arachni 1.2.1 → 1.3

data/lib/arachni/browser.rb

@@ -350,11 +350,11 @@ class Browser
             url:     url,
             cookies: extra_cookies
         ) do
+            print_debug_level_2 "Loading: #{url}"
             watir.goto url
+            print_debug_level_2 'Done'
 
-            @javascript.wait_till_ready
-            wait_for_pending_requests
-            wait_for_timers
+            wait_till_ready
 
             url = watir.url
             Options.browser_cluster.css_to_wait_for( url ).each do |css|
@@ -388,6 +388,20 @@ class Browser
         transition
     end
 
+    def wait_till_ready
+        print_debug_level_2 'Waiting for custom JS...'
+        @javascript.wait_till_ready
+        print_debug_level_2 'Done'
+
+        print_debug_level_2 "Waiting for #{@proxy.active_connections} connections to close.."
+        wait_for_pending_requests
+        print_debug_level_2 'Done'
+
+        print_debug_level_2 'Waiting for timers...'
+        wait_for_timers
+        print_debug_level_2 'Done'
+    end
+
     def shutdown
         begin
             watir.close if browser_alive?
@@ -704,6 +718,13 @@ class Browser
                     # Some of these need an explicit event triggers.
                     had_special_trigger = true if ![:change, :blur, :focus, :select].include? event
 
+                    # Send keys will append to the existing value, so we need to
+                    # clear it first. The receiving input may support values
+                    # though, so watch out.
+                    if (subtype = element.to_subtype).respond_to?( :value= )
+                        subtype.value = ''
+                    end
+
                     element.send_keys( (options[:value] || value_for( element )).to_s )
                 end
 
@@ -808,6 +829,14 @@ class Browser
         page.dom.transitions          = @transitions.dup
         page.dom.skip_states          = skip_states.dup
 
+        if Options.audit.ui_inputs?
+            page.ui_inputs = Element::UIInput.from_browser( self, page )
+        end
+
+        if Options.audit.ui_forms?
+            page.ui_forms = Element::UIForm.from_browser( self, page )
+        end
+
         # Go through auditable DOM forms and cookies and remove the DOM from
         # them if no events are associated with it.
         #
@@ -1012,6 +1041,11 @@ class Browser
         s << '>'
     end
 
+    def filter_events( element, events )
+        supported = Set.new( Arachni::Browser::Javascript.events_for( element ) )
+        events.reject { |name, _| !supported.include? ('on' + name.to_s.gsub( /^on/, '' )).to_sym }
+    end
+
     private
 
     def fill_in_form_inputs( form, inputs = nil )
@@ -1273,8 +1307,23 @@ class Browser
         end
 
         url = "#{url}/set-cookies-#{request_token}"
+
+        body = ''
+        if Arachni::Options::browser_cluster.local_storage.any?
+            body = <<EOJS
+                <script>
+                    var data = #{Arachni::Options::browser_cluster.local_storage.to_json};
+
+                    for( prop in data ) {
+                        localStorage.setItem( prop, data[prop] );
+                    }
+                </script>
+EOJS
+        end
+
         watir.goto preload( HTTP::Response.new(
             url:     url,
+            body:    body,
             headers: {
                 'Set-Cookie' => set_cookies.values.map(&:to_set_cookie)
             }

data/lib/arachni/browser/javascript.rb

@@ -504,13 +504,13 @@ class Javascript
     end
 
     def wrapped_taint_tracer_initializer
-        "/* #{token}_initialize_start */" <<
-            "#{@taint_tracer.stub.function( :initialize, taints )}" <<
+        "/* #{token}_initialize_start */ " <<
+            "#{@taint_tracer.stub.function( :initialize, taints )} " <<
             "/* #{token}_initialize_stop */"
     end
 
     def wrapped_custom_code
-        "/* #{token}_code_start */#{custom_code}/* #{token}_code_stop */"
+        "/* #{token}_code_start */ #{custom_code} /* #{token}_code_stop */"
     end
 
     def js_initialization_signal

data/lib/arachni/browser/javascript/scripts/taint_tracer.js

@@ -25,6 +25,10 @@ var _tokenTaintTracer = _tokenTaintTracer || {
 
     max_sinks:            50,
 
+    // Limits the maximum depth when traversing object properties, looking for
+    // taints -- safeguard for circular references.
+    find_taint_recursively_max_depth: 3,
+
     // Hold debugging information, usually pushed by the 'debug' function.
     debugging_data:       [],
 
@@ -41,8 +45,7 @@ var _tokenTaintTracer = _tokenTaintTracer || {
     },
 
     // Keeps track of which functions have had tracers installed.
-    traced:               {
-    },
+    traced:               {},
 
     // Original functions, without tracers. We don't want to trigger traced
     // functions to provide functionality to this object.
@@ -211,7 +214,7 @@ var _tokenTaintTracer = _tokenTaintTracer || {
         if( _tokenTaintTracer.data_flow_sinks[taint].length > _tokenTaintTracer.max_sinks ) {
             _tokenTaintTracer.data_flow_sinks[taint] =
                 _tokenTaintTracer.data_flow_sinks[taint].slice(
-                    _tokenTaintTracer.data_flow_sinks[taint].length -
+                        _tokenTaintTracer.data_flow_sinks[taint].length -
                         _tokenTaintTracer.max_sinks,
                     _tokenTaintTracer.data_flow_sinks[taint].length
                 )
@@ -329,34 +332,38 @@ var _tokenTaintTracer = _tokenTaintTracer || {
     },
 
     cleanup_event: function( e ) {
-        var elements = [
-            'toElement', 'target', 'srcElement', 'currentTarget',
-            'fromElement'
+        var keep = [
+            'toElement',
+            'target',
+            'srcElement',
+            'currentTarget',
+            'fromElement',
+            'eventPhase',
+            'type'
         ];
 
-        var arg = {};
-        for( var prop in e ) {
-            if( elements.indexOf( prop ) != -1 && e[prop] ) {
+        var prop;
+        var event_data = {};
+        for( var i = 0; i < keep.length; i++ ) {
+            prop = keep[i];
 
-                // Quick and easy, get the element as HTML.
-                if( e[prop].outerHTML ) {
-                    arg[prop] = e[prop].outerHTML;
+            if( !e[prop] ) continue;
 
-                    // Dealing with a HTMLDocument,, needs some special
-                    // treatment to get the HTML.
-                } else if( e[prop].documentElement ) {
-                    arg[prop] = e[prop].documentElement.outerHTML;
+            // Quick and easy, get the element as HTML.
+            if( e[prop].outerHTML ) {
+                event_data[prop] = e[prop].outerHTML;
 
-                    // You never know...
-                } else {
-                    arg[prop] = e[prop].toString();
-                }
+                // Dealing with a HTMLDocument, needs some special treatment to get the HTML.
+            } else if( e[prop].documentElement ) {
+                event_data[prop] = e[prop].documentElement.outerHTML;
+
+                // You never know...
             } else {
-                arg[prop] = e[prop];
+                event_data[prop] = e[prop].toString();
             }
         }
 
-        return arg;
+        return event_data;
     },
 
     has_function: function( func ) {
@@ -414,8 +421,12 @@ var _tokenTaintTracer = _tokenTaintTracer || {
         return null;
     },
 
-    find_taint_recursively: function( taint, object ) {
+    find_taint_recursively: function( taint, object, depth ) {
         var tainted;
+        depth = depth || 0;
+
+        if( depth > _tokenTaintTracer.find_taint_recursively_max_depth ) return;
+        depth++;
 
         switch( Object.prototype.toString.call( object ) ) {
             case '[object String]':
@@ -424,7 +435,12 @@ var _tokenTaintTracer = _tokenTaintTracer || {
 
             case '[object Array]':
                 for( var i = 0; i < object.length; i++ ) {
-                    tainted = _tokenTaintTracer.find_taint_recursively( taint, object[i] );
+                    tainted = _tokenTaintTracer.find_taint_recursively(
+                        taint,
+                        object[i],
+                        depth
+                    );
+
                     if ( tainted ) return tainted;
                 }
                 break;
@@ -435,7 +451,12 @@ var _tokenTaintTracer = _tokenTaintTracer || {
                         var property_value = object[property];
 
                         if( Object.prototype.toString.call( property_value ) !== '[object Function]' ){
-                            tainted = _tokenTaintTracer.find_taint_recursively( taint, property_value );
+                            tainted = _tokenTaintTracer.find_taint_recursively(
+                                taint,
+                                property_value,
+                                depth
+                            );
+
                             if ( tainted ) return tainted;
                         }
                     }

data/lib/arachni/browser_cluster.rb

@@ -71,6 +71,8 @@ class BrowserCluster
 
     attr_reader :consumed_pids
 
+    attr_reader :job_counter
+
     # @param    [Hash]  options
     # @option   options [Integer]   :pool_size (5)
     #   Amount of {Worker browsers} to add to the pool.
@@ -153,6 +155,8 @@ class BrowserCluster
 
             notify_on_queue job
 
+            self.class.increment_queued_job_count
+
             @pending_job_counter  += 1
             @pending_jobs[job.id] += 1
             @job_callbacks[job.id] = block if block
@@ -362,6 +366,9 @@ class BrowserCluster
     # @private
     def decrease_pending_job( job )
         synchronize do
+            increment_completed_job_count
+            add_to_total_job_time( job.time )
+
             @pending_job_counter  -= 1
             @pending_jobs[job.id] -= 1
             job_done( job ) if @pending_jobs[job.id] <= 0
@@ -373,6 +380,60 @@ class BrowserCluster
         @job_callbacks[job.id]
     end
 
+    def increment_queued_job_count
+        synchronize do
+            self.class.increment_queued_job_count
+        end
+    end
+
+    def increment_completed_job_count( *args )
+        synchronize do
+            self.class.increment_completed_job_count( *args )
+        end
+    end
+
+    def add_to_total_job_time( time )
+        synchronize do
+            self.class.add_to_total_job_time( time )
+        end
+    end
+
+    def self.seconds_per_job
+        total_job_time / Float( completed_job_count )
+    end
+
+    def self.increment_queued_job_count
+        @queued_job_count ||= 0
+        @queued_job_count += 1
+    end
+
+    def self.increment_completed_job_count( increment = 1 )
+        @completed_job_count ||= 0
+        @completed_job_count += increment
+    end
+
+    def self.completed_job_count
+        @completed_job_count.to_i
+    end
+
+    def self.total_job_time
+        @total_job_time.to_i
+    end
+
+    def self.add_to_total_job_time( time )
+        @total_job_time ||= 0
+        @total_job_time += time.to_i
+    end
+
+    def self.statistics
+        {
+            seconds_per_job:     seconds_per_job,
+            total_job_time:      total_job_time,
+            queued_job_count:    @queued_job_count    || 0,
+            completed_job_count: @completed_job_count || 0
+        }
+    end
+
     private
 
     def notify_on_queue( job )

data/lib/arachni/browser_cluster/job.rb

@@ -44,6 +44,10 @@ class Job
     # @see #forward_as
     attr_accessor :forwarder
 
+    # @return   [Integer]
+    #   Duration of the job, in seconds.
+    attr_accessor :time
+
     # @param    [Hash]  options
     def initialize( options = {} )
         @options      = options.dup
@@ -52,6 +56,19 @@ class Job
         options.each { |k, v| options[k] = send( "#{k}=", v ) }
     end
 
+    # @param    [Integer]   time
+    #   Amount of {#time} elapsed until time-out.
+    def timed_out!( time )
+        @timed_out = true
+        @time = time
+    end
+
+    # @return   [Bool]
+    #   `true` if timed-ot, `false` otherwise.
+    def timed_out?
+        !!@timed_out
+    end
+
     # @note The following resources will be available at the time of execution:
     #
     #       * {#browser}
@@ -121,7 +138,10 @@ class Job
     # @return   [Job]
     #   Copy of `self`
     def dup
-        self.class.new add_id( @options )
+        n = self.class.new( add_id( @options ) )
+        n.time = time
+        n.timed_out!( time ) if timed_out?
+        n
     end
 
     # @param    [Hash]  options

data/lib/arachni/browser_cluster/jobs/browser_provider.rb

@@ -21,7 +21,9 @@ class BrowserProvider < Job
     end
 
     def to_s
-        "#<#{self.class}:#{object_id} callback=#{browser.master.callback_for( self ) if browser && browser.master}>"
+        "#<#{self.class}:#{object_id} " <<
+            "callback=#{browser.master.callback_for( self ) if browser && browser.master} " <<
+            "time=#{@time} timed_out=#{timed_out?}>"
     end
     alias :inspect :to_s
 

data/lib/arachni/browser_cluster/jobs/resource_exploration.rb

@@ -45,7 +45,8 @@ class ResourceExploration < Job
     end
 
     def to_s
-        "#<#{self.class}:#{object_id} @resource=#{@resource}>"
+        "#<#{self.class}:#{object_id} @resource=#{@resource} " <<
+            "time=#{@time} timed_out=#{timed_out?}>"
     end
     alias :inspect :to_s
 

data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb

@@ -37,7 +37,8 @@ class EventTrigger < ResourceExploration
 
     def to_s
         "#<#{self.class}:#{object_id} @resource=#{@resource} " +
-            "@event=#{@event.inspect} @element=#{@element.inspect}>"
+            "@event=#{@event.inspect} @element=#{@element.inspect} " <<
+            "time=#{@time} timed_out=#{timed_out?}>"
     end
 
 end

data/lib/arachni/browser_cluster/jobs/taint_trace.rb

@@ -42,8 +42,9 @@ class TaintTrace < ResourceExploration
     end
 
     def to_s
-        "#<#{self.class}:#{object_id} @resource=#{@resource} " +
-            "@taint=#{@taint.inspect} @injector=#{@injector.inspect}>"
+        "#<#{self.class}:#{object_id} @resource=#{@resource} " <<
+            "@taint=#{@taint.inspect} @injector=#{@injector.inspect} " <<
+            "time=#{@time} timed_out=#{timed_out?}>"
     end
     alias :inspect :to_s
 

data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb

@@ -28,7 +28,7 @@ class EventTrigger < ResourceExploration::EventTrigger
     def to_s
         "#<#{self.class}:#{object_id} @resource=#{@resource} " +
             "@event=#{@event.inspect} @element=#{@element.inspect} " +
-            "@forwarder=#{@forwarder}>"
+            "@forwarder=#{@forwarder} time=#{@time} timed_out=#{timed_out?}>"
     end
 
 end

data/lib/arachni/browser_cluster/worker.rb

@@ -82,6 +82,7 @@ class Worker < Arachni::Browser
         # If we can't respawn, then bail out.
         return if browser_respawn_if_necessary.nil?
 
+        time = Time.now
         begin
             with_timeout @job_timeout do
                 exception_jail false do
@@ -98,7 +99,11 @@ class Worker < Arachni::Browser
                     end
                 end
             end
+
+            job.time = Time.now - time
         rescue TimeoutError => e
+            job.timed_out!( Time.now - time )
+
             print_bad "Job timed-out after #{@job_timeout} seconds: #{@job}"
 
             # Could have left us with a broken browser.