(url + 'test2/param/myvalue')
|
331
|
+
expect(link.url).to eq(url)
|
332
|
+
expect(link.inputs).to eq({
|
315
333
|
'param' => 'myvalue'
|
316
|
-
}
|
334
|
+
})
|
317
335
|
end
|
318
336
|
|
319
337
|
context 'when the URL matches a link template' do
|
@@ -323,11 +341,11 @@ describe Arachni::Element::LinkTemplate do
|
|
323
341
|
)
|
324
342
|
|
325
343
|
link = described_class.from_response( response ).first
|
326
|
-
link.action.
|
327
|
-
link.url.
|
328
|
-
link.inputs.
|
344
|
+
expect(link.action).to eq(url + 'test2/param/myvalue')
|
345
|
+
expect(link.url).to eq(link.action)
|
346
|
+
expect(link.inputs).to eq({
|
329
347
|
'param' => 'myvalue'
|
330
|
-
}
|
348
|
+
})
|
331
349
|
end
|
332
350
|
end
|
333
351
|
end
|
@@ -335,7 +353,7 @@ describe Arachni::Element::LinkTemplate do
|
|
335
353
|
describe '.from_document' do
|
336
354
|
context 'when the response does not contain any link templates' do
|
337
355
|
it 'returns an empty array' do
|
338
|
-
described_class.from_document( '', '' ).
|
356
|
+
expect(described_class.from_document( '', '' )).to be_empty
|
339
357
|
end
|
340
358
|
end
|
341
359
|
context 'when links have actions that are out of scope' do
|
@@ -352,8 +370,8 @@ describe Arachni::Element::LinkTemplate do
|
|
352
370
|
Arachni::Options.scope.exclude_path_patterns = [/exclude/]
|
353
371
|
|
354
372
|
links = described_class.from_document( url, html )
|
355
|
-
links.size.
|
356
|
-
links.first.action.
|
373
|
+
expect(links.size).to eq(1)
|
374
|
+
expect(links.first.action).to eq(url + 'test2/param/myvalue')
|
357
375
|
end
|
358
376
|
end
|
359
377
|
context 'when the response contains link templates' do
|
@@ -366,11 +384,11 @@ describe Arachni::Element::LinkTemplate do
|
|
366
384
|
</html>'
|
367
385
|
|
368
386
|
link = described_class.from_document( url, html ).first
|
369
|
-
link.action.
|
370
|
-
link.url.
|
371
|
-
link.inputs.
|
387
|
+
expect(link.action).to eq(url + 'test2/param/myvalue')
|
388
|
+
expect(link.url).to eq(url)
|
389
|
+
expect(link.inputs).to eq({
|
372
390
|
'param' => 'myvalue'
|
373
|
-
}
|
391
|
+
})
|
374
392
|
end
|
375
393
|
|
376
394
|
context 'and includes a base attribute' do
|
@@ -387,11 +405,11 @@ describe Arachni::Element::LinkTemplate do
|
|
387
405
|
</html>'
|
388
406
|
|
389
407
|
link = described_class.from_document( url, html ).first
|
390
|
-
link.action.
|
391
|
-
link.url.
|
392
|
-
link.inputs.
|
408
|
+
expect(link.action).to eq(base_url + 'test/param/myvalue')
|
409
|
+
expect(link.url).to eq(url)
|
410
|
+
expect(link.inputs).to eq({
|
393
411
|
'param' => 'myvalue'
|
394
|
-
}
|
412
|
+
})
|
395
413
|
end
|
396
414
|
end
|
397
415
|
end
|