arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -5,9 +5,9 @@ describe Typhoeus::Hydra do
5
5
  describe '#max_concurrency' do
6
6
  it 'is be accessible' do
7
7
  h = Typhoeus::Hydra.new
8
- h.max_concurrency.should be_true
8
+ expect(h.max_concurrency).to be_truthy
9
9
  h.max_concurrency = 10
10
- h.max_concurrency.should == 10
10
+ expect(h.max_concurrency).to eq(10)
11
11
  end
12
12
  end
13
13
 
@@ -15,21 +15,21 @@ describe Arachni::URI::Scope do
15
15
  context "less than #{Arachni::OptionGroups::Scope}#directory_depth_limit" do
16
16
  it 'returns false' do
17
17
  scope.directory_depth_limit = 100
18
- subject.too_deep?.should be_false
18
+ expect(subject.too_deep?).to be_falsey
19
19
  end
20
20
  end
21
21
 
22
22
  context "less than #{Arachni::OptionGroups::Scope}#directory_depth_limit" do
23
23
  it 'returns true' do
24
24
  scope.directory_depth_limit = 2
25
- subject.too_deep?.should be_true
25
+ expect(subject.too_deep?).to be_truthy
26
26
  end
27
27
  end
28
28
  end
29
29
 
30
30
  context "when #{Arachni::OptionGroups::Scope}#directory_depth_limit has not been configured" do
31
31
  it 'returns false' do
32
- subject.too_deep?.should be_false
32
+ expect(subject.too_deep?).to be_falsey
33
33
  end
34
34
  end
35
35
  end
@@ -43,10 +43,10 @@ describe Arachni::URI::Scope do
43
43
  scope.redundant_path_patterns = { /match_this/ => 10 }
44
44
 
45
45
  10.times do
46
- subject.redundant?( true ).should be_false
46
+ expect(subject.redundant?( true )).to be_falsey
47
47
  end
48
48
 
49
- scope.redundant_path_patterns[/match_this/].should == 0
49
+ expect(scope.redundant_path_patterns[/match_this/]).to eq(0)
50
50
  end
51
51
  end
52
52
 
@@ -55,10 +55,10 @@ describe Arachni::URI::Scope do
55
55
  scope.redundant_path_patterns = { /match_this/ => 10 }
56
56
 
57
57
  10.times do
58
- subject.redundant?.should be_false
58
+ expect(subject.redundant?).to be_falsey
59
59
  end
60
60
 
61
- scope.redundant_path_patterns[/match_this/].should == 10
61
+ expect(scope.redundant_path_patterns[/match_this/]).to eq(10)
62
62
  end
63
63
  end
64
64
 
@@ -67,10 +67,10 @@ describe Arachni::URI::Scope do
67
67
  scope.redundant_path_patterns = { /match_this/ => 10 }
68
68
 
69
69
  10.times do
70
- subject.redundant?.should be_false
70
+ expect(subject.redundant?).to be_falsey
71
71
  end
72
72
 
73
- scope.redundant_path_patterns[/match_this/].should == 10
73
+ expect(scope.redundant_path_patterns[/match_this/]).to eq(10)
74
74
  end
75
75
  end
76
76
  end
@@ -80,10 +80,10 @@ describe Arachni::URI::Scope do
80
80
  scope.redundant_path_patterns = { /match_this/ => 10 }
81
81
 
82
82
  10.times do
83
- subject.redundant?( true ).should be_false
83
+ expect(subject.redundant?( true )).to be_falsey
84
84
  end
85
85
 
86
- subject.redundant?( true ).should be_true
86
+ expect(subject.redundant?( true )).to be_truthy
87
87
  end
88
88
  end
89
89
  context "when a URL's counter has not reached 0" do
@@ -91,17 +91,17 @@ describe Arachni::URI::Scope do
91
91
  scope.redundant_path_patterns = { /match_this/ => 11 }
92
92
 
93
93
  10.times do
94
- subject.redundant?( true ).should be_false
94
+ expect(subject.redundant?( true )).to be_falsey
95
95
  end
96
96
 
97
- subject.redundant?( true ).should be_false
97
+ expect(subject.redundant?( true )).to be_falsey
98
98
  end
99
99
  end
100
100
 
101
101
  context 'when #auto_redundant returns true' do
102
102
  it 'returns true' do
103
- subject.stub(:auto_redundant?) { true }
104
- subject.should be_redundant
103
+ allow(subject).to receive(:auto_redundant?) { true }
104
+ expect(subject).to be_redundant
105
105
  end
106
106
  end
107
107
  end
@@ -114,12 +114,12 @@ describe Arachni::URI::Scope do
114
114
  it 'decrements the counters' do
115
115
  scope.auto_redundant_paths = 10
116
116
 
117
- subject.auto_redundant?( true ).should be_false
117
+ expect(subject.auto_redundant?( true )).to be_falsey
118
118
  9.times do
119
- subject.auto_redundant?( true ).should be_false
119
+ expect(subject.auto_redundant?( true )).to be_falsey
120
120
  end
121
121
 
122
- subject.auto_redundant?.should be_true
122
+ expect(subject.auto_redundant?).to be_truthy
123
123
  end
124
124
  end
125
125
 
@@ -127,12 +127,12 @@ describe Arachni::URI::Scope do
127
127
  it 'does not decrement the counters' do
128
128
  scope.auto_redundant_paths = 10
129
129
 
130
- subject.auto_redundant?( false ).should be_false
130
+ expect(subject.auto_redundant?( false )).to be_falsey
131
131
  9.times do
132
- subject.auto_redundant?( false ).should be_false
132
+ expect(subject.auto_redundant?( false )).to be_falsey
133
133
  end
134
134
 
135
- subject.auto_redundant?( false ).should_not be_true
135
+ expect(subject.auto_redundant?( false )).not_to be_truthy
136
136
  end
137
137
  end
138
138
 
@@ -140,12 +140,12 @@ describe Arachni::URI::Scope do
140
140
  it 'does not decrement the counters' do
141
141
  scope.auto_redundant_paths = 10
142
142
 
143
- subject.auto_redundant?.should be_false
143
+ expect(subject.auto_redundant?).to be_falsey
144
144
  9.times do
145
- subject.auto_redundant?.should be_false
145
+ expect(subject.auto_redundant?).to be_falsey
146
146
  end
147
147
 
148
- subject.auto_redundant?.should_not be_true
148
+ expect(subject.auto_redundant?).not_to be_truthy
149
149
  end
150
150
  end
151
151
  end
@@ -154,18 +154,18 @@ describe Arachni::URI::Scope do
154
154
  it 'returns true' do
155
155
  scope.auto_redundant_paths = 10
156
156
 
157
- subject.auto_redundant?( true ).should be_false
157
+ expect(subject.auto_redundant?( true )).to be_falsey
158
158
  9.times do
159
- subject.auto_redundant?( true ).should be_false
159
+ expect(subject.auto_redundant?( true )).to be_falsey
160
160
  end
161
161
 
162
- subject.auto_redundant?( true ).should be_true
162
+ expect(subject.auto_redundant?( true )).to be_truthy
163
163
  end
164
164
  end
165
165
 
166
166
  describe 'by default' do
167
167
  it 'returns false' do
168
- subject.auto_redundant?.should be_false
168
+ expect(subject.auto_redundant?).to be_falsey
169
169
  end
170
170
  end
171
171
 
@@ -175,7 +175,7 @@ describe Arachni::URI::Scope do
175
175
  it 'returns false' do
176
176
  scope.auto_redundant_paths = 1
177
177
  3.times do
178
- subject.auto_redundant?.should be_false
178
+ expect(subject.auto_redundant?).to be_falsey
179
179
  end
180
180
  end
181
181
  end
@@ -188,7 +188,7 @@ describe Arachni::URI::Scope do
188
188
  it 'returns true' do
189
189
  scope.exclude_path_patterns = [ /exclude/ ]
190
190
 
191
- subject.exclude?.should be_true
191
+ expect(subject.exclude?).to be_truthy
192
192
  end
193
193
  end
194
194
 
@@ -196,7 +196,7 @@ describe Arachni::URI::Scope do
196
196
  it 'returns false' do
197
197
  scope.exclude_path_patterns = [ /boo/ ]
198
198
 
199
- subject.exclude?.should be_false
199
+ expect(subject.exclude?).to be_falsey
200
200
  end
201
201
  end
202
202
  end
@@ -207,14 +207,14 @@ describe Arachni::URI::Scope do
207
207
  context 'when self matches the provided include rules in' do
208
208
  it 'returns true' do
209
209
  scope.include_path_patterns = [ /include/ ]
210
- subject.include?.should be_true
210
+ expect(subject.include?).to be_truthy
211
211
  end
212
212
  end
213
213
 
214
214
  context 'when self does not match the provided scope_include_path_patterns rules in' do
215
215
  it 'returns false' do
216
216
  scope.include_path_patterns = [ /boo/ ]
217
- subject.include?.should be_false
217
+ expect(subject.include?).to be_falsey
218
218
  end
219
219
  end
220
220
  end
@@ -244,19 +244,19 @@ describe Arachni::URI::Scope do
244
244
 
245
245
  context 'and the url has a different subdomain' do
246
246
  it 'return true' do
247
- with_different_subdomain.in_domain?.should be_true
247
+ expect(with_different_subdomain.in_domain?).to be_truthy
248
248
  end
249
249
  end
250
250
 
251
251
  context 'and the url has the same subdomain' do
252
252
  it 'return true' do
253
- with_same_subdomain.in_domain?.should be_true
253
+ expect(with_same_subdomain.in_domain?).to be_truthy
254
254
  end
255
255
  end
256
256
 
257
257
  context 'and the url has no subdomain' do
258
258
  it 'return true' do
259
- without_subdomain.in_domain?.should be_true
259
+ expect(without_subdomain.in_domain?).to be_truthy
260
260
  end
261
261
  end
262
262
  end
@@ -268,13 +268,13 @@ describe Arachni::URI::Scope do
268
268
 
269
269
  context 'and the url has a subdomain' do
270
270
  it 'return true' do
271
- with_subdomain.in_domain?.should be_true
271
+ expect(with_subdomain.in_domain?).to be_truthy
272
272
  end
273
273
  end
274
274
 
275
275
  context 'and the url has no subdomain' do
276
276
  it 'return true' do
277
- without_subdomain.in_domain?.should be_true
277
+ expect(without_subdomain.in_domain?).to be_truthy
278
278
  end
279
279
  end
280
280
  end
@@ -294,19 +294,19 @@ describe Arachni::URI::Scope do
294
294
 
295
295
  context 'and the url has a different subdomain' do
296
296
  it 'return false' do
297
- with_different_subdomain.in_domain?.should be_false
297
+ expect(with_different_subdomain.in_domain?).to be_falsey
298
298
  end
299
299
  end
300
300
 
301
301
  context 'and the url has the same subdomain' do
302
302
  it 'return true' do
303
- with_same_subdomain.in_domain?.should be_true
303
+ expect(with_same_subdomain.in_domain?).to be_truthy
304
304
  end
305
305
  end
306
306
 
307
307
  context 'and the url has no subdomain' do
308
308
  it 'return false' do
309
- without_subdomain.in_domain?.should be_false
309
+ expect(without_subdomain.in_domain?).to be_falsey
310
310
  end
311
311
  end
312
312
  end
@@ -318,13 +318,13 @@ describe Arachni::URI::Scope do
318
318
 
319
319
  context 'and the url has a subdomain' do
320
320
  it 'return false' do
321
- with_subdomain.in_domain?.should be_false
321
+ expect(with_subdomain.in_domain?).to be_falsey
322
322
  end
323
323
  end
324
324
 
325
325
  context 'and the url has no subdomain' do
326
326
  it 'return true' do
327
- without_subdomain.in_domain?.should be_true
327
+ expect(without_subdomain.in_domain?).to be_truthy
328
328
  end
329
329
  end
330
330
  end
@@ -350,14 +350,14 @@ describe Arachni::URI::Scope do
350
350
  context true do
351
351
  it 'returns true' do
352
352
  scope.https_only = true
353
- https.follow_protocol?.should be_true
353
+ expect(https.follow_protocol?).to be_truthy
354
354
  end
355
355
  end
356
356
 
357
357
  context false do
358
358
  it 'returns true' do
359
359
  scope.https_only = false
360
- https.follow_protocol?.should be_true
360
+ expect(https.follow_protocol?).to be_truthy
361
361
  end
362
362
  end
363
363
  end
@@ -368,14 +368,14 @@ describe Arachni::URI::Scope do
368
368
  context true do
369
369
  it 'returns false' do
370
370
  scope.https_only = true
371
- http.follow_protocol?.should be_false
371
+ expect(http.follow_protocol?).to be_falsey
372
372
  end
373
373
  end
374
374
 
375
375
  context false do
376
376
  it 'returns true' do
377
377
  scope.https_only = false
378
- http.follow_protocol?.should be_true
378
+ expect(http.follow_protocol?).to be_truthy
379
379
  end
380
380
  end
381
381
  end
@@ -394,14 +394,14 @@ describe Arachni::URI::Scope do
394
394
  context true do
395
395
  it 'returns true' do
396
396
  scope.https_only = true
397
- https.follow_protocol?.should be_true
397
+ expect(https.follow_protocol?).to be_truthy
398
398
  end
399
399
  end
400
400
 
401
401
  context false do
402
402
  it 'returns true' do
403
403
  scope.https_only = false
404
- https.follow_protocol?.should be_true
404
+ expect(https.follow_protocol?).to be_truthy
405
405
  end
406
406
  end
407
407
  end
@@ -411,14 +411,14 @@ describe Arachni::URI::Scope do
411
411
  context true do
412
412
  it 'returns true' do
413
413
  scope.https_only = true
414
- http.follow_protocol?.should be_true
414
+ expect(http.follow_protocol?).to be_truthy
415
415
  end
416
416
  end
417
417
 
418
418
  context false do
419
419
  it 'returns true' do
420
420
  scope.https_only = false
421
- http.follow_protocol?.should be_true
421
+ expect(http.follow_protocol?).to be_truthy
422
422
  end
423
423
  end
424
424
  end
@@ -432,14 +432,14 @@ describe Arachni::URI::Scope do
432
432
  subject { Arachni::URI.parse( 'http://stuff/' ).scope }
433
433
 
434
434
  it 'returns true' do
435
- subject.should be_in
435
+ expect(subject).to be_in
436
436
  end
437
437
 
438
438
  context 'when #out?' do
439
439
  context 'is true' do
440
440
  it 'returns false' do
441
- subject.stub(:out?) { true }
442
- subject.should_not be_in
441
+ allow(subject).to receive(:out?) { true }
442
+ expect(subject).not_to be_in
443
443
  end
444
444
  end
445
445
  end
@@ -449,19 +449,19 @@ describe Arachni::URI::Scope do
449
449
  subject { Arachni::URI.parse( 'http://stuff/' ).scope }
450
450
 
451
451
  it 'returns false' do
452
- subject.should_not be_out
452
+ expect(subject).not_to be_out
453
453
  end
454
454
 
455
455
  it 'does not call #redundant?' do
456
- subject.should_not receive(:redundant?)
456
+ expect(subject).not_to receive(:redundant?)
457
457
  subject.out?
458
458
  end
459
459
 
460
460
  context 'when #follow_protocol?' do
461
461
  context 'is false' do
462
462
  it 'returns true' do
463
- subject.stub(:follow_protocol?) { false }
464
- subject.should be_out
463
+ allow(subject).to receive(:follow_protocol?) { false }
464
+ expect(subject).to be_out
465
465
  end
466
466
  end
467
467
  end
@@ -469,8 +469,8 @@ describe Arachni::URI::Scope do
469
469
  context 'when #in_domain?' do
470
470
  context 'is false' do
471
471
  it 'returns true' do
472
- subject.stub(:in_domain?) { false }
473
- subject.should be_out
472
+ allow(subject).to receive(:in_domain?) { false }
473
+ expect(subject).to be_out
474
474
  end
475
475
  end
476
476
  end
@@ -478,8 +478,8 @@ describe Arachni::URI::Scope do
478
478
  context 'when #too_deep?' do
479
479
  context 'is true' do
480
480
  it 'returns true' do
481
- subject.stub(:too_deep?) { true }
482
- subject.should be_out
481
+ allow(subject).to receive(:too_deep?) { true }
482
+ expect(subject).to be_out
483
483
  end
484
484
  end
485
485
  end
@@ -487,8 +487,8 @@ describe Arachni::URI::Scope do
487
487
  context 'when #include?' do
488
488
  context 'is false' do
489
489
  it 'returns true' do
490
- subject.stub(:include?) { false }
491
- subject.should be_out
490
+ allow(subject).to receive(:include?) { false }
491
+ expect(subject).to be_out
492
492
  end
493
493
  end
494
494
  end
@@ -496,8 +496,8 @@ describe Arachni::URI::Scope do
496
496
  context 'when #exclude?' do
497
497
  context 'is true' do
498
498
  it 'returns true' do
499
- subject.stub(:exclude?) { true }
500
- subject.should be_out
499
+ allow(subject).to receive(:exclude?) { true }
500
+ expect(subject).to be_out
501
501
  end
502
502
  end
503
503
  end
@@ -102,8 +102,8 @@ describe Arachni::URI do
102
102
  it 'parses and normalize the give string' do
103
103
  @urls.each do |url|
104
104
  uri = Arachni::URI( url )
105
- uri.is_a?( Arachni::URI ).should be_true
106
- uri.to_s.should == @ref_normalizer.call( url )
105
+ expect(uri.is_a?( Arachni::URI )).to be_truthy
106
+ expect(uri.to_s).to eq(@ref_normalizer.call( url ))
107
107
  end
108
108
  end
109
109
  end
@@ -112,16 +112,18 @@ describe Arachni::URI do
112
112
  let(:url) { 'http://test.com/articles/some-stuff/23' }
113
113
 
114
114
  it 'rewrites a URL based on the given rules' do
115
- described_class.rewrite( url, rewrite_rules ).should ==
115
+ expect(described_class.rewrite( url, rewrite_rules )).to eq(
116
116
  'http://test.com/articles.php?id=23'
117
+ )
117
118
  end
118
119
 
119
120
  context 'when no rules are provided' do
120
121
  it "uses the ones in #{Arachni::OptionGroups::Scope}#url_rewrites" do
121
122
  Arachni::Options.scope.url_rewrites = rewrite_rules
122
123
 
123
- described_class.rewrite( url ).should ==
124
+ expect(described_class.rewrite( url )).to eq(
124
125
  'http://test.com/articles.php?id=23'
126
+ )
125
127
  end
126
128
  end
127
129
  end
@@ -129,29 +131,29 @@ describe Arachni::URI do
129
131
  describe '.parse_query' do
130
132
  it 'returns the query parameters as a Hash' do
131
133
  url = 'http://test/?param_one=value_one&param_two=value_two'
132
- described_class.parse_query( url ).should == {
134
+ expect(described_class.parse_query( url )).to eq({
133
135
  'param_one' => 'value_one',
134
136
  'param_two' => 'value_two'
135
- }
137
+ })
136
138
  end
137
139
 
138
140
  it 'decodes the parameters' do
139
141
  url = 'http://test/?stuff%20here=bl%20ah'
140
- described_class.parse_query( url ).should == {
142
+ expect(described_class.parse_query( url )).to eq({
141
143
  'stuff here' => 'bl ah'
142
- }
144
+ })
143
145
  end
144
146
 
145
147
  context 'when passed' do
146
148
  describe 'nil' do
147
149
  it 'returns an empty Hash' do
148
- described_class.parse_query( nil ).should == {}
150
+ expect(described_class.parse_query( nil )).to eq({})
149
151
  end
150
152
  end
151
153
  describe 'an unparsable URL' do
152
154
  it 'returns an empty Hash' do
153
155
  url = '$#%^$6#5436#$%^'
154
- described_class.parse_query( url ).should == {}
156
+ expect(described_class.parse_query( url )).to eq({})
155
157
  end
156
158
  end
157
159
  end
@@ -160,20 +162,20 @@ describe Arachni::URI do
160
162
  describe '.encode' do
161
163
  it 'decodes a URI' do
162
164
  uri = "my test.asp?name=ståle&car=saab"
163
- described_class.encode( uri ).should == 'my%20test.asp?name=st%C3%A5le&car=saab'
165
+ expect(described_class.encode( uri )).to eq('my%20test.asp?name=st%C3%A5le&car=saab')
164
166
  end
165
167
  end
166
168
 
167
169
  describe '.decode' do
168
170
  it 'decodes a URI' do
169
171
  uri = 'my%20test.asp?name=st%C3%A5le&car=saab'
170
- described_class.decode( uri ).should == "my test.asp?name=ståle&car=saab"
172
+ expect(described_class.decode( uri )).to eq("my test.asp?name=ståle&car=saab")
171
173
  end
172
174
  end
173
175
 
174
176
  describe '.parser' do
175
177
  it 'returns a URI::Parser' do
176
- described_class.parser.class.should == ::URI::Parser
178
+ expect(described_class.parser.class).to eq(::URI::Parser)
177
179
  end
178
180
  end
179
181
 
@@ -190,40 +192,40 @@ describe Arachni::URI do
190
192
 
191
193
  parsed_uri = described_class.parse( uri )
192
194
 
193
- parsed_uri.to_s.should == uri
195
+ expect(parsed_uri.to_s).to eq(uri)
194
196
 
195
- parsed_uri.scheme.should == scheme
196
- parsed_uri.user.should == user
197
- parsed_uri.password.should == password
198
- parsed_uri.host.should == host
199
- parsed_uri.path.should == path
200
- parsed_uri.query.should == query
197
+ expect(parsed_uri.scheme).to eq(scheme)
198
+ expect(parsed_uri.user).to eq(user)
199
+ expect(parsed_uri.password).to eq(password)
200
+ expect(parsed_uri.host).to eq(host)
201
+ expect(parsed_uri.path).to eq(path)
202
+ expect(parsed_uri.query).to eq(query)
201
203
  end
202
204
 
203
205
  it 'ignores javascript: URLs' do
204
- described_class.parse( 'javascript:stuff()' ).should be_nil
205
- described_class.parse( 'jAvaScRipT:stuff()' ).should be_nil
206
+ expect(described_class.parse( 'javascript:stuff()' )).to be_nil
207
+ expect(described_class.parse( 'jAvaScRipT:stuff()' )).to be_nil
206
208
  end
207
209
  end
208
210
 
209
211
  describe '.ruby_parse' do
210
212
  it 'cleans the URL' do
211
213
  @urls.each do |url|
212
- described_class.ruby_parse( url ).to_s.should == @ref_normalizer.call( url )
214
+ expect(described_class.ruby_parse( url ).to_s).to eq(@ref_normalizer.call( url ))
213
215
  end
214
216
  end
215
217
 
216
218
  it 'ignores javascript: URLs' do
217
- described_class.ruby_parse( 'javascript:stuff()' ).should be_nil
218
- described_class.ruby_parse( 'jAvaScRipT:stuff()' ).should be_nil
219
+ expect(described_class.ruby_parse( 'javascript:stuff()' )).to be_nil
220
+ expect(described_class.ruby_parse( 'jAvaScRipT:stuff()' )).to be_nil
219
221
  end
220
222
 
221
223
  context 'when an error occurs' do
222
224
  it 'returns nil' do
223
- described_class.stub(:fast_parse){ raise }
224
- described_class.stub(:normalize){ raise }
225
+ allow(described_class).to receive(:fast_parse){ raise }
226
+ allow(described_class).to receive(:normalize){ raise }
225
227
 
226
- described_class.ruby_parse( 'http://test.com/222' ).should be_nil
228
+ expect(described_class.ruby_parse( 'http://test.com/222' )).to be_nil
227
229
  end
228
230
  end
229
231
  end
@@ -241,19 +243,19 @@ describe Arachni::URI do
241
243
 
242
244
  parsed_uri = described_class.fast_parse( uri )
243
245
 
244
- parsed_uri[:scheme].should == scheme
245
- parsed_uri[:userinfo].should == user + ':' + password
246
- parsed_uri[:host].should == host
247
- parsed_uri[:path].should == path
248
- parsed_uri[:query].should == query
246
+ expect(parsed_uri[:scheme]).to eq(scheme)
247
+ expect(parsed_uri[:userinfo]).to eq(user + ':' + password)
248
+ expect(parsed_uri[:host]).to eq(host)
249
+ expect(parsed_uri[:path]).to eq(path)
250
+ expect(parsed_uri[:query]).to eq(query)
249
251
 
250
252
  parsed_uri = described_class.fast_parse( "//#{user}:#{password}@#{host}/#{path}?#{query}" )
251
253
 
252
- parsed_uri[:scheme].should be_nil
253
- parsed_uri[:userinfo].should == user + ':' + password
254
- parsed_uri[:host].should == host
255
- parsed_uri[:path].should == path
256
- parsed_uri[:query].should == query
254
+ expect(parsed_uri[:scheme]).to be_nil
255
+ expect(parsed_uri[:userinfo]).to eq(user + ':' + password)
256
+ expect(parsed_uri[:host]).to eq(host)
257
+ expect(parsed_uri[:path]).to eq(path)
258
+ expect(parsed_uri[:query]).to eq(query)
257
259
  end
258
260
 
259
261
  it 'returns a frozen hash (with frozen values)' do
@@ -264,7 +266,7 @@ describe Arachni::URI do
264
266
  end
265
267
 
266
268
  it 'ignores javascript: URLs' do
267
- described_class.fast_parse( 'javascript:stuff()' ).should be_nil
269
+ expect(described_class.fast_parse( 'javascript:stuff()' )).to be_nil
268
270
  end
269
271
  end
270
272
 
@@ -273,41 +275,41 @@ describe Arachni::URI do
273
275
  abs = 'http://test.com/blah/ha'
274
276
  rel = '/test'
275
277
  rel2 = 'test2'
276
- described_class.to_absolute( rel, abs ).should == "http://test.com" + rel
277
- described_class.to_absolute( rel2, abs ).should == "http://test.com/blah/" + rel2
278
- described_class.to_absolute( rel2, abs + '/' ).should == "http://test.com/blah/ha/" + rel2
278
+ expect(described_class.to_absolute( rel, abs )).to eq("http://test.com" + rel)
279
+ expect(described_class.to_absolute( rel2, abs )).to eq("http://test.com/blah/" + rel2)
280
+ expect(described_class.to_absolute( rel2, abs + '/' )).to eq("http://test.com/blah/ha/" + rel2)
279
281
 
280
282
  rel = '//domain-name.com/stuff'
281
- described_class.to_absolute( rel, abs ).should == "http:" + rel
283
+ expect(described_class.to_absolute( rel, abs )).to eq("http:" + rel)
282
284
  end
283
285
  end
284
286
 
285
287
  describe '.normalize' do
286
288
  it 'cleans the URL' do
287
289
  @urls.each do |url|
288
- described_class.normalize( url ).should == @ref_normalizer.call( url )
290
+ expect(described_class.normalize( url )).to eq(@ref_normalizer.call( url ))
289
291
  end
290
292
  with_whitespace = 'http://test.com/stuff '
291
- described_class.normalize( with_whitespace ).to_s.should == with_whitespace.strip
293
+ expect(described_class.normalize( with_whitespace ).to_s).to eq(with_whitespace.strip)
292
294
  end
293
295
  end
294
296
 
295
297
  describe '.full_and_absolute?' do
296
298
  context 'when given a nil URL' do
297
299
  it 'returns false' do
298
- described_class.full_and_absolute?( nil ).should be_false
300
+ expect(described_class.full_and_absolute?( nil )).to be_falsey
299
301
  end
300
302
  end
301
303
 
302
304
  context 'when given an non absolute URL' do
303
305
  it 'returns false' do
304
- described_class.full_and_absolute?( '433' ).should be_false
306
+ expect(described_class.full_and_absolute?( '433' )).to be_falsey
305
307
  end
306
308
  end
307
309
 
308
310
  context 'when given an absolute URL' do
309
311
  it 'returns true' do
310
- described_class.full_and_absolute?( 'http://stuff/' ).should be_true
312
+ expect(described_class.full_and_absolute?( 'http://stuff/' )).to be_truthy
311
313
  end
312
314
  end
313
315
  end
@@ -317,8 +319,8 @@ describe Arachni::URI do
317
319
  it 'normalizes and parse the string' do
318
320
  @urls.each do |url|
319
321
  uri = described_class.new( url )
320
- uri.is_a?( Arachni::URI ).should be_true
321
- uri.to_s.should == @ref_normalizer.call( url )
322
+ expect(uri.is_a?( Arachni::URI )).to be_truthy
323
+ expect(uri.to_s).to eq(@ref_normalizer.call( url ))
322
324
  end
323
325
  end
324
326
  end
@@ -327,8 +329,8 @@ describe Arachni::URI do
327
329
  it 'normalizes and construct a URI from a Hash of components' do
328
330
  @urls.each do |url|
329
331
  uri = described_class.new( described_class.fast_parse( url ) )
330
- uri.is_a?( Arachni::URI ).should be_true
331
- uri.to_s.should == @ref_normalizer.call( url )
332
+ expect(uri.is_a?( Arachni::URI )).to be_truthy
333
+ expect(uri.to_s).to eq(@ref_normalizer.call( url ))
332
334
  end
333
335
  end
334
336
  end
@@ -337,11 +339,11 @@ describe Arachni::URI do
337
339
  it 'normalizes and construct a URI from a Hash of components' do
338
340
  @urls.each do |url|
339
341
  uri = ::URI.parse( described_class.normalize( url ) )
340
- uri.is_a?( ::URI ).should be_true
342
+ expect(uri.is_a?( ::URI )).to be_truthy
341
343
 
342
344
  a_uri = described_class.new( url )
343
- a_uri.is_a?( Arachni::URI ).should be_true
344
- a_uri.to_s.should == @ref_normalizer.call( url )
345
+ expect(a_uri.is_a?( Arachni::URI )).to be_truthy
346
+ expect(a_uri.to_s).to eq(@ref_normalizer.call( url ))
345
347
  end
346
348
  end
347
349
  end
@@ -351,8 +353,8 @@ describe Arachni::URI do
351
353
  @urls.each do |url|
352
354
  uri = described_class.new( url )
353
355
  a_uri = described_class.new( uri )
354
- a_uri.is_a?( Arachni::URI ).should be_true
355
- a_uri.should == uri
356
+ expect(a_uri.is_a?( Arachni::URI )).to be_truthy
357
+ expect(a_uri).to eq(uri)
356
358
  end
357
359
  end
358
360
  end
@@ -369,14 +371,14 @@ describe Arachni::URI do
369
371
  @urls.each do |url|
370
372
  normalized_str = described_class.normalize( url )
371
373
  uri = ::URI.parse( normalized_str )
372
- uri.is_a?( ::URI ).should be_true
374
+ expect(uri.is_a?( ::URI )).to be_truthy
373
375
 
374
376
  a_uri = described_class.new( url )
375
- a_uri.is_a?( Arachni::URI ).should be_true
377
+ expect(a_uri.is_a?( Arachni::URI )).to be_truthy
376
378
 
377
- a_uri.should == uri
378
- a_uri.should == normalized_str
379
- a_uri.should == a_uri
379
+ expect(a_uri).to eq(uri)
380
+ expect(a_uri).to eq(normalized_str)
381
+ expect(a_uri).to eq(a_uri)
380
382
  end
381
383
  end
382
384
  end
@@ -386,20 +388,20 @@ describe Arachni::URI do
386
388
 
387
389
  it 'sets the URL query' do
388
390
  subject.query = 'my2=val2'
389
- subject.query.should == 'my2=val2'
391
+ expect(subject.query).to eq('my2=val2')
390
392
  end
391
393
 
392
394
  context 'when given an empty string' do
393
395
  it 'removes the query' do
394
396
  subject.query = ''
395
- subject.query.should be_nil
397
+ expect(subject.query).to be_nil
396
398
  end
397
399
  end
398
400
 
399
401
  context 'when given nil' do
400
402
  it 'removes the query' do
401
403
  subject.query = ''
402
- subject.query.should be_nil
404
+ expect(subject.query).to be_nil
403
405
  end
404
406
  end
405
407
  end
@@ -410,15 +412,15 @@ describe Arachni::URI do
410
412
  it 'return a duplicate object' do
411
413
  dupped = subject.dup
412
414
 
413
- subject.should == dupped
414
- subject.object_id.should_not == dupped.object_id
415
+ expect(subject).to eq(dupped)
416
+ expect(subject.object_id).not_to eq(dupped.object_id)
415
417
  end
416
418
  end
417
419
 
418
420
  describe '#_dump' do
419
421
  it 'returns the URL as a string' do
420
422
  uri = 'http://test.com/?my=val'
421
- described_class.new( uri )._dump(nil).should == uri
423
+ expect(described_class.new( uri )._dump(nil)).to eq(uri)
422
424
  end
423
425
  end
424
426
 
@@ -427,7 +429,7 @@ describe Arachni::URI do
427
429
  uri = 'http://test.com/?my=val'
428
430
  parsed = described_class.new( uri )
429
431
 
430
- described_class._load( parsed._dump(nil) ).should == parsed
432
+ expect(described_class._load( parsed._dump(nil) )).to eq(parsed)
431
433
  end
432
434
  end
433
435
 
@@ -436,50 +438,50 @@ describe Arachni::URI do
436
438
  abs = 'http://test.com/blah/ha'
437
439
  rel = '/test'
438
440
  rel2 = 'test2'
439
- described_class.parse( rel ).to_absolute( abs ).should == "http://test.com" + rel
440
- described_class.parse( rel2 ).to_absolute( abs ).should == "http://test.com/blah/" + rel2
441
- described_class.parse( rel2 ).to_absolute( abs + '/' ).should == "http://test.com/blah/ha/" + rel2
441
+ expect(described_class.parse( rel ).to_absolute( abs )).to eq("http://test.com" + rel)
442
+ expect(described_class.parse( rel2 ).to_absolute( abs )).to eq("http://test.com/blah/" + rel2)
443
+ expect(described_class.parse( rel2 ).to_absolute( abs + '/' )).to eq("http://test.com/blah/ha/" + rel2)
442
444
  end
443
445
  end
444
446
 
445
447
  describe '#up_to_path' do
446
448
  it 'returns the URL up to its path component (no resource name, query, fragment, etc)' do
447
449
  url = 'http://test.com/path/goes/here.php?query=goes&here=.!#frag'
448
- described_class.parse( url ).up_to_path.should == 'http://test.com/path/goes/'
450
+ expect(described_class.parse( url ).up_to_path).to eq('http://test.com/path/goes/')
449
451
 
450
452
  url = 'http://test.com/path/goes/here/?query=goes&here=.!#frag'
451
- described_class.parse( url ).up_to_path.should == 'http://test.com/path/goes/here/'
453
+ expect(described_class.parse( url ).up_to_path).to eq('http://test.com/path/goes/here/')
452
454
 
453
455
  url = 'http://test.com/path/goes/here?query=goes&here=.!#frag'
454
- described_class.parse( url ).up_to_path.should == 'http://test.com/path/goes/here/'
456
+ expect(described_class.parse( url ).up_to_path).to eq('http://test.com/path/goes/here/')
455
457
 
456
458
  url = 'http://test.com'
457
- described_class.parse( url ).up_to_path.should == 'http://test.com/'
459
+ expect(described_class.parse( url ).up_to_path).to eq('http://test.com/')
458
460
 
459
461
  url = 'http://test.com/'
460
- described_class.parse( url ).up_to_path.should == 'http://test.com/'
462
+ expect(described_class.parse( url ).up_to_path).to eq('http://test.com/')
461
463
  end
462
464
  end
463
465
 
464
466
  describe '#domain' do
465
467
  it 'removes the deepest subdomain from the host' do
466
468
  url = 'http://test.com/'
467
- described_class.parse( url ).domain.should == 'test.com'
469
+ expect(described_class.parse( url ).domain).to eq('test.com')
468
470
 
469
471
  url = 'http://test/'
470
- described_class.parse( url ).domain.should == 'test'
472
+ expect(described_class.parse( url ).domain).to eq('test')
471
473
 
472
474
  url = 'http://subdomain.test.com/'
473
- described_class.parse( url ).domain.should == 'test.com'
475
+ expect(described_class.parse( url ).domain).to eq('test.com')
474
476
 
475
477
  url = 'http://deep.subdomain.test.com/'
476
- described_class.parse( url ).domain.should == 'subdomain.test.com'
478
+ expect(described_class.parse( url ).domain).to eq('subdomain.test.com')
477
479
  end
478
480
 
479
481
  context 'when no host is available' do
480
482
  it 'returns nil' do
481
483
  url = '/stuff/'
482
- described_class.parse( url ).domain.should be_nil
484
+ expect(described_class.parse( url ).domain).to be_nil
483
485
  end
484
486
  end
485
487
  end
@@ -488,13 +490,13 @@ describe Arachni::URI do
488
490
  context 'when passed a URL with' do
489
491
  context 'a domain name' do
490
492
  it 'returns false' do
491
- described_class.parse( 'http://stuff.com/blah' ).ip_address?.should be_false
493
+ expect(described_class.parse( 'http://stuff.com/blah' ).ip_address?).to be_falsey
492
494
  end
493
495
  end
494
496
 
495
497
  context 'an IP address' do
496
498
  it 'returns the IP address' do
497
- described_class.parse( 'http://127.0.0.1/blah/' ).ip_address?.should be_true
499
+ expect(described_class.parse( 'http://127.0.0.1/blah/' ).ip_address?).to be_truthy
498
500
  end
499
501
  end
500
502
  end
@@ -503,7 +505,7 @@ describe Arachni::URI do
503
505
  describe '#without_query' do
504
506
  it 'returns the URI up to its resource component without the query' do
505
507
  expected = 'http://test.com/directory/resource.php'
506
- described_class.new( "#{expected}?param=1&param2=2" ).without_query.should == expected
508
+ expect(described_class.new( "#{expected}?param=1&param2=2" ).without_query).to eq(expected)
507
509
  end
508
510
  end
509
511
 
@@ -512,14 +514,14 @@ describe Arachni::URI do
512
514
  let(:rewritten) { described_class.new( 'http://test.com/articles.php?id=23' ) }
513
515
 
514
516
  it 'rewrites a URL based on the given rules' do
515
- url.rewrite( rewrite_rules ).should == rewritten
517
+ expect(url.rewrite( rewrite_rules )).to eq(rewritten)
516
518
  end
517
519
 
518
520
  context 'when no rules are provided' do
519
521
  it "uses the ones in #{Arachni::OptionGroups::Scope}#url_rewrites" do
520
522
  Arachni::Options.scope.url_rewrites = rewrite_rules
521
523
 
522
- url.rewrite.should == rewritten
524
+ expect(url.rewrite).to eq(rewritten)
523
525
  end
524
526
  end
525
527
 
@@ -527,8 +529,8 @@ describe Arachni::URI do
527
529
  let(:url) { described_class.new( 'http://blahblah/more.blah' ) }
528
530
 
529
531
  it 'returns a copy of self' do
530
- url.rewrite.should == url
531
- url.rewrite.object_id.should_not == url.object_id
532
+ expect(url.rewrite).to eq(url)
533
+ expect(url.rewrite.object_id).not_to eq(url.object_id)
532
534
  end
533
535
  end
534
536
  end
@@ -536,45 +538,45 @@ describe Arachni::URI do
536
538
  describe '#resource_name' do
537
539
  context 'when there is no file name' do
538
540
  it 'returns nil' do
539
- described_class.new( 'http://stuff.com/' ).resource_name.should be_nil
541
+ expect(described_class.new( 'http://stuff.com/' ).resource_name).to be_nil
540
542
  end
541
543
  end
542
544
 
543
545
  it 'returns the file name of the resource' do
544
546
  uri = 'http://test.com/direct.ory/resource.php?param=1&param2=2'
545
- described_class.new( uri ).resource_name.should == 'resource.php'
546
- described_class.new( 'http://stuff.com/test/' ).resource_name.should == 'test'
547
+ expect(described_class.new( uri ).resource_name).to eq('resource.php')
548
+ expect(described_class.new( 'http://stuff.com/test/' ).resource_name).to eq('test')
547
549
  end
548
550
  end
549
551
 
550
552
  describe '#resource_extension' do
551
553
  context 'when there is no extension' do
552
554
  it 'returns nil' do
553
- described_class.new( 'http://stuff.com/test' ).resource_extension.should be_nil
555
+ expect(described_class.new( 'http://stuff.com/test' ).resource_extension).to be_nil
554
556
  end
555
557
  end
556
558
 
557
559
  context 'when there are multiple periods' do
558
560
  it 'returns the last one' do
559
- described_class.new( 'http://stuff.com/test.1.2' ).resource_extension.should == '2'
561
+ expect(described_class.new( 'http://stuff.com/test.1.2' ).resource_extension).to eq('2')
560
562
  end
561
563
  end
562
564
 
563
565
  it 'returns the extension of the resource' do
564
566
  uri = "http://test.com/direct.ory/resource.php?param=1&param2=2"
565
- described_class.new( uri ).resource_extension.should == 'php'
567
+ expect(described_class.new( uri ).resource_extension).to eq('php')
566
568
  end
567
569
  end
568
570
 
569
571
  describe '#mailto?' do
570
572
  context 'when the URI has a mailto scheme' do
571
573
  it 'returns true' do
572
- described_class.new( 'mailto:stuff@blah.com' ).mailto?.should be_true
574
+ expect(described_class.new( 'mailto:stuff@blah.com' ).mailto?).to be_truthy
573
575
  end
574
576
  end
575
577
  context 'when the URI does not have a mailto scheme' do
576
578
  it 'returns false' do
577
- described_class.new( 'blah.com' ).mailto?.should be_false
579
+ expect(described_class.new( 'blah.com' ).mailto?).to be_falsey
578
580
  end
579
581
  end
580
582
  end
@@ -582,30 +584,30 @@ describe Arachni::URI do
582
584
  describe '#hash' do
583
585
  it 'returns a hash uniquely identifying the URI' do
584
586
  uri = described_class.new( 'http://stuff/' )
585
- uri.hash.should be_kind_of Integer
586
- uri.hash.should == uri.hash
587
+ expect(uri.hash).to be_kind_of Integer
588
+ expect(uri.hash).to eq(uri.hash)
587
589
 
588
590
  uri2 = described_class.new( 'http://stuff2/' )
589
- uri.hash.should_not == uri2.hash
591
+ expect(uri.hash).not_to eq(uri2.hash)
590
592
  end
591
593
 
592
594
  it 'is an integer' do
593
- described_class.new( 'http://stuff/' ).hash.should be_kind_of Integer
595
+ expect(described_class.new( 'http://stuff/' ).hash).to be_kind_of Integer
594
596
  end
595
597
  end
596
598
 
597
599
  describe '#persistent_hash' do
598
600
  it 'returns a hash uniquely identifying the URI' do
599
601
  uri = described_class.new( 'http://stuff/' )
600
- uri.persistent_hash.should be_kind_of Integer
601
- uri.persistent_hash.should == uri.persistent_hash
602
+ expect(uri.persistent_hash).to be_kind_of Integer
603
+ expect(uri.persistent_hash).to eq(uri.persistent_hash)
602
604
 
603
605
  uri2 = described_class.new( 'http://stuff2/' )
604
- uri.persistent_hash.should_not == uri2.persistent_hash
606
+ expect(uri.persistent_hash).not_to eq(uri2.persistent_hash)
605
607
  end
606
608
 
607
609
  it 'is an integer' do
608
- described_class.new( 'http://stuff/' ).persistent_hash.should be_kind_of Integer
610
+ expect(described_class.new( 'http://stuff/' ).persistent_hash).to be_kind_of Integer
609
611
  end
610
612
  end
611
613
  end