arachni 1.2.1 → 1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +66 -0
- data/Gemfile +1 -1
- data/README.md +16 -5
- data/components/checks/active/ldap_injection/errors.txt +1 -0
- data/components/checks/active/source_code_disclosure.rb +1 -1
- data/components/checks/active/unvalidated_redirect.rb +6 -6
- data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
- data/components/checks/passive/grep/captcha.rb +14 -5
- data/components/checks/passive/grep/form_upload.rb +7 -3
- data/components/checks/passive/grep/hsts.rb +3 -3
- data/components/checks/passive/grep/html_objects.rb +2 -3
- data/components/checks/passive/grep/http_only_cookies.rb +2 -3
- data/components/checks/passive/grep/insecure_cookies.rb +1 -1
- data/components/checks/passive/grep/password_autocomplete.rb +2 -2
- data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
- data/components/checks/passive/grep/x_frame_options.rb +2 -2
- data/components/checks/passive/http_put.rb +2 -3
- data/components/path_extractors/comments.rb +3 -3
- data/components/path_extractors/scripts.rb +10 -1
- data/components/plugins/defaults/autothrottle.rb +27 -18
- data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
- data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
- data/components/plugins/login_script.rb +9 -3
- data/components/plugins/proxy.rb +4 -3
- data/components/reporters/html.rb +11 -14
- data/components/reporters/html/default/issue.erb +13 -38
- data/components/reporters/html/default/issue/info.erb +1 -1
- data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
- data/components/reporters/stdout.rb +62 -71
- data/components/reporters/xml.rb +26 -40
- data/components/reporters/xml/schema.xsd +43 -89
- data/lib/arachni/browser.rb +52 -3
- data/lib/arachni/browser/javascript.rb +3 -3
- data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
- data/lib/arachni/browser_cluster.rb +61 -0
- data/lib/arachni/browser_cluster/job.rb +21 -1
- data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/worker.rb +5 -0
- data/lib/arachni/check/auditor.rb +22 -12
- data/lib/arachni/data/framework.rb +13 -1
- data/lib/arachni/data/issues.rb +9 -25
- data/lib/arachni/element/base.rb +9 -3
- data/lib/arachni/element/capabilities/analyzable.rb +2 -6
- data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
- data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
- data/lib/arachni/element/capabilities/auditable.rb +0 -6
- data/lib/arachni/element/capabilities/dom_only.rb +61 -0
- data/lib/arachni/element/capabilities/with_dom.rb +3 -1
- data/lib/arachni/element/cookie.rb +35 -5
- data/lib/arachni/element/cookie/dom.rb +13 -4
- data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
- data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
- data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
- data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
- data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
- data/lib/arachni/element/form.rb +12 -1
- data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
- data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/form/dom.rb +9 -3
- data/lib/arachni/element/header.rb +14 -33
- data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
- data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
- data/lib/arachni/element/input/dom.rb +71 -0
- data/lib/arachni/element/json.rb +2 -0
- data/lib/arachni/element/link.rb +3 -0
- data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link/dom.rb +16 -3
- data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/link_template.rb +3 -5
- data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
- data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link_template/dom.rb +16 -3
- data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/server.rb +3 -5
- data/lib/arachni/element/ui_form.rb +106 -0
- data/lib/arachni/element/ui_form/dom.rb +107 -0
- data/lib/arachni/element/ui_input.rb +62 -0
- data/lib/arachni/element/xml.rb +2 -1
- data/lib/arachni/framework.rb +7 -5
- data/lib/arachni/framework/parts/audit.rb +0 -1
- data/lib/arachni/framework/parts/check.rb +1 -0
- data/lib/arachni/framework/parts/data.rb +4 -0
- data/lib/arachni/framework/parts/state.rb +0 -2
- data/lib/arachni/http/client.rb +17 -6
- data/lib/arachni/http/proxy_server.rb +52 -5
- data/lib/arachni/http/request.rb +1 -1
- data/lib/arachni/issue.rb +34 -179
- data/lib/arachni/issue/severity.rb +2 -0
- data/lib/arachni/option_groups/audit.rb +22 -2
- data/lib/arachni/option_groups/browser_cluster.rb +15 -0
- data/lib/arachni/page.rb +3 -2
- data/lib/arachni/parser.rb +24 -5
- data/lib/arachni/platform/manager.rb +1 -2
- data/lib/arachni/rpc/server/framework.rb +3 -4
- data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
- data/lib/arachni/session.rb +1 -1
- data/lib/arachni/trainer.rb +4 -7
- data/lib/arachni/watir/element.rb +12 -1
- data/lib/version +1 -1
- data/spec/arachni/browser/element_locator_spec.rb +43 -43
- data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
- data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
- data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
- data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
- data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
- data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
- data/spec/arachni/browser/javascript_spec.rb +73 -63
- data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
- data/spec/arachni/browser_cluster/job_spec.rb +68 -48
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
- data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
- data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
- data/spec/arachni/browser_cluster_spec.rb +64 -39
- data/spec/arachni/browser_spec.rb +692 -527
- data/spec/arachni/check/auditor_spec.rb +177 -147
- data/spec/arachni/check/base_spec.rb +33 -33
- data/spec/arachni/check/manager_spec.rb +15 -15
- data/spec/arachni/component/base_spec.rb +8 -8
- data/spec/arachni/component/manager_spec.rb +100 -99
- data/spec/arachni/component/options/address_spec.rb +3 -3
- data/spec/arachni/component/options/base_spec.rb +7 -7
- data/spec/arachni/component/options/bool_spec.rb +9 -9
- data/spec/arachni/component/options/float_spec.rb +6 -6
- data/spec/arachni/component/options/int_spec.rb +5 -5
- data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
- data/spec/arachni/component/options/object_spec.rb +2 -2
- data/spec/arachni/component/options/path_spec.rb +3 -3
- data/spec/arachni/component/options/port_spec.rb +5 -5
- data/spec/arachni/component/options/string_spec.rb +3 -3
- data/spec/arachni/component/options/url_spec.rb +4 -4
- data/spec/arachni/component/utilities_spec.rb +2 -2
- data/spec/arachni/data/framework/rpc_spec.rb +10 -9
- data/spec/arachni/data/framework_spec.rb +65 -46
- data/spec/arachni/data/issues_spec.rb +39 -77
- data/spec/arachni/data/plugins_spec.rb +11 -11
- data/spec/arachni/data/session_spec.rb +6 -6
- data/spec/arachni/data_spec.rb +8 -8
- data/spec/arachni/element/body_spec.rb +10 -10
- data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
- data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
- data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
- data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
- data/spec/arachni/element/cookie/dom_spec.rb +37 -18
- data/spec/arachni/element/cookie_spec.rb +206 -139
- data/spec/arachni/element/form/dom_spec.rb +36 -19
- data/spec/arachni/element/form_spec.rb +210 -187
- data/spec/arachni/element/generic_dom_spec.rb +14 -14
- data/spec/arachni/element/header_spec.rb +35 -17
- data/spec/arachni/element/json_spec.rb +53 -31
- data/spec/arachni/element/link/dom_spec.rb +46 -28
- data/spec/arachni/element/link_spec.rb +58 -40
- data/spec/arachni/element/link_template/dom_spec.rb +47 -29
- data/spec/arachni/element/link_template_spec.rb +79 -61
- data/spec/arachni/element/path_spec.rb +1 -1
- data/spec/arachni/element/server_spec.rb +33 -32
- data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
- data/spec/arachni/element/ui_form_spec.rb +242 -0
- data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
- data/spec/arachni/element/ui_input_spec.rb +136 -0
- data/spec/arachni/element/xml_spec.rb +42 -24
- data/spec/arachni/element_filter_spec.rb +49 -48
- data/spec/arachni/error_spec.rb +3 -3
- data/spec/arachni/framework/parts/audit_spec.rb +64 -63
- data/spec/arachni/framework/parts/browser_spec.rb +16 -16
- data/spec/arachni/framework/parts/check_spec.rb +3 -3
- data/spec/arachni/framework/parts/data_spec.rb +48 -48
- data/spec/arachni/framework/parts/platform_spec.rb +3 -3
- data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
- data/spec/arachni/framework/parts/report_spec.rb +7 -7
- data/spec/arachni/framework/parts/scope_spec.rb +16 -16
- data/spec/arachni/framework/parts/state_spec.rb +68 -69
- data/spec/arachni/framework_spec.rb +39 -31
- data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
- data/spec/arachni/http/client_spec.rb +219 -208
- data/spec/arachni/http/cookie_jar_spec.rb +72 -72
- data/spec/arachni/http/headers_spec.rb +14 -14
- data/spec/arachni/http/proxy_server_spec.rb +43 -42
- data/spec/arachni/http/request_spec.rb +105 -103
- data/spec/arachni/http/response/scope_spec.rb +24 -24
- data/spec/arachni/http/response_spec.rb +50 -49
- data/spec/arachni/issue/severity_spec.rb +10 -9
- data/spec/arachni/issue_spec.rb +71 -369
- data/spec/arachni/option_groups/audit_spec.rb +114 -114
- data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
- data/spec/arachni/option_groups/datastore_spec.rb +6 -6
- data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
- data/spec/arachni/option_groups/http_spec.rb +11 -11
- data/spec/arachni/option_groups/input_spec.rb +31 -27
- data/spec/arachni/option_groups/output_spec.rb +2 -2
- data/spec/arachni/option_groups/paths_spec.rb +17 -17
- data/spec/arachni/option_groups/rpc_spec.rb +2 -2
- data/spec/arachni/option_groups/scope_spec.rb +40 -40
- data/spec/arachni/option_groups/session_spec.rb +6 -5
- data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
- data/spec/arachni/options_spec.rb +46 -45
- data/spec/arachni/page/dom/transition_spec.rb +74 -72
- data/spec/arachni/page/dom_spec.rb +35 -35
- data/spec/arachni/page/scope_spec.rb +15 -15
- data/spec/arachni/page_spec.rb +217 -217
- data/spec/arachni/parser_spec.rb +106 -104
- data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
- data/spec/arachni/platform/list_spec.rb +33 -33
- data/spec/arachni/platform/manager_spec.rb +67 -64
- data/spec/arachni/plugin/base_spec.rb +10 -10
- data/spec/arachni/plugin/manager_spec.rb +38 -37
- data/spec/arachni/report_spec.rb +43 -40
- data/spec/arachni/reporter/base_spec.rb +15 -15
- data/spec/arachni/reporter/manager_spec.rb +4 -4
- data/spec/arachni/reporter/options_spec.rb +6 -6
- data/spec/arachni/rpc/client/base_spec.rb +6 -6
- data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
- data/spec/arachni/rpc/client/instance_spec.rb +6 -6
- data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
- data/spec/arachni/rpc/server/base_spec.rb +5 -5
- data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
- data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
- data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
- data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
- data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
- data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
- data/spec/arachni/rpc/server/framework_spec.rb +90 -85
- data/spec/arachni/rpc/server/instance_spec.rb +126 -107
- data/spec/arachni/rpc/server/output_spec.rb +1 -1
- data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
- data/spec/arachni/ruby/array_spec.rb +42 -42
- data/spec/arachni/ruby/hash_spec.rb +20 -18
- data/spec/arachni/ruby/io_spec.rb +2 -2
- data/spec/arachni/ruby/object_spec.rb +1 -1
- data/spec/arachni/ruby/set_spec.rb +3 -3
- data/spec/arachni/ruby/string_spec.rb +30 -30
- data/spec/arachni/ruby/webrick_spec.rb +2 -2
- data/spec/arachni/scope_spec.rb +1 -1
- data/spec/arachni/session_spec.rb +67 -64
- data/spec/arachni/snapshot_spec.rb +15 -15
- data/spec/arachni/state/audit_spec.rb +11 -11
- data/spec/arachni/state/element_filter_spec.rb +6 -6
- data/spec/arachni/state/framework/rpc_spec.rb +12 -12
- data/spec/arachni/state/framework_spec.rb +125 -121
- data/spec/arachni/state/http_spec.rb +7 -7
- data/spec/arachni/state/options_spec.rb +7 -7
- data/spec/arachni/state/plugins_spec.rb +8 -8
- data/spec/arachni/state_spec.rb +10 -10
- data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
- data/spec/arachni/support/buffer/base_spec.rb +39 -39
- data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
- data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
- data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
- data/spec/arachni/support/cache/preference_spec.rb +4 -4
- data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
- data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
- data/spec/arachni/support/database/hash_spec.rb +44 -43
- data/spec/arachni/support/database/queue_spec.rb +27 -27
- data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
- data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
- data/spec/arachni/support/mixins/observable_spec.rb +6 -6
- data/spec/arachni/support/signature_spec.rb +19 -19
- data/spec/arachni/trainer_spec.rb +39 -39
- data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
- data/spec/arachni/uri/scope_spec.rb +66 -66
- data/spec/arachni/uri_spec.rb +107 -105
- data/spec/arachni/utilities_spec.rb +40 -40
- data/spec/components/checks/active/csrf_spec.rb +8 -8
- data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
- data/spec/components/checks/active/sql_injection_spec.rb +16 -16
- data/spec/components/checks/active/trainer_spec.rb +4 -4
- data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
- data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
- data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
- data/spec/components/checks/active/xss_dom_spec.rb +46 -24
- data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
- data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
- data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
- data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
- data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
- data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
- data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
- data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
- data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
- data/spec/components/checks/passive/webdav_spec.rb +1 -1
- data/spec/components/checks/passive/xst_spec.rb +1 -1
- data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
- data/spec/components/path_extractors/comments_spec.rb +5 -1
- data/spec/components/path_extractors/scripts_spec.rb +5 -2
- data/spec/components/plugins/autologin_spec.rb +22 -22
- data/spec/components/plugins/autothrottle_spec.rb +6 -5
- data/spec/components/plugins/content_types_spec.rb +4 -4
- data/spec/components/plugins/cookie_collector_spec.rb +5 -5
- data/spec/components/plugins/exec_spec.rb +12 -12
- data/spec/components/plugins/form_dicattack_spec.rb +3 -3
- data/spec/components/plugins/headers_collector_spec.rb +8 -8
- data/spec/components/plugins/healthmap_spec.rb +3 -3
- data/spec/components/plugins/http_dicattack_spec.rb +3 -3
- data/spec/components/plugins/login_script_spec.rb +79 -22
- data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
- data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
- data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
- data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
- data/spec/components/plugins/script_spec.rb +1 -1
- data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
- data/spec/components/plugins/vector_collector_spec.rb +2 -2
- data/spec/components/plugins/vector_feed_spec.rb +40 -40
- data/spec/components/plugins/waf_detector_spec.rb +6 -6
- data/spec/components/reporters/json_spec.rb +4 -4
- data/spec/components/reporters/marshal_spec.rb +2 -2
- data/spec/components/reporters/yaml_spec.rb +3 -2
- data/spec/external/wavsep/active/sqli_spec.rb +1 -3
- data/spec/spec_helper.rb +4 -0
- data/spec/support/factories/element/ui_form.rb +14 -0
- data/spec/support/factories/element/ui_input.rb +13 -0
- data/spec/support/factories/issue.rb +0 -13
- data/spec/support/fixtures/report.afr +0 -0
- data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
- data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/pages.rb +2 -2
- data/spec/support/servers/arachni/browser.rb +139 -0
- data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
- data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
- data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
- data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
- data/spec/support/servers/checks/active/trainer_check.rb +7 -7
- data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
- data/spec/support/servers/checks/active/xss_dom.rb +50 -0
- data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
- data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
- data/spec/support/shared/check.rb +10 -12
- data/spec/support/shared/component/options/base.rb +24 -24
- data/spec/support/shared/element/base.rb +25 -25
- data/spec/support/shared/element/capabilities/auditable.rb +116 -140
- data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
- data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
- data/spec/support/shared/element/capabilities/mutable.rb +122 -111
- data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
- data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
- data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
- data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
- data/spec/support/shared/element/capabilities/with_node.rb +4 -6
- data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
- data/spec/support/shared/element/capabilities/with_source.rb +6 -8
- data/spec/support/shared/element/dom.rb +144 -0
- data/spec/support/shared/element/dom/auditable.rb +42 -0
- data/spec/support/shared/element/dom/inputtable.rb +5 -0
- data/spec/support/shared/element/dom/mutable.rb +3 -0
- data/spec/support/shared/element/dom/submittable.rb +119 -0
- data/spec/support/shared/external/wavsep.rb +3 -3
- data/spec/support/shared/fingerprinter.rb +2 -2
- data/spec/support/shared/framework.rb +1 -1
- data/spec/support/shared/http/message.rb +9 -9
- data/spec/support/shared/option_group.rb +17 -17
- data/spec/support/shared/path_extractor.rb +1 -1
- data/spec/support/shared/plugin.rb +2 -2
- data/spec/support/shared/support/cache.rb +57 -57
- data/spec/support/shared/support/lookup.rb +25 -25
- data/ui/cli/framework.rb +22 -11
- data/ui/cli/framework/option_parser.rb +15 -0
- data/ui/cli/option_parser.rb +8 -1
- data/ui/cli/output.rb +2 -1
- metadata +54 -20
- data/components/checks/active/xss_dom_inputs.rb +0 -236
- data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
- data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
- data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -44,12 +44,12 @@ describe Arachni::HTTP::Request do
|
|
44
44
|
|
45
45
|
it "supports #{Marshal} serialization" do
|
46
46
|
subject = described_class.new( options )
|
47
|
-
subject.
|
47
|
+
expect(subject).to eq(Marshal.load( Marshal.dump( subject ) ))
|
48
48
|
end
|
49
49
|
|
50
50
|
it "supports #{Arachni::RPC::Serializer}" do
|
51
51
|
subject = described_class.new( options )
|
52
|
-
subject.
|
52
|
+
expect(subject).to eq(Arachni::RPC::Serializer.deep_clone( subject ))
|
53
53
|
end
|
54
54
|
|
55
55
|
describe '#to_rpc_data' do
|
@@ -58,7 +58,7 @@ describe Arachni::HTTP::Request do
|
|
58
58
|
%w(url method parameters body headers_string effective_body timeout
|
59
59
|
headers cookies username password).each do |attribute|
|
60
60
|
it "includes '#{attribute}'" do
|
61
|
-
data[attribute].
|
61
|
+
expect(data[attribute]).to eq(subject.send( attribute ))
|
62
62
|
end
|
63
63
|
end
|
64
64
|
end
|
@@ -70,53 +70,53 @@ describe Arachni::HTTP::Request do
|
|
70
70
|
%w(url method parameters body headers_string effective_body timeout
|
71
71
|
headers cookies username password).each do |attribute|
|
72
72
|
it "restores '#{attribute}'" do
|
73
|
-
restored.send( attribute ).
|
73
|
+
expect(restored.send( attribute )).to eq(subject.send( attribute ))
|
74
74
|
end
|
75
75
|
end
|
76
76
|
|
77
77
|
it "does not include 'scope" do
|
78
|
-
data.
|
78
|
+
expect(data).not_to include 'scope'
|
79
79
|
end
|
80
80
|
end
|
81
81
|
|
82
82
|
describe '#initialize' do
|
83
83
|
it 'sets the instance attributes by the options' do
|
84
84
|
r = described_class.new( options )
|
85
|
-
r.url.
|
86
|
-
r.method.
|
87
|
-
r.parameters.
|
88
|
-
r.timeout.
|
89
|
-
r.headers.
|
90
|
-
r.username.
|
91
|
-
r.password.
|
85
|
+
expect(r.url).to eq(Arachni::Utilities.normalize_url( url ))
|
86
|
+
expect(r.method).to eq(options[:method])
|
87
|
+
expect(r.parameters).to eq(options[:parameters])
|
88
|
+
expect(r.timeout).to eq(options[:timeout])
|
89
|
+
expect(r.headers).to eq(options[:headers])
|
90
|
+
expect(r.username).to eq(options[:username])
|
91
|
+
expect(r.password).to eq(options[:password])
|
92
92
|
end
|
93
93
|
|
94
94
|
it 'uses the setter methods when configuring' do
|
95
95
|
options = { url: url, method: 'gEt', parameters: { test: 'blah' } }
|
96
96
|
r = described_class.new( options )
|
97
|
-
r.method.
|
98
|
-
r.parameters.
|
97
|
+
expect(r.method).to eq(:get)
|
98
|
+
expect(r.parameters).to eq({ 'test' => 'blah' })
|
99
99
|
end
|
100
100
|
|
101
101
|
describe :fingerprint do
|
102
102
|
context true do
|
103
103
|
it 'enables fingerprinting' do
|
104
104
|
r = described_class.new( options.merge( fingerprint: true ) )
|
105
|
-
r.fingerprint
|
105
|
+
expect(r.fingerprint?).to be_truthy
|
106
106
|
end
|
107
107
|
end
|
108
108
|
|
109
109
|
context false do
|
110
110
|
it 'disables fingerprinting' do
|
111
111
|
r = described_class.new( options.merge( fingerprint: false ) )
|
112
|
-
r.fingerprint
|
112
|
+
expect(r.fingerprint?).not_to be_truthy
|
113
113
|
end
|
114
114
|
end
|
115
115
|
|
116
116
|
context 'nil' do
|
117
117
|
it 'enables fingerprinting' do
|
118
118
|
r = described_class.new( options.merge( fingerprint: nil ) )
|
119
|
-
r.fingerprint
|
119
|
+
expect(r.fingerprint?).to be_truthy
|
120
120
|
end
|
121
121
|
end
|
122
122
|
end
|
@@ -129,7 +129,7 @@ describe Arachni::HTTP::Request do
|
|
129
129
|
rescue ArgumentError
|
130
130
|
raised = true
|
131
131
|
end
|
132
|
-
raised.
|
132
|
+
expect(raised).to be_truthy
|
133
133
|
end
|
134
134
|
end
|
135
135
|
end
|
@@ -137,20 +137,20 @@ describe Arachni::HTTP::Request do
|
|
137
137
|
describe '#to_s' do
|
138
138
|
it 'returns the HTTP request as a string' do
|
139
139
|
request = described_class.new( url: @url ).run.request
|
140
|
-
request.to_s.
|
140
|
+
expect(request.to_s).to eq("#{request.headers_string}#{request.effective_body}")
|
141
141
|
end
|
142
142
|
end
|
143
143
|
|
144
144
|
describe '#asynchronous?' do
|
145
145
|
context 'when the mode is :async' do
|
146
146
|
it 'returns true' do
|
147
|
-
described_class.new( url: @url, mode: :async ).
|
147
|
+
expect(described_class.new( url: @url, mode: :async )).to be_asynchronous
|
148
148
|
end
|
149
149
|
end
|
150
150
|
|
151
151
|
context 'when the mode is :sync' do
|
152
152
|
it 'returns false' do
|
153
|
-
described_class.new( url: @url, mode: :sync ).
|
153
|
+
expect(described_class.new( url: @url, mode: :sync )).not_to be_asynchronous
|
154
154
|
end
|
155
155
|
end
|
156
156
|
end
|
@@ -158,13 +158,13 @@ describe Arachni::HTTP::Request do
|
|
158
158
|
describe '#blocking?' do
|
159
159
|
context 'when the mode is :async' do
|
160
160
|
it 'returns false' do
|
161
|
-
described_class.new( url: @url, mode: :async ).
|
161
|
+
expect(described_class.new( url: @url, mode: :async )).not_to be_blocking
|
162
162
|
end
|
163
163
|
end
|
164
164
|
|
165
165
|
context 'when the mode is :sync' do
|
166
166
|
it 'returns true' do
|
167
|
-
described_class.new( url: @url, mode: :sync ).
|
167
|
+
expect(described_class.new( url: @url, mode: :sync )).to be_blocking
|
168
168
|
end
|
169
169
|
end
|
170
170
|
end
|
@@ -174,8 +174,8 @@ describe Arachni::HTTP::Request do
|
|
174
174
|
request = described_class.new( url: @url )
|
175
175
|
response = request.run
|
176
176
|
|
177
|
-
response.
|
178
|
-
response.request.
|
177
|
+
expect(response).to be_kind_of Arachni::HTTP::Response
|
178
|
+
expect(response.request).to eq(request)
|
179
179
|
end
|
180
180
|
|
181
181
|
it 'calls #on_complete callbacks' do
|
@@ -187,23 +187,24 @@ describe Arachni::HTTP::Request do
|
|
187
187
|
end
|
188
188
|
|
189
189
|
response = request.run
|
190
|
-
response.
|
191
|
-
response.request.
|
190
|
+
expect(response).to be_kind_of Arachni::HTTP::Response
|
191
|
+
expect(response.request).to eq(request)
|
192
192
|
|
193
|
-
called.
|
194
|
-
called.first.request.
|
193
|
+
expect(called).to eq([response])
|
194
|
+
expect(called.first.request).to eq(request)
|
195
195
|
end
|
196
196
|
|
197
197
|
it "fills in #{Arachni::HTTP::Request}#headers_string" do
|
198
198
|
host = "#{Arachni::URI(@url).host}:#{Arachni::URI(@url).port}"
|
199
|
-
described_class.new( url: @url ).run.request.headers_string.
|
199
|
+
expect(described_class.new( url: @url ).run.request.headers_string).to eq(
|
200
200
|
"GET / HTTP/1.1\r\nHost: #{host}\r\nAccept-Encoding: gzip, " +
|
201
201
|
"deflate\r\nUser-Agent: Arachni/v#{Arachni::VERSION}\r\nAccept: text/html," +
|
202
202
|
"application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n\r\n"
|
203
|
+
)
|
203
204
|
end
|
204
205
|
|
205
206
|
it "fills in #{Arachni::HTTP::Request}#effective_body" do
|
206
|
-
described_class.new(
|
207
|
+
expect(described_class.new(
|
207
208
|
url: @url,
|
208
209
|
body: {
|
209
210
|
'1' => ' 2',
|
@@ -211,13 +212,13 @@ describe Arachni::HTTP::Request do
|
|
211
212
|
},
|
212
213
|
mode: :sync,
|
213
214
|
method: :post
|
214
|
-
).run.request.effective_body.
|
215
|
+
).run.request.effective_body).to eq("1=%202&%203=4")
|
215
216
|
end
|
216
217
|
end
|
217
218
|
|
218
219
|
describe '#parameters' do
|
219
220
|
it 'defaults to an empty Hash' do
|
220
|
-
described_class.new( url: url ).parameters.
|
221
|
+
expect(described_class.new( url: url ).parameters).to eq({})
|
221
222
|
end
|
222
223
|
end
|
223
224
|
|
@@ -238,7 +239,7 @@ describe Arachni::HTTP::Request do
|
|
238
239
|
|
239
240
|
request = described_class.new( url: url )
|
240
241
|
request.parameters = with_symbols
|
241
|
-
request.parameters.
|
242
|
+
expect(request.parameters).to eq(with_strings)
|
242
243
|
end
|
243
244
|
end
|
244
245
|
|
@@ -253,7 +254,7 @@ describe Arachni::HTTP::Request do
|
|
253
254
|
response = Arachni::HTTP::Response.new( url: url )
|
254
255
|
request.handle_response( response )
|
255
256
|
|
256
|
-
passed_response.
|
257
|
+
expect(passed_response).to eq(response)
|
257
258
|
end
|
258
259
|
|
259
260
|
it 'can add multiple callbacks' do
|
@@ -268,9 +269,9 @@ describe Arachni::HTTP::Request do
|
|
268
269
|
response = Arachni::HTTP::Response.new( url: url )
|
269
270
|
request.handle_response( response )
|
270
271
|
|
271
|
-
passed_responses.size.
|
272
|
-
passed_responses.uniq.size.
|
273
|
-
passed_responses.uniq.first.
|
272
|
+
expect(passed_responses.size).to eq(2)
|
273
|
+
expect(passed_responses.uniq.size).to eq(1)
|
274
|
+
expect(passed_responses.uniq.first).to eq(response)
|
274
275
|
end
|
275
276
|
end
|
276
277
|
end
|
@@ -286,7 +287,7 @@ describe Arachni::HTTP::Request do
|
|
286
287
|
request.clear_callbacks
|
287
288
|
request.handle_response( response )
|
288
289
|
|
289
|
-
passed_response.
|
290
|
+
expect(passed_response).to be_nil
|
290
291
|
end
|
291
292
|
end
|
292
293
|
|
@@ -301,7 +302,7 @@ describe Arachni::HTTP::Request do
|
|
301
302
|
response = Arachni::HTTP::Response.new( url: url )
|
302
303
|
request.handle_response( response )
|
303
304
|
|
304
|
-
passed_response.request.
|
305
|
+
expect(passed_response.request).to eq(request)
|
305
306
|
end
|
306
307
|
|
307
308
|
it 'calls #on_complete callbacks' do
|
@@ -312,19 +313,19 @@ describe Arachni::HTTP::Request do
|
|
312
313
|
request.on_complete { |res| passed_response = res }
|
313
314
|
request.handle_response( response )
|
314
315
|
|
315
|
-
passed_response.
|
316
|
+
expect(passed_response).to eq(response)
|
316
317
|
end
|
317
318
|
end
|
318
319
|
|
319
320
|
describe '#parsed_url' do
|
320
321
|
it 'returns the configured URL as a parsed object' do
|
321
|
-
described_class.new( url: url ).parsed_url.
|
322
|
+
expect(described_class.new( url: url ).parsed_url).to eq(Arachni::URI( url ))
|
322
323
|
end
|
323
324
|
end
|
324
325
|
|
325
326
|
describe '#method' do
|
326
327
|
it 'defaults to :get' do
|
327
|
-
described_class.new( url: url ).method.
|
328
|
+
expect(described_class.new( url: url ).method).to eq(:get)
|
328
329
|
end
|
329
330
|
end
|
330
331
|
|
@@ -332,7 +333,7 @@ describe Arachni::HTTP::Request do
|
|
332
333
|
it 'normalizes the HTTP method to a downcase symbol' do
|
333
334
|
request = described_class.new( url: url )
|
334
335
|
request.method = 'pOsT'
|
335
|
-
request.method.
|
336
|
+
expect(request.method).to eq(:post)
|
336
337
|
end
|
337
338
|
end
|
338
339
|
|
@@ -340,7 +341,7 @@ describe Arachni::HTTP::Request do
|
|
340
341
|
it 'normalizes and sets the given mode' do
|
341
342
|
request = described_class.new( url: url )
|
342
343
|
request.mode = 'aSyNC'
|
343
|
-
request.mode.
|
344
|
+
expect(request.mode).to eq(:async)
|
344
345
|
end
|
345
346
|
|
346
347
|
context 'when an invalid mode is given' do
|
@@ -364,22 +365,22 @@ describe Arachni::HTTP::Request do
|
|
364
365
|
}
|
365
366
|
)
|
366
367
|
|
367
|
-
request.cookies.
|
368
|
+
expect(request.cookies).to eq({
|
368
369
|
'cookie2' => 'updated_value',
|
369
370
|
'cookie3' => 'value3'
|
370
|
-
}
|
371
|
-
request.effective_cookies.
|
371
|
+
})
|
372
|
+
expect(request.effective_cookies).to eq({
|
372
373
|
'my_cookie' => 'my_value',
|
373
374
|
'cookie2' => 'updated_value',
|
374
375
|
'cookie3' => 'value3'
|
375
|
-
}
|
376
|
+
})
|
376
377
|
end
|
377
378
|
end
|
378
379
|
|
379
380
|
describe '#id' do
|
380
381
|
it 'is incremented by the Arachni::HTTP::Client' do
|
381
382
|
10.times do |i|
|
382
|
-
@http.get( @url ).id.
|
383
|
+
expect(@http.get( @url ).id).to eq(i)
|
383
384
|
end
|
384
385
|
end
|
385
386
|
end
|
@@ -387,18 +388,18 @@ describe Arachni::HTTP::Request do
|
|
387
388
|
describe '#train' do
|
388
389
|
it 'sets train? to return true' do
|
389
390
|
req = described_class.new( url: url )
|
390
|
-
req.train
|
391
|
+
expect(req.train?).to be_falsey
|
391
392
|
req.train
|
392
|
-
req.train
|
393
|
+
expect(req.train?).to be_truthy
|
393
394
|
end
|
394
395
|
end
|
395
396
|
|
396
397
|
describe '#update_cookies' do
|
397
398
|
it 'sets update_cookies? to return true' do
|
398
399
|
req = described_class.new( url: url )
|
399
|
-
req.update_cookies
|
400
|
+
expect(req.update_cookies?).to be_falsey
|
400
401
|
req.update_cookies
|
401
|
-
req.update_cookies
|
402
|
+
expect(req.update_cookies?).to be_truthy
|
402
403
|
end
|
403
404
|
end
|
404
405
|
|
@@ -407,14 +408,14 @@ describe Arachni::HTTP::Request do
|
|
407
408
|
subject { request.to_typhoeus }
|
408
409
|
|
409
410
|
it "converts #{described_class} to #{Typhoeus::Request}" do
|
410
|
-
subject.
|
411
|
+
expect(subject).to be_kind_of Typhoeus::Request
|
411
412
|
end
|
412
413
|
|
413
414
|
context 'when the request is blocking' do
|
414
415
|
let(:request) { described_class.new( url: url, mode: :sync ) }
|
415
416
|
|
416
417
|
it 'forbids socket reuse' do
|
417
|
-
subject.options[:forbid_reuse].
|
418
|
+
expect(subject.options[:forbid_reuse]).to be_truthy
|
418
419
|
end
|
419
420
|
end
|
420
421
|
|
@@ -422,7 +423,7 @@ describe Arachni::HTTP::Request do
|
|
422
423
|
let(:request) { described_class.new( url: url, mode: :async ) }
|
423
424
|
|
424
425
|
it 'reuses sockets' do
|
425
|
-
subject.options[:forbid_reuse].
|
426
|
+
expect(subject.options[:forbid_reuse]).to be_falsey
|
426
427
|
end
|
427
428
|
end
|
428
429
|
|
@@ -438,7 +439,7 @@ describe Arachni::HTTP::Request do
|
|
438
439
|
end
|
439
440
|
|
440
441
|
it 'encodes and puts them in the Cookie header' do
|
441
|
-
subject.options[:headers]['Cookie'].
|
442
|
+
expect(subject.options[:headers]['Cookie']).to eq('na+me=stu+ff;na+me2=stu+ff2')
|
442
443
|
end
|
443
444
|
end
|
444
445
|
|
@@ -451,7 +452,7 @@ describe Arachni::HTTP::Request do
|
|
451
452
|
end
|
452
453
|
|
453
454
|
it 'forwards it' do
|
454
|
-
subject.options[:proxy].
|
455
|
+
expect(subject.options[:proxy]).to eq('http://stuff/')
|
455
456
|
end
|
456
457
|
|
457
458
|
context 'and #proxy_user_password' do
|
@@ -464,7 +465,7 @@ describe Arachni::HTTP::Request do
|
|
464
465
|
end
|
465
466
|
|
466
467
|
it 'forwards it' do
|
467
|
-
subject.options[:proxyuserpwd].
|
468
|
+
expect(subject.options[:proxyuserpwd]).to eq('name:secret')
|
468
469
|
end
|
469
470
|
end
|
470
471
|
|
@@ -478,7 +479,7 @@ describe Arachni::HTTP::Request do
|
|
478
479
|
end
|
479
480
|
|
480
481
|
it 'forwards it' do
|
481
|
-
subject.options[:proxytype].
|
482
|
+
expect(subject.options[:proxytype]).to eq(:http)
|
482
483
|
end
|
483
484
|
end
|
484
485
|
end
|
@@ -494,7 +495,7 @@ describe Arachni::HTTP::Request do
|
|
494
495
|
end
|
495
496
|
|
496
497
|
it 'forwards it' do
|
497
|
-
subject.options[:proxy].
|
498
|
+
expect(subject.options[:proxy]).to eq('stuff:8080')
|
498
499
|
end
|
499
500
|
|
500
501
|
context "and #{Arachni::OptionGroups::HTTP}#proxy_username/#{Arachni::OptionGroups::HTTP}#proxy_password" do
|
@@ -502,14 +503,14 @@ describe Arachni::HTTP::Request do
|
|
502
503
|
Arachni::Options.http.proxy_username = 'name'
|
503
504
|
Arachni::Options.http.proxy_password = 'secret'
|
504
505
|
|
505
|
-
subject.options[:proxyuserpwd].
|
506
|
+
expect(subject.options[:proxyuserpwd]).to eq('name:secret')
|
506
507
|
end
|
507
508
|
end
|
508
509
|
|
509
510
|
context "and #{Arachni::OptionGroups::HTTP}#proxy_type" do
|
510
511
|
it 'forwards it' do
|
511
512
|
Arachni::Options.http.proxy_type = 'http'
|
512
|
-
subject.options[:proxytype].
|
513
|
+
expect(subject.options[:proxytype]).to eq(:http)
|
513
514
|
end
|
514
515
|
end
|
515
516
|
end
|
@@ -524,11 +525,11 @@ describe Arachni::HTTP::Request do
|
|
524
525
|
end
|
525
526
|
|
526
527
|
it 'forwards it' do
|
527
|
-
subject.options[:userpwd].
|
528
|
+
expect(subject.options[:userpwd]).to eq('name:secret')
|
528
529
|
end
|
529
530
|
|
530
531
|
it 'sets authentication type to :auto' do
|
531
|
-
subject.options[:httpauth].
|
532
|
+
expect(subject.options[:httpauth]).to eq(:auto)
|
532
533
|
end
|
533
534
|
end
|
534
535
|
|
@@ -543,11 +544,11 @@ describe Arachni::HTTP::Request do
|
|
543
544
|
end
|
544
545
|
|
545
546
|
it 'forwards it' do
|
546
|
-
subject.options[:userpwd].
|
547
|
+
expect(subject.options[:userpwd]).to eq('name:secret')
|
547
548
|
end
|
548
549
|
|
549
550
|
it 'sets authentication type to :auto' do
|
550
|
-
subject.options[:httpauth].
|
551
|
+
expect(subject.options[:httpauth]).to eq(:auto)
|
551
552
|
end
|
552
553
|
end
|
553
554
|
|
@@ -559,7 +560,7 @@ describe Arachni::HTTP::Request do
|
|
559
560
|
context 'when #response_max_size' do
|
560
561
|
context 'has not been set' do
|
561
562
|
it 'sets it as maxfilesize' do
|
562
|
-
subject.options[:maxfilesize].
|
563
|
+
expect(subject.options[:maxfilesize]).to eq(10)
|
563
564
|
end
|
564
565
|
end
|
565
566
|
|
@@ -572,7 +573,7 @@ describe Arachni::HTTP::Request do
|
|
572
573
|
end
|
573
574
|
|
574
575
|
it 'overrides it' do
|
575
|
-
subject.options[:maxfilesize].
|
576
|
+
expect(subject.options[:maxfilesize]).to eq(1)
|
576
577
|
end
|
577
578
|
|
578
579
|
context 'ands is < 0' do
|
@@ -584,7 +585,7 @@ describe Arachni::HTTP::Request do
|
|
584
585
|
end
|
585
586
|
|
586
587
|
it 'removes it' do
|
587
|
-
subject.options[:maxfilesize].
|
588
|
+
expect(subject.options[:maxfilesize]).to be_nil
|
588
589
|
end
|
589
590
|
end
|
590
591
|
end
|
@@ -595,14 +596,14 @@ describe Arachni::HTTP::Request do
|
|
595
596
|
context 'true' do
|
596
597
|
it "sets #{Typhoeus::Request}#options[:ssl_verifypeer]" do
|
597
598
|
Arachni::Options.http.ssl_verify_peer = true
|
598
|
-
subject.options[:ssl_verifypeer].
|
599
|
+
expect(subject.options[:ssl_verifypeer]).to eq(true)
|
599
600
|
end
|
600
601
|
end
|
601
602
|
|
602
603
|
context 'false' do
|
603
604
|
it "sets #{Typhoeus::Request}#options[:ssl_verifypeer]" do
|
604
605
|
Arachni::Options.http.ssl_verify_peer = false
|
605
|
-
subject.options[:ssl_verifypeer].
|
606
|
+
expect(subject.options[:ssl_verifypeer]).to eq(false)
|
606
607
|
end
|
607
608
|
end
|
608
609
|
end
|
@@ -610,84 +611,84 @@ describe Arachni::HTTP::Request do
|
|
610
611
|
context "#{Arachni::OptionGroups::HTTP}#ssl_verify_host" do
|
611
612
|
context 'true' do
|
612
613
|
it "sets #{Typhoeus::Request}#options[:ssl_verifyhost] to 2" do
|
613
|
-
Arachni::Options.http.
|
614
|
-
subject.options[:ssl_verifyhost].
|
614
|
+
allow(Arachni::Options.http).to receive(:ssl_verify_host){ true }
|
615
|
+
expect(subject.options[:ssl_verifyhost]).to eq(2)
|
615
616
|
end
|
616
617
|
end
|
617
618
|
|
618
619
|
context 'false' do
|
619
620
|
it "sets #{Typhoeus::Request}#options[:ssl_verifyhost] to 2" do
|
620
|
-
Arachni::Options.http.
|
621
|
-
subject.options[:ssl_verifyhost].
|
621
|
+
allow(Arachni::Options.http).to receive(:ssl_verify_host){ false }
|
622
|
+
expect(subject.options[:ssl_verifyhost]).to eq(0)
|
622
623
|
end
|
623
624
|
end
|
624
625
|
end
|
625
626
|
|
626
627
|
context "#{Arachni::OptionGroups::HTTP}#ssl_certificate_filepath" do
|
627
628
|
it "sets #{Typhoeus::Request}#options[:sslcert]" do
|
628
|
-
Arachni::Options.http.
|
629
|
-
subject.options[:sslcert].
|
629
|
+
allow(Arachni::Options.http).to receive(:ssl_certificate_filepath){ :stuff }
|
630
|
+
expect(subject.options[:sslcert]).to eq(:stuff)
|
630
631
|
end
|
631
632
|
end
|
632
633
|
|
633
634
|
context "#{Arachni::OptionGroups::HTTP}#ssl_certificate_type" do
|
634
635
|
it "sets #{Typhoeus::Request}#options[:sslcerttype]" do
|
635
|
-
Arachni::Options.http.
|
636
|
-
subject.options[:sslcerttype].
|
636
|
+
allow(Arachni::Options.http).to receive(:ssl_certificate_type){ :stuff }
|
637
|
+
expect(subject.options[:sslcerttype]).to eq(:stuff)
|
637
638
|
end
|
638
639
|
end
|
639
640
|
|
640
641
|
context "#{Arachni::OptionGroups::HTTP}#ssl_key_filepath" do
|
641
642
|
it "sets #{Typhoeus::Request}#options[:sslkey]" do
|
642
|
-
Arachni::Options.http.
|
643
|
-
subject.options[:sslkey].
|
643
|
+
allow(Arachni::Options.http).to receive(:ssl_key_filepath){ :stuff }
|
644
|
+
expect(subject.options[:sslkey]).to eq(:stuff)
|
644
645
|
end
|
645
646
|
end
|
646
647
|
|
647
648
|
context "#{Arachni::OptionGroups::HTTP}#ssl_key_type" do
|
648
649
|
it "sets #{Typhoeus::Request}#options[:sslkeytype]" do
|
649
|
-
Arachni::Options.http.
|
650
|
-
subject.options[:sslkeytype].
|
650
|
+
allow(Arachni::Options.http).to receive(:ssl_key_type){ :stuff }
|
651
|
+
expect(subject.options[:sslkeytype]).to eq(:stuff)
|
651
652
|
end
|
652
653
|
end
|
653
654
|
|
654
655
|
context "#{Arachni::OptionGroups::HTTP}#ssl_key_password" do
|
655
656
|
it "sets #{Typhoeus::Request}#options[:sslkeypasswd]" do
|
656
|
-
Arachni::Options.http.
|
657
|
-
subject.options[:sslkeypasswd].
|
657
|
+
allow(Arachni::Options.http).to receive(:ssl_key_password){ :stuff }
|
658
|
+
expect(subject.options[:sslkeypasswd]).to eq(:stuff)
|
658
659
|
end
|
659
660
|
end
|
660
661
|
|
661
662
|
context "#{Arachni::OptionGroups::HTTP}#ssl_ca_filepath" do
|
662
663
|
it "sets #{Typhoeus::Request}#options[:cainfo]" do
|
663
|
-
Arachni::Options.http.
|
664
|
-
subject.options[:cainfo].
|
664
|
+
allow(Arachni::Options.http).to receive(:ssl_ca_filepath){ :stuff }
|
665
|
+
expect(subject.options[:cainfo]).to eq(:stuff)
|
665
666
|
end
|
666
667
|
end
|
667
668
|
|
668
669
|
context "#{Arachni::OptionGroups::HTTP}#ssl_ca_directory" do
|
669
670
|
it "sets #{Typhoeus::Request}#options[:capath]" do
|
670
|
-
Arachni::Options.http.
|
671
|
-
subject.options[:capath].
|
671
|
+
allow(Arachni::Options.http).to receive(:ssl_ca_directory){ :stuff }
|
672
|
+
expect(subject.options[:capath]).to eq(:stuff)
|
672
673
|
end
|
673
674
|
end
|
674
675
|
|
675
676
|
context "#{Arachni::OptionGroups::HTTP}#ssl_version" do
|
676
677
|
it "sets #{Typhoeus::Request}#options[:sslversion]" do
|
677
|
-
Arachni::Options.http.
|
678
|
-
subject.options[:sslversion].
|
678
|
+
allow(Arachni::Options.http).to receive(:ssl_version){ :stuff }
|
679
|
+
expect(subject.options[:sslversion]).to eq(:stuff)
|
679
680
|
end
|
680
681
|
end
|
681
682
|
end
|
682
683
|
|
683
684
|
describe '#to_h' do
|
684
685
|
it 'returns a hash representation of self' do
|
685
|
-
described_class.new( options ).to_h.
|
686
|
+
expect(described_class.new( options ).to_h).to eq(options.tap do |h|
|
686
687
|
h.delete :timeout
|
687
688
|
h.delete :cookies
|
688
689
|
h.delete :username
|
689
690
|
h.delete :password
|
690
|
-
end
|
691
|
+
end)
|
691
692
|
end
|
692
693
|
end
|
693
694
|
|
@@ -697,32 +698,32 @@ describe Arachni::HTTP::Request do
|
|
697
698
|
context 'and there are #parameters' do
|
698
699
|
it 'returns #parameters' do
|
699
700
|
parameters = { 'stuff' => 'here' }
|
700
|
-
described_class.new(
|
701
|
+
expect(described_class.new(
|
701
702
|
url: url,
|
702
703
|
parameters: parameters,
|
703
704
|
method: :post
|
704
|
-
).body_parameters.
|
705
|
+
).body_parameters).to eq(parameters)
|
705
706
|
end
|
706
707
|
end
|
707
708
|
|
708
709
|
context 'and there are no #parameters' do
|
709
710
|
it 'parses the #body' do
|
710
711
|
body = 'stuff=here&and_here=too'
|
711
|
-
described_class.new(
|
712
|
+
expect(described_class.new(
|
712
713
|
url: url,
|
713
714
|
body: body,
|
714
715
|
method: :post
|
715
|
-
).body_parameters.
|
716
|
+
).body_parameters).to eq({
|
716
717
|
'stuff' => 'here',
|
717
718
|
'and_here' => 'too'
|
718
|
-
}
|
719
|
+
})
|
719
720
|
end
|
720
721
|
end
|
721
722
|
end
|
722
723
|
|
723
724
|
context 'other' do
|
724
725
|
it 'returns an empty Hash' do
|
725
|
-
described_class.new( url: url ).body_parameters.
|
726
|
+
expect(described_class.new( url: url ).body_parameters).to eq({})
|
726
727
|
end
|
727
728
|
end
|
728
729
|
end
|
@@ -730,7 +731,7 @@ describe Arachni::HTTP::Request do
|
|
730
731
|
|
731
732
|
describe '.parse_body' do
|
732
733
|
it 'parses the request body into a Hash' do
|
733
|
-
described_class.parse_body( 'value%5C+%2B%3D%26%3B=value%5C+%2B%3D%26%3B&testID=53738&deliveryID=53618&testIDs=&deliveryIDs=&selectedRows=2&event=§ion=&event%3Dmanage%26amp%3Bsection%3Dexam=Manage+selected+exam' ).
|
734
|
+
expect(described_class.parse_body( 'value%5C+%2B%3D%26%3B=value%5C+%2B%3D%26%3B&testID=53738&deliveryID=53618&testIDs=&deliveryIDs=&selectedRows=2&event=§ion=&event%3Dmanage%26amp%3Bsection%3Dexam=Manage+selected+exam' )).to eq(
|
734
735
|
{
|
735
736
|
"value\\ +=&;" => "value\\ +=&;",
|
736
737
|
"testID" => "53738",
|
@@ -742,11 +743,12 @@ describe Arachni::HTTP::Request do
|
|
742
743
|
"section" => "",
|
743
744
|
"event=manage&section=exam" => "Manage selected exam"
|
744
745
|
}
|
746
|
+
)
|
745
747
|
end
|
746
748
|
|
747
749
|
context 'when the body is nil' do
|
748
750
|
it 'returns an empty Hash' do
|
749
|
-
described_class.parse_body(nil).
|
751
|
+
expect(described_class.parse_body(nil)).to eq({})
|
750
752
|
end
|
751
753
|
end
|
752
754
|
end
|