arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -6,8 +6,8 @@ describe Arachni::OptionGroups::Audit do
6
6
 
7
7
  %w(with_both_http_methods exclude_vector_patterns include_vector_patterns
8
8
  links forms cookies cookies_extensively headers link_templates).each do |method|
9
- it { should respond_to method }
10
- it { should respond_to "#{method}=" }
9
+ it { is_expected.to respond_to method }
10
+ it { is_expected.to respond_to "#{method}=" }
11
11
  end
12
12
 
13
13
  describe '#link_templates=' do
@@ -15,27 +15,27 @@ describe Arachni::OptionGroups::Audit do
15
15
  templates = %w(/param\/(?<param>\w+)/ /param2\/(?<param2>\w+)/)
16
16
 
17
17
  subject.link_templates = templates.first
18
- subject.link_templates.should == [Regexp.new( templates.first )]
18
+ expect(subject.link_templates).to eq([Regexp.new( templates.first )])
19
19
 
20
20
  subject.link_templates = templates
21
- subject.link_templates.should == templates.map { |p| Regexp.new( p ) }
21
+ expect(subject.link_templates).to eq(templates.map { |p| Regexp.new( p ) })
22
22
  end
23
23
 
24
24
  context 'when given nil' do
25
25
  it 'empties the templates' do
26
26
  subject.link_templates = /param\/(?<param>\w+)/
27
- subject.link_templates.should be_any
27
+ expect(subject.link_templates).to be_any
28
28
  subject.link_templates = nil
29
- subject.link_templates.should be_empty
29
+ expect(subject.link_templates).to be_empty
30
30
  end
31
31
  end
32
32
 
33
33
  context 'when given false' do
34
34
  it 'empties the templates' do
35
35
  subject.link_templates = /param\/(?<param>\w+)/
36
- subject.link_templates.should be_any
36
+ expect(subject.link_templates).to be_any
37
37
  subject.link_templates = false
38
- subject.link_templates.should be_empty
38
+ expect(subject.link_templates).to be_empty
39
39
  end
40
40
  end
41
41
 
@@ -51,13 +51,13 @@ describe Arachni::OptionGroups::Audit do
51
51
  context 'when templates are available' do
52
52
  it 'returns true' do
53
53
  subject.link_templates << /param\/(?<param>\w+)/
54
- subject.link_templates?.should == true
54
+ expect(subject.link_templates?).to eq(true)
55
55
  end
56
56
  end
57
57
 
58
58
  context 'when templates not available' do
59
59
  it 'returns false' do
60
- subject.link_templates?.should == false
60
+ expect(subject.link_templates?).to eq(false)
61
61
  end
62
62
  end
63
63
  end
@@ -69,21 +69,21 @@ describe Arachni::OptionGroups::Audit do
69
69
  context true do
70
70
  it 'returns true' do
71
71
  subject.send "#{attribute}=", true
72
- subject.send("#{attribute}?").should == true
72
+ expect(subject.send("#{attribute}?")).to eq(true)
73
73
  end
74
74
  end
75
75
 
76
76
  context false do
77
77
  it 'returns false' do
78
78
  subject.send "#{attribute}=", false
79
- subject.send("#{attribute}?").should == false
79
+ expect(subject.send("#{attribute}?")).to eq(false)
80
80
  end
81
81
  end
82
82
 
83
83
  context 'nil' do
84
84
  it 'returns false' do
85
85
  subject.send "#{attribute}=", false
86
- subject.send("#{attribute}?").should == false
86
+ expect(subject.send("#{attribute}?")).to eq(false)
87
87
  end
88
88
  end
89
89
  end
@@ -93,14 +93,14 @@ describe Arachni::OptionGroups::Audit do
93
93
  describe '#exclude_vector_patterns=' do
94
94
  it 'converts the argument to a flat array of Regexp' do
95
95
  subject.exclude_vector_patterns = [ [:test], 'string' ]
96
- subject.exclude_vector_patterns.should == [/test/, /string/]
96
+ expect(subject.exclude_vector_patterns).to eq([/test/, /string/])
97
97
  end
98
98
  end
99
99
 
100
100
  describe '#include_vector_patterns=' do
101
101
  it 'converts the argument to a flat array of Regexp' do
102
102
  subject.include_vector_patterns = [ [:test], 'string' ]
103
- subject.include_vector_patterns.should == [/test/, /string/]
103
+ expect(subject.include_vector_patterns).to eq([/test/, /string/])
104
104
  end
105
105
  end
106
106
 
@@ -108,7 +108,7 @@ describe Arachni::OptionGroups::Audit do
108
108
  context 'when #include_vector_patterns' do
109
109
  context 'is empty' do
110
110
  it 'returns true' do
111
- subject.vector?( 'blah' ).should be_true
111
+ expect(subject.vector?( 'blah' )).to be_truthy
112
112
  end
113
113
  end
114
114
 
@@ -116,8 +116,8 @@ describe Arachni::OptionGroups::Audit do
116
116
  it 'returns true' do
117
117
  subject.include_vector_patterns = [/stuff/, /blah/]
118
118
 
119
- subject.vector?( 'stufferson' ).should be_true
120
- subject.vector?( 'blaherson' ).should be_true
119
+ expect(subject.vector?( 'stufferson' )).to be_truthy
120
+ expect(subject.vector?( 'blaherson' )).to be_truthy
121
121
  end
122
122
  end
123
123
 
@@ -125,7 +125,7 @@ describe Arachni::OptionGroups::Audit do
125
125
  it 'returns false' do
126
126
  subject.include_vector_patterns = [/stuff/, /blah/]
127
127
 
128
- subject.vector?( 'mooh' ).should be_false
128
+ expect(subject.vector?( 'mooh' )).to be_falsey
129
129
  end
130
130
  end
131
131
  end
@@ -133,7 +133,7 @@ describe Arachni::OptionGroups::Audit do
133
133
  context 'when #exclude_vector_patterns' do
134
134
  context 'is empty' do
135
135
  it 'returns true' do
136
- subject.vector?( 'blah' ).should be_true
136
+ expect(subject.vector?( 'blah' )).to be_truthy
137
137
  end
138
138
  end
139
139
 
@@ -141,8 +141,8 @@ describe Arachni::OptionGroups::Audit do
141
141
  it 'returns true' do
142
142
  subject.exclude_vector_patterns = [/stuff/, /blah/]
143
143
 
144
- subject.vector?( 'stufferson' ).should be_false
145
- subject.vector?( 'blaherson' ).should be_false
144
+ expect(subject.vector?( 'stufferson' )).to be_falsey
145
+ expect(subject.vector?( 'blaherson' )).to be_falsey
146
146
  end
147
147
  end
148
148
 
@@ -150,7 +150,7 @@ describe Arachni::OptionGroups::Audit do
150
150
  it 'returns false' do
151
151
  subject.exclude_vector_patterns = [/stuff/, /blah/]
152
152
 
153
- subject.vector?( 'mooh' ).should be_true
153
+ expect(subject.vector?( 'mooh' )).to be_truthy
154
154
  end
155
155
  end
156
156
  end
@@ -158,17 +158,17 @@ describe Arachni::OptionGroups::Audit do
158
158
 
159
159
  describe '#elements' do
160
160
  it 'enables auditing of the given element types' do
161
- subject.links.should be_false
162
- subject.forms.should be_false
163
- subject.cookies.should be_false
164
- subject.headers.should be_false
161
+ expect(subject.links).to be_falsey
162
+ expect(subject.forms).to be_falsey
163
+ expect(subject.cookies).to be_falsey
164
+ expect(subject.headers).to be_falsey
165
165
 
166
166
  subject.elements :links, :forms, :cookies, :headers
167
167
 
168
- subject.links.should be_true
169
- subject.forms.should be_true
170
- subject.cookies.should be_true
171
- subject.headers.should be_true
168
+ expect(subject.links).to be_truthy
169
+ expect(subject.forms).to be_truthy
170
+ expect(subject.cookies).to be_truthy
171
+ expect(subject.headers).to be_truthy
172
172
  end
173
173
 
174
174
  context 'when given an invalid element type' do
@@ -182,17 +182,17 @@ describe Arachni::OptionGroups::Audit do
182
182
 
183
183
  describe '#elements=' do
184
184
  it 'enables auditing of the given element types' do
185
- subject.links.should be_false
186
- subject.forms.should be_false
187
- subject.cookies.should be_false
188
- subject.headers.should be_false
185
+ expect(subject.links).to be_falsey
186
+ expect(subject.forms).to be_falsey
187
+ expect(subject.cookies).to be_falsey
188
+ expect(subject.headers).to be_falsey
189
189
 
190
190
  subject.elements = :links, :forms, :cookies, :headers
191
191
 
192
- subject.links.should be_true
193
- subject.forms.should be_true
194
- subject.cookies.should be_true
195
- subject.headers.should be_true
192
+ expect(subject.links).to be_truthy
193
+ expect(subject.forms).to be_truthy
194
+ expect(subject.cookies).to be_truthy
195
+ expect(subject.headers).to be_truthy
196
196
  end
197
197
 
198
198
  context 'when given an invalid element type' do
@@ -209,19 +209,19 @@ describe Arachni::OptionGroups::Audit do
209
209
  subject.elements :links, :forms, :cookies, :headers
210
210
  subject.link_templates = /param\/(?<param>\w+)/
211
211
 
212
- subject.links?.should be_true
213
- subject.forms?.should be_true
214
- subject.cookies?.should be_true
215
- subject.headers?.should be_true
216
- subject.link_templates?.should be_true
212
+ expect(subject.links?).to be_truthy
213
+ expect(subject.forms?).to be_truthy
214
+ expect(subject.cookies?).to be_truthy
215
+ expect(subject.headers?).to be_truthy
216
+ expect(subject.link_templates?).to be_truthy
217
217
 
218
218
  subject.skip_elements :links, :forms, :cookies, :headers, :link_templates
219
219
 
220
- subject.links?.should be_false
221
- subject.forms?.should be_false
222
- subject.cookies?.should be_false
223
- subject.headers?.should be_false
224
- subject.link_templates?.should be_false
220
+ expect(subject.links?).to be_falsey
221
+ expect(subject.forms?).to be_falsey
222
+ expect(subject.cookies?).to be_falsey
223
+ expect(subject.headers?).to be_falsey
224
+ expect(subject.link_templates?).to be_falsey
225
225
  end
226
226
 
227
227
  context 'when given an invalid element type' do
@@ -239,74 +239,74 @@ describe Arachni::OptionGroups::Audit do
239
239
  subject.elements :links, :forms, :cookies, :headers
240
240
  subject.link_templates << /param\/(?<param>\w+)/
241
241
 
242
- subject.links.should be_true
243
- subject.elements?( :links ).should be_true
244
- subject.elements?( :link ).should be_true
245
- subject.elements?( 'links' ).should be_true
246
- subject.elements?( 'link' ).should be_true
247
-
248
- subject.forms.should be_true
249
- subject.elements?( :forms ).should be_true
250
- subject.elements?( :form ).should be_true
251
- subject.elements?( 'forms' ).should be_true
252
- subject.elements?( 'form' ).should be_true
253
-
254
- subject.cookies.should be_true
255
- subject.elements?( :cookies ).should be_true
256
- subject.elements?( :cookie ).should be_true
257
- subject.elements?( 'cookies' ).should be_true
258
- subject.elements?( 'cookie' ).should be_true
259
-
260
- subject.headers.should be_true
261
- subject.elements?( :headers ).should be_true
262
- subject.elements?( :header ).should be_true
263
- subject.elements?( 'headers' ).should be_true
264
- subject.elements?( 'header' ).should be_true
265
-
266
- subject.link_templates.should be_any
267
- subject.elements?( :link_templates ).should be_true
268
- subject.elements?( :link_template ).should be_true
269
- subject.elements?( 'link_templates' ).should be_true
270
- subject.elements?( 'link_template' ).should be_true
271
-
272
- subject.elements?( :header, :link, :form, :cookie, :link_template ).should be_true
273
- subject.elements?( [:header, :link, :form, :cookie, :link_template] ).should be_true
242
+ expect(subject.links).to be_truthy
243
+ expect(subject.elements?( :links )).to be_truthy
244
+ expect(subject.elements?( :link )).to be_truthy
245
+ expect(subject.elements?( 'links' )).to be_truthy
246
+ expect(subject.elements?( 'link' )).to be_truthy
247
+
248
+ expect(subject.forms).to be_truthy
249
+ expect(subject.elements?( :forms )).to be_truthy
250
+ expect(subject.elements?( :form )).to be_truthy
251
+ expect(subject.elements?( 'forms' )).to be_truthy
252
+ expect(subject.elements?( 'form' )).to be_truthy
253
+
254
+ expect(subject.cookies).to be_truthy
255
+ expect(subject.elements?( :cookies )).to be_truthy
256
+ expect(subject.elements?( :cookie )).to be_truthy
257
+ expect(subject.elements?( 'cookies' )).to be_truthy
258
+ expect(subject.elements?( 'cookie' )).to be_truthy
259
+
260
+ expect(subject.headers).to be_truthy
261
+ expect(subject.elements?( :headers )).to be_truthy
262
+ expect(subject.elements?( :header )).to be_truthy
263
+ expect(subject.elements?( 'headers' )).to be_truthy
264
+ expect(subject.elements?( 'header' )).to be_truthy
265
+
266
+ expect(subject.link_templates).to be_any
267
+ expect(subject.elements?( :link_templates )).to be_truthy
268
+ expect(subject.elements?( :link_template )).to be_truthy
269
+ expect(subject.elements?( 'link_templates' )).to be_truthy
270
+ expect(subject.elements?( 'link_template' )).to be_truthy
271
+
272
+ expect(subject.elements?( :header, :link, :form, :cookie, :link_template )).to be_truthy
273
+ expect(subject.elements?( [:header, :link, :form, :cookie, :link_template] )).to be_truthy
274
274
  end
275
275
  end
276
276
  context 'if the given element is not to be audited' do
277
277
  it 'returns false' do
278
- subject.links.should be_false
279
- subject.elements?( :links ).should be_false
280
- subject.elements?( :link ).should be_false
281
- subject.elements?( 'links' ).should be_false
282
- subject.elements?( 'link' ).should be_false
283
-
284
- subject.forms.should be_false
285
- subject.elements?( :forms ).should be_false
286
- subject.elements?( :form ).should be_false
287
- subject.elements?( 'forms' ).should be_false
288
- subject.elements?( 'form' ).should be_false
289
-
290
- subject.cookies.should be_false
291
- subject.elements?( :cookies ).should be_false
292
- subject.elements?( :cookie ).should be_false
293
- subject.elements?( 'cookies' ).should be_false
294
- subject.elements?( 'cookie' ).should be_false
295
-
296
- subject.headers.should be_false
297
- subject.elements?( :headers ).should be_false
298
- subject.elements?( :header ).should be_false
299
- subject.elements?( 'headers' ).should be_false
300
- subject.elements?( 'header' ).should be_false
301
-
302
- subject.link_templates.should be_empty
303
- subject.elements?( :link_templates ).should be_false
304
- subject.elements?( :link_template ).should be_false
305
- subject.elements?( 'link_templates' ).should be_false
306
- subject.elements?( 'link_template' ).should be_false
307
-
308
- subject.elements?( :header, :link, :form, :cookie, :link_templates ).should be_false
309
- subject.elements?( [:header, :link, :form, :cookie, :link_templates] ).should be_false
278
+ expect(subject.links).to be_falsey
279
+ expect(subject.elements?( :links )).to be_falsey
280
+ expect(subject.elements?( :link )).to be_falsey
281
+ expect(subject.elements?( 'links' )).to be_falsey
282
+ expect(subject.elements?( 'link' )).to be_falsey
283
+
284
+ expect(subject.forms).to be_falsey
285
+ expect(subject.elements?( :forms )).to be_falsey
286
+ expect(subject.elements?( :form )).to be_falsey
287
+ expect(subject.elements?( 'forms' )).to be_falsey
288
+ expect(subject.elements?( 'form' )).to be_falsey
289
+
290
+ expect(subject.cookies).to be_falsey
291
+ expect(subject.elements?( :cookies )).to be_falsey
292
+ expect(subject.elements?( :cookie )).to be_falsey
293
+ expect(subject.elements?( 'cookies' )).to be_falsey
294
+ expect(subject.elements?( 'cookie' )).to be_falsey
295
+
296
+ expect(subject.headers).to be_falsey
297
+ expect(subject.elements?( :headers )).to be_falsey
298
+ expect(subject.elements?( :header )).to be_falsey
299
+ expect(subject.elements?( 'headers' )).to be_falsey
300
+ expect(subject.elements?( 'header' )).to be_falsey
301
+
302
+ expect(subject.link_templates).to be_empty
303
+ expect(subject.elements?( :link_templates )).to be_falsey
304
+ expect(subject.elements?( :link_template )).to be_falsey
305
+ expect(subject.elements?( 'link_templates' )).to be_falsey
306
+ expect(subject.elements?( 'link_template' )).to be_falsey
307
+
308
+ expect(subject.elements?( :header, :link, :form, :cookie, :link_templates )).to be_falsey
309
+ expect(subject.elements?( [:header, :link, :form, :cookie, :link_templates] )).to be_falsey
310
310
  end
311
311
  end
312
312
 
@@ -324,7 +324,7 @@ describe Arachni::OptionGroups::Audit do
324
324
 
325
325
  it "converts 'link_templates' to strings" do
326
326
  subject.link_templates << /param\/(?<param>\w+)/
327
- data['link_templates'].should == subject.link_templates.map(&:to_s)
327
+ expect(data['link_templates']).to eq(subject.link_templates.map(&:to_s))
328
328
  end
329
329
  end
330
330
  end
@@ -5,8 +5,25 @@ describe Arachni::OptionGroups::BrowserCluster do
5
5
  subject { described_class.new }
6
6
 
7
7
  %w(pool_size job_timeout worker_time_to_live ignore_images screen_width
8
- screen_height).each do |method|
9
- it { should respond_to method }
10
- it { should respond_to "#{method}=" }
8
+ screen_height local_storage).each do |method|
9
+ it { is_expected.to respond_to method }
10
+ it { is_expected.to respond_to "#{method}=" }
11
+ end
12
+
13
+ describe '#local_storage' do
14
+ context 'when passed a Hash' do
15
+ it 'sets it' do
16
+ subject.local_storage = { 1 => 2 }
17
+ expect(subject.local_storage).to eq({ 1 => 2 })
18
+ end
19
+ end
20
+
21
+ context 'when passed anything other than Hash' do
22
+ it 'raises ArgumentError' do
23
+ expect do
24
+ subject.local_storage = 1
25
+ end.to raise_error ArgumentError
26
+ end
27
+ end
11
28
  end
12
29
  end
@@ -6,7 +6,7 @@ describe Arachni::OptionGroups::Datastore do
6
6
 
7
7
  it 'creates attribute accessors on the fly' do
8
8
  subject.test = 1
9
- subject.test.should == 1
9
+ expect(subject.test).to eq(1)
10
10
  end
11
11
 
12
12
  describe '#to_h' do
@@ -16,7 +16,7 @@ describe Arachni::OptionGroups::Datastore do
16
16
  subject.instance_variable_set( :@blah, true )
17
17
 
18
18
  value = subject.send( method, 'stuff' )
19
- subject.to_h.should == { method.to_s[0...-1].to_sym => value }
19
+ expect(subject.to_h).to eq({ method.to_s[0...-1].to_sym => value })
20
20
  end
21
21
  end
22
22
 
@@ -26,11 +26,11 @@ describe Arachni::OptionGroups::Datastore do
26
26
  value = 'stuff'
27
27
 
28
28
  subject.update( { method => value } )
29
- subject.send( method ).should include value
29
+ expect(subject.send( method )).to include value
30
30
  end
31
31
 
32
32
  it 'returns self' do
33
- subject.update({}).should == subject
33
+ expect(subject.update({})).to eq(subject)
34
34
  end
35
35
  end
36
36
 
@@ -43,12 +43,12 @@ describe Arachni::OptionGroups::Datastore do
43
43
  group.update( { method => value } )
44
44
 
45
45
  subject.merge( group )
46
- subject.send( method ).should include value
46
+ expect(subject.send( method )).to include value
47
47
  end
48
48
 
49
49
  it 'returns self' do
50
50
  group = described_class.new
51
- subject.merge( group ).should == subject
51
+ expect(subject.merge( group )).to eq(subject)
52
52
  end
53
53
  end
54
54
  end