arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -12,22 +12,22 @@ describe Arachni::HTTP::Response::Scope do
12
12
 
13
13
  describe '#out?' do
14
14
  it 'returns false' do
15
- subject.out?.should be_false
15
+ expect(subject.out?).to be_falsey
16
16
  end
17
17
 
18
18
  context "when #{Arachni::URI::Scope}#out?" do
19
19
  context true do
20
20
  it 'returns true' do
21
21
  # We can't stub #out? because we also override it.
22
- Arachni::URI::Scope.any_instance.stub(:exclude?) { true }
23
- subject.out?.should be_true
22
+ allow_any_instance_of(Arachni::URI::Scope).to receive(:exclude?) { true }
23
+ expect(subject.out?).to be_truthy
24
24
  end
25
25
  end
26
26
 
27
27
  context false do
28
28
  it 'returns false' do
29
- Arachni::URI::Scope.any_instance.stub(:exclude?) { false }
30
- subject.out?.should be_false
29
+ allow_any_instance_of(Arachni::URI::Scope).to receive(:exclude?) { false }
30
+ expect(subject.out?).to be_falsey
31
31
  end
32
32
  end
33
33
  end
@@ -35,15 +35,15 @@ describe Arachni::HTTP::Response::Scope do
35
35
  context 'when #exclude_as_binary?' do
36
36
  context true do
37
37
  it 'returns true' do
38
- subject.stub(:exclude_as_binary?) { true }
39
- subject.out?.should be_true
38
+ allow(subject).to receive(:exclude_as_binary?) { true }
39
+ expect(subject.out?).to be_truthy
40
40
  end
41
41
  end
42
42
 
43
43
  context false do
44
44
  it 'returns false' do
45
- subject.stub(:exclude_as_binary?) { false }
46
- subject.out?.should be_false
45
+ allow(subject).to receive(:exclude_as_binary?) { false }
46
+ expect(subject.out?).to be_falsey
47
47
  end
48
48
  end
49
49
  end
@@ -51,15 +51,15 @@ describe Arachni::HTTP::Response::Scope do
51
51
  context 'when #exclude_content?' do
52
52
  context true do
53
53
  it 'returns true' do
54
- subject.stub(:exclude_content?) { true }
55
- subject.out?.should be_true
54
+ allow(subject).to receive(:exclude_content?) { true }
55
+ expect(subject.out?).to be_truthy
56
56
  end
57
57
  end
58
58
 
59
59
  context false do
60
60
  it 'returns false' do
61
- subject.stub(:exclude_content?) { false }
62
- subject.out?.should be_false
61
+ allow(subject).to receive(:exclude_content?) { false }
62
+ expect(subject.out?).to be_falsey
63
63
  end
64
64
  end
65
65
  end
@@ -72,18 +72,18 @@ describe Arachni::HTTP::Response::Scope do
72
72
  context true do
73
73
  it 'returns false' do
74
74
  scope.exclude_binaries = true
75
- response.stub(:text?) { true }
75
+ allow(response).to receive(:text?) { true }
76
76
 
77
- subject.exclude_as_binary?.should be_false
77
+ expect(subject.exclude_as_binary?).to be_falsey
78
78
  end
79
79
  end
80
80
 
81
81
  context false do
82
82
  it 'returns false' do
83
83
  scope.exclude_binaries = false
84
- response.stub(:text?) { true }
84
+ allow(response).to receive(:text?) { true }
85
85
 
86
- subject.exclude_as_binary?.should be_false
86
+ expect(subject.exclude_as_binary?).to be_falsey
87
87
  end
88
88
  end
89
89
  end
@@ -94,18 +94,18 @@ describe Arachni::HTTP::Response::Scope do
94
94
  context true do
95
95
  it 'returns true' do
96
96
  scope.exclude_binaries = true
97
- response.stub(:text?) { false }
97
+ allow(response).to receive(:text?) { false }
98
98
 
99
- subject.exclude_as_binary?.should be_true
99
+ expect(subject.exclude_as_binary?).to be_truthy
100
100
  end
101
101
  end
102
102
 
103
103
  context false do
104
104
  it 'returns false' do
105
105
  scope.exclude_binaries = false
106
- response.stub(:text?) { false }
106
+ allow(response).to receive(:text?) { false }
107
107
 
108
- subject.exclude_as_binary?.should be_false
108
+ expect(subject.exclude_as_binary?).to be_falsey
109
109
  end
110
110
  end
111
111
  end
@@ -118,16 +118,16 @@ describe Arachni::HTTP::Response::Scope do
118
118
  context 'match the #body' do
119
119
  it 'returns true' do
120
120
  scope.exclude_content_patterns = /<a/
121
- subject.exclude_content?.should be_true
121
+ expect(subject.exclude_content?).to be_truthy
122
122
  end
123
123
  end
124
124
 
125
125
  context 'do not match the #body' do
126
126
  it 'returns false' do
127
- subject.exclude_content?.should be_false
127
+ expect(subject.exclude_content?).to be_falsey
128
128
 
129
129
  scope.exclude_content_patterns = /<blah/
130
- subject.exclude_content?.should be_false
130
+ expect(subject.exclude_content?).to be_falsey
131
131
  end
132
132
  end
133
133
  end
@@ -13,7 +13,7 @@ describe Arachni::HTTP::Response do
13
13
  subject { @subject }
14
14
 
15
15
  it "supports #{Arachni::RPC::Serializer}" do
16
- subject.should == Arachni::RPC::Serializer.deep_clone( subject )
16
+ expect(subject).to eq(Arachni::RPC::Serializer.deep_clone( subject ))
17
17
  end
18
18
 
19
19
  describe '#to_rpc_data' do
@@ -22,16 +22,16 @@ describe Arachni::HTTP::Response do
22
22
  %w(url code ip_address headers body time app_time total_time return_code
23
23
  return_message).each do |attribute|
24
24
  it "includes '#{attribute}'" do
25
- data[attribute].should == subject.send( attribute )
25
+ expect(data[attribute]).to eq(subject.send( attribute ))
26
26
  end
27
27
  end
28
28
 
29
29
  it "includes 'request'" do
30
- data['request'].should == subject.request.to_rpc_data
30
+ expect(data['request']).to eq(subject.request.to_rpc_data)
31
31
  end
32
32
 
33
33
  it "does not include 'scope" do
34
- data.should_not include 'scope'
34
+ expect(data).not_to include 'scope'
35
35
  end
36
36
  end
37
37
 
@@ -42,14 +42,14 @@ describe Arachni::HTTP::Response do
42
42
  %w(url code ip_address headers body time app_time total_time return_code
43
43
  return_message request).each do |attribute|
44
44
  it "restores '#{attribute}'" do
45
- restored.send( attribute ).should == subject.send( attribute )
45
+ expect(restored.send( attribute )).to eq(subject.send( attribute ))
46
46
  end
47
47
  end
48
48
  end
49
49
 
50
50
  describe '#status_line' do
51
51
  it 'returns the first line of the response' do
52
- @http.get( @url, mode: :sync ).status_line.should == 'HTTP/1.1 200 OK'
52
+ expect(@http.get( @url, mode: :sync ).status_line).to eq('HTTP/1.1 200 OK')
53
53
  end
54
54
  end
55
55
 
@@ -57,13 +57,13 @@ describe Arachni::HTTP::Response do
57
57
  context 'when the #code is' do
58
58
  describe 200 do
59
59
  it 'returns false' do
60
- described_class.new( url: @url, code: 200 ).should be_modified
60
+ expect(described_class.new( url: @url, code: 200 )).to be_modified
61
61
  end
62
62
  end
63
63
 
64
64
  describe 304 do
65
65
  it 'returns true' do
66
- described_class.new( url: @url, code: 304 ).should_not be_modified
66
+ expect(described_class.new( url: @url, code: 304 )).not_to be_modified
67
67
  end
68
68
  end
69
69
  end
@@ -73,44 +73,44 @@ describe Arachni::HTTP::Response do
73
73
  context 'when the response is a redirection' do
74
74
  it 'returns true' do
75
75
  300.upto( 399 ) do |c|
76
- described_class.new(
76
+ expect(described_class.new(
77
77
  url: 'http://test.com',
78
78
  code: c,
79
79
  headers: {
80
80
  location: '/test'
81
- }).redirection?.should be_true
81
+ }).redirection?).to be_truthy
82
82
  end
83
83
  end
84
84
  end
85
85
 
86
86
  context 'when the response is not a redirection' do
87
87
  it 'returns false' do
88
- described_class.new( url: 'http://test.com', code: 200 ).redirection?.should be_false
88
+ expect(described_class.new( url: 'http://test.com', code: 200 ).redirection?).to be_falsey
89
89
  end
90
90
  end
91
91
  end
92
92
 
93
93
  describe '#to_s' do
94
94
  it 'returns the HTTP response as a string' do
95
- subject.to_s.should == "#{subject.headers_string}#{subject.body}"
95
+ expect(subject.to_s).to eq("#{subject.headers_string}#{subject.body}")
96
96
  end
97
97
  end
98
98
 
99
99
  describe '#platforms' do
100
100
  it 'returns the platform manager for the resource' do
101
- Factory[:response].platforms.should be_kind_of Arachni::Platform::Manager
101
+ expect(Factory[:response].platforms).to be_kind_of Arachni::Platform::Manager
102
102
  end
103
103
  end
104
104
 
105
105
  describe '#app_time' do
106
106
  it 'returns the approximated webap pprocessing time' do
107
107
  response = @http.get( @url, mode: :sync )
108
- response.app_time.should > 0
109
- response.app_time.should < 0.01
108
+ expect(response.app_time).to be > 0
109
+ expect(response.app_time).to be < 0.01
110
110
 
111
111
  response = @http.get( "#{@url}/sleep", mode: :sync )
112
- response.app_time.should > 5
113
- response.app_time.should < 5.01
112
+ expect(response.app_time).to be > 5
113
+ expect(response.app_time).to be < 5.01
114
114
  end
115
115
  end
116
116
 
@@ -123,7 +123,7 @@ describe Arachni::HTTP::Response do
123
123
  headers: { 'Content-Type' => 'text/stuff' },
124
124
  body: 'stuff'
125
125
  }
126
- described_class.new( h ).text?.should be_true
126
+ expect(described_class.new( h ).text?).to be_truthy
127
127
  end
128
128
  end
129
129
 
@@ -136,7 +136,7 @@ describe Arachni::HTTP::Response do
136
136
  headers: { 'Content-Type' => 'application/stuff' },
137
137
  body: "\00\00\00"
138
138
  }
139
- described_class.new( h ).text?.should be_false
139
+ expect(described_class.new( h ).text?).to be_falsey
140
140
  end
141
141
  end
142
142
 
@@ -147,7 +147,7 @@ describe Arachni::HTTP::Response do
147
147
  headers: { 'Content-Type' => 'application/stuff' },
148
148
  body: 'stuff'
149
149
  }
150
- described_class.new( h ).text?.should be_true
150
+ expect(described_class.new( h ).text?).to be_truthy
151
151
  end
152
152
  end
153
153
  end
@@ -160,7 +160,7 @@ describe Arachni::HTTP::Response do
160
160
  headers: { 'Content-Type' => 'blah/stuff' },
161
161
  body: 'stuff'
162
162
  }
163
- described_class.new( h ).text?.should be_false
163
+ expect(described_class.new( h ).text?).to be_falsey
164
164
  end
165
165
  end
166
166
 
@@ -172,7 +172,7 @@ describe Arachni::HTTP::Response do
172
172
  url: 'http://test.com',
173
173
  body: "\00\00\00"
174
174
  }
175
- described_class.new( h ).text?.should == false
175
+ expect(described_class.new( h ).text?).to eq(false)
176
176
  end
177
177
  end
178
178
 
@@ -182,7 +182,7 @@ describe Arachni::HTTP::Response do
182
182
  url: 'http://test.com',
183
183
  body: 'stuff'
184
184
  }
185
- described_class.new( h ).text?.should be_true
185
+ expect(described_class.new( h ).text?).to be_truthy
186
186
  end
187
187
  end
188
188
 
@@ -192,7 +192,7 @@ describe Arachni::HTTP::Response do
192
192
  url: 'http://test.com',
193
193
  body: "abc\u3042\x81"
194
194
  )
195
- r.text?.should be_nil
195
+ expect(r.text?).to be_nil
196
196
  end
197
197
  end
198
198
  end
@@ -229,18 +229,18 @@ describe Arachni::HTTP::Response do
229
229
  parser = Arachni::Parser.new( response )
230
230
  page = parser.page
231
231
 
232
- page.url.should == parser.url
233
- page.method.should == parser.response.request.method
234
- page.response.should == parser.response
235
- page.body.should == parser.response.body
236
- page.query_vars.should == parser.link_vars
237
- page.paths.should == parser.paths
238
- page.links.should == parser.links
239
- page.forms.should == parser.forms
240
- page.cookies.should == parser.cookies_to_be_audited
241
- page.headers.should == parser.headers
242
- page.cookie_jar.should == parser.cookie_jar
243
- page.text?.should == parser.text?
232
+ expect(page.url).to eq(parser.url)
233
+ expect(page.method).to eq(parser.response.request.method)
234
+ expect(page.response).to eq(parser.response)
235
+ expect(page.body).to eq(parser.response.body)
236
+ expect(page.query_vars).to eq(parser.link_vars)
237
+ expect(page.paths).to eq(parser.paths)
238
+ expect(page.links).to eq(parser.links)
239
+ expect(page.forms).to eq(parser.forms)
240
+ expect(page.cookies).to eq(parser.cookies_to_be_audited)
241
+ expect(page.headers).to eq(parser.headers)
242
+ expect(page.cookie_jar).to eq(parser.cookie_jar)
243
+ expect(page.text?).to eq(parser.text?)
244
244
  end
245
245
  end
246
246
 
@@ -248,19 +248,19 @@ describe Arachni::HTTP::Response do
248
248
  it 'sets the #time' do
249
249
  r = described_class.new( url: url )
250
250
  r.time = 1.2
251
- r.time.should == 1.2
251
+ expect(r.time).to eq(1.2)
252
252
  end
253
253
 
254
254
  it 'casts to Float' do
255
255
  r = described_class.new( url: url )
256
256
  r.time = '1.2'
257
- r.time.should == 1.2
257
+ expect(r.time).to eq(1.2)
258
258
  end
259
259
  end
260
260
 
261
261
  describe '#time' do
262
262
  it 'defaults to 0.0' do
263
- described_class.new( url: url ).time.should == 0.0
263
+ expect(described_class.new( url: url ).time).to eq(0.0)
264
264
  end
265
265
  end
266
266
 
@@ -269,19 +269,19 @@ describe Arachni::HTTP::Response do
269
269
  body = 'Stuff...'
270
270
  r = described_class.new( url: url )
271
271
  r.body = body
272
- r.body.should == body
272
+ expect(r.body).to eq(body)
273
273
  end
274
274
 
275
275
  it 'freezes it' do
276
276
  r = described_class.new( url: url )
277
277
  r.body = 'Stuff...'
278
- r.body.should be_frozen
278
+ expect(r.body).to be_frozen
279
279
  end
280
280
 
281
281
  it 'forces it to a string' do
282
282
  r = described_class.new( url: url )
283
283
  r.body = nil
284
- r.body.should == ''
284
+ expect(r.body).to eq('')
285
285
  end
286
286
 
287
287
  context 'when content-length is' do
@@ -295,7 +295,7 @@ describe Arachni::HTTP::Response do
295
295
  body: 'stuff'
296
296
  )
297
297
  r.body = body
298
- r.body.should == "abcあ�"
298
+ expect(r.body).to eq("abcあ�")
299
299
  end
300
300
  end
301
301
 
@@ -307,7 +307,7 @@ describe Arachni::HTTP::Response do
307
307
  body: 'stuff'
308
308
  )
309
309
  r.body = body
310
- r.body.should == body
310
+ expect(r.body).to eq(body)
311
311
  end
312
312
  end
313
313
 
@@ -315,7 +315,7 @@ describe Arachni::HTTP::Response do
315
315
  it 'removes invalid characters' do
316
316
  r = described_class.new( url: 'http://test.com' )
317
317
  r.body = body
318
- r.body.should == "abcあ�"
318
+ expect(r.body).to eq("abcあ�")
319
319
  end
320
320
  end
321
321
  end
@@ -329,21 +329,22 @@ describe Arachni::HTTP::Response do
329
329
  headers: { 'Content-Type' => 'application/stuff' },
330
330
  body: 'stuff'
331
331
  }
332
- described_class.new( h.dup ).should == described_class.new( h.dup )
332
+ expect(described_class.new( h.dup )).to eq(described_class.new( h.dup ))
333
333
  end
334
334
  end
335
335
  context 'when responses are not identical' do
336
336
  it 'returns false' do
337
- described_class.new(
337
+ expect(described_class.new(
338
338
  url: 'http://test.com',
339
339
  headers: { 'Content-Type' => 'application/stuff' },
340
340
  body: 'stuff'
341
- ).should_not ==
341
+ )).not_to eq(
342
342
  described_class.new(
343
343
  url: 'http://test.com',
344
344
  headers: { 'Content-Type' => 'application/stuff1' },
345
345
  body: 'stuff'
346
346
  )
347
+ )
347
348
  end
348
349
  end
349
350
  end
@@ -363,7 +364,7 @@ describe Arachni::HTTP::Response do
363
364
  return_message: 'No error'
364
365
  }
365
366
 
366
- described_class.new( h ).to_h.should == h
367
+ expect(described_class.new( h ).to_h).to eq(h)
367
368
  end
368
369
  end
369
370
 
@@ -3,27 +3,27 @@ require 'spec_helper'
3
3
  describe Arachni::Issue::Severity do
4
4
  describe 'Arachni::Issue::Severity::HIGH' do
5
5
  it 'returns "high"' do
6
- Arachni::Issue::Severity::HIGH.to_s.should == 'high'
6
+ expect(Arachni::Issue::Severity::HIGH.to_s).to eq('high')
7
7
  end
8
8
  end
9
9
  describe 'Arachni::Issue::Severity::MEDIUM' do
10
10
  it 'returns "medium"' do
11
- Arachni::Issue::Severity::MEDIUM.to_s.should == 'medium'
11
+ expect(Arachni::Issue::Severity::MEDIUM.to_s).to eq('medium')
12
12
  end
13
13
  end
14
14
  describe 'Arachni::Issue::Severity::LOW' do
15
15
  it 'returns "low"' do
16
- Arachni::Issue::Severity::LOW.to_s.should == 'low'
16
+ expect(Arachni::Issue::Severity::LOW.to_s).to eq('low')
17
17
  end
18
18
  end
19
19
  describe 'Arachni::Issue::Severity::INFORMATIONAL' do
20
20
  it 'returns "informational"' do
21
- Arachni::Issue::Severity::INFORMATIONAL.to_s.should == 'informational'
21
+ expect(Arachni::Issue::Severity::INFORMATIONAL.to_s).to eq('informational')
22
22
  end
23
23
  end
24
24
 
25
25
  it 'is assigned to Arachni::Severity for easy access' do
26
- Arachni::Severity.should == Arachni::Issue::Severity
26
+ expect(Arachni::Severity).to eq(Arachni::Issue::Severity)
27
27
  end
28
28
 
29
29
  it 'is comparable' do
@@ -32,12 +32,13 @@ describe Arachni::Issue::Severity do
32
32
  medium = Arachni::Issue::Severity::MEDIUM
33
33
  high = Arachni::Issue::Severity::HIGH
34
34
 
35
- informational.should be < low
36
- low.should be < medium
37
- medium.should be < high
35
+ expect(informational).to be < low
36
+ expect(low).to be < medium
37
+ expect(medium).to be < high
38
38
 
39
- [low, informational, high, medium].sort.should ==
39
+ expect([low, informational, high, medium].sort).to eq(
40
40
  [informational, low, medium, high]
41
+ )
41
42
  end
42
43
 
43
44
  end