arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -9,10 +9,10 @@ shared_examples_for 'element' do
9
9
  let(:page) { Factory[:page].dup }
10
10
 
11
11
  it "supports #{Arachni::RPC::Serializer}" do
12
- subject.should == Arachni::RPC::Serializer.deep_clone( subject )
12
+ expect(subject).to eq(Arachni::RPC::Serializer.deep_clone( subject ))
13
13
  end
14
14
 
15
- rpc_attributes = if described_class.ancestors.include? Arachni::Element::Capabilities::Auditable::DOM
15
+ rpc_attributes = if described_class.ancestors.include? Arachni::Element::DOM
16
16
  %w(url)
17
17
  else
18
18
  %w(url initialization_options)
@@ -22,7 +22,7 @@ shared_examples_for 'element' do
22
22
  let(:data) { subject.to_rpc_data }
23
23
 
24
24
  it "includes 'url'" do
25
- data['url'].should == subject.url
25
+ expect(data['url']).to eq(subject.url)
26
26
  end
27
27
 
28
28
  if rpc_attributes.include? 'initialization_options'
@@ -45,16 +45,16 @@ shared_examples_for 'element' do
45
45
  end
46
46
  end
47
47
 
48
- data['initialization_options'].should == init
48
+ expect(data['initialization_options']).to eq(init)
49
49
  end
50
50
  end
51
51
 
52
52
  it "includes 'class'" do
53
- data['class'].should == subject.class.to_s
53
+ expect(data['class']).to eq(subject.class.to_s)
54
54
  end
55
55
 
56
56
  it 'excludes #page' do
57
- data.should_not include 'page'
57
+ expect(data).not_to include 'page'
58
58
  end
59
59
  end
60
60
 
@@ -69,15 +69,15 @@ shared_examples_for 'element' do
69
69
 
70
70
  if attribute == 'initialization_options' && v1.is_a?( Hash )
71
71
  if v1.include? :expires
72
- v1.delete(:expires).to_s.should == v2.delete(:expires).to_s
72
+ expect(v1.delete(:expires).to_s).to eq(v2.delete(:expires).to_s)
73
73
  end
74
74
 
75
75
  if v1.include? :template
76
- v1.delete(:template).source.should == v2.delete(:template).source
76
+ expect(v1.delete(:template).source).to eq(v2.delete(:template).source)
77
77
  end
78
78
  end
79
79
 
80
- v1.should == v2
80
+ expect(v1).to eq(v2)
81
81
  end
82
82
  end
83
83
  end
@@ -86,19 +86,19 @@ shared_examples_for 'element' do
86
86
  context 'when passed an Numeric' do
87
87
  context "equal to #{described_class::MAX_SIZE}" do
88
88
  it 'returns true' do
89
- described_class.too_big?( described_class::MAX_SIZE ).should be_true
89
+ expect(described_class.too_big?( described_class::MAX_SIZE )).to be_truthy
90
90
  end
91
91
  end
92
92
 
93
93
  context "larger than #{described_class::MAX_SIZE}" do
94
94
  it 'returns true' do
95
- described_class.too_big?( described_class::MAX_SIZE + 1 ).should be_true
95
+ expect(described_class.too_big?( described_class::MAX_SIZE + 1 )).to be_truthy
96
96
  end
97
97
  end
98
98
 
99
99
  context "smaller than #{described_class::MAX_SIZE}" do
100
100
  it 'returns false' do
101
- described_class.too_big?( described_class::MAX_SIZE - 1 ).should be_false
101
+ expect(described_class.too_big?( described_class::MAX_SIZE - 1 )).to be_falsey
102
102
  end
103
103
  end
104
104
  end
@@ -106,19 +106,19 @@ shared_examples_for 'element' do
106
106
  context 'when passed a String' do
107
107
  context "whose size is equal to #{described_class::MAX_SIZE}" do
108
108
  it 'returns true' do
109
- described_class.too_big?( 'a' * described_class::MAX_SIZE ).should be_true
109
+ expect(described_class.too_big?( 'a' * described_class::MAX_SIZE )).to be_truthy
110
110
  end
111
111
  end
112
112
 
113
113
  context "whose size is larger than #{described_class::MAX_SIZE}" do
114
114
  it 'returns true' do
115
- described_class.too_big?( 'a' * (described_class::MAX_SIZE + 1) ).should be_true
115
+ expect(described_class.too_big?( 'a' * (described_class::MAX_SIZE + 1) )).to be_truthy
116
116
  end
117
117
  end
118
118
 
119
119
  context "whose size is smaller than #{described_class::MAX_SIZE}" do
120
120
  it 'returns false' do
121
- described_class.too_big?( 'a' * (described_class::MAX_SIZE - 1) ).should be_false
121
+ expect(described_class.too_big?( 'a' * (described_class::MAX_SIZE - 1) )).to be_falsey
122
122
  end
123
123
  end
124
124
  end
@@ -127,34 +127,34 @@ shared_examples_for 'element' do
127
127
  describe '#marshal_dump' do
128
128
  it 'excludes #page' do
129
129
  subject.page = page
130
- subject.marshal_dump.should_not include :page
130
+ expect(subject.marshal_dump).not_to include :page
131
131
  end
132
132
  end
133
133
 
134
134
  describe '#url=',
135
- if: !described_class.ancestors.include?( Arachni::Element::Capabilities::Auditable::DOM ) do
135
+ if: !described_class.ancestors.include?( Arachni::Element::DOM ) do
136
136
  it 'normalizes the passed URL' do
137
137
  url = 'http://test.com/some stuff#frag!'
138
138
  subject.url = url
139
- subject.url.should == Arachni::Utilities.normalize_url( url )
139
+ expect(subject.url).to eq(Arachni::Utilities.normalize_url( url ))
140
140
  end
141
141
  end
142
142
 
143
143
  describe '#page=' do
144
144
  it 'sets the associated page' do
145
145
  subject.page = page
146
- subject.page.should == page
146
+ expect(subject.page).to eq(page)
147
147
  end
148
148
  end
149
149
 
150
150
  describe '#dup' do
151
151
  it 'returns a copy of self' do
152
- subject.dup.should == subject
152
+ expect(subject.dup).to eq(subject)
153
153
  end
154
154
 
155
155
  it 'copies #page' do
156
156
  subject.page = page
157
- subject.dup.page.should == page
157
+ expect(subject.dup.page).to eq(page)
158
158
  end
159
159
  end
160
160
 
@@ -162,19 +162,19 @@ shared_examples_for 'element' do
162
162
  let(:hash) { subject.to_h }
163
163
 
164
164
  it 'includes the #type' do
165
- hash[:type].should == subject.type
165
+ expect(hash[:type]).to eq(subject.type)
166
166
  end
167
167
 
168
168
  it 'includes the #url' do
169
- hash[:url].should == subject.url
169
+ expect(hash[:url]).to eq(subject.url)
170
170
  end
171
171
 
172
172
  it 'includes the element class as a string' do
173
- hash[:class].should == described_class.to_s
173
+ expect(hash[:class]).to eq(described_class.to_s)
174
174
  end
175
175
 
176
176
  it 'is aliased to #to_hash' do
177
- hash.should == subject.to_hash
177
+ expect(hash).to eq(subject.to_hash)
178
178
  end
179
179
  end
180
180
  end
@@ -1,34 +1,16 @@
1
- shared_examples_for 'auditable' do |options = {}|
2
- it_should_behave_like 'inputtable', options
3
- it_should_behave_like 'submittable'
4
- it_should_behave_like 'mutable', options
5
- it_should_behave_like 'with_auditor'
6
-
7
- let(:opts) do
8
- {
9
- single_input: false,
10
- supports_nulls: true
11
- }.merge( options )
12
- end
1
+ shared_examples_for 'auditable' do
13
2
 
14
3
  before :each do
15
4
  begin
16
5
  Arachni::Options.audit.elements described_class.type
17
- rescue Arachni::OptionGroups::Audit::Error
6
+ rescue Arachni::OptionGroups::Audit::Error => e
18
7
  end
19
-
20
- @framework ||= Arachni::Framework.new
21
- @page = Arachni::Page.from_url( url )
22
- @auditor = Auditor.new( @page, @framework )
23
8
  end
24
9
 
25
10
  after :each do
26
- @framework.clean_up
27
- @framework.reset
28
11
  reset_options
29
12
  end
30
13
 
31
- let(:auditor) { @auditor }
32
14
  let(:seed) { 'my_seed' }
33
15
 
34
16
  let(:auditable) do
@@ -42,12 +24,6 @@ shared_examples_for 'auditable' do |options = {}|
42
24
  end
43
25
  end
44
26
 
45
- let(:other) do
46
- new = auditable.dup
47
- new.inputs = { stuff: 'blah' }
48
- new
49
- end
50
-
51
27
  def has_parameter_extractor?
52
28
  begin
53
29
  auditable_extract_parameters
@@ -60,14 +36,14 @@ shared_examples_for 'auditable' do |options = {}|
60
36
  end
61
37
 
62
38
  it "supports #{Arachni::RPC::Serializer}" do
63
- auditable.should == Arachni::RPC::Serializer.deep_clone( auditable )
39
+ expect(auditable).to eq(Arachni::RPC::Serializer.deep_clone( auditable ))
64
40
  end
65
41
 
66
42
  describe '#to_rpc_data' do
67
43
  let(:data) { auditable.to_rpc_data }
68
44
 
69
45
  it 'excludes #audit_options' do
70
- data.should_not include 'audit_options'
46
+ expect(data).not_to include 'audit_options'
71
47
  end
72
48
  end
73
49
 
@@ -75,7 +51,7 @@ shared_examples_for 'auditable' do |options = {}|
75
51
  it 'clears #audit_options' do
76
52
  auditable.audit_options[:stuff] = true
77
53
  auditable.reset
78
- auditable.audit_options.should be_empty
54
+ expect(auditable.audit_options).to be_empty
79
55
  end
80
56
  end
81
57
 
@@ -87,14 +63,14 @@ shared_examples_for 'auditable' do |options = {}|
87
63
  dupped.audit( seed ) { |_, m| audited = m }
88
64
  run
89
65
 
90
- audited.audit_options.should be_any
66
+ expect(audited.audit_options).to be_any
91
67
  dupped = audited.dup
92
- dupped.audit_options.should == audited.audit_options
68
+ expect(dupped.audit_options).to eq(audited.audit_options)
93
69
 
94
70
  dupped2 = dupped.dup
95
71
  dupped.audit_options.clear
96
72
 
97
- dupped2.audit_options.should == audited.audit_options
73
+ expect(dupped2.audit_options).to eq(audited.audit_options)
98
74
  end
99
75
  end
100
76
 
@@ -103,7 +79,7 @@ shared_examples_for 'auditable' do |options = {}|
103
79
  audited = false
104
80
  auditable.audit( 'seed' ){ audited = true }
105
81
  run
106
- audited.should be_true
82
+ expect(audited).to be_truthy
107
83
 
108
84
  Arachni::Element::Capabilities::Auditable.reset
109
85
  Arachni::Element::Capabilities::Auditable.skip_like do
@@ -113,14 +89,14 @@ shared_examples_for 'auditable' do |options = {}|
113
89
  audited = false
114
90
  auditable.audit( 'seed' ){ audited = true }
115
91
  run
116
- audited.should be_false
92
+ expect(audited).to be_falsey
117
93
  end
118
94
 
119
95
  it 'skips element mutations based on the block\'s return value' do
120
96
  called = false
121
97
  auditable.audit( 'seed' ){ called = true }
122
98
  run
123
- called.should be_true
99
+ expect(called).to be_truthy
124
100
 
125
101
  Arachni::Element::Capabilities::Auditable.reset
126
102
  Arachni::Element::Capabilities::Auditable.skip_like do |element|
@@ -130,7 +106,7 @@ shared_examples_for 'auditable' do |options = {}|
130
106
  i = 0
131
107
  auditable.audit( 'seed' ){ i += 1 }
132
108
  run
133
- i.should == 0
109
+ expect(i).to eq(0)
134
110
  end
135
111
  end
136
112
 
@@ -142,55 +118,55 @@ shared_examples_for 'auditable' do |options = {}|
142
118
  id = auditable.audit_id
143
119
 
144
120
  auditable.auditor = '2'
145
- auditable.audit_id.should_not == id
121
+ expect(auditable.audit_id).not_to eq(id)
146
122
 
147
123
  auditable.auditor = 1
148
124
  id = auditable.audit_id
149
125
 
150
126
  auditable.auditor = 2
151
- auditable.audit_id.should == id
127
+ expect(auditable.audit_id).to eq(id)
152
128
  end
153
129
 
154
130
  it 'takes into account #action' do
155
131
  e = auditable.dup
156
- e.stub(:action) { action }
132
+ allow(e).to receive(:action) { action }
157
133
 
158
134
  c = auditable.dup
159
- c.stub(:action) { "#{action}2" }
135
+ allow(c).to receive(:action) { "#{action}2" }
160
136
 
161
- e.audit_id.should_not == c.audit_id
137
+ expect(e.audit_id).not_to eq(c.audit_id)
162
138
  end
163
139
 
164
140
  it 'takes into account #type' do
165
141
  e = auditable.dup
166
- e.stub(:type) { :blah }
142
+ allow(e).to receive(:type) { :blah }
167
143
 
168
144
  c = auditable.dup
169
- c.stub(:type) { :blooh }
145
+ allow(c).to receive(:type) { :blooh }
170
146
 
171
- e.audit_id.should_not == c.audit_id
147
+ expect(e.audit_id).not_to eq(c.audit_id)
172
148
  end
173
149
 
174
150
  it 'takes into account #inputs names' do
175
151
  e = auditable.dup
176
- e.stub(:inputs) { {input1: 'stuff' } }
152
+ allow(e).to receive(:inputs) { {input1: 'stuff' } }
177
153
 
178
154
  c = auditable.dup
179
- c.stub(:inputs) { {input1: 'stuff2' } }
180
- e.audit_id.should == c.audit_id
155
+ allow(c).to receive(:inputs) { {input1: 'stuff2' } }
156
+ expect(e.audit_id).to eq(c.audit_id)
181
157
 
182
158
  e = auditable.dup
183
- e.stub(:inputs) { {input1: 'stuff' } }
159
+ allow(e).to receive(:inputs) { {input1: 'stuff' } }
184
160
 
185
161
  c = auditable.dup
186
- c.stub(:inputs) { {input2: 'stuff' } }
162
+ allow(c).to receive(:inputs) { {input2: 'stuff' } }
187
163
 
188
- e.audit_id.should_not == c.audit_id
164
+ expect(e.audit_id).not_to eq(c.audit_id)
189
165
  end
190
166
 
191
167
  it 'takes into account the given payload' do
192
168
  id = auditable.audit_id( '1' )
193
- auditable.audit_id( '2' ).should_not == id
169
+ expect(auditable.audit_id( '2' )).not_to eq(id)
194
170
  end
195
171
  end
196
172
 
@@ -199,45 +175,45 @@ shared_examples_for 'auditable' do |options = {}|
199
175
 
200
176
  it 'takes into account #action' do
201
177
  e = auditable.dup
202
- e.stub(:action) { action }
178
+ allow(e).to receive(:action) { action }
203
179
 
204
180
  c = auditable.dup
205
- c.stub(:action) { "#{action}2" }
181
+ allow(c).to receive(:action) { "#{action}2" }
206
182
 
207
- e.coverage_id.should_not == c.coverage_id
183
+ expect(e.coverage_id).not_to eq(c.coverage_id)
208
184
  end
209
185
 
210
186
  it 'takes into account #type' do
211
187
  e = auditable.dup
212
- e.stub(:type) { :blah }
188
+ allow(e).to receive(:type) { :blah }
213
189
 
214
190
  c = auditable.dup
215
- c.stub(:type) { :blooh }
191
+ allow(c).to receive(:type) { :blooh }
216
192
 
217
- e.coverage_id.should_not == c.coverage_id
193
+ expect(e.coverage_id).not_to eq(c.coverage_id)
218
194
  end
219
195
 
220
196
  it 'takes into account #inputs names' do
221
197
  e = auditable.dup
222
- e.stub(:inputs) { {input1: 'stuff' } }
198
+ allow(e).to receive(:inputs) { {input1: 'stuff' } }
223
199
 
224
200
  c = auditable.dup
225
- c.stub(:inputs) { {input1: 'stuff2' } }
226
- e.coverage_id.should == c.coverage_id
201
+ allow(c).to receive(:inputs) { {input1: 'stuff2' } }
202
+ expect(e.coverage_id).to eq(c.coverage_id)
227
203
 
228
204
  e = auditable.dup
229
- e.stub(:inputs) { {input1: 'stuff' } }
205
+ allow(e).to receive(:inputs) { {input1: 'stuff' } }
230
206
 
231
207
  c = auditable.dup
232
- c.stub(:inputs) { {input2: 'stuff' } }
208
+ allow(c).to receive(:inputs) { {input2: 'stuff' } }
233
209
 
234
- e.coverage_id.should_not == c.coverage_id
210
+ expect(e.coverage_id).not_to eq(c.coverage_id)
235
211
  end
236
212
  end
237
213
 
238
214
  describe '#coverage_hash' do
239
215
  it 'returns the String#persistent_hash of #coverage_id' do
240
- auditable.coverage_hash.should == auditable.coverage_id.persistent_hash
216
+ expect(auditable.coverage_hash).to eq(auditable.coverage_id.persistent_hash)
241
217
  end
242
218
  end
243
219
 
@@ -262,7 +238,7 @@ shared_examples_for 'auditable' do |options = {}|
262
238
  end
263
239
 
264
240
  run
265
- injected.should == payload
241
+ expect(injected).to eq(payload)
266
242
  end
267
243
 
268
244
  context 'with invalid data' do
@@ -270,7 +246,7 @@ shared_examples_for 'auditable' do |options = {}|
270
246
  payload = 'stuff-here'
271
247
  called = 0
272
248
 
273
- auditable.class.any_instance.stub(:valid_input_data?) { |i| i != payload }
249
+ allow_any_instance_of(auditable.class).to receive(:valid_input_data?) { |instance, i| i != payload }
274
250
 
275
251
  auditable.audit( payload,
276
252
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
@@ -278,7 +254,7 @@ shared_examples_for 'auditable' do |options = {}|
278
254
  ) { |_, element| called += 1 }
279
255
  run
280
256
 
281
- called.should == 0
257
+ expect(called).to eq(0)
282
258
  end
283
259
  end
284
260
  end
@@ -295,21 +271,21 @@ shared_examples_for 'auditable' do |options = {}|
295
271
  end
296
272
 
297
273
  run
298
- injected.uniq.sort.should == payloads.sort
274
+ expect(injected.uniq.sort).to eq(payloads.sort)
299
275
  end
300
276
 
301
277
  context 'and is empty' do
302
278
  it 'returns nil' do
303
279
  injected = []
304
- auditable.audit( [],
280
+ expect(auditable.audit( [],
305
281
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
306
282
  skip_original: true
307
283
  ) do |_, element|
308
284
  injected << element.affected_input_value
309
- end.should be_nil
285
+ end).to be_nil
310
286
 
311
287
  run
312
- injected.should be_empty
288
+ expect(injected).to be_empty
313
289
  end
314
290
  end
315
291
  end
@@ -327,31 +303,31 @@ shared_examples_for 'auditable' do |options = {}|
327
303
  injected = []
328
304
 
329
305
  auditable.platforms.update %w(unix php apache)
330
- auditable.audit( payloads,
306
+ expect(auditable.audit( payloads,
331
307
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
332
308
  skip_original: true
333
309
  ) do |_, element|
334
310
  injected << element.affected_input_value
335
- end.should be_true
311
+ end).to be_truthy
336
312
 
337
313
  run
338
314
 
339
315
  payloads.delete( :windows )
340
316
  payloads.delete( :aspx )
341
317
 
342
- injected.uniq.sort.should == payloads.values.flatten.sort
318
+ expect(injected.uniq.sort).to eq(payloads.values.flatten.sort)
343
319
  end
344
320
 
345
321
  context 'and is empty' do
346
322
  it 'returns nil' do
347
323
  injected = []
348
- auditable.audit( {},
324
+ expect(auditable.audit( {},
349
325
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ] ) do |_, element|
350
326
  injected << element.affected_input_value
351
- end.should be_nil
327
+ end).to be_nil
352
328
 
353
329
  run
354
- injected.should be_empty
330
+ expect(injected).to be_empty
355
331
  end
356
332
  end
357
333
 
@@ -369,16 +345,16 @@ shared_examples_for 'auditable' do |options = {}|
369
345
  injected = []
370
346
 
371
347
  auditable.platforms.clear
372
- auditable.audit( payloads,
348
+ expect(auditable.audit( payloads,
373
349
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
374
350
  skip_original: true
375
351
  ) do |_, element|
376
352
  injected << element.affected_input_value
377
- end.should be_true
353
+ end).to be_truthy
378
354
 
379
355
  run
380
356
 
381
- injected.uniq.sort.should == payloads.values.flatten.sort
357
+ expect(injected.uniq.sort).to eq(payloads.values.flatten.sort)
382
358
  end
383
359
  end
384
360
 
@@ -392,17 +368,17 @@ shared_examples_for 'auditable' do |options = {}|
392
368
  injected = []
393
369
 
394
370
  auditable.platforms.update %w(unix php apache)
395
- auditable.audit( payloads,
371
+ expect(auditable.audit( payloads,
396
372
  format: [ Arachni::Check::Auditor::Format::STRAIGHT ] ) do |_, element|
397
373
  injected << element.affected_input_value
398
- end.should be_nil
374
+ end).to be_nil
399
375
 
400
376
  run
401
377
 
402
378
  payloads.delete( :windows )
403
379
  payloads.delete( :aspx )
404
380
 
405
- injected.should be_empty
381
+ expect(injected).to be_empty
406
382
  end
407
383
  end
408
384
  end
@@ -426,18 +402,18 @@ shared_examples_for 'auditable' do |options = {}|
426
402
 
427
403
  called = false
428
404
  each = proc do |mutation|
429
- mutation.should receive(:submit).with(options)
405
+ expect(mutation).to receive(:submit).with(options)
430
406
  called = true
431
407
  end
432
408
  auditable.audit( seed, each_mutation: each, submit: options ){}
433
409
 
434
- called.should be_true
410
+ expect(called).to be_truthy
435
411
  end
436
412
  end
437
413
 
438
414
  describe :each_mutation do
439
415
  it 'is passed each generated mutation' do
440
- pending if !has_parameter_extractor?
416
+ skip if !has_parameter_extractor?
441
417
 
442
418
  submitted = nil
443
419
  cnt = 0
@@ -451,12 +427,12 @@ shared_examples_for 'auditable' do |options = {}|
451
427
  end
452
428
 
453
429
  run
454
- cnt.should == 1
430
+ expect(cnt).to eq(1)
455
431
  auditable.inputs == submitted
456
432
  end
457
433
 
458
434
  it 'is able to modify mutations on the fly' do
459
- pending if !has_parameter_extractor?
435
+ skip if !has_parameter_extractor?
460
436
 
461
437
  submitted = nil
462
438
 
@@ -472,12 +448,12 @@ shared_examples_for 'auditable' do |options = {}|
472
448
  end
473
449
 
474
450
  run
475
- submitted.values.first.should == modified_seed
451
+ expect(submitted.values.first).to eq(modified_seed)
476
452
  end
477
453
 
478
454
  context 'when it returns one or more elements of the same type' do
479
455
  it 'audits those elements too' do
480
- pending if !has_parameter_extractor?
456
+ skip if !has_parameter_extractor?
481
457
 
482
458
  injected = []
483
459
  cnt = 0
@@ -500,8 +476,8 @@ shared_examples_for 'auditable' do |options = {}|
500
476
  end
501
477
 
502
478
  run
503
- cnt.should == 3
504
- injected.sort.should == [ seed, 'houa', 'houa2'].sort
479
+ expect(cnt).to eq(3)
480
+ expect(injected.sort).to eq([ seed, 'houa', 'houa2'].sort)
505
481
  end
506
482
  end
507
483
  end
@@ -519,8 +495,8 @@ shared_examples_for 'auditable' do |options = {}|
519
495
  run
520
496
 
521
497
  audited.uniq!
522
- audited.size.should == 1
523
- audited.should == [auditable.inputs.keys.first]
498
+ expect(audited.size).to eq(1)
499
+ expect(audited).to eq([auditable.inputs.keys.first])
524
500
  end
525
501
  end
526
502
 
@@ -537,8 +513,8 @@ shared_examples_for 'auditable' do |options = {}|
537
513
  run
538
514
 
539
515
  audited.uniq!
540
- audited.size.should == 1
541
- audited.should == [auditable.inputs.keys.first]
516
+ expect(audited.size).to eq(1)
517
+ expect(audited).to eq([auditable.inputs.keys.first])
542
518
  end
543
519
  end
544
520
  end
@@ -546,7 +522,7 @@ shared_examples_for 'auditable' do |options = {}|
546
522
  describe :format do
547
523
  describe 'Arachni::Check::Auditor::Format::STRAIGHT' do
548
524
  it 'injects the seed as is' do
549
- pending if !has_parameter_extractor?
525
+ skip if !has_parameter_extractor?
550
526
 
551
527
  injected = nil
552
528
  cnt = 0
@@ -559,14 +535,14 @@ shared_examples_for 'auditable' do |options = {}|
559
535
  end
560
536
 
561
537
  run
562
- cnt.should == 1
563
- injected.should == seed
538
+ expect(cnt).to eq(1)
539
+ expect(injected).to eq(seed)
564
540
  end
565
541
  end
566
542
 
567
543
  describe 'Arachni::Check::Auditor::Format::APPEND' do
568
544
  it 'appends the seed to the existing value of the input' do
569
- pending if !has_parameter_extractor?
545
+ skip if !has_parameter_extractor?
570
546
 
571
547
  injected = nil
572
548
  cnt = 0
@@ -579,16 +555,16 @@ shared_examples_for 'auditable' do |options = {}|
579
555
  end
580
556
 
581
557
  run
582
- cnt.should == 1
583
- injected.should == auditable.inputs.values.first + seed
558
+ expect(cnt).to eq(1)
559
+ expect(injected).to eq(auditable.inputs.values.first + seed)
584
560
  end
585
561
  end
586
562
 
587
563
  describe 'Arachni::Check::Auditor::Format::NULL' do
588
564
  it 'terminates the seed with a null character',
589
565
  if: described_class != Arachni::Element::Header &&
590
- described_class.is_a?( Arachni::Element::Capabilities::Auditable::DOM ) do
591
- pending if !has_parameter_extractor?
566
+ described_class.is_a?( Arachni::Element::DOM ) do
567
+ skip if !has_parameter_extractor?
592
568
 
593
569
  injected = nil
594
570
  cnt = 0
@@ -600,14 +576,14 @@ shared_examples_for 'auditable' do |options = {}|
600
576
  end
601
577
 
602
578
  run
603
- cnt.should == 1
604
- auditable.decode( injected ).should == seed + "\0"
579
+ expect(cnt).to eq(1)
580
+ expect(auditable.decode( injected )).to eq(seed + "\0")
605
581
  end
606
582
  end
607
583
 
608
584
  describe 'Arachni::Check::Auditor::Format::SEMICOLON' do
609
585
  it 'prepends the seed with a semicolon' do
610
- pending if !has_parameter_extractor?
586
+ skip if !has_parameter_extractor?
611
587
 
612
588
  injected = nil
613
589
  cnt = 0
@@ -618,9 +594,9 @@ shared_examples_for 'auditable' do |options = {}|
618
594
  cnt += 1
619
595
  end
620
596
  run
621
- cnt.should == 1
597
+ expect(cnt).to eq(1)
622
598
 
623
- auditable.decode( injected ).should == ";" + seed
599
+ expect(auditable.decode( injected )).to eq(";" + seed)
624
600
  end
625
601
  end
626
602
  end
@@ -640,7 +616,7 @@ shared_examples_for 'auditable' do |options = {}|
640
616
  auditable.audit( seed, @audit_opts.merge( redundant: true )){ cnt += 1 }
641
617
  end
642
618
  run
643
- cnt.should == 5
619
+ expect(cnt).to eq(5)
644
620
  end
645
621
  end
646
622
 
@@ -651,7 +627,7 @@ shared_examples_for 'auditable' do |options = {}|
651
627
  auditable.audit( seed, @audit_opts.merge( redundant: false )){ cnt += 1 }
652
628
  end
653
629
  run
654
- cnt.should == 1
630
+ expect(cnt).to eq(1)
655
631
  end
656
632
  end
657
633
 
@@ -662,7 +638,7 @@ shared_examples_for 'auditable' do |options = {}|
662
638
  auditable.audit( seed, @audit_opts ){ cnt += 1 }
663
639
  end
664
640
  run
665
- cnt.should == 1
641
+ expect(cnt).to eq(1)
666
642
  end
667
643
  end
668
644
  end
@@ -673,41 +649,41 @@ shared_examples_for 'auditable' do |options = {}|
673
649
  Arachni::Options.audit.exclude_vector_patterns = auditable.inputs.keys
674
650
 
675
651
  audited = []
676
- auditable.audit( seed, skip_original: true ) do |_, elem|
652
+ expect(auditable.audit( seed, skip_original: true ) do |_, elem|
677
653
  audited << elem.affected_input_name
678
- end.should be_true
654
+ end).to be_truthy
679
655
 
680
656
  run
681
- audited.should be_empty
657
+ expect(audited).to be_empty
682
658
  end
683
659
  end
684
660
 
685
661
  context "when #{Arachni::OptionGroups::Audit}#vector?" do
686
662
  context 'returns true' do
687
663
  it 'audits the input' do
688
- Arachni::Options.audit.stub(:vector?){ true }
664
+ allow(Arachni::Options.audit).to receive(:vector?){ true }
689
665
 
690
666
  audited = []
691
- auditable.audit( seed, skip_original: true ) do |_, elem|
667
+ expect(auditable.audit( seed, skip_original: true ) do |_, elem|
692
668
  audited << elem.affected_input_name
693
- end.should be_true
669
+ end).to be_truthy
694
670
 
695
671
  run
696
- audited.should_not be_empty
672
+ expect(audited).not_to be_empty
697
673
  end
698
674
  end
699
675
 
700
676
  context 'returns false' do
701
677
  it 'skips the input' do
702
- Arachni::Options.audit.stub(:vector?){ false }
678
+ allow(Arachni::Options.audit).to receive(:vector?){ false }
703
679
 
704
680
  audited = []
705
- auditable.audit( seed, skip_original: true ) do |_, elem|
681
+ expect(auditable.audit( seed, skip_original: true ) do |_, elem|
706
682
  audited << elem.affected_input_name
707
- end.should be_true
683
+ end).to be_truthy
708
684
 
709
685
  run
710
- audited.should be_empty
686
+ expect(audited).to be_empty
711
687
  end
712
688
  end
713
689
  end
@@ -715,12 +691,12 @@ shared_examples_for 'auditable' do |options = {}|
715
691
  context "when #{described_class::Scope}#out?" do
716
692
  context true do
717
693
  it 'returns immediately' do
718
- described_class::Scope.any_instance.stub(:out?) { true }
694
+ allow_any_instance_of(described_class::Scope).to receive(:out?) { true }
719
695
 
720
696
  ran = false
721
- auditable.audit( seed ) { ran = true }.should be_false
697
+ expect(auditable.audit( seed ) { ran = true }).to be_falsey
722
698
  run
723
- ran.should be_false
699
+ expect(ran).to be_falsey
724
700
  end
725
701
  end
726
702
  end
@@ -729,19 +705,19 @@ shared_examples_for 'auditable' do |options = {}|
729
705
  it 'returns immediately' do
730
706
  ran = false
731
707
  auditable.inputs = {}
732
- auditable.audit( seed ) { ran = true }.should be_false
708
+ expect(auditable.audit( seed ) { ran = true }).to be_falsey
733
709
  run
734
710
 
735
- ran.should be_false
711
+ expect(ran).to be_falsey
736
712
  end
737
713
  end
738
714
 
739
715
  context 'when the auditor\'s #skip? method returns true for a mutation' do
740
716
  it 'is skipped' do
741
717
  ran = false
742
- auditable.audit( seed ) { ran = true }.should be_true
718
+ expect(auditable.audit( seed ) { ran = true }).to be_truthy
743
719
  run
744
- ran.should be_true
720
+ expect(ran).to be_truthy
745
721
 
746
722
  Arachni::Element::Capabilities::Auditable.reset
747
723
 
@@ -750,9 +726,9 @@ shared_examples_for 'auditable' do |options = {}|
750
726
  end
751
727
 
752
728
  ran = false
753
- auditable.audit( seed ) { ran = true }.should be_true
729
+ expect(auditable.audit( seed ) { ran = true }).to be_truthy
754
730
  run
755
- ran.should be_false
731
+ expect(ran).to be_falsey
756
732
 
757
733
  Arachni::Element::Capabilities::Auditable.reset
758
734
 
@@ -761,18 +737,18 @@ shared_examples_for 'auditable' do |options = {}|
761
737
  end
762
738
 
763
739
  ran = false
764
- auditable.audit( seed ) { ran = true }.should be_true
740
+ expect(auditable.audit( seed ) { ran = true }).to be_truthy
765
741
  run
766
- ran.should be_true
742
+ expect(ran).to be_truthy
767
743
  end
768
744
  end
769
745
 
770
746
  context 'when the element\'s #skip? method returns true for a mutation' do
771
747
  it 'is skipped' do
772
748
  ran = false
773
- auditable.audit( seed ) { ran = true }.should be_true
749
+ expect(auditable.audit( seed ) { ran = true }).to be_truthy
774
750
  run
775
- ran.should be_true
751
+ expect(ran).to be_truthy
776
752
 
777
753
  Arachni::Element::Capabilities::Auditable.reset
778
754
 
@@ -781,9 +757,9 @@ shared_examples_for 'auditable' do |options = {}|
781
757
  end
782
758
 
783
759
  ran = false
784
- auditable.audit( seed ) { ran = true }.should be_true
760
+ expect(auditable.audit( seed ) { ran = true }).to be_truthy
785
761
  run
786
- ran.should be_false
762
+ expect(ran).to be_falsey
787
763
 
788
764
  Arachni::Element::Capabilities::Auditable.reset
789
765
 
@@ -792,9 +768,9 @@ shared_examples_for 'auditable' do |options = {}|
792
768
  end
793
769
 
794
770
  ran = false
795
- auditable.audit( seed ) { ran = true }.should be_true
771
+ expect(auditable.audit( seed ) { ran = true }).to be_truthy
796
772
  run
797
- ran.should be_true
773
+ expect(ran).to be_truthy
798
774
  end
799
775
  end
800
776
  end