arachni 1.2.1 → 1.3

data/spec/components/checks/active/xss_dom_spec.rb

@@ -5,7 +5,7 @@ describe name_from_filename do
 
     def self.elements
         [ Element::Form::DOM, Element::Link::DOM, Element::Cookie::DOM,
-          Element::LinkTemplate::DOM ]
+          Element::LinkTemplate::DOM, Element::UIInput::DOM, Element::UIForm::DOM ]
     end
 
     def issue_count_per_element
@@ -13,7 +13,9 @@ describe name_from_filename do
             Element::Form::DOM         => 2,
             Element::Link::DOM         => 2,
             Element::Cookie::DOM       => 2,
-            Element::LinkTemplate::DOM => 2
+            Element::LinkTemplate::DOM => 2,
+            Element::UIInput::DOM        => 2,
+            Element::UIForm::DOM       => 2
         }
     end
 
@@ -25,41 +27,61 @@ describe name_from_filename do
             case issue.vector
 
                 when Element::Form::DOM
-                    transition.element.tag_name.should == :form
-                    transition.event.should == :submit
+                    expect(transition.element.tag_name).to eq :form
+                    expect(transition.event).to eq :submit
 
-                    data_flow_sinks.should be_empty
+                    expect(data_flow_sinks).to be_empty
 
                 when Element::LinkTemplate::DOM
-                    transition.element.should == :page
-                    transition.event.should == :load
+                    expect(transition.element).to eq :page
+                    expect(transition.event).to eq :load
 
-                    data_flow_sinks.size.should == 1
+                    expect(data_flow_sinks.size).to eq 1
                     data_flow_sink = data_flow_sinks.first
 
-                    data_flow_sink.function.source.should start_with 'function decodeURI()'
-                    data_flow_sink.function.name.should == 'decodeURI'
-                    data_flow_sink.object.should == 'DOMWindow'
-                    data_flow_sink.tainted_value.should include Arachni::URI(issue.vector.seed).to_s
-                    data_flow_sink.function.arguments.should == [data_flow_sink.tainted_value]
+                    expect(data_flow_sink.function.source).to start_with 'function decodeURI()'
+                    expect(data_flow_sink.function.name).to eq 'decodeURI'
+                    expect(data_flow_sink.object).to eq 'DOMWindow'
+                    expect(data_flow_sink.tainted_value).to include Arachni::URI(issue.vector.seed).to_s
+                    expect(data_flow_sink.function.arguments).to eq [data_flow_sink.tainted_value]
 
                 when Element::Link::DOM
-                    transition.element.should == :page
-                    transition.event.should == :load
+                    expect(transition.element).to eq :page
+                    expect(transition.event).to eq :load
 
-                    data_flow_sinks.size.should == 1
+                    expect(data_flow_sinks.size).to eq 1
                     data_flow_sink = data_flow_sinks.first
 
-                    data_flow_sink.function.source.should start_with 'function decodeURIComponent()'
-                    data_flow_sink.function.name.should == 'decodeURIComponent'
-                    data_flow_sink.object.should == 'DOMWindow'
-                    data_flow_sink.tainted_value.should include Arachni::URI(issue.vector.seed).to_s
-                    data_flow_sink.function.arguments.should == [data_flow_sink.tainted_value]
+                    expect(data_flow_sink.function.source).to start_with 'function decodeURIComponent()'
+                    expect(data_flow_sink.function.name).to eq 'decodeURIComponent'
+                    expect(data_flow_sink.object).to eq 'DOMWindow'
+                    expect(data_flow_sink.tainted_value).to include Arachni::URI(issue.vector.seed).to_s
+                    expect(data_flow_sink.function.arguments).to eq [data_flow_sink.tainted_value]
 
                 when Element::Cookie::DOM
-                    transition.element.should == :page
-                    transition.event.should == :load
-                    transition.options[:cookies].should == issue.vector.inputs
+                    expect(transition.element).to eq :page
+                    expect(transition.event).to eq :load
+                    expect(transition.options[:cookies]).to eq issue.vector.inputs
+
+                when Element::UIInput::DOM
+                    expect(transition.element.tag_name).to eq :input
+                    expect(transition.event).to eq :input
+
+                    expect(data_flow_sinks).to be_empty
+
+                when Element::UIForm::DOM
+                    transitions = [
+                        issue.page.dom.transitions.pop,
+                        issue.page.dom.transitions.pop
+                    ].reverse
+
+                    expect(transitions[0].element.tag_name).to eq :input
+                    expect(transitions[0].event).to eq :input
+
+                    expect(transitions[1].element.tag_name).to eq :button
+                    expect(transitions[1].event).to eq :click
+
+                    expect(data_flow_sinks).to be_empty
             end
 
         end

data/spec/components/checks/passive/allowed_methods_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         1
     end
 
-    easy_test { issues.first.proof.should == 'OPTIONS, TRACE, GET, HEAD' }
+    easy_test { expect(issues.first.proof).to eq 'OPTIONS, TRACE, GET, HEAD' }
 end

data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         2
     end
 
-    easy_test { issues.map { |i| i.vector.name }.sort.should == %w(cookie cookie2).sort }
+    easy_test { expect(issues.map { |i| i.vector.name }.sort).to eq %w(cookie cookie2).sort }
 end

data/spec/components/checks/passive/grep/hsts_spec.rb

@@ -14,12 +14,12 @@ describe name_from_filename do
     it 'logs hosts missing the header' do
         options.url = "#{url}/vulnerable"
         run
-        issues.should be_any
+        expect(issues).to be_any
     end
 
     it 'logs hosts missing the header' do
         options.url = "#{url}/safe"
         run
-        issues.should be_empty
+        expect(issues).to be_empty
     end
 end

data/spec/components/checks/passive/grep/http_only_cookies_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         2
     end
 
-    easy_test { issues.map { |i| i.vector.name }.sort.should == %w(cookie cookie2).sort }
+    easy_test { expect(issues.map { |i| i.vector.name }.sort).to eq %w(cookie cookie2).sort }
 end

data/spec/components/checks/passive/grep/insecure_cookies_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         2
     end
 
-    easy_test { issues.map { |i| i.vector.name }.sort.should == %w(cookie cookie2).sort }
+    easy_test { expect(issues.map { |i| i.vector.name }.sort).to eq %w(cookie cookie2).sort }
 end

data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb

@@ -14,12 +14,12 @@ describe name_from_filename do
     it 'logs hosts with a wildcard Access-Control-Allow-Origin' do
         options.url = "#{url}/vulnerable"
         run
-        issues.should be_any
+        expect(issues).to be_any
     end
 
     it 'does not log hosts without a wildcard Access-Control-Allow-Origin' do
         options.url = "#{url}/safe"
         run
-        issues.should be_empty
+        expect(issues).to be_empty
     end
 end

data/spec/components/checks/passive/grep/password_autocomplete_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         2
     end
 
-    easy_test { issues.map { |i| i.vector.name_or_id }.sort.should == %w(insecure insecure_2).sort }
+    easy_test { expect(issues.map { |i| i.vector.name_or_id }.sort).to eq %w(insecure insecure_2).sort }
 end

data/spec/components/checks/passive/grep/private_ip_spec.rb

@@ -13,10 +13,10 @@ describe name_from_filename do
 
     easy_test( false ) do
         header_issue = issues.select { |i| i.vector.class == Element::Header }.first
-        header_issue.vector.name.should == 'Disclosure'
-        header_issue.proof.should == '192.168.1.121'
+        expect(header_issue.vector.name).to eq 'Disclosure'
+        expect(header_issue.proof).to eq '192.168.1.121'
 
         body_issue  = issues.select { |i| i.vector.class == Element::Body }.first
-        body_issue.proof.should == '192.168.1.12'
+        expect(body_issue.proof).to eq '192.168.1.12'
     end
 end

data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         2
     end
 
-    easy_test { issues.map { |i| i.vector.affected_input_name }.sort.should == %w(insecure insecure_2).sort }
+    easy_test { expect(issues.map { |i| i.vector.affected_input_name }.sort).to eq %w(insecure insecure_2).sort }
 end

data/spec/components/checks/passive/grep/x_frame_options_spec.rb

@@ -14,12 +14,12 @@ describe name_from_filename do
     it 'logs hosts missing the header' do
         options.url = "#{url}/vulnerable"
         run
-        issues.should be_any
+        expect(issues).to be_any
     end
 
     it 'does not log hosts with the header' do
         options.url = "#{url}/safe"
         run
-        issues.should be_empty
+        expect(issues).to be_empty
     end
 end

data/spec/components/checks/passive/interesting_responses_spec.rb

@@ -18,7 +18,7 @@ describe name_from_filename do
         http.run
 
         max_issues = current_check.max_issues
-        issues.size.should == max_issues
+        expect(issues.size).to eq(max_issues)
     end
 
     it 'skips HTTP responses which are out of scope' do
@@ -31,6 +31,6 @@ describe name_from_filename do
         end
         http.run
 
-        issues.should be_empty
+        expect(issues).to be_empty
     end
 end

data/spec/components/checks/passive/webdav_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         1
     end
 
-    easy_test { issues.first.vector.url.should == url }
+    easy_test { expect(issues.first.vector.url).to eq url }
 end

data/spec/components/checks/passive/xst_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         1
     end
 
-    easy_test { issues.first.vector.url.should == url }
+    easy_test { expect(issues.first.vector.url).to eq url }
 end

data/spec/components/fingerprinters/servers/apache_spec.rb

@@ -27,10 +27,10 @@ describe Arachni::Platform::Fingerprinters::Apache do
 
     context 'when there is an Server header that includes Coyote' do
         it 'does not identify it as Apache' do
-            platforms_for( Arachni::Page.from_data(
+            expect(platforms_for( Arachni::Page.from_data(
                 url:     'http://stuff.com/blah',
                 response: { headers:  { 'Server' => 'Apache-Coyote/1.1' } }
-            )).to_a.should be_empty
+            )).to_a).to be_empty
         end
     end
 

data/spec/components/path_extractors/comments_spec.rb

@@ -6,13 +6,17 @@ describe name_from_filename do
     def results
         [
             '/stuff/here.php',
-            '/stuff/here'
+            '/stuff/here',
+            '/other/stuff/here.php'
         ]
     end
 
     def text
         <<-HTML
             <!-- Blah blah: /stuff/here.php -->
+<!--
+/other/stuff/here.php
+-->
             <!-- <style type="text/css"> stuff: here; </style> -->
             Blah blah...
             <!--Pre blah /stuff/here post blah -->

data/spec/components/path_extractors/scripts_spec.rb

@@ -8,14 +8,17 @@ describe name_from_filename do
             'http://test.com',
             'test',
             'test.com',
-            'test/stuff2.php'
+            '/test/stuff2.php'
         ]
     end
 
     def text
         s = <<SCRIPT
         <script>
-            var path = "test/stuff2.php"
+            /*Blah.1*/
+            //Blah.2
+            var path = "/test/stuff2.php"
+            var ignore = "test/stuff2"
         </script>
 SCRIPT
 

data/spec/components/plugins/autologin_spec.rb

@@ -22,11 +22,11 @@ describe name_from_filename do
 
             run
 
-            actual_results['status'].should  == 'ok'
-            actual_results['message'].should == plugin::STATUSES[:ok]
-            actual_results['cookies']['success'].should == 'true'
+            expect(actual_results['status']).to  eq('ok')
+            expect(actual_results['message']).to eq(plugin::STATUSES[:ok])
+            expect(actual_results['cookies']['success']).to eq('true')
 
-            framework.sitemap.include?( url + 'congrats' ).should be_true
+            expect(framework.sitemap.include?( url + 'congrats' )).to be_truthy
         end
 
         it 'provides a login sequence and login check to the framework' do
@@ -39,17 +39,17 @@ describe name_from_filename do
             # The framework will call #clean_up which nil out the session...
             session = framework.session
             # ...in addition to removing its configuration.
-            session.stub(:clean_up)
+            allow(session).to receive(:clean_up)
 
             run
 
-            session.logged_in?.should be_true
+            expect(session.logged_in?).to be_truthy
 
             http.cookie_jar.clear
 
-            session.logged_in?.should be_false
-            session.login.should be_true
-            session.logged_in?.should be_true
+            expect(session.logged_in?).to be_falsey
+            expect(session.login).to be_truthy
+            expect(session.logged_in?).to be_truthy
         end
     end
 
@@ -65,14 +65,14 @@ describe name_from_filename do
         it 'complains about not being able to find the form' do
             run
 
-            actual_results['status'].should  == 'form_not_found'
-            actual_results['message'].should == plugin::STATUSES[:form_not_found]
+            expect(actual_results['status']).to  eq('form_not_found')
+            expect(actual_results['message']).to eq(plugin::STATUSES[:form_not_found])
         end
 
         it 'aborts the scan' do
             run
 
-            framework.status.should == :aborted
+            expect(framework.status).to eq(:aborted)
         end
     end
 
@@ -88,14 +88,14 @@ describe name_from_filename do
         it 'complains about not the form being invisible' do
             run
 
-            actual_results['status'].should  == 'form_not_visible'
-            actual_results['message'].should == plugin::STATUSES[:form_not_visible]
+            expect(actual_results['status']).to  eq('form_not_visible')
+            expect(actual_results['message']).to eq(plugin::STATUSES[:form_not_visible])
         end
 
         it 'aborts the scan' do
             run
 
-            framework.status.should == :aborted
+            expect(framework.status).to eq(:aborted)
         end
     end
 
@@ -111,14 +111,14 @@ describe name_from_filename do
         it 'complains about not being able to verify the login' do
             run
 
-            actual_results['status'].should  == 'check_failed'
-            actual_results['message'].should == plugin::STATUSES[:check_failed]
+            expect(actual_results['status']).to  eq('check_failed')
+            expect(actual_results['message']).to eq(plugin::STATUSES[:check_failed])
         end
 
         it 'aborts the scan' do
             run
 
-            framework.status.should == :aborted
+            expect(framework.status).to eq(:aborted)
         end
     end
 
@@ -135,7 +135,7 @@ describe name_from_filename do
             it 'sets it to the login response URL' do
                 framework.options.session.check_url = nil
                 run
-                framework.options.session.check_url.should == url
+                expect(framework.options.session.check_url).to eq(url)
             end
         end
 
@@ -144,7 +144,7 @@ describe name_from_filename do
                 option_url = url + '/stuff'
                 framework.options.session.check_url = option_url
                 run
-                framework.options.session.check_url.should == option_url
+                expect(framework.options.session.check_url).to eq(option_url)
             end
         end
     end
@@ -162,7 +162,7 @@ describe name_from_filename do
             it 'sets it to the plugin pattern' do
                 framework.options.session.check_pattern = nil
                 run
-                framework.options.session.check_pattern.should == /Hi there logged-in user/
+                expect(framework.options.session.check_pattern).to eq(/Hi there logged-in user/)
             end
         end
 
@@ -170,7 +170,7 @@ describe name_from_filename do
             it 'does not change it' do
                 framework.options.session.check_pattern = /stuff/
                 run
-                framework.options.session.check_pattern.should == /stuff/
+                expect(framework.options.session.check_pattern).to eq(/stuff/)
             end
         end
     end

data/spec/components/plugins/autothrottle_spec.rb

@@ -24,7 +24,7 @@ describe name_from_filename do
                 http.max_concurrency.times { http.get( url ) }
                 http.run
 
-                http.max_concurrency.should == pre
+                expect(http.max_concurrency).to eq(pre)
             end
         end
         context 'above threshold' do
@@ -34,21 +34,22 @@ describe name_from_filename do
                 http.max_concurrency.times { http.get( url + 'slow' ) }
                 http.run
 
-                http.max_concurrency.should < pre
+                expect(http.max_concurrency).to be < pre
             end
+
             context 'and then fall bellow threshold' do
                 it 'increases the max concurrency (without exceeding http_request_concurrency)' do
                     http.max_concurrency.times { http.get( url + 'slow' ) }
                     http.run
-                    http.max_concurrency.should < options.http.request_concurrency
+                    expect(http.max_concurrency).to be < options.http.request_concurrency
 
                     pre = http.max_concurrency
 
                     (10 * http.max_concurrency).times { http.get( url ) }
                     http.run
 
-                    http.max_concurrency.should > pre
-                    http.max_concurrency.should <= options.http.request_concurrency
+                    expect(http.max_concurrency).to be > pre
+                    expect(http.max_concurrency).to be <= options.http.request_concurrency
                 end
             end
         end