arachni 1.2.1 → 1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +66 -0
- data/Gemfile +1 -1
- data/README.md +16 -5
- data/components/checks/active/ldap_injection/errors.txt +1 -0
- data/components/checks/active/source_code_disclosure.rb +1 -1
- data/components/checks/active/unvalidated_redirect.rb +6 -6
- data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
- data/components/checks/passive/grep/captcha.rb +14 -5
- data/components/checks/passive/grep/form_upload.rb +7 -3
- data/components/checks/passive/grep/hsts.rb +3 -3
- data/components/checks/passive/grep/html_objects.rb +2 -3
- data/components/checks/passive/grep/http_only_cookies.rb +2 -3
- data/components/checks/passive/grep/insecure_cookies.rb +1 -1
- data/components/checks/passive/grep/password_autocomplete.rb +2 -2
- data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
- data/components/checks/passive/grep/x_frame_options.rb +2 -2
- data/components/checks/passive/http_put.rb +2 -3
- data/components/path_extractors/comments.rb +3 -3
- data/components/path_extractors/scripts.rb +10 -1
- data/components/plugins/defaults/autothrottle.rb +27 -18
- data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
- data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
- data/components/plugins/login_script.rb +9 -3
- data/components/plugins/proxy.rb +4 -3
- data/components/reporters/html.rb +11 -14
- data/components/reporters/html/default/issue.erb +13 -38
- data/components/reporters/html/default/issue/info.erb +1 -1
- data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
- data/components/reporters/stdout.rb +62 -71
- data/components/reporters/xml.rb +26 -40
- data/components/reporters/xml/schema.xsd +43 -89
- data/lib/arachni/browser.rb +52 -3
- data/lib/arachni/browser/javascript.rb +3 -3
- data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
- data/lib/arachni/browser_cluster.rb +61 -0
- data/lib/arachni/browser_cluster/job.rb +21 -1
- data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/worker.rb +5 -0
- data/lib/arachni/check/auditor.rb +22 -12
- data/lib/arachni/data/framework.rb +13 -1
- data/lib/arachni/data/issues.rb +9 -25
- data/lib/arachni/element/base.rb +9 -3
- data/lib/arachni/element/capabilities/analyzable.rb +2 -6
- data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
- data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
- data/lib/arachni/element/capabilities/auditable.rb +0 -6
- data/lib/arachni/element/capabilities/dom_only.rb +61 -0
- data/lib/arachni/element/capabilities/with_dom.rb +3 -1
- data/lib/arachni/element/cookie.rb +35 -5
- data/lib/arachni/element/cookie/dom.rb +13 -4
- data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
- data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
- data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
- data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
- data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
- data/lib/arachni/element/form.rb +12 -1
- data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
- data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/form/dom.rb +9 -3
- data/lib/arachni/element/header.rb +14 -33
- data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
- data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
- data/lib/arachni/element/input/dom.rb +71 -0
- data/lib/arachni/element/json.rb +2 -0
- data/lib/arachni/element/link.rb +3 -0
- data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link/dom.rb +16 -3
- data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/link_template.rb +3 -5
- data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
- data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
- data/lib/arachni/element/link_template/dom.rb +16 -3
- data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
- data/lib/arachni/element/server.rb +3 -5
- data/lib/arachni/element/ui_form.rb +106 -0
- data/lib/arachni/element/ui_form/dom.rb +107 -0
- data/lib/arachni/element/ui_input.rb +62 -0
- data/lib/arachni/element/xml.rb +2 -1
- data/lib/arachni/framework.rb +7 -5
- data/lib/arachni/framework/parts/audit.rb +0 -1
- data/lib/arachni/framework/parts/check.rb +1 -0
- data/lib/arachni/framework/parts/data.rb +4 -0
- data/lib/arachni/framework/parts/state.rb +0 -2
- data/lib/arachni/http/client.rb +17 -6
- data/lib/arachni/http/proxy_server.rb +52 -5
- data/lib/arachni/http/request.rb +1 -1
- data/lib/arachni/issue.rb +34 -179
- data/lib/arachni/issue/severity.rb +2 -0
- data/lib/arachni/option_groups/audit.rb +22 -2
- data/lib/arachni/option_groups/browser_cluster.rb +15 -0
- data/lib/arachni/page.rb +3 -2
- data/lib/arachni/parser.rb +24 -5
- data/lib/arachni/platform/manager.rb +1 -2
- data/lib/arachni/rpc/server/framework.rb +3 -4
- data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
- data/lib/arachni/session.rb +1 -1
- data/lib/arachni/trainer.rb +4 -7
- data/lib/arachni/watir/element.rb +12 -1
- data/lib/version +1 -1
- data/spec/arachni/browser/element_locator_spec.rb +43 -43
- data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
- data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
- data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
- data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
- data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
- data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
- data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
- data/spec/arachni/browser/javascript_spec.rb +73 -63
- data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
- data/spec/arachni/browser_cluster/job_spec.rb +68 -48
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
- data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
- data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
- data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
- data/spec/arachni/browser_cluster_spec.rb +64 -39
- data/spec/arachni/browser_spec.rb +692 -527
- data/spec/arachni/check/auditor_spec.rb +177 -147
- data/spec/arachni/check/base_spec.rb +33 -33
- data/spec/arachni/check/manager_spec.rb +15 -15
- data/spec/arachni/component/base_spec.rb +8 -8
- data/spec/arachni/component/manager_spec.rb +100 -99
- data/spec/arachni/component/options/address_spec.rb +3 -3
- data/spec/arachni/component/options/base_spec.rb +7 -7
- data/spec/arachni/component/options/bool_spec.rb +9 -9
- data/spec/arachni/component/options/float_spec.rb +6 -6
- data/spec/arachni/component/options/int_spec.rb +5 -5
- data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
- data/spec/arachni/component/options/object_spec.rb +2 -2
- data/spec/arachni/component/options/path_spec.rb +3 -3
- data/spec/arachni/component/options/port_spec.rb +5 -5
- data/spec/arachni/component/options/string_spec.rb +3 -3
- data/spec/arachni/component/options/url_spec.rb +4 -4
- data/spec/arachni/component/utilities_spec.rb +2 -2
- data/spec/arachni/data/framework/rpc_spec.rb +10 -9
- data/spec/arachni/data/framework_spec.rb +65 -46
- data/spec/arachni/data/issues_spec.rb +39 -77
- data/spec/arachni/data/plugins_spec.rb +11 -11
- data/spec/arachni/data/session_spec.rb +6 -6
- data/spec/arachni/data_spec.rb +8 -8
- data/spec/arachni/element/body_spec.rb +10 -10
- data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
- data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
- data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
- data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
- data/spec/arachni/element/cookie/dom_spec.rb +37 -18
- data/spec/arachni/element/cookie_spec.rb +206 -139
- data/spec/arachni/element/form/dom_spec.rb +36 -19
- data/spec/arachni/element/form_spec.rb +210 -187
- data/spec/arachni/element/generic_dom_spec.rb +14 -14
- data/spec/arachni/element/header_spec.rb +35 -17
- data/spec/arachni/element/json_spec.rb +53 -31
- data/spec/arachni/element/link/dom_spec.rb +46 -28
- data/spec/arachni/element/link_spec.rb +58 -40
- data/spec/arachni/element/link_template/dom_spec.rb +47 -29
- data/spec/arachni/element/link_template_spec.rb +79 -61
- data/spec/arachni/element/path_spec.rb +1 -1
- data/spec/arachni/element/server_spec.rb +33 -32
- data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
- data/spec/arachni/element/ui_form_spec.rb +242 -0
- data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
- data/spec/arachni/element/ui_input_spec.rb +136 -0
- data/spec/arachni/element/xml_spec.rb +42 -24
- data/spec/arachni/element_filter_spec.rb +49 -48
- data/spec/arachni/error_spec.rb +3 -3
- data/spec/arachni/framework/parts/audit_spec.rb +64 -63
- data/spec/arachni/framework/parts/browser_spec.rb +16 -16
- data/spec/arachni/framework/parts/check_spec.rb +3 -3
- data/spec/arachni/framework/parts/data_spec.rb +48 -48
- data/spec/arachni/framework/parts/platform_spec.rb +3 -3
- data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
- data/spec/arachni/framework/parts/report_spec.rb +7 -7
- data/spec/arachni/framework/parts/scope_spec.rb +16 -16
- data/spec/arachni/framework/parts/state_spec.rb +68 -69
- data/spec/arachni/framework_spec.rb +39 -31
- data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
- data/spec/arachni/http/client_spec.rb +219 -208
- data/spec/arachni/http/cookie_jar_spec.rb +72 -72
- data/spec/arachni/http/headers_spec.rb +14 -14
- data/spec/arachni/http/proxy_server_spec.rb +43 -42
- data/spec/arachni/http/request_spec.rb +105 -103
- data/spec/arachni/http/response/scope_spec.rb +24 -24
- data/spec/arachni/http/response_spec.rb +50 -49
- data/spec/arachni/issue/severity_spec.rb +10 -9
- data/spec/arachni/issue_spec.rb +71 -369
- data/spec/arachni/option_groups/audit_spec.rb +114 -114
- data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
- data/spec/arachni/option_groups/datastore_spec.rb +6 -6
- data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
- data/spec/arachni/option_groups/http_spec.rb +11 -11
- data/spec/arachni/option_groups/input_spec.rb +31 -27
- data/spec/arachni/option_groups/output_spec.rb +2 -2
- data/spec/arachni/option_groups/paths_spec.rb +17 -17
- data/spec/arachni/option_groups/rpc_spec.rb +2 -2
- data/spec/arachni/option_groups/scope_spec.rb +40 -40
- data/spec/arachni/option_groups/session_spec.rb +6 -5
- data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
- data/spec/arachni/options_spec.rb +46 -45
- data/spec/arachni/page/dom/transition_spec.rb +74 -72
- data/spec/arachni/page/dom_spec.rb +35 -35
- data/spec/arachni/page/scope_spec.rb +15 -15
- data/spec/arachni/page_spec.rb +217 -217
- data/spec/arachni/parser_spec.rb +106 -104
- data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
- data/spec/arachni/platform/list_spec.rb +33 -33
- data/spec/arachni/platform/manager_spec.rb +67 -64
- data/spec/arachni/plugin/base_spec.rb +10 -10
- data/spec/arachni/plugin/manager_spec.rb +38 -37
- data/spec/arachni/report_spec.rb +43 -40
- data/spec/arachni/reporter/base_spec.rb +15 -15
- data/spec/arachni/reporter/manager_spec.rb +4 -4
- data/spec/arachni/reporter/options_spec.rb +6 -6
- data/spec/arachni/rpc/client/base_spec.rb +6 -6
- data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
- data/spec/arachni/rpc/client/instance_spec.rb +6 -6
- data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
- data/spec/arachni/rpc/server/base_spec.rb +5 -5
- data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
- data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
- data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
- data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
- data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
- data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
- data/spec/arachni/rpc/server/framework_spec.rb +90 -85
- data/spec/arachni/rpc/server/instance_spec.rb +126 -107
- data/spec/arachni/rpc/server/output_spec.rb +1 -1
- data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
- data/spec/arachni/ruby/array_spec.rb +42 -42
- data/spec/arachni/ruby/hash_spec.rb +20 -18
- data/spec/arachni/ruby/io_spec.rb +2 -2
- data/spec/arachni/ruby/object_spec.rb +1 -1
- data/spec/arachni/ruby/set_spec.rb +3 -3
- data/spec/arachni/ruby/string_spec.rb +30 -30
- data/spec/arachni/ruby/webrick_spec.rb +2 -2
- data/spec/arachni/scope_spec.rb +1 -1
- data/spec/arachni/session_spec.rb +67 -64
- data/spec/arachni/snapshot_spec.rb +15 -15
- data/spec/arachni/state/audit_spec.rb +11 -11
- data/spec/arachni/state/element_filter_spec.rb +6 -6
- data/spec/arachni/state/framework/rpc_spec.rb +12 -12
- data/spec/arachni/state/framework_spec.rb +125 -121
- data/spec/arachni/state/http_spec.rb +7 -7
- data/spec/arachni/state/options_spec.rb +7 -7
- data/spec/arachni/state/plugins_spec.rb +8 -8
- data/spec/arachni/state_spec.rb +10 -10
- data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
- data/spec/arachni/support/buffer/base_spec.rb +39 -39
- data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
- data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
- data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
- data/spec/arachni/support/cache/preference_spec.rb +4 -4
- data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
- data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
- data/spec/arachni/support/database/hash_spec.rb +44 -43
- data/spec/arachni/support/database/queue_spec.rb +27 -27
- data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
- data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
- data/spec/arachni/support/mixins/observable_spec.rb +6 -6
- data/spec/arachni/support/signature_spec.rb +19 -19
- data/spec/arachni/trainer_spec.rb +39 -39
- data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
- data/spec/arachni/uri/scope_spec.rb +66 -66
- data/spec/arachni/uri_spec.rb +107 -105
- data/spec/arachni/utilities_spec.rb +40 -40
- data/spec/components/checks/active/csrf_spec.rb +8 -8
- data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
- data/spec/components/checks/active/sql_injection_spec.rb +16 -16
- data/spec/components/checks/active/trainer_spec.rb +4 -4
- data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
- data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
- data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
- data/spec/components/checks/active/xss_dom_spec.rb +46 -24
- data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
- data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
- data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
- data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
- data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
- data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
- data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
- data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
- data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
- data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
- data/spec/components/checks/passive/webdav_spec.rb +1 -1
- data/spec/components/checks/passive/xst_spec.rb +1 -1
- data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
- data/spec/components/path_extractors/comments_spec.rb +5 -1
- data/spec/components/path_extractors/scripts_spec.rb +5 -2
- data/spec/components/plugins/autologin_spec.rb +22 -22
- data/spec/components/plugins/autothrottle_spec.rb +6 -5
- data/spec/components/plugins/content_types_spec.rb +4 -4
- data/spec/components/plugins/cookie_collector_spec.rb +5 -5
- data/spec/components/plugins/exec_spec.rb +12 -12
- data/spec/components/plugins/form_dicattack_spec.rb +3 -3
- data/spec/components/plugins/headers_collector_spec.rb +8 -8
- data/spec/components/plugins/healthmap_spec.rb +3 -3
- data/spec/components/plugins/http_dicattack_spec.rb +3 -3
- data/spec/components/plugins/login_script_spec.rb +79 -22
- data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
- data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
- data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
- data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
- data/spec/components/plugins/script_spec.rb +1 -1
- data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
- data/spec/components/plugins/vector_collector_spec.rb +2 -2
- data/spec/components/plugins/vector_feed_spec.rb +40 -40
- data/spec/components/plugins/waf_detector_spec.rb +6 -6
- data/spec/components/reporters/json_spec.rb +4 -4
- data/spec/components/reporters/marshal_spec.rb +2 -2
- data/spec/components/reporters/yaml_spec.rb +3 -2
- data/spec/external/wavsep/active/sqli_spec.rb +1 -3
- data/spec/spec_helper.rb +4 -0
- data/spec/support/factories/element/ui_form.rb +14 -0
- data/spec/support/factories/element/ui_input.rb +13 -0
- data/spec/support/factories/issue.rb +0 -13
- data/spec/support/fixtures/report.afr +0 -0
- data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
- data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/pages.rb +2 -2
- data/spec/support/servers/arachni/browser.rb +139 -0
- data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
- data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
- data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
- data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
- data/spec/support/servers/checks/active/trainer_check.rb +7 -7
- data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
- data/spec/support/servers/checks/active/xss_dom.rb +50 -0
- data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
- data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
- data/spec/support/shared/check.rb +10 -12
- data/spec/support/shared/component/options/base.rb +24 -24
- data/spec/support/shared/element/base.rb +25 -25
- data/spec/support/shared/element/capabilities/auditable.rb +116 -140
- data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
- data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
- data/spec/support/shared/element/capabilities/mutable.rb +122 -111
- data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
- data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
- data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
- data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
- data/spec/support/shared/element/capabilities/with_node.rb +4 -6
- data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
- data/spec/support/shared/element/capabilities/with_source.rb +6 -8
- data/spec/support/shared/element/dom.rb +144 -0
- data/spec/support/shared/element/dom/auditable.rb +42 -0
- data/spec/support/shared/element/dom/inputtable.rb +5 -0
- data/spec/support/shared/element/dom/mutable.rb +3 -0
- data/spec/support/shared/element/dom/submittable.rb +119 -0
- data/spec/support/shared/external/wavsep.rb +3 -3
- data/spec/support/shared/fingerprinter.rb +2 -2
- data/spec/support/shared/framework.rb +1 -1
- data/spec/support/shared/http/message.rb +9 -9
- data/spec/support/shared/option_group.rb +17 -17
- data/spec/support/shared/path_extractor.rb +1 -1
- data/spec/support/shared/plugin.rb +2 -2
- data/spec/support/shared/support/cache.rb +57 -57
- data/spec/support/shared/support/lookup.rb +25 -25
- data/ui/cli/framework.rb +22 -11
- data/ui/cli/framework/option_parser.rb +15 -0
- data/ui/cli/option_parser.rb +8 -1
- data/ui/cli/output.rb +2 -1
- metadata +54 -20
- data/components/checks/active/xss_dom_inputs.rb +0 -236
- data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
- data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
- data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -9,10 +9,10 @@ shared_examples_for 'element' do
|
|
9
9
|
let(:page) { Factory[:page].dup }
|
10
10
|
|
11
11
|
it "supports #{Arachni::RPC::Serializer}" do
|
12
|
-
subject.
|
12
|
+
expect(subject).to eq(Arachni::RPC::Serializer.deep_clone( subject ))
|
13
13
|
end
|
14
14
|
|
15
|
-
rpc_attributes = if described_class.ancestors.include? Arachni::Element::
|
15
|
+
rpc_attributes = if described_class.ancestors.include? Arachni::Element::DOM
|
16
16
|
%w(url)
|
17
17
|
else
|
18
18
|
%w(url initialization_options)
|
@@ -22,7 +22,7 @@ shared_examples_for 'element' do
|
|
22
22
|
let(:data) { subject.to_rpc_data }
|
23
23
|
|
24
24
|
it "includes 'url'" do
|
25
|
-
data['url'].
|
25
|
+
expect(data['url']).to eq(subject.url)
|
26
26
|
end
|
27
27
|
|
28
28
|
if rpc_attributes.include? 'initialization_options'
|
@@ -45,16 +45,16 @@ shared_examples_for 'element' do
|
|
45
45
|
end
|
46
46
|
end
|
47
47
|
|
48
|
-
data['initialization_options'].
|
48
|
+
expect(data['initialization_options']).to eq(init)
|
49
49
|
end
|
50
50
|
end
|
51
51
|
|
52
52
|
it "includes 'class'" do
|
53
|
-
data['class'].
|
53
|
+
expect(data['class']).to eq(subject.class.to_s)
|
54
54
|
end
|
55
55
|
|
56
56
|
it 'excludes #page' do
|
57
|
-
data.
|
57
|
+
expect(data).not_to include 'page'
|
58
58
|
end
|
59
59
|
end
|
60
60
|
|
@@ -69,15 +69,15 @@ shared_examples_for 'element' do
|
|
69
69
|
|
70
70
|
if attribute == 'initialization_options' && v1.is_a?( Hash )
|
71
71
|
if v1.include? :expires
|
72
|
-
v1.delete(:expires).to_s.
|
72
|
+
expect(v1.delete(:expires).to_s).to eq(v2.delete(:expires).to_s)
|
73
73
|
end
|
74
74
|
|
75
75
|
if v1.include? :template
|
76
|
-
v1.delete(:template).source.
|
76
|
+
expect(v1.delete(:template).source).to eq(v2.delete(:template).source)
|
77
77
|
end
|
78
78
|
end
|
79
79
|
|
80
|
-
v1.
|
80
|
+
expect(v1).to eq(v2)
|
81
81
|
end
|
82
82
|
end
|
83
83
|
end
|
@@ -86,19 +86,19 @@ shared_examples_for 'element' do
|
|
86
86
|
context 'when passed an Numeric' do
|
87
87
|
context "equal to #{described_class::MAX_SIZE}" do
|
88
88
|
it 'returns true' do
|
89
|
-
described_class.too_big?( described_class::MAX_SIZE ).
|
89
|
+
expect(described_class.too_big?( described_class::MAX_SIZE )).to be_truthy
|
90
90
|
end
|
91
91
|
end
|
92
92
|
|
93
93
|
context "larger than #{described_class::MAX_SIZE}" do
|
94
94
|
it 'returns true' do
|
95
|
-
described_class.too_big?( described_class::MAX_SIZE + 1 ).
|
95
|
+
expect(described_class.too_big?( described_class::MAX_SIZE + 1 )).to be_truthy
|
96
96
|
end
|
97
97
|
end
|
98
98
|
|
99
99
|
context "smaller than #{described_class::MAX_SIZE}" do
|
100
100
|
it 'returns false' do
|
101
|
-
described_class.too_big?( described_class::MAX_SIZE - 1 ).
|
101
|
+
expect(described_class.too_big?( described_class::MAX_SIZE - 1 )).to be_falsey
|
102
102
|
end
|
103
103
|
end
|
104
104
|
end
|
@@ -106,19 +106,19 @@ shared_examples_for 'element' do
|
|
106
106
|
context 'when passed a String' do
|
107
107
|
context "whose size is equal to #{described_class::MAX_SIZE}" do
|
108
108
|
it 'returns true' do
|
109
|
-
described_class.too_big?( 'a' * described_class::MAX_SIZE ).
|
109
|
+
expect(described_class.too_big?( 'a' * described_class::MAX_SIZE )).to be_truthy
|
110
110
|
end
|
111
111
|
end
|
112
112
|
|
113
113
|
context "whose size is larger than #{described_class::MAX_SIZE}" do
|
114
114
|
it 'returns true' do
|
115
|
-
described_class.too_big?( 'a' * (described_class::MAX_SIZE + 1) ).
|
115
|
+
expect(described_class.too_big?( 'a' * (described_class::MAX_SIZE + 1) )).to be_truthy
|
116
116
|
end
|
117
117
|
end
|
118
118
|
|
119
119
|
context "whose size is smaller than #{described_class::MAX_SIZE}" do
|
120
120
|
it 'returns false' do
|
121
|
-
described_class.too_big?( 'a' * (described_class::MAX_SIZE - 1) ).
|
121
|
+
expect(described_class.too_big?( 'a' * (described_class::MAX_SIZE - 1) )).to be_falsey
|
122
122
|
end
|
123
123
|
end
|
124
124
|
end
|
@@ -127,34 +127,34 @@ shared_examples_for 'element' do
|
|
127
127
|
describe '#marshal_dump' do
|
128
128
|
it 'excludes #page' do
|
129
129
|
subject.page = page
|
130
|
-
subject.marshal_dump.
|
130
|
+
expect(subject.marshal_dump).not_to include :page
|
131
131
|
end
|
132
132
|
end
|
133
133
|
|
134
134
|
describe '#url=',
|
135
|
-
if: !described_class.ancestors.include?( Arachni::Element::
|
135
|
+
if: !described_class.ancestors.include?( Arachni::Element::DOM ) do
|
136
136
|
it 'normalizes the passed URL' do
|
137
137
|
url = 'http://test.com/some stuff#frag!'
|
138
138
|
subject.url = url
|
139
|
-
subject.url.
|
139
|
+
expect(subject.url).to eq(Arachni::Utilities.normalize_url( url ))
|
140
140
|
end
|
141
141
|
end
|
142
142
|
|
143
143
|
describe '#page=' do
|
144
144
|
it 'sets the associated page' do
|
145
145
|
subject.page = page
|
146
|
-
subject.page.
|
146
|
+
expect(subject.page).to eq(page)
|
147
147
|
end
|
148
148
|
end
|
149
149
|
|
150
150
|
describe '#dup' do
|
151
151
|
it 'returns a copy of self' do
|
152
|
-
subject.dup.
|
152
|
+
expect(subject.dup).to eq(subject)
|
153
153
|
end
|
154
154
|
|
155
155
|
it 'copies #page' do
|
156
156
|
subject.page = page
|
157
|
-
subject.dup.page.
|
157
|
+
expect(subject.dup.page).to eq(page)
|
158
158
|
end
|
159
159
|
end
|
160
160
|
|
@@ -162,19 +162,19 @@ shared_examples_for 'element' do
|
|
162
162
|
let(:hash) { subject.to_h }
|
163
163
|
|
164
164
|
it 'includes the #type' do
|
165
|
-
hash[:type].
|
165
|
+
expect(hash[:type]).to eq(subject.type)
|
166
166
|
end
|
167
167
|
|
168
168
|
it 'includes the #url' do
|
169
|
-
hash[:url].
|
169
|
+
expect(hash[:url]).to eq(subject.url)
|
170
170
|
end
|
171
171
|
|
172
172
|
it 'includes the element class as a string' do
|
173
|
-
hash[:class].
|
173
|
+
expect(hash[:class]).to eq(described_class.to_s)
|
174
174
|
end
|
175
175
|
|
176
176
|
it 'is aliased to #to_hash' do
|
177
|
-
hash.
|
177
|
+
expect(hash).to eq(subject.to_hash)
|
178
178
|
end
|
179
179
|
end
|
180
180
|
end
|
@@ -1,34 +1,16 @@
|
|
1
|
-
shared_examples_for 'auditable' do
|
2
|
-
it_should_behave_like 'inputtable', options
|
3
|
-
it_should_behave_like 'submittable'
|
4
|
-
it_should_behave_like 'mutable', options
|
5
|
-
it_should_behave_like 'with_auditor'
|
6
|
-
|
7
|
-
let(:opts) do
|
8
|
-
{
|
9
|
-
single_input: false,
|
10
|
-
supports_nulls: true
|
11
|
-
}.merge( options )
|
12
|
-
end
|
1
|
+
shared_examples_for 'auditable' do
|
13
2
|
|
14
3
|
before :each do
|
15
4
|
begin
|
16
5
|
Arachni::Options.audit.elements described_class.type
|
17
|
-
rescue Arachni::OptionGroups::Audit::Error
|
6
|
+
rescue Arachni::OptionGroups::Audit::Error => e
|
18
7
|
end
|
19
|
-
|
20
|
-
@framework ||= Arachni::Framework.new
|
21
|
-
@page = Arachni::Page.from_url( url )
|
22
|
-
@auditor = Auditor.new( @page, @framework )
|
23
8
|
end
|
24
9
|
|
25
10
|
after :each do
|
26
|
-
@framework.clean_up
|
27
|
-
@framework.reset
|
28
11
|
reset_options
|
29
12
|
end
|
30
13
|
|
31
|
-
let(:auditor) { @auditor }
|
32
14
|
let(:seed) { 'my_seed' }
|
33
15
|
|
34
16
|
let(:auditable) do
|
@@ -42,12 +24,6 @@ shared_examples_for 'auditable' do |options = {}|
|
|
42
24
|
end
|
43
25
|
end
|
44
26
|
|
45
|
-
let(:other) do
|
46
|
-
new = auditable.dup
|
47
|
-
new.inputs = { stuff: 'blah' }
|
48
|
-
new
|
49
|
-
end
|
50
|
-
|
51
27
|
def has_parameter_extractor?
|
52
28
|
begin
|
53
29
|
auditable_extract_parameters
|
@@ -60,14 +36,14 @@ shared_examples_for 'auditable' do |options = {}|
|
|
60
36
|
end
|
61
37
|
|
62
38
|
it "supports #{Arachni::RPC::Serializer}" do
|
63
|
-
auditable.
|
39
|
+
expect(auditable).to eq(Arachni::RPC::Serializer.deep_clone( auditable ))
|
64
40
|
end
|
65
41
|
|
66
42
|
describe '#to_rpc_data' do
|
67
43
|
let(:data) { auditable.to_rpc_data }
|
68
44
|
|
69
45
|
it 'excludes #audit_options' do
|
70
|
-
data.
|
46
|
+
expect(data).not_to include 'audit_options'
|
71
47
|
end
|
72
48
|
end
|
73
49
|
|
@@ -75,7 +51,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
75
51
|
it 'clears #audit_options' do
|
76
52
|
auditable.audit_options[:stuff] = true
|
77
53
|
auditable.reset
|
78
|
-
auditable.audit_options.
|
54
|
+
expect(auditable.audit_options).to be_empty
|
79
55
|
end
|
80
56
|
end
|
81
57
|
|
@@ -87,14 +63,14 @@ shared_examples_for 'auditable' do |options = {}|
|
|
87
63
|
dupped.audit( seed ) { |_, m| audited = m }
|
88
64
|
run
|
89
65
|
|
90
|
-
audited.audit_options.
|
66
|
+
expect(audited.audit_options).to be_any
|
91
67
|
dupped = audited.dup
|
92
|
-
dupped.audit_options.
|
68
|
+
expect(dupped.audit_options).to eq(audited.audit_options)
|
93
69
|
|
94
70
|
dupped2 = dupped.dup
|
95
71
|
dupped.audit_options.clear
|
96
72
|
|
97
|
-
dupped2.audit_options.
|
73
|
+
expect(dupped2.audit_options).to eq(audited.audit_options)
|
98
74
|
end
|
99
75
|
end
|
100
76
|
|
@@ -103,7 +79,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
103
79
|
audited = false
|
104
80
|
auditable.audit( 'seed' ){ audited = true }
|
105
81
|
run
|
106
|
-
audited.
|
82
|
+
expect(audited).to be_truthy
|
107
83
|
|
108
84
|
Arachni::Element::Capabilities::Auditable.reset
|
109
85
|
Arachni::Element::Capabilities::Auditable.skip_like do
|
@@ -113,14 +89,14 @@ shared_examples_for 'auditable' do |options = {}|
|
|
113
89
|
audited = false
|
114
90
|
auditable.audit( 'seed' ){ audited = true }
|
115
91
|
run
|
116
|
-
audited.
|
92
|
+
expect(audited).to be_falsey
|
117
93
|
end
|
118
94
|
|
119
95
|
it 'skips element mutations based on the block\'s return value' do
|
120
96
|
called = false
|
121
97
|
auditable.audit( 'seed' ){ called = true }
|
122
98
|
run
|
123
|
-
called.
|
99
|
+
expect(called).to be_truthy
|
124
100
|
|
125
101
|
Arachni::Element::Capabilities::Auditable.reset
|
126
102
|
Arachni::Element::Capabilities::Auditable.skip_like do |element|
|
@@ -130,7 +106,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
130
106
|
i = 0
|
131
107
|
auditable.audit( 'seed' ){ i += 1 }
|
132
108
|
run
|
133
|
-
i.
|
109
|
+
expect(i).to eq(0)
|
134
110
|
end
|
135
111
|
end
|
136
112
|
|
@@ -142,55 +118,55 @@ shared_examples_for 'auditable' do |options = {}|
|
|
142
118
|
id = auditable.audit_id
|
143
119
|
|
144
120
|
auditable.auditor = '2'
|
145
|
-
auditable.audit_id.
|
121
|
+
expect(auditable.audit_id).not_to eq(id)
|
146
122
|
|
147
123
|
auditable.auditor = 1
|
148
124
|
id = auditable.audit_id
|
149
125
|
|
150
126
|
auditable.auditor = 2
|
151
|
-
auditable.audit_id.
|
127
|
+
expect(auditable.audit_id).to eq(id)
|
152
128
|
end
|
153
129
|
|
154
130
|
it 'takes into account #action' do
|
155
131
|
e = auditable.dup
|
156
|
-
e.
|
132
|
+
allow(e).to receive(:action) { action }
|
157
133
|
|
158
134
|
c = auditable.dup
|
159
|
-
c.
|
135
|
+
allow(c).to receive(:action) { "#{action}2" }
|
160
136
|
|
161
|
-
e.audit_id.
|
137
|
+
expect(e.audit_id).not_to eq(c.audit_id)
|
162
138
|
end
|
163
139
|
|
164
140
|
it 'takes into account #type' do
|
165
141
|
e = auditable.dup
|
166
|
-
e.
|
142
|
+
allow(e).to receive(:type) { :blah }
|
167
143
|
|
168
144
|
c = auditable.dup
|
169
|
-
c.
|
145
|
+
allow(c).to receive(:type) { :blooh }
|
170
146
|
|
171
|
-
e.audit_id.
|
147
|
+
expect(e.audit_id).not_to eq(c.audit_id)
|
172
148
|
end
|
173
149
|
|
174
150
|
it 'takes into account #inputs names' do
|
175
151
|
e = auditable.dup
|
176
|
-
e.
|
152
|
+
allow(e).to receive(:inputs) { {input1: 'stuff' } }
|
177
153
|
|
178
154
|
c = auditable.dup
|
179
|
-
c.
|
180
|
-
e.audit_id.
|
155
|
+
allow(c).to receive(:inputs) { {input1: 'stuff2' } }
|
156
|
+
expect(e.audit_id).to eq(c.audit_id)
|
181
157
|
|
182
158
|
e = auditable.dup
|
183
|
-
e.
|
159
|
+
allow(e).to receive(:inputs) { {input1: 'stuff' } }
|
184
160
|
|
185
161
|
c = auditable.dup
|
186
|
-
c.
|
162
|
+
allow(c).to receive(:inputs) { {input2: 'stuff' } }
|
187
163
|
|
188
|
-
e.audit_id.
|
164
|
+
expect(e.audit_id).not_to eq(c.audit_id)
|
189
165
|
end
|
190
166
|
|
191
167
|
it 'takes into account the given payload' do
|
192
168
|
id = auditable.audit_id( '1' )
|
193
|
-
auditable.audit_id( '2' ).
|
169
|
+
expect(auditable.audit_id( '2' )).not_to eq(id)
|
194
170
|
end
|
195
171
|
end
|
196
172
|
|
@@ -199,45 +175,45 @@ shared_examples_for 'auditable' do |options = {}|
|
|
199
175
|
|
200
176
|
it 'takes into account #action' do
|
201
177
|
e = auditable.dup
|
202
|
-
e.
|
178
|
+
allow(e).to receive(:action) { action }
|
203
179
|
|
204
180
|
c = auditable.dup
|
205
|
-
c.
|
181
|
+
allow(c).to receive(:action) { "#{action}2" }
|
206
182
|
|
207
|
-
e.coverage_id.
|
183
|
+
expect(e.coverage_id).not_to eq(c.coverage_id)
|
208
184
|
end
|
209
185
|
|
210
186
|
it 'takes into account #type' do
|
211
187
|
e = auditable.dup
|
212
|
-
e.
|
188
|
+
allow(e).to receive(:type) { :blah }
|
213
189
|
|
214
190
|
c = auditable.dup
|
215
|
-
c.
|
191
|
+
allow(c).to receive(:type) { :blooh }
|
216
192
|
|
217
|
-
e.coverage_id.
|
193
|
+
expect(e.coverage_id).not_to eq(c.coverage_id)
|
218
194
|
end
|
219
195
|
|
220
196
|
it 'takes into account #inputs names' do
|
221
197
|
e = auditable.dup
|
222
|
-
e.
|
198
|
+
allow(e).to receive(:inputs) { {input1: 'stuff' } }
|
223
199
|
|
224
200
|
c = auditable.dup
|
225
|
-
c.
|
226
|
-
e.coverage_id.
|
201
|
+
allow(c).to receive(:inputs) { {input1: 'stuff2' } }
|
202
|
+
expect(e.coverage_id).to eq(c.coverage_id)
|
227
203
|
|
228
204
|
e = auditable.dup
|
229
|
-
e.
|
205
|
+
allow(e).to receive(:inputs) { {input1: 'stuff' } }
|
230
206
|
|
231
207
|
c = auditable.dup
|
232
|
-
c.
|
208
|
+
allow(c).to receive(:inputs) { {input2: 'stuff' } }
|
233
209
|
|
234
|
-
e.coverage_id.
|
210
|
+
expect(e.coverage_id).not_to eq(c.coverage_id)
|
235
211
|
end
|
236
212
|
end
|
237
213
|
|
238
214
|
describe '#coverage_hash' do
|
239
215
|
it 'returns the String#persistent_hash of #coverage_id' do
|
240
|
-
auditable.coverage_hash.
|
216
|
+
expect(auditable.coverage_hash).to eq(auditable.coverage_id.persistent_hash)
|
241
217
|
end
|
242
218
|
end
|
243
219
|
|
@@ -262,7 +238,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
262
238
|
end
|
263
239
|
|
264
240
|
run
|
265
|
-
injected.
|
241
|
+
expect(injected).to eq(payload)
|
266
242
|
end
|
267
243
|
|
268
244
|
context 'with invalid data' do
|
@@ -270,7 +246,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
270
246
|
payload = 'stuff-here'
|
271
247
|
called = 0
|
272
248
|
|
273
|
-
auditable.class.
|
249
|
+
allow_any_instance_of(auditable.class).to receive(:valid_input_data?) { |instance, i| i != payload }
|
274
250
|
|
275
251
|
auditable.audit( payload,
|
276
252
|
format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
|
@@ -278,7 +254,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
278
254
|
) { |_, element| called += 1 }
|
279
255
|
run
|
280
256
|
|
281
|
-
called.
|
257
|
+
expect(called).to eq(0)
|
282
258
|
end
|
283
259
|
end
|
284
260
|
end
|
@@ -295,21 +271,21 @@ shared_examples_for 'auditable' do |options = {}|
|
|
295
271
|
end
|
296
272
|
|
297
273
|
run
|
298
|
-
injected.uniq.sort.
|
274
|
+
expect(injected.uniq.sort).to eq(payloads.sort)
|
299
275
|
end
|
300
276
|
|
301
277
|
context 'and is empty' do
|
302
278
|
it 'returns nil' do
|
303
279
|
injected = []
|
304
|
-
auditable.audit( [],
|
280
|
+
expect(auditable.audit( [],
|
305
281
|
format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
|
306
282
|
skip_original: true
|
307
283
|
) do |_, element|
|
308
284
|
injected << element.affected_input_value
|
309
|
-
end.
|
285
|
+
end).to be_nil
|
310
286
|
|
311
287
|
run
|
312
|
-
injected.
|
288
|
+
expect(injected).to be_empty
|
313
289
|
end
|
314
290
|
end
|
315
291
|
end
|
@@ -327,31 +303,31 @@ shared_examples_for 'auditable' do |options = {}|
|
|
327
303
|
injected = []
|
328
304
|
|
329
305
|
auditable.platforms.update %w(unix php apache)
|
330
|
-
auditable.audit( payloads,
|
306
|
+
expect(auditable.audit( payloads,
|
331
307
|
format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
|
332
308
|
skip_original: true
|
333
309
|
) do |_, element|
|
334
310
|
injected << element.affected_input_value
|
335
|
-
end.
|
311
|
+
end).to be_truthy
|
336
312
|
|
337
313
|
run
|
338
314
|
|
339
315
|
payloads.delete( :windows )
|
340
316
|
payloads.delete( :aspx )
|
341
317
|
|
342
|
-
injected.uniq.sort.
|
318
|
+
expect(injected.uniq.sort).to eq(payloads.values.flatten.sort)
|
343
319
|
end
|
344
320
|
|
345
321
|
context 'and is empty' do
|
346
322
|
it 'returns nil' do
|
347
323
|
injected = []
|
348
|
-
auditable.audit( {},
|
324
|
+
expect(auditable.audit( {},
|
349
325
|
format: [ Arachni::Check::Auditor::Format::STRAIGHT ] ) do |_, element|
|
350
326
|
injected << element.affected_input_value
|
351
|
-
end.
|
327
|
+
end).to be_nil
|
352
328
|
|
353
329
|
run
|
354
|
-
injected.
|
330
|
+
expect(injected).to be_empty
|
355
331
|
end
|
356
332
|
end
|
357
333
|
|
@@ -369,16 +345,16 @@ shared_examples_for 'auditable' do |options = {}|
|
|
369
345
|
injected = []
|
370
346
|
|
371
347
|
auditable.platforms.clear
|
372
|
-
auditable.audit( payloads,
|
348
|
+
expect(auditable.audit( payloads,
|
373
349
|
format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
|
374
350
|
skip_original: true
|
375
351
|
) do |_, element|
|
376
352
|
injected << element.affected_input_value
|
377
|
-
end.
|
353
|
+
end).to be_truthy
|
378
354
|
|
379
355
|
run
|
380
356
|
|
381
|
-
injected.uniq.sort.
|
357
|
+
expect(injected.uniq.sort).to eq(payloads.values.flatten.sort)
|
382
358
|
end
|
383
359
|
end
|
384
360
|
|
@@ -392,17 +368,17 @@ shared_examples_for 'auditable' do |options = {}|
|
|
392
368
|
injected = []
|
393
369
|
|
394
370
|
auditable.platforms.update %w(unix php apache)
|
395
|
-
auditable.audit( payloads,
|
371
|
+
expect(auditable.audit( payloads,
|
396
372
|
format: [ Arachni::Check::Auditor::Format::STRAIGHT ] ) do |_, element|
|
397
373
|
injected << element.affected_input_value
|
398
|
-
end.
|
374
|
+
end).to be_nil
|
399
375
|
|
400
376
|
run
|
401
377
|
|
402
378
|
payloads.delete( :windows )
|
403
379
|
payloads.delete( :aspx )
|
404
380
|
|
405
|
-
injected.
|
381
|
+
expect(injected).to be_empty
|
406
382
|
end
|
407
383
|
end
|
408
384
|
end
|
@@ -426,18 +402,18 @@ shared_examples_for 'auditable' do |options = {}|
|
|
426
402
|
|
427
403
|
called = false
|
428
404
|
each = proc do |mutation|
|
429
|
-
mutation.
|
405
|
+
expect(mutation).to receive(:submit).with(options)
|
430
406
|
called = true
|
431
407
|
end
|
432
408
|
auditable.audit( seed, each_mutation: each, submit: options ){}
|
433
409
|
|
434
|
-
called.
|
410
|
+
expect(called).to be_truthy
|
435
411
|
end
|
436
412
|
end
|
437
413
|
|
438
414
|
describe :each_mutation do
|
439
415
|
it 'is passed each generated mutation' do
|
440
|
-
|
416
|
+
skip if !has_parameter_extractor?
|
441
417
|
|
442
418
|
submitted = nil
|
443
419
|
cnt = 0
|
@@ -451,12 +427,12 @@ shared_examples_for 'auditable' do |options = {}|
|
|
451
427
|
end
|
452
428
|
|
453
429
|
run
|
454
|
-
cnt.
|
430
|
+
expect(cnt).to eq(1)
|
455
431
|
auditable.inputs == submitted
|
456
432
|
end
|
457
433
|
|
458
434
|
it 'is able to modify mutations on the fly' do
|
459
|
-
|
435
|
+
skip if !has_parameter_extractor?
|
460
436
|
|
461
437
|
submitted = nil
|
462
438
|
|
@@ -472,12 +448,12 @@ shared_examples_for 'auditable' do |options = {}|
|
|
472
448
|
end
|
473
449
|
|
474
450
|
run
|
475
|
-
submitted.values.first.
|
451
|
+
expect(submitted.values.first).to eq(modified_seed)
|
476
452
|
end
|
477
453
|
|
478
454
|
context 'when it returns one or more elements of the same type' do
|
479
455
|
it 'audits those elements too' do
|
480
|
-
|
456
|
+
skip if !has_parameter_extractor?
|
481
457
|
|
482
458
|
injected = []
|
483
459
|
cnt = 0
|
@@ -500,8 +476,8 @@ shared_examples_for 'auditable' do |options = {}|
|
|
500
476
|
end
|
501
477
|
|
502
478
|
run
|
503
|
-
cnt.
|
504
|
-
injected.sort.
|
479
|
+
expect(cnt).to eq(3)
|
480
|
+
expect(injected.sort).to eq([ seed, 'houa', 'houa2'].sort)
|
505
481
|
end
|
506
482
|
end
|
507
483
|
end
|
@@ -519,8 +495,8 @@ shared_examples_for 'auditable' do |options = {}|
|
|
519
495
|
run
|
520
496
|
|
521
497
|
audited.uniq!
|
522
|
-
audited.size.
|
523
|
-
audited.
|
498
|
+
expect(audited.size).to eq(1)
|
499
|
+
expect(audited).to eq([auditable.inputs.keys.first])
|
524
500
|
end
|
525
501
|
end
|
526
502
|
|
@@ -537,8 +513,8 @@ shared_examples_for 'auditable' do |options = {}|
|
|
537
513
|
run
|
538
514
|
|
539
515
|
audited.uniq!
|
540
|
-
audited.size.
|
541
|
-
audited.
|
516
|
+
expect(audited.size).to eq(1)
|
517
|
+
expect(audited).to eq([auditable.inputs.keys.first])
|
542
518
|
end
|
543
519
|
end
|
544
520
|
end
|
@@ -546,7 +522,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
546
522
|
describe :format do
|
547
523
|
describe 'Arachni::Check::Auditor::Format::STRAIGHT' do
|
548
524
|
it 'injects the seed as is' do
|
549
|
-
|
525
|
+
skip if !has_parameter_extractor?
|
550
526
|
|
551
527
|
injected = nil
|
552
528
|
cnt = 0
|
@@ -559,14 +535,14 @@ shared_examples_for 'auditable' do |options = {}|
|
|
559
535
|
end
|
560
536
|
|
561
537
|
run
|
562
|
-
cnt.
|
563
|
-
injected.
|
538
|
+
expect(cnt).to eq(1)
|
539
|
+
expect(injected).to eq(seed)
|
564
540
|
end
|
565
541
|
end
|
566
542
|
|
567
543
|
describe 'Arachni::Check::Auditor::Format::APPEND' do
|
568
544
|
it 'appends the seed to the existing value of the input' do
|
569
|
-
|
545
|
+
skip if !has_parameter_extractor?
|
570
546
|
|
571
547
|
injected = nil
|
572
548
|
cnt = 0
|
@@ -579,16 +555,16 @@ shared_examples_for 'auditable' do |options = {}|
|
|
579
555
|
end
|
580
556
|
|
581
557
|
run
|
582
|
-
cnt.
|
583
|
-
injected.
|
558
|
+
expect(cnt).to eq(1)
|
559
|
+
expect(injected).to eq(auditable.inputs.values.first + seed)
|
584
560
|
end
|
585
561
|
end
|
586
562
|
|
587
563
|
describe 'Arachni::Check::Auditor::Format::NULL' do
|
588
564
|
it 'terminates the seed with a null character',
|
589
565
|
if: described_class != Arachni::Element::Header &&
|
590
|
-
described_class.is_a?( Arachni::Element::
|
591
|
-
|
566
|
+
described_class.is_a?( Arachni::Element::DOM ) do
|
567
|
+
skip if !has_parameter_extractor?
|
592
568
|
|
593
569
|
injected = nil
|
594
570
|
cnt = 0
|
@@ -600,14 +576,14 @@ shared_examples_for 'auditable' do |options = {}|
|
|
600
576
|
end
|
601
577
|
|
602
578
|
run
|
603
|
-
cnt.
|
604
|
-
auditable.decode( injected ).
|
579
|
+
expect(cnt).to eq(1)
|
580
|
+
expect(auditable.decode( injected )).to eq(seed + "\0")
|
605
581
|
end
|
606
582
|
end
|
607
583
|
|
608
584
|
describe 'Arachni::Check::Auditor::Format::SEMICOLON' do
|
609
585
|
it 'prepends the seed with a semicolon' do
|
610
|
-
|
586
|
+
skip if !has_parameter_extractor?
|
611
587
|
|
612
588
|
injected = nil
|
613
589
|
cnt = 0
|
@@ -618,9 +594,9 @@ shared_examples_for 'auditable' do |options = {}|
|
|
618
594
|
cnt += 1
|
619
595
|
end
|
620
596
|
run
|
621
|
-
cnt.
|
597
|
+
expect(cnt).to eq(1)
|
622
598
|
|
623
|
-
auditable.decode( injected ).
|
599
|
+
expect(auditable.decode( injected )).to eq(";" + seed)
|
624
600
|
end
|
625
601
|
end
|
626
602
|
end
|
@@ -640,7 +616,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
640
616
|
auditable.audit( seed, @audit_opts.merge( redundant: true )){ cnt += 1 }
|
641
617
|
end
|
642
618
|
run
|
643
|
-
cnt.
|
619
|
+
expect(cnt).to eq(5)
|
644
620
|
end
|
645
621
|
end
|
646
622
|
|
@@ -651,7 +627,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
651
627
|
auditable.audit( seed, @audit_opts.merge( redundant: false )){ cnt += 1 }
|
652
628
|
end
|
653
629
|
run
|
654
|
-
cnt.
|
630
|
+
expect(cnt).to eq(1)
|
655
631
|
end
|
656
632
|
end
|
657
633
|
|
@@ -662,7 +638,7 @@ shared_examples_for 'auditable' do |options = {}|
|
|
662
638
|
auditable.audit( seed, @audit_opts ){ cnt += 1 }
|
663
639
|
end
|
664
640
|
run
|
665
|
-
cnt.
|
641
|
+
expect(cnt).to eq(1)
|
666
642
|
end
|
667
643
|
end
|
668
644
|
end
|
@@ -673,41 +649,41 @@ shared_examples_for 'auditable' do |options = {}|
|
|
673
649
|
Arachni::Options.audit.exclude_vector_patterns = auditable.inputs.keys
|
674
650
|
|
675
651
|
audited = []
|
676
|
-
auditable.audit( seed, skip_original: true ) do |_, elem|
|
652
|
+
expect(auditable.audit( seed, skip_original: true ) do |_, elem|
|
677
653
|
audited << elem.affected_input_name
|
678
|
-
end.
|
654
|
+
end).to be_truthy
|
679
655
|
|
680
656
|
run
|
681
|
-
audited.
|
657
|
+
expect(audited).to be_empty
|
682
658
|
end
|
683
659
|
end
|
684
660
|
|
685
661
|
context "when #{Arachni::OptionGroups::Audit}#vector?" do
|
686
662
|
context 'returns true' do
|
687
663
|
it 'audits the input' do
|
688
|
-
Arachni::Options.audit.
|
664
|
+
allow(Arachni::Options.audit).to receive(:vector?){ true }
|
689
665
|
|
690
666
|
audited = []
|
691
|
-
auditable.audit( seed, skip_original: true ) do |_, elem|
|
667
|
+
expect(auditable.audit( seed, skip_original: true ) do |_, elem|
|
692
668
|
audited << elem.affected_input_name
|
693
|
-
end.
|
669
|
+
end).to be_truthy
|
694
670
|
|
695
671
|
run
|
696
|
-
audited.
|
672
|
+
expect(audited).not_to be_empty
|
697
673
|
end
|
698
674
|
end
|
699
675
|
|
700
676
|
context 'returns false' do
|
701
677
|
it 'skips the input' do
|
702
|
-
Arachni::Options.audit.
|
678
|
+
allow(Arachni::Options.audit).to receive(:vector?){ false }
|
703
679
|
|
704
680
|
audited = []
|
705
|
-
auditable.audit( seed, skip_original: true ) do |_, elem|
|
681
|
+
expect(auditable.audit( seed, skip_original: true ) do |_, elem|
|
706
682
|
audited << elem.affected_input_name
|
707
|
-
end.
|
683
|
+
end).to be_truthy
|
708
684
|
|
709
685
|
run
|
710
|
-
audited.
|
686
|
+
expect(audited).to be_empty
|
711
687
|
end
|
712
688
|
end
|
713
689
|
end
|
@@ -715,12 +691,12 @@ shared_examples_for 'auditable' do |options = {}|
|
|
715
691
|
context "when #{described_class::Scope}#out?" do
|
716
692
|
context true do
|
717
693
|
it 'returns immediately' do
|
718
|
-
described_class::Scope.
|
694
|
+
allow_any_instance_of(described_class::Scope).to receive(:out?) { true }
|
719
695
|
|
720
696
|
ran = false
|
721
|
-
auditable.audit( seed ) { ran = true }.
|
697
|
+
expect(auditable.audit( seed ) { ran = true }).to be_falsey
|
722
698
|
run
|
723
|
-
ran.
|
699
|
+
expect(ran).to be_falsey
|
724
700
|
end
|
725
701
|
end
|
726
702
|
end
|
@@ -729,19 +705,19 @@ shared_examples_for 'auditable' do |options = {}|
|
|
729
705
|
it 'returns immediately' do
|
730
706
|
ran = false
|
731
707
|
auditable.inputs = {}
|
732
|
-
auditable.audit( seed ) { ran = true }.
|
708
|
+
expect(auditable.audit( seed ) { ran = true }).to be_falsey
|
733
709
|
run
|
734
710
|
|
735
|
-
ran.
|
711
|
+
expect(ran).to be_falsey
|
736
712
|
end
|
737
713
|
end
|
738
714
|
|
739
715
|
context 'when the auditor\'s #skip? method returns true for a mutation' do
|
740
716
|
it 'is skipped' do
|
741
717
|
ran = false
|
742
|
-
auditable.audit( seed ) { ran = true }.
|
718
|
+
expect(auditable.audit( seed ) { ran = true }).to be_truthy
|
743
719
|
run
|
744
|
-
ran.
|
720
|
+
expect(ran).to be_truthy
|
745
721
|
|
746
722
|
Arachni::Element::Capabilities::Auditable.reset
|
747
723
|
|
@@ -750,9 +726,9 @@ shared_examples_for 'auditable' do |options = {}|
|
|
750
726
|
end
|
751
727
|
|
752
728
|
ran = false
|
753
|
-
auditable.audit( seed ) { ran = true }.
|
729
|
+
expect(auditable.audit( seed ) { ran = true }).to be_truthy
|
754
730
|
run
|
755
|
-
ran.
|
731
|
+
expect(ran).to be_falsey
|
756
732
|
|
757
733
|
Arachni::Element::Capabilities::Auditable.reset
|
758
734
|
|
@@ -761,18 +737,18 @@ shared_examples_for 'auditable' do |options = {}|
|
|
761
737
|
end
|
762
738
|
|
763
739
|
ran = false
|
764
|
-
auditable.audit( seed ) { ran = true }.
|
740
|
+
expect(auditable.audit( seed ) { ran = true }).to be_truthy
|
765
741
|
run
|
766
|
-
ran.
|
742
|
+
expect(ran).to be_truthy
|
767
743
|
end
|
768
744
|
end
|
769
745
|
|
770
746
|
context 'when the element\'s #skip? method returns true for a mutation' do
|
771
747
|
it 'is skipped' do
|
772
748
|
ran = false
|
773
|
-
auditable.audit( seed ) { ran = true }.
|
749
|
+
expect(auditable.audit( seed ) { ran = true }).to be_truthy
|
774
750
|
run
|
775
|
-
ran.
|
751
|
+
expect(ran).to be_truthy
|
776
752
|
|
777
753
|
Arachni::Element::Capabilities::Auditable.reset
|
778
754
|
|
@@ -781,9 +757,9 @@ shared_examples_for 'auditable' do |options = {}|
|
|
781
757
|
end
|
782
758
|
|
783
759
|
ran = false
|
784
|
-
auditable.audit( seed ) { ran = true }.
|
760
|
+
expect(auditable.audit( seed ) { ran = true }).to be_truthy
|
785
761
|
run
|
786
|
-
ran.
|
762
|
+
expect(ran).to be_falsey
|
787
763
|
|
788
764
|
Arachni::Element::Capabilities::Auditable.reset
|
789
765
|
|
@@ -792,9 +768,9 @@ shared_examples_for 'auditable' do |options = {}|
|
|
792
768
|
end
|
793
769
|
|
794
770
|
ran = false
|
795
|
-
auditable.audit( seed ) { ran = true }.
|
771
|
+
expect(auditable.audit( seed ) { ran = true }).to be_truthy
|
796
772
|
run
|
797
|
-
ran.
|
773
|
+
expect(ran).to be_truthy
|
798
774
|
end
|
799
775
|
end
|
800
776
|
end
|