arachni 1.2.1 → 1.3

data/spec/arachni/utilities_spec.rb

@@ -18,13 +18,13 @@ describe Arachni::Utilities do
 
     describe '#caller_name' do
         it 'returns the filename of the caller' do
-            subject.caller_name.should == 'instance_eval_with_args'
+            expect(subject.caller_name).to eq('instance_eval_with_args')
         end
     end
 
     describe '#caller_path' do
         it 'returns the filepath of the caller' do
-            subject.caller_path.should == Kernel.caller.first.match( /^(.+):\d/ )[1]
+            expect(subject.caller_path).to eq(Kernel.caller.first.match( /^(.+):\d/ )[1])
         end
     end
 
@@ -61,15 +61,15 @@ describe Arachni::Utilities do
             it "delegates to #{klass}.#{delegated}" do
                 ret = :blah
 
-                klass.stub(delegated){ ret }
-                subject.send( m, 'stuff' ).should == ret
+                allow(klass).to receive(delegated){ ret }
+                expect(subject.send( m, 'stuff' )).to eq(ret)
             end
         end
     end
 
     describe '#uri_parser' do
         it 'returns a URI::Parser' do
-            subject.uri_parser.class.should == ::URI::Parser
+            expect(subject.uri_parser.class).to eq(::URI::Parser)
         end
     end
 
@@ -78,8 +78,8 @@ describe Arachni::Utilities do
     }.each do |k, v|
         describe "##{k}" do
             it "delegates to #{Arachni::URI}##{v}" do
-                Arachni::URI.any_instance.stub(v) { :stuff }
-                subject.send( k, 'http://url/' ).should == :stuff
+                allow_any_instance_of(Arachni::URI).to receive(v) { :stuff }
+                expect(subject.send( k, 'http://url/' )).to eq(:stuff)
             end
         end
     end
@@ -94,8 +94,8 @@ describe Arachni::Utilities do
     }.each do |k, v|
         describe "##{k}" do
             it "delegates to #{Arachni::URI::Scope}##{v}" do
-                Arachni::URI::Scope.any_instance.stub(v) { :stuff }
-                subject.send( k, 'http://url/' ).should == :stuff
+                allow_any_instance_of(Arachni::URI::Scope).to receive(v) { :stuff }
+                expect(subject.send( k, 'http://url/' )).to eq(:stuff)
             end
         end
     end
@@ -103,14 +103,14 @@ describe Arachni::Utilities do
     describe '#port_available?' do
         context 'when a port is available' do
             it 'returns true' do
-                subject.port_available?( 7777 ).should be_true
+                expect(subject.port_available?( 7777 )).to be_truthy
             end
         end
 
         context 'when a port is not available' do
             it 'returns true' do
                 s = TCPServer.new( 7777 )
-                subject.port_available?( 7777 ).should be_false
+                expect(subject.port_available?( 7777 )).to be_falsey
                 s.close
             end
         end
@@ -118,15 +118,15 @@ describe Arachni::Utilities do
 
     describe '#skip_page?' do
         it "delegates to #{Arachni::Page::Scope}#out?" do
-            Arachni::Page::Scope.any_instance.stub(:out?) { :stuff }
-            subject.skip_page?( page ).should == :stuff
+            allow_any_instance_of(Arachni::Page::Scope).to receive(:out?) { :stuff }
+            expect(subject.skip_page?( page )).to eq(:stuff)
         end
     end
 
     describe '#skip_response?' do
         it "delegates to #{Arachni::HTTP::Response::Scope}#out?" do
-            Arachni::HTTP::Response::Scope.any_instance.stub(:out?) { :stuff }
-            subject.skip_response?( response ).should == :stuff
+            allow_any_instance_of(Arachni::HTTP::Response::Scope).to receive(:out?) { :stuff }
+            expect(subject.skip_response?( response )).to eq(:stuff)
         end
     end
 
@@ -136,15 +136,15 @@ describe Arachni::Utilities do
                 context 'and #skip_response? returns' do
                     context 'true' do
                         it 'returns true' do
-                            subject.stub(:skip_response?){ true }
-                            subject.skip_resource?( response ).should be_true
+                            allow(subject).to receive(:skip_response?){ true }
+                            expect(subject.skip_resource?( response )).to be_truthy
                         end
                     end
 
                     context 'false' do
                         it 'returns false' do
-                            subject.stub(:skip_response?){ false }
-                            subject.skip_resource?( response ).should be_false
+                            allow(subject).to receive(:skip_response?){ false }
+                            expect(subject.skip_resource?( response )).to be_falsey
                         end
                     end
                 end
@@ -154,15 +154,15 @@ describe Arachni::Utilities do
                 context 'and #skip_page? returns' do
                     context 'true' do
                         it 'returns true' do
-                            subject.stub(:skip_page?){ true }
-                            subject.skip_resource?( page ).should be_true
+                            allow(subject).to receive(:skip_page?){ true }
+                            expect(subject.skip_resource?( page )).to be_truthy
                         end
                     end
 
                     context 'false' do
                         it 'returns false' do
-                            subject.stub(:skip_page?){ false }
-                            subject.skip_resource?( page ).should be_false
+                            allow(subject).to receive(:skip_page?){ false }
+                            expect(subject.skip_resource?( page )).to be_falsey
                         end
                     end
                 end
@@ -172,15 +172,15 @@ describe Arachni::Utilities do
                 context 'and #skip_path? returns' do
                     context 'true' do
                         it 'returns true' do
-                            subject.stub(:skip_path?){ true }
-                            subject.skip_resource?( 'stuff' ).should be_true
+                            allow(subject).to receive(:skip_path?){ true }
+                            expect(subject.skip_resource?( 'stuff' )).to be_truthy
                         end
                     end
 
                     context 'false' do
                         it 'returns false' do
-                            subject.stub(:skip_path?){ false }
-                            subject.skip_resource?( 'stuff' ).should be_false
+                            allow(subject).to receive(:skip_path?){ false }
+                            expect(subject.skip_resource?( 'stuff' )).to be_falsey
                         end
                     end
                 end
@@ -190,34 +190,34 @@ describe Arachni::Utilities do
 
     describe '#random_seed' do
         it 'returns a random string' do
-            subject.random_seed.should be_kind_of String
+            expect(subject.random_seed).to be_kind_of String
         end
     end
 
     describe '#seconds_to_hms' do
         it 'converts seconds to HOURS:MINUTES:SECONDS' do
-            subject.seconds_to_hms( 0 ).should == '00:00:00'
-            subject.seconds_to_hms( 1 ).should == '00:00:01'
-            subject.seconds_to_hms( 60 ).should == '00:01:00'
-            subject.seconds_to_hms( 60*60 ).should == '01:00:00'
-            subject.seconds_to_hms( 60*60 + 60 + 1 ).should == '01:01:01'
+            expect(subject.seconds_to_hms( 0 )).to eq('00:00:00')
+            expect(subject.seconds_to_hms( 1 )).to eq('00:00:01')
+            expect(subject.seconds_to_hms( 60 )).to eq('00:01:00')
+            expect(subject.seconds_to_hms( 60*60 )).to eq('01:00:00')
+            expect(subject.seconds_to_hms( 60*60 + 60 + 1 )).to eq('01:01:01')
         end
     end
 
     describe '#hms_to_seconds' do
         it 'converts seconds to HOURS:MINUTES:SECONDS' do
-            subject.hms_to_seconds( '00:00:00' ).should == 0
-            subject.hms_to_seconds( '00:00:01' ).should == 1
-            subject.hms_to_seconds( '00:01:00' ).should == 60
-            subject.hms_to_seconds( '01:00:00' ).should == 60*60
-            subject.hms_to_seconds( '01:01:01').should == 60 * 60 + 60 + 1
+            expect(subject.hms_to_seconds( '00:00:00' )).to eq(0)
+            expect(subject.hms_to_seconds( '00:00:01' )).to eq(1)
+            expect(subject.hms_to_seconds( '00:01:00' )).to eq(60)
+            expect(subject.hms_to_seconds( '01:00:00' )).to eq(60*60)
+            expect(subject.hms_to_seconds( '01:01:01')).to eq(60 * 60 + 60 + 1)
         end
     end
 
     describe '#exception_jail' do
         context 'when no error occurs' do
             it 'returns the return value of the block' do
-                subject.exception_jail { :stuff }.should == :stuff
+                expect(subject.exception_jail { :stuff }).to eq(:stuff)
             end
         end
 
@@ -241,7 +241,7 @@ describe Arachni::Utilities do
 
                 context false do
                     it 'returns nil' do
-                        subject.exception_jail( false ) { raise }.should be_nil
+                        expect(subject.exception_jail( false ) { raise }).to be_nil
                     end
                 end
             end

data/spec/components/checks/active/csrf_spec.rb

@@ -16,29 +16,29 @@ describe name_from_filename do
 
     it 'logs forms that lack CSRF protection' do
         audit :forms
-        issues.size.should == 1
-        issues.first.vector.name.should == 'insecure_important_form'
+        expect(issues.size).to eq(1)
+        expect(issues.first.vector.name).to eq('insecure_important_form')
     end
 
     it 'skips forms that have an anti-CSRF token in a name attribute' do
         options.url = url + 'token_in_name'
         audit :forms
-        issues.size.should == 1
-        issues.first.vector.name.should == 'insecure_important_form'
+        expect(issues.size).to eq(1)
+        expect(issues.first.vector.name).to eq('insecure_important_form')
     end
 
     it 'skips forms that have an anti-CSRF token in their action URL' do
         options.url = url + 'token_in_action'
         audit :forms
-        issues.size.should == 1
-        issues.first.vector.name.should == 'insecure_important_form'
+        expect(issues.size).to eq(1)
+        expect(issues.first.vector.name).to eq('insecure_important_form')
     end
 
     it 'skips forms that have a nonce' do
         options.url = url + 'with_nonce'
         audit :forms
-        issues.size.should == 1
-        issues.first.vector.name.should == 'insecure_important_form'
+        expect(issues.size).to eq(1)
+        expect(issues.first.vector.name).to eq('insecure_important_form')
     end
 
 end

data/spec/components/checks/active/no_sql_injection_spec.rb

@@ -17,7 +17,7 @@ describe name_from_filename do
             mongodb: {
                 Element::Form         => 2,
                 Element::Link         => 2,
-                Element::Cookie       => 1,
+                Element::Cookie       => 2,
                 Element::Header       => 1,
                 Element::LinkTemplate => 1,
                 Element::JSON         => 2,

data/spec/components/checks/active/sql_injection_spec.rb

@@ -19,7 +19,7 @@ describe name_from_filename do
             access:     {
                 Element::Form         => 12,
                 Element::Link         => 12,
-                Element::Cookie       => 6,
+                Element::Cookie       => 12,
                 Element::Header       => 6,
                 Element::LinkTemplate => 6,
                 Element::JSON         => 12,
@@ -28,7 +28,7 @@ describe name_from_filename do
             db2:        {
                 Element::Form         => 16,
                 Element::Link         => 16,
-                Element::Cookie       => 8,
+                Element::Cookie       => 16,
                 Element::Header       => 8,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 16,
@@ -37,7 +37,7 @@ describe name_from_filename do
             emc:        {
                 Element::Form         => 8,
                 Element::Link         => 8,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 4,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 8,
@@ -46,7 +46,7 @@ describe name_from_filename do
             firebird:   {
                 Element::Form         => 4,
                 Element::Link         => 4,
-                Element::Cookie       => 2,
+                Element::Cookie       => 4,
                 Element::Header       => 2,
                 Element::LinkTemplate => 2,
                 Element::JSON         => 4,
@@ -55,7 +55,7 @@ describe name_from_filename do
             frontbase:  {
                 Element::Form         => 4,
                 Element::Link         => 4,
-                Element::Cookie       => 2,
+                Element::Cookie       => 4,
                 Element::Header       => 2,
                 Element::LinkTemplate => 2,
                 Element::JSON         => 4,
@@ -64,7 +64,7 @@ describe name_from_filename do
             hsqldb:     {
                 Element::Form         => 4,
                 Element::Link         => 4,
-                Element::Cookie       => 2,
+                Element::Cookie       => 4,
                 Element::Header       => 2,
                 Element::LinkTemplate => 2,
                 Element::JSON         => 4,
@@ -73,7 +73,7 @@ describe name_from_filename do
             informix:   {
                 Element::Form         => 12,
                 Element::Link         => 12,
-                Element::Cookie       => 6,
+                Element::Cookie       => 12,
                 Element::Header       => 6,
                 Element::LinkTemplate => 6,
                 Element::JSON         => 12,
@@ -82,7 +82,7 @@ describe name_from_filename do
             ingres:     {
                 Element::Form         => 12,
                 Element::Link         => 12,
-                Element::Cookie       => 6,
+                Element::Cookie       => 12,
                 Element::Header       => 6,
                 Element::LinkTemplate => 6,
                 Element::JSON         => 12,
@@ -91,7 +91,7 @@ describe name_from_filename do
             interbase:  {
                 Element::Form         => 8,
                 Element::Link         => 8,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 4,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 8,
@@ -100,7 +100,7 @@ describe name_from_filename do
             maxdb:      {
                 Element::Form         => 4,
                 Element::Link         => 4,
-                Element::Cookie       => 2,
+                Element::Cookie       => 4,
                 Element::Header       => 2,
                 Element::LinkTemplate => 2,
                 Element::JSON         => 4,
@@ -109,7 +109,7 @@ describe name_from_filename do
             mssql:      {
                 Element::Form         => 86,
                 Element::Link         => 86,
-                Element::Cookie       => 42,
+                Element::Cookie       => 86,
                 Element::Header       => 42,
                 Element::LinkTemplate => 42,
                 Element::JSON         => 86,
@@ -118,7 +118,7 @@ describe name_from_filename do
             mysql:      {
                 Element::Form         => 52,
                 Element::Link         => 52,
-                Element::Cookie       => 26,
+                Element::Cookie       => 52,
                 Element::Header       => 26,
                 Element::LinkTemplate => 26,
                 Element::JSON         => 52,
@@ -127,7 +127,7 @@ describe name_from_filename do
             oracle:     {
                 Element::Form         => 20,
                 Element::Link         => 20,
-                Element::Cookie       => 10,
+                Element::Cookie       => 20,
                 Element::Header       => 10,
                 Element::LinkTemplate => 10,
                 Element::JSON         => 20,
@@ -136,7 +136,7 @@ describe name_from_filename do
             pgsql:      {
                 Element::Form         => 36,
                 Element::Link         => 36,
-                Element::Cookie       => 18,
+                Element::Cookie       => 36,
                 Element::Header       => 18,
                 Element::LinkTemplate => 18,
                 Element::JSON         => 36,
@@ -145,7 +145,7 @@ describe name_from_filename do
             sqlite:     {
                 Element::Form         => 16,
                 Element::Link         => 16,
-                Element::Cookie       => 8,
+                Element::Cookie       => 16,
                 Element::Header       => 8,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 16,
@@ -154,7 +154,7 @@ describe name_from_filename do
             sybase:     {
                 Element::Form         => 12,
                 Element::Link         => 12,
-                Element::Cookie       => 6,
+                Element::Cookie       => 12,
                 Element::Header       => 6,
                 Element::LinkTemplate => 6,
                 Element::JSON         => 12,

data/spec/components/checks/active/trainer_spec.rb

@@ -17,8 +17,8 @@ describe name_from_filename do
             audit element, false
 
             urls = framework.sitemap
-            urls.should include options.url + "#{element}/straight/trained"
-            urls.should include options.url + "#{element}/append/trained"
+            expect(urls).to include options.url + "#{element}/straight/trained"
+            expect(urls).to include options.url + "#{element}/append/trained"
         end
     end
 
@@ -28,8 +28,8 @@ describe name_from_filename do
             audit :form, false
 
             urls = framework.sitemap
-            urls.should_not include "#{options.url}form/straight/trained"
-            urls.should_not include "#{options.url}form/append/trained"
+            expect(urls).not_to include "#{options.url}header/straight/trained"
+            expect(urls).not_to include "#{options.url}header/append/trained"
         end
     end
 

data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb

@@ -4,14 +4,16 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form::DOM, Element::Link::DOM, Element::Cookie::DOM ]
+        [ Element::Form::DOM, Element::Link::DOM, Element::Cookie::DOM,
+          Element::UIForm::DOM ]
     end
 
     def issue_count_per_element
         {
             Element::Form::DOM   => 3,
             Element::Link::DOM   => 3,
-            Element::Cookie::DOM => 3
+            Element::Cookie::DOM => 3,
+            Element::UIForm::DOM => 3
         }
     end
 

data/spec/components/checks/active/xpath_injection_spec.rb

@@ -12,7 +12,7 @@ describe name_from_filename do
         {
             Element::Form         => 125,
             Element::Link         => 125,
-            Element::Cookie       => 75,
+            Element::Cookie       => 150,
             Element::Header       => 75,
             Element::LinkTemplate => 75,
             Element::JSON         => 75,

data/spec/components/checks/active/xss_dom_script_context_spec.rb

@@ -5,7 +5,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form::DOM, Element::Link::DOM, Element::Cookie::DOM,
-          Element::LinkTemplate::DOM]
+          Element::LinkTemplate::DOM, Element::UIInput::DOM, Element::UIForm::DOM ]
     end
 
     def issue_count_per_element
@@ -13,49 +13,79 @@ describe name_from_filename do
             Element::Form::DOM         => 2,
             Element::Link::DOM         => 2,
             Element::Cookie::DOM       => 2,
-            Element::LinkTemplate::DOM => 2
+            Element::LinkTemplate::DOM => 2,
+            Element::UIInput::DOM        => 2,
+            Element::UIForm::DOM       => 2
         }
     end
 
     easy_test do
         issues.each do |issue|
-            issue.page.dom.execution_flow_sinks.should be_any
+            expect(issue.page.dom.execution_flow_sinks).to be_any
             data_flow_sinks = issue.page.dom.data_flow_sinks
 
-            if [Element::Link::DOM, Element::LinkTemplate::DOM].include? issue.vector.class
-                data_flow_sinks.size.should == 2
+            if [
+                Element::Cookie::DOM,
+                Element::Link::DOM,
+                Element::LinkTemplate::DOM
+            ].include?( issue.vector.class )
+
+                expect(data_flow_sinks.size).to eq 2
+
+            elsif issue.vector.class == Element::UIInput::DOM
+
+                expect(data_flow_sinks.size).to eq 3
+
             else
-                data_flow_sinks.size.should == 1
+                expect(data_flow_sinks.size).to eq 1
             end
 
             data = data_flow_sinks.last
-            data.function.source.should start_with 'function pre_eval('
-            data.function.name.should == 'pre_eval'
-            data.object.should == 'DOMWindow'
-            data.taint.should include 'taint_tracer.log_execution_flow_sink()'
-            data.tainted_value.should include 'taint_tracer.log_execution_flow_sink()'
-            data.function.arguments.should == [data.tainted_value]
+            expect(data.function.source).to start_with 'function pre_eval('
+            expect(data.function.name).to eq 'pre_eval'
+            expect(data.object).to eq 'DOMWindow'
+            expect(data.taint).to include 'taint_tracer.log_execution_flow_sink()'
+            expect(data.tainted_value).to include 'taint_tracer.log_execution_flow_sink()'
+            expect(data.function.arguments).to eq [data.tainted_value]
 
             trace = data_flow_sinks.first.trace
 
             case issue.vector
 
                 when Element::Form::DOM
-                    trace.size.should == 2
-                    trace.first.function.source.should start_with 'function handleSubmit()'
-                    trace.first.function.name.should start_with 'handleSubmit'
+                    expect(trace.size).to eq 2
+                    expect(trace.first.function.source).to start_with 'function handleSubmit()'
+                    expect(trace.first.function.name).to start_with 'handleSubmit'
 
                 when Element::LinkTemplate::DOM
-                    trace.size.should == 2
-                    trace.first.url.should == issue.page.dom.url
+                    expect(trace.size).to eq 2
+                    expect(trace.first.url).to eq issue.page.dom.url
 
                 when Element::Link::DOM
-                    trace.size.should == 2
-                    trace.first.url.should == issue.page.dom.url
+                    expect(trace.size).to eq 2
+                    expect(trace.first.url).to eq issue.page.dom.url
 
                 when Element::Cookie::DOM
-                    trace.size.should == 1
-                    trace.first.url.should == issue.page.dom.url
+                    expect(trace.size).to eq 2
+                    expect(trace.first.url).to eq issue.page.dom.url
+
+                when Element::UIInput::DOM
+                    transition = issue.page.dom.transitions.last
+
+                    expect(transition.element.tag_name).to eq :input
+                    expect(transition.event).to eq :input
+
+                when Element::UIForm::DOM
+                    transitions = [
+                        issue.page.dom.transitions.pop,
+                        issue.page.dom.transitions.pop
+                    ].reverse
+
+                    expect(transitions[0].element.tag_name).to eq :input
+                    expect(transitions[0].event).to eq :input
+
+                    expect(transitions[1].element.tag_name).to eq :button
+                    expect(transitions[1].event).to eq :click
             end
 
         end