arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -25,14 +25,14 @@ describe Arachni::Parser do
25
25
 
26
26
  describe '#url' do
27
27
  it 'holds the effective URL of the response' do
28
- subject.url.should == @url
28
+ expect(subject.url).to eq(@url)
29
29
  end
30
30
  end
31
31
 
32
32
  describe '#link' do
33
33
  it 'returns the URL of the response as a Link' do
34
- subject.link.action.should == @opts.url
35
- subject.link.inputs.should == { 'query_var_input' => 'query_var_val' }
34
+ expect(subject.link.action).to eq(@opts.url)
35
+ expect(subject.link.inputs).to eq({ 'query_var_input' => 'query_var_val' })
36
36
  end
37
37
  end
38
38
 
@@ -47,17 +47,17 @@ describe Arachni::Parser do
47
47
 
48
48
  it 'overrides the body of the HTTP response for the parsing process' do
49
49
  subject.body = '<a href="/?name2=val2">Stuff</a>'
50
- subject.links.size.should == 1
51
- subject.links.first.inputs.should == { 'name2' => 'val2' }
50
+ expect(subject.links.size).to eq(1)
51
+ expect(subject.links.first.inputs).to eq({ 'name2' => 'val2' })
52
52
  end
53
53
 
54
54
  it 'clears the existing element cache' do
55
- subject.links.size.should == 1
56
- subject.links.first.inputs.should == { 'name' => 'val' }
55
+ expect(subject.links.size).to eq(1)
56
+ expect(subject.links.first.inputs).to eq({ 'name' => 'val' })
57
57
 
58
58
  subject.body = '<a href="/?name2=val2">Stuff</a>'
59
- subject.links.size.should == 1
60
- subject.links.first.inputs.should == { 'name2' => 'val2' }
59
+ expect(subject.links.size).to eq(1)
60
+ expect(subject.links.first.inputs).to eq({ 'name2' => 'val2' })
61
61
  end
62
62
  end
63
63
 
@@ -65,22 +65,22 @@ describe Arachni::Parser do
65
65
  it 'returns a Page' do
66
66
  page = subject.page
67
67
 
68
- page.should be_kind_of Arachni::Page
69
- page.url.should == subject.url
70
- page.method.should == @response.request.method
71
- page.query_vars.should == { 'query_var_input' => 'query_var_val' }
72
- page.body.should == @response.body
73
- page.response.should == @response
74
- page.paths.should == subject.paths
68
+ expect(page).to be_kind_of Arachni::Page
69
+ expect(page.url).to eq(subject.url)
70
+ expect(page.method).to eq(@response.request.method)
71
+ expect(page.query_vars).to eq({ 'query_var_input' => 'query_var_val' })
72
+ expect(page.body).to eq(@response.body)
73
+ expect(page.response).to eq(@response)
74
+ expect(page.paths).to eq(subject.paths)
75
75
 
76
76
  link = Arachni::Element::Link.new( url: @url, inputs: subject.link_vars )
77
77
 
78
- page.links.should == subject.links | [link]
79
- page.forms.should == subject.forms
80
- page.cookies.should == subject.cookies_to_be_audited
81
- page.headers.should == subject.headers
78
+ expect(page.links).to eq(subject.links | [link])
79
+ expect(page.forms).to eq(subject.forms)
80
+ expect(page.cookies).to eq(subject.cookies_to_be_audited)
81
+ expect(page.headers).to eq(subject.headers)
82
82
 
83
- page.cookie_jar.should == subject.cookie_jar
83
+ expect(page.cookie_jar).to eq(subject.cookie_jar)
84
84
  end
85
85
  end
86
86
 
@@ -98,10 +98,10 @@ describe Arachni::Parser do
98
98
  end
99
99
 
100
100
  it 'returns cookies that need to be transmitted to the page' do
101
- subject.cookie_jar.map(&:inputs).should == [
101
+ expect(subject.cookie_jar.map(&:inputs)).to eq([
102
102
  { 'cname' => 'cval' },
103
103
  { 'name_from_cookiejar' => 'updated' }
104
- ]
104
+ ])
105
105
  end
106
106
  end
107
107
 
@@ -127,23 +127,23 @@ describe Arachni::Parser do
127
127
  }
128
128
  ))
129
129
 
130
- subject.cookies_to_be_audited.map(&:inputs).should == [
130
+ expect(subject.cookies_to_be_audited.map(&:inputs)).to eq([
131
131
  { 'cname' => 'cval' },
132
132
  { 'name_from_cookiejar' => 'updated' },
133
133
  { 'irrelevant' => 'iv' }
134
- ]
134
+ ])
135
135
  end
136
136
 
137
137
  it 'forces the #action to the page URL' do
138
138
  cookies = subject.cookies_to_be_audited
139
- cookies.size.should == 2
140
- cookies.map { |c| c.action }.uniq.should == [@url]
139
+ expect(cookies.size).to eq(2)
140
+ expect(cookies.map { |c| c.action }.uniq).to eq([@url])
141
141
  end
142
142
  end
143
143
 
144
144
  describe '#text?' do
145
145
  context 'when the response is text based' do
146
- it { subject.text?.should be_true }
146
+ it { expect(subject.text?).to be_truthy }
147
147
  end
148
148
 
149
149
  context 'when the response is not text based' do
@@ -152,7 +152,7 @@ describe Arachni::Parser do
152
152
  'Content-Type' => 'bin/stuff'
153
153
  })
154
154
  end
155
- it { subject.text?.should be_false }
155
+ it { expect(subject.text?).to be_falsey }
156
156
  end
157
157
  end
158
158
 
@@ -171,7 +171,7 @@ describe Arachni::Parser do
171
171
  end
172
172
 
173
173
  it 'returns nil' do
174
- subject.document.should be_nil
174
+ expect(subject.document).to be_nil
175
175
  end
176
176
  end
177
177
 
@@ -210,7 +210,7 @@ describe Arachni::Parser do
210
210
 
211
211
  it 'includes the URL in the array' do
212
212
  subject.links.size == 1
213
- subject.links.first.inputs.should == { 'stuff' => 'ba' }
213
+ expect(subject.links.first.inputs).to eq({ 'stuff' => 'ba' })
214
214
  end
215
215
  end
216
216
 
@@ -227,7 +227,7 @@ describe Arachni::Parser do
227
227
  end
228
228
 
229
229
  it 'should not include it the response URL' do
230
- subject.links.should be_empty
230
+ expect(subject.links).to be_empty
231
231
  end
232
232
  end
233
233
  context 'when the response is not text based' do
@@ -238,7 +238,7 @@ describe Arachni::Parser do
238
238
  end
239
239
 
240
240
  it 'returns nil' do
241
- subject.links.should be_empty
241
+ expect(subject.links).to be_empty
242
242
  end
243
243
 
244
244
  context 'and the URL has query parameters' do
@@ -249,8 +249,8 @@ describe Arachni::Parser do
249
249
  end
250
250
 
251
251
  it 'returns the URL parsed as a link' do
252
- subject.links.size.should == 1
253
- subject.links.first.should == subject.link
252
+ expect(subject.links.size).to eq(1)
253
+ expect(subject.links.first).to eq(subject.link)
254
254
  end
255
255
  end
256
256
  end
@@ -258,22 +258,22 @@ describe Arachni::Parser do
258
258
 
259
259
  describe '#forms' do
260
260
  it 'returns an array of parsed forms' do
261
- subject.forms.size.should == 2
261
+ expect(subject.forms.size).to eq(2)
262
262
 
263
263
  form = subject.forms.first
264
- form.action.should == @utils.normalize_url( @opts.url + '/form' )
265
- form.url.should == @url
264
+ expect(form.action).to eq(@utils.normalize_url( @opts.url + '/form' ))
265
+ expect(form.url).to eq(@url)
266
266
 
267
- form.inputs.should == {
267
+ expect(form.inputs).to eq({
268
268
  "form_input_1" => "form_val_1",
269
269
  "form_input_2" => "form_val_2"
270
- }
271
- form.method.should == :post
270
+ })
271
+ expect(form.method).to eq(:post)
272
272
 
273
273
  form = subject.forms.last
274
- form.action.should == @utils.normalize_url( @opts.url + '/form_2' )
275
- form.url.should == @url
276
- form.inputs.should == { "form_2_input_1" => "form_2_val_1" }
274
+ expect(form.action).to eq(@utils.normalize_url( @opts.url + '/form_2' ))
275
+ expect(form.url).to eq(@url)
276
+ expect(form.inputs).to eq({ "form_2_input_1" => "form_2_val_1" })
277
277
  end
278
278
 
279
279
  context 'when passed secondary responses' do
@@ -284,7 +284,7 @@ describe Arachni::Parser do
284
284
  responses << Arachni::HTTP::Client.get( @opts.url + 'with_nonce', mode: :sync )
285
285
 
286
286
  parser = Arachni::Parser.new( responses, @opts )
287
- parser.forms.map { |f| f.nonce_name }.sort.should == %w(nonce nonce2).sort
287
+ expect(parser.forms.map { |f| f.nonce_name }.sort).to eq(%w(nonce nonce2).sort)
288
288
  end
289
289
  end
290
290
  context 'when the response is not text based' do
@@ -293,40 +293,40 @@ describe Arachni::Parser do
293
293
  end
294
294
 
295
295
  it 'returns nil' do
296
- subject.forms.should be_empty
296
+ expect(subject.forms).to be_empty
297
297
  end
298
298
  end
299
299
  end
300
300
 
301
301
  describe '#cookies' do
302
302
  it 'returns an array of cookies' do
303
- subject.cookies.size.should == 3
303
+ expect(subject.cookies.size).to eq(3)
304
304
 
305
305
  cookies = subject.cookies.sort_by { |cookie| cookie.name }.reverse
306
306
 
307
307
  cookie = cookies.pop
308
- cookie.action.should == @url
309
- cookie.inputs.should == { 'cookie_input' => 'cookie_val' }
310
- cookie.method.should == :get
311
- cookie.secure?.should be_true
312
- cookie.http_only?.should be_true
313
- cookie.url.should == @url
308
+ expect(cookie.action).to eq(@url)
309
+ expect(cookie.inputs).to eq({ 'cookie_input' => 'cookie_val' })
310
+ expect(cookie.method).to eq(:get)
311
+ expect(cookie.secure?).to be_truthy
312
+ expect(cookie.http_only?).to be_truthy
313
+ expect(cookie.url).to eq(@url)
314
314
 
315
315
  cookie = cookies.pop
316
- cookie.action.should == @url
317
- cookie.inputs.should == { 'cookie_input2' => 'cookie_val2' }
318
- cookie.method.should == :get
319
- cookie.secure?.should be_false
320
- cookie.http_only?.should be_false
321
- cookie.url.should == @url
316
+ expect(cookie.action).to eq(@url)
317
+ expect(cookie.inputs).to eq({ 'cookie_input2' => 'cookie_val2' })
318
+ expect(cookie.method).to eq(:get)
319
+ expect(cookie.secure?).to be_falsey
320
+ expect(cookie.http_only?).to be_falsey
321
+ expect(cookie.url).to eq(@url)
322
322
 
323
323
  cookie = cookies.pop
324
- cookie.action.should == @url
325
- cookie.inputs.should == { "http_equiv_cookie_name" => "http_equiv_cookie_val" }
326
- cookie.secure?.should be_true
327
- cookie.http_only?.should be_true
328
- cookie.method.should == :get
329
- cookie.url.should == @url
324
+ expect(cookie.action).to eq(@url)
325
+ expect(cookie.inputs).to eq({ "http_equiv_cookie_name" => "http_equiv_cookie_val" })
326
+ expect(cookie.secure?).to be_truthy
327
+ expect(cookie.http_only?).to be_truthy
328
+ expect(cookie.method).to eq(:get)
329
+ expect(cookie.url).to eq(@url)
330
330
  end
331
331
  end
332
332
 
@@ -344,11 +344,11 @@ describe Arachni::Parser do
344
344
 
345
345
  it "returns a #{Arachni::Element::LinkTemplate}" do
346
346
  link = subject.link_template
347
- link.action.should == response.url
348
- link.url.should == response.url
349
- link.inputs.should == {
347
+ expect(link.action).to eq(response.url)
348
+ expect(link.url).to eq(response.url)
349
+ expect(link.inputs).to eq({
350
350
  'param' => 'myvalue'
351
- }
351
+ })
352
352
  end
353
353
  end
354
354
  end
@@ -375,11 +375,11 @@ describe Arachni::Parser do
375
375
 
376
376
  it "returns a #{Arachni::Element::LinkTemplate}" do
377
377
  link = subject.link_templates.first
378
- link.action.should == response.url + 'test2/param/myvalue'
379
- link.url.should == response.url
380
- link.inputs.should == {
378
+ expect(link.action).to eq(response.url + 'test2/param/myvalue')
379
+ expect(link.url).to eq(response.url)
380
+ expect(link.inputs).to eq({
381
381
  'param' => 'myvalue'
382
- }
382
+ })
383
383
  end
384
384
  end
385
385
  end
@@ -387,8 +387,8 @@ describe Arachni::Parser do
387
387
  describe '#paths' do
388
388
  context 'when an error occurs' do
389
389
  it 'returns an empty array' do
390
- described_class.stub(:extractors){ raise }
391
- described_class.new( @response ).paths.should == []
390
+ allow(described_class).to receive(:extractors){ raise }
391
+ expect(described_class.new( @response ).paths).to eq([])
392
392
  end
393
393
  end
394
394
  end
@@ -396,33 +396,34 @@ describe Arachni::Parser do
396
396
  context 'without base' do
397
397
  describe '#base' do
398
398
  it 'returns nil' do
399
- subject.base.should == nil
399
+ expect(subject.base).to eq(nil)
400
400
  end
401
401
  end
402
402
 
403
403
  describe '#to_absolute' do
404
404
  it 'converts a relative path to absolute' do
405
- subject.to_absolute( 'relative/path' ).should ==
405
+ expect(subject.to_absolute( 'relative/path' )).to eq(
406
406
  @utils.normalize_url( "#{@opts.url}/relative/path" )
407
+ )
407
408
  end
408
409
  end
409
410
 
410
411
  describe '#links' do
411
412
  it 'returns an array of links' do
412
413
  links = subject.links
413
- links.size.should == 2
414
+ expect(links.size).to eq(2)
414
415
 
415
416
  link = links.first
416
- link.action.should == @opts.url
417
- link.inputs.should == { 'query_var_input' => 'query_var_val' }
418
- link.method.should == :get
419
- link.url.should == @url
417
+ expect(link.action).to eq(@opts.url)
418
+ expect(link.inputs).to eq({ 'query_var_input' => 'query_var_val' })
419
+ expect(link.method).to eq(:get)
420
+ expect(link.url).to eq(@url)
420
421
 
421
422
  link = links.last
422
- link.action.should == @utils.normalize_url( @opts.url + '/link' )
423
- link.inputs.should == { 'link_input' => 'link_val' }
424
- link.method.should == :get
425
- link.url.should == @url
423
+ expect(link.action).to eq(@utils.normalize_url( @opts.url + '/link' ))
424
+ expect(link.inputs).to eq({ 'link_input' => 'link_val' })
425
+ expect(link.method).to eq(:get)
426
+ expect(link.url).to eq(@url)
426
427
  end
427
428
  end
428
429
 
@@ -434,7 +435,7 @@ describe Arachni::Parser do
434
435
  "form_2",
435
436
  ].map { |p| @utils.normalize_url( @opts.url.to_s + '/' + p ) }
436
437
 
437
- (subject.paths & paths).sort.should == paths.sort
438
+ expect((subject.paths & paths).sort).to eq(paths.sort)
438
439
  end
439
440
  end
440
441
  end
@@ -449,33 +450,34 @@ describe Arachni::Parser do
449
450
 
450
451
  describe '#base' do
451
452
  it 'returns the base href attr' do
452
- subject.base.should == @utils.normalize_url( "#{@opts.url.to_s}/this_is_the_base/" )
453
+ expect(subject.base).to eq(@utils.normalize_url( "#{@opts.url.to_s}/this_is_the_base/" ))
453
454
  end
454
455
  end
455
456
 
456
457
  describe '#to_absolute' do
457
458
  it 'converts a relative path to absolute' do
458
- subject.to_absolute( 'relative/path' ).should ==
459
+ expect(subject.to_absolute( 'relative/path' )).to eq(
459
460
  @utils.normalize_url( "#{subject.base}relative/path" )
461
+ )
460
462
  end
461
463
  end
462
464
 
463
465
  describe '#links' do
464
466
  it 'returns an array of links' do
465
467
  links = subject.links
466
- links.size.should == 2
468
+ expect(links.size).to eq(2)
467
469
 
468
470
  link = links.first
469
- link.action.should == @opts.url + 'with_base'
470
- link.inputs.should == { 'stuff' => 'ha' }
471
- link.method.should == :get
472
- link.url.should == url
471
+ expect(link.action).to eq(@opts.url + 'with_base')
472
+ expect(link.inputs).to eq({ 'stuff' => 'ha' })
473
+ expect(link.method).to eq(:get)
474
+ expect(link.url).to eq(url)
473
475
 
474
476
  link = links.last
475
- link.action.should == subject.base + 'link_with_base'
476
- link.inputs.should == { 'link_input' => 'link_val' }
477
- link.method.should == :get
478
- link.url.should == url
477
+ expect(link.action).to eq(subject.base + 'link_with_base')
478
+ expect(link.inputs).to eq({ 'link_input' => 'link_val' })
479
+ expect(link.method).to eq(:get)
480
+ expect(link.url).to eq(url)
479
481
  end
480
482
  end
481
483
 
@@ -486,25 +488,25 @@ describe Arachni::Parser do
486
488
  'link_with_base?link_input=link_val'
487
489
  ].map { |p| subject.base + '' + p }
488
490
 
489
- (subject.paths & paths).sort.should == paths.sort
491
+ expect((subject.paths & paths).sort).to eq(paths.sort)
490
492
  end
491
493
  end
492
494
  end
493
495
 
494
496
  describe '#headers' do
495
497
  it 'returns an array of headers' do
496
- subject.headers.each { |h| h.class.should == Arachni::Element::Header }
498
+ subject.headers.each { |h| expect(h.class).to eq(Arachni::Element::Header) }
497
499
  end
498
500
 
499
501
  it 'includes headers from the HTTP request' do
500
502
  subject.response.request.headers['X-Custom-Header'] = 'My-stuff'
501
- subject.headers.find { |h| h.name == 'X-Custom-Header' }.should be_true
503
+ expect(subject.headers.find { |h| h.name == 'X-Custom-Header' }).to be_truthy
502
504
  end
503
505
  end
504
506
 
505
507
  describe '#link_vars' do
506
508
  it 'returns a hash of link query inputs' do
507
- subject.link_vars.should == { 'query_var_input' => 'query_var_val' }
509
+ expect(subject.link_vars).to eq({ 'query_var_input' => 'query_var_val' })
508
510
  end
509
511
 
510
512
  context "when there are #{Arachni::OptionGroups::Scope}#url_rewrites" do
@@ -519,14 +521,14 @@ describe Arachni::Parser do
519
521
  end
520
522
 
521
523
  it 'rewrites the url' do
522
- subject.link_vars.should == { 'id' => '13' }
524
+ expect(subject.link_vars).to eq({ 'id' => '13' })
523
525
  end
524
526
  end
525
527
 
526
528
  context 'when the URL cannot be parsed' do
527
529
  it 'returns an empty array' do
528
530
  subject.url = nil
529
- subject.link_vars.should == {}
531
+ expect(subject.link_vars).to eq({})
530
532
  end
531
533
  end
532
534
  end