arachni 1.2.1 → 1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (373) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +66 -0
  3. data/Gemfile +1 -1
  4. data/README.md +16 -5
  5. data/components/checks/active/ldap_injection/errors.txt +1 -0
  6. data/components/checks/active/source_code_disclosure.rb +1 -1
  7. data/components/checks/active/unvalidated_redirect.rb +6 -6
  8. data/components/checks/active/unvalidated_redirect_dom.rb +10 -7
  9. data/components/checks/passive/grep/captcha.rb +14 -5
  10. data/components/checks/passive/grep/form_upload.rb +7 -3
  11. data/components/checks/passive/grep/hsts.rb +3 -3
  12. data/components/checks/passive/grep/html_objects.rb +2 -3
  13. data/components/checks/passive/grep/http_only_cookies.rb +2 -3
  14. data/components/checks/passive/grep/insecure_cookies.rb +1 -1
  15. data/components/checks/passive/grep/password_autocomplete.rb +2 -2
  16. data/components/checks/passive/grep/unencrypted_password_forms.rb +7 -7
  17. data/components/checks/passive/grep/x_frame_options.rb +2 -2
  18. data/components/checks/passive/http_put.rb +2 -3
  19. data/components/path_extractors/comments.rb +3 -3
  20. data/components/path_extractors/scripts.rb +10 -1
  21. data/components/plugins/defaults/autothrottle.rb +27 -18
  22. data/components/plugins/defaults/meta/remedies/discovery.rb +30 -33
  23. data/components/plugins/defaults/meta/remedies/timing_attacks.rb +7 -11
  24. data/components/plugins/login_script.rb +9 -3
  25. data/components/plugins/proxy.rb +4 -3
  26. data/components/reporters/html.rb +11 -14
  27. data/components/reporters/html/default/issue.erb +13 -38
  28. data/components/reporters/html/default/issue/info.erb +1 -1
  29. data/components/reporters/html/default/summary/issues/by_name.erb +3 -3
  30. data/components/reporters/stdout.rb +62 -71
  31. data/components/reporters/xml.rb +26 -40
  32. data/components/reporters/xml/schema.xsd +43 -89
  33. data/lib/arachni/browser.rb +52 -3
  34. data/lib/arachni/browser/javascript.rb +3 -3
  35. data/lib/arachni/browser/javascript/scripts/taint_tracer.js +46 -25
  36. data/lib/arachni/browser_cluster.rb +61 -0
  37. data/lib/arachni/browser_cluster/job.rb +21 -1
  38. data/lib/arachni/browser_cluster/jobs/browser_provider.rb +3 -1
  39. data/lib/arachni/browser_cluster/jobs/resource_exploration.rb +2 -1
  40. data/lib/arachni/browser_cluster/jobs/resource_exploration/event_trigger.rb +2 -1
  41. data/lib/arachni/browser_cluster/jobs/taint_trace.rb +3 -2
  42. data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
  43. data/lib/arachni/browser_cluster/worker.rb +5 -0
  44. data/lib/arachni/check/auditor.rb +22 -12
  45. data/lib/arachni/data/framework.rb +13 -1
  46. data/lib/arachni/data/issues.rb +9 -25
  47. data/lib/arachni/element/base.rb +9 -3
  48. data/lib/arachni/element/capabilities/analyzable.rb +2 -6
  49. data/lib/arachni/element/capabilities/analyzable/differential.rb +24 -7
  50. data/lib/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +23 -23
  51. data/lib/arachni/element/capabilities/auditable.rb +0 -6
  52. data/lib/arachni/element/capabilities/dom_only.rb +61 -0
  53. data/lib/arachni/element/capabilities/with_dom.rb +3 -1
  54. data/lib/arachni/element/cookie.rb +35 -5
  55. data/lib/arachni/element/cookie/dom.rb +13 -4
  56. data/lib/arachni/element/{capabilities/auditable/dom.rb → dom.rb} +20 -68
  57. data/lib/arachni/element/dom/capabilities/auditable.rb +29 -0
  58. data/lib/arachni/element/dom/capabilities/inputtable.rb +27 -0
  59. data/lib/arachni/element/dom/capabilities/mutable.rb +21 -0
  60. data/lib/arachni/element/dom/capabilities/submittable.rb +52 -0
  61. data/lib/arachni/element/form.rb +12 -1
  62. data/lib/arachni/element/form/capabilities/mutable.rb +2 -1
  63. data/lib/arachni/element/form/capabilities/with_dom.rb +0 -1
  64. data/lib/arachni/element/form/dom.rb +9 -3
  65. data/lib/arachni/element/header.rb +14 -33
  66. data/lib/arachni/element/header/capabilities/inputtable.rb +29 -0
  67. data/lib/arachni/element/header/capabilities/mutable.rb +51 -0
  68. data/lib/arachni/element/input/dom.rb +71 -0
  69. data/lib/arachni/element/json.rb +2 -0
  70. data/lib/arachni/element/link.rb +3 -0
  71. data/lib/arachni/element/link/capabilities/with_dom.rb +0 -1
  72. data/lib/arachni/element/link/dom.rb +16 -3
  73. data/lib/arachni/element/link/dom/capabilities/submittable.rb +29 -0
  74. data/lib/arachni/element/link_template.rb +3 -5
  75. data/lib/arachni/element/link_template/capabilities/inputtable.rb +5 -0
  76. data/lib/arachni/element/link_template/capabilities/with_dom.rb +0 -1
  77. data/lib/arachni/element/link_template/dom.rb +16 -3
  78. data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +29 -0
  79. data/lib/arachni/element/server.rb +3 -5
  80. data/lib/arachni/element/ui_form.rb +106 -0
  81. data/lib/arachni/element/ui_form/dom.rb +107 -0
  82. data/lib/arachni/element/ui_input.rb +62 -0
  83. data/lib/arachni/element/xml.rb +2 -1
  84. data/lib/arachni/framework.rb +7 -5
  85. data/lib/arachni/framework/parts/audit.rb +0 -1
  86. data/lib/arachni/framework/parts/check.rb +1 -0
  87. data/lib/arachni/framework/parts/data.rb +4 -0
  88. data/lib/arachni/framework/parts/state.rb +0 -2
  89. data/lib/arachni/http/client.rb +17 -6
  90. data/lib/arachni/http/proxy_server.rb +52 -5
  91. data/lib/arachni/http/request.rb +1 -1
  92. data/lib/arachni/issue.rb +34 -179
  93. data/lib/arachni/issue/severity.rb +2 -0
  94. data/lib/arachni/option_groups/audit.rb +22 -2
  95. data/lib/arachni/option_groups/browser_cluster.rb +15 -0
  96. data/lib/arachni/page.rb +3 -2
  97. data/lib/arachni/parser.rb +24 -5
  98. data/lib/arachni/platform/manager.rb +1 -2
  99. data/lib/arachni/rpc/server/framework.rb +3 -4
  100. data/lib/arachni/rpc/server/framework/multi_instance.rb +2 -1
  101. data/lib/arachni/session.rb +1 -1
  102. data/lib/arachni/trainer.rb +4 -7
  103. data/lib/arachni/watir/element.rb +12 -1
  104. data/lib/version +1 -1
  105. data/spec/arachni/browser/element_locator_spec.rb +43 -43
  106. data/spec/arachni/browser/javascript/dom_monitor_spec.rb +44 -44
  107. data/spec/arachni/browser/javascript/proxy/stub_spec.rb +17 -14
  108. data/spec/arachni/browser/javascript/proxy_spec.rb +24 -24
  109. data/spec/arachni/browser/javascript/taint_tracer/frame/called_function_spec.rb +11 -11
  110. data/spec/arachni/browser/javascript/taint_tracer/frame_spec.rb +7 -7
  111. data/spec/arachni/browser/javascript/taint_tracer/sink/data_flow_spec.rb +13 -13
  112. data/spec/arachni/browser/javascript/taint_tracer/sink/execution_flow_spec.rb +7 -7
  113. data/spec/arachni/browser/javascript/taint_tracer_spec.rb +568 -558
  114. data/spec/arachni/browser/javascript_spec.rb +73 -63
  115. data/spec/arachni/browser_cluster/job/result_spec.rb +3 -3
  116. data/spec/arachni/browser_cluster/job_spec.rb +68 -48
  117. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger/result_spec.rb +2 -2
  118. data/spec/arachni/browser_cluster/jobs/resource_exploration/event_trigger_spec.rb +5 -4
  119. data/spec/arachni/browser_cluster/jobs/resource_exploration/result_spec.rb +2 -2
  120. data/spec/arachni/browser_cluster/jobs/resource_exploration_spec.rb +5 -5
  121. data/spec/arachni/browser_cluster/worker_spec.rb +87 -70
  122. data/spec/arachni/browser_cluster_spec.rb +64 -39
  123. data/spec/arachni/browser_spec.rb +692 -527
  124. data/spec/arachni/check/auditor_spec.rb +177 -147
  125. data/spec/arachni/check/base_spec.rb +33 -33
  126. data/spec/arachni/check/manager_spec.rb +15 -15
  127. data/spec/arachni/component/base_spec.rb +8 -8
  128. data/spec/arachni/component/manager_spec.rb +100 -99
  129. data/spec/arachni/component/options/address_spec.rb +3 -3
  130. data/spec/arachni/component/options/base_spec.rb +7 -7
  131. data/spec/arachni/component/options/bool_spec.rb +9 -9
  132. data/spec/arachni/component/options/float_spec.rb +6 -6
  133. data/spec/arachni/component/options/int_spec.rb +5 -5
  134. data/spec/arachni/component/options/multiple_choice_spec.rb +12 -12
  135. data/spec/arachni/component/options/object_spec.rb +2 -2
  136. data/spec/arachni/component/options/path_spec.rb +3 -3
  137. data/spec/arachni/component/options/port_spec.rb +5 -5
  138. data/spec/arachni/component/options/string_spec.rb +3 -3
  139. data/spec/arachni/component/options/url_spec.rb +4 -4
  140. data/spec/arachni/component/utilities_spec.rb +2 -2
  141. data/spec/arachni/data/framework/rpc_spec.rb +10 -9
  142. data/spec/arachni/data/framework_spec.rb +65 -46
  143. data/spec/arachni/data/issues_spec.rb +39 -77
  144. data/spec/arachni/data/plugins_spec.rb +11 -11
  145. data/spec/arachni/data/session_spec.rb +6 -6
  146. data/spec/arachni/data_spec.rb +8 -8
  147. data/spec/arachni/element/body_spec.rb +10 -10
  148. data/spec/arachni/element/capabilities/analyzable/differential_spec.rb +39 -21
  149. data/spec/arachni/element/capabilities/analyzable/{taint_spec.rb → signature_spec.rb} +63 -63
  150. data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb +51 -51
  151. data/spec/arachni/element/capabilities/with_scope/scope_spec.rb +5 -5
  152. data/spec/arachni/element/cookie/dom_spec.rb +37 -18
  153. data/spec/arachni/element/cookie_spec.rb +206 -139
  154. data/spec/arachni/element/form/dom_spec.rb +36 -19
  155. data/spec/arachni/element/form_spec.rb +210 -187
  156. data/spec/arachni/element/generic_dom_spec.rb +14 -14
  157. data/spec/arachni/element/header_spec.rb +35 -17
  158. data/spec/arachni/element/json_spec.rb +53 -31
  159. data/spec/arachni/element/link/dom_spec.rb +46 -28
  160. data/spec/arachni/element/link_spec.rb +58 -40
  161. data/spec/arachni/element/link_template/dom_spec.rb +47 -29
  162. data/spec/arachni/element/link_template_spec.rb +79 -61
  163. data/spec/arachni/element/path_spec.rb +1 -1
  164. data/spec/arachni/element/server_spec.rb +33 -32
  165. data/spec/arachni/element/ui_form/ui_form_dom_spec.rb +164 -0
  166. data/spec/arachni/element/ui_form_spec.rb +242 -0
  167. data/spec/arachni/element/ui_input/dom_spec.rb +157 -0
  168. data/spec/arachni/element/ui_input_spec.rb +136 -0
  169. data/spec/arachni/element/xml_spec.rb +42 -24
  170. data/spec/arachni/element_filter_spec.rb +49 -48
  171. data/spec/arachni/error_spec.rb +3 -3
  172. data/spec/arachni/framework/parts/audit_spec.rb +64 -63
  173. data/spec/arachni/framework/parts/browser_spec.rb +16 -16
  174. data/spec/arachni/framework/parts/check_spec.rb +3 -3
  175. data/spec/arachni/framework/parts/data_spec.rb +48 -48
  176. data/spec/arachni/framework/parts/platform_spec.rb +3 -3
  177. data/spec/arachni/framework/parts/plugin_spec.rb +7 -6
  178. data/spec/arachni/framework/parts/report_spec.rb +7 -7
  179. data/spec/arachni/framework/parts/scope_spec.rb +16 -16
  180. data/spec/arachni/framework/parts/state_spec.rb +68 -69
  181. data/spec/arachni/framework_spec.rb +39 -31
  182. data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +32 -32
  183. data/spec/arachni/http/client_spec.rb +219 -208
  184. data/spec/arachni/http/cookie_jar_spec.rb +72 -72
  185. data/spec/arachni/http/headers_spec.rb +14 -14
  186. data/spec/arachni/http/proxy_server_spec.rb +43 -42
  187. data/spec/arachni/http/request_spec.rb +105 -103
  188. data/spec/arachni/http/response/scope_spec.rb +24 -24
  189. data/spec/arachni/http/response_spec.rb +50 -49
  190. data/spec/arachni/issue/severity_spec.rb +10 -9
  191. data/spec/arachni/issue_spec.rb +71 -369
  192. data/spec/arachni/option_groups/audit_spec.rb +114 -114
  193. data/spec/arachni/option_groups/browser_cluster_spec.rb +20 -3
  194. data/spec/arachni/option_groups/datastore_spec.rb +6 -6
  195. data/spec/arachni/option_groups/dispatcher_spec.rb +19 -19
  196. data/spec/arachni/option_groups/http_spec.rb +11 -11
  197. data/spec/arachni/option_groups/input_spec.rb +31 -27
  198. data/spec/arachni/option_groups/output_spec.rb +2 -2
  199. data/spec/arachni/option_groups/paths_spec.rb +17 -17
  200. data/spec/arachni/option_groups/rpc_spec.rb +2 -2
  201. data/spec/arachni/option_groups/scope_spec.rb +40 -40
  202. data/spec/arachni/option_groups/session_spec.rb +6 -5
  203. data/spec/arachni/option_groups/snapshot_spec.rb +4 -4
  204. data/spec/arachni/options_spec.rb +46 -45
  205. data/spec/arachni/page/dom/transition_spec.rb +74 -72
  206. data/spec/arachni/page/dom_spec.rb +35 -35
  207. data/spec/arachni/page/scope_spec.rb +15 -15
  208. data/spec/arachni/page_spec.rb +217 -217
  209. data/spec/arachni/parser_spec.rb +106 -104
  210. data/spec/arachni/platform/fingerprinter_spec.rb +17 -14
  211. data/spec/arachni/platform/list_spec.rb +33 -33
  212. data/spec/arachni/platform/manager_spec.rb +67 -64
  213. data/spec/arachni/plugin/base_spec.rb +10 -10
  214. data/spec/arachni/plugin/manager_spec.rb +38 -37
  215. data/spec/arachni/report_spec.rb +43 -40
  216. data/spec/arachni/reporter/base_spec.rb +15 -15
  217. data/spec/arachni/reporter/manager_spec.rb +4 -4
  218. data/spec/arachni/reporter/options_spec.rb +6 -6
  219. data/spec/arachni/rpc/client/base_spec.rb +6 -6
  220. data/spec/arachni/rpc/client/dispatcher_spec.rb +2 -2
  221. data/spec/arachni/rpc/client/instance_spec.rb +6 -6
  222. data/spec/arachni/rpc/server/active_options_spec.rb +11 -8
  223. data/spec/arachni/rpc/server/base_spec.rb +5 -5
  224. data/spec/arachni/rpc/server/checks/manager_spec.rb +8 -8
  225. data/spec/arachni/rpc/server/dispatcher/node_spec.rb +37 -37
  226. data/spec/arachni/rpc/server/dispatcher/service_spec.rb +15 -14
  227. data/spec/arachni/rpc/server/dispatcher_spec.rb +36 -35
  228. data/spec/arachni/rpc/server/framework/distributor_spec.rb +36 -36
  229. data/spec/arachni/rpc/server/framework_multi_spec.rb +340 -336
  230. data/spec/arachni/rpc/server/framework_spec.rb +90 -85
  231. data/spec/arachni/rpc/server/instance_spec.rb +126 -107
  232. data/spec/arachni/rpc/server/output_spec.rb +1 -1
  233. data/spec/arachni/rpc/server/plugin/manager_spec.rb +6 -6
  234. data/spec/arachni/ruby/array_spec.rb +42 -42
  235. data/spec/arachni/ruby/hash_spec.rb +20 -18
  236. data/spec/arachni/ruby/io_spec.rb +2 -2
  237. data/spec/arachni/ruby/object_spec.rb +1 -1
  238. data/spec/arachni/ruby/set_spec.rb +3 -3
  239. data/spec/arachni/ruby/string_spec.rb +30 -30
  240. data/spec/arachni/ruby/webrick_spec.rb +2 -2
  241. data/spec/arachni/scope_spec.rb +1 -1
  242. data/spec/arachni/session_spec.rb +67 -64
  243. data/spec/arachni/snapshot_spec.rb +15 -15
  244. data/spec/arachni/state/audit_spec.rb +11 -11
  245. data/spec/arachni/state/element_filter_spec.rb +6 -6
  246. data/spec/arachni/state/framework/rpc_spec.rb +12 -12
  247. data/spec/arachni/state/framework_spec.rb +125 -121
  248. data/spec/arachni/state/http_spec.rb +7 -7
  249. data/spec/arachni/state/options_spec.rb +7 -7
  250. data/spec/arachni/state/plugins_spec.rb +8 -8
  251. data/spec/arachni/state_spec.rb +10 -10
  252. data/spec/arachni/support/buffer/autoflush_spec.rb +16 -16
  253. data/spec/arachni/support/buffer/base_spec.rb +39 -39
  254. data/spec/arachni/support/cache/least_cost_replacement_spec.rb +18 -18
  255. data/spec/arachni/support/cache/least_recently_pushed_spec.rb +24 -24
  256. data/spec/arachni/support/cache/least_recently_used_spec.rb +20 -20
  257. data/spec/arachni/support/cache/preference_spec.rb +4 -4
  258. data/spec/arachni/support/cache/random_replacement_spec.rb +8 -8
  259. data/spec/arachni/support/crypto/rsa_aes_cbc_spec.rb +1 -1
  260. data/spec/arachni/support/database/hash_spec.rb +44 -43
  261. data/spec/arachni/support/database/queue_spec.rb +27 -27
  262. data/spec/arachni/support/lookup/hash_set_spec.rb +8 -8
  263. data/spec/arachni/support/lookup/moolb_spec.rb +3 -3
  264. data/spec/arachni/support/mixins/observable_spec.rb +6 -6
  265. data/spec/arachni/support/signature_spec.rb +19 -19
  266. data/spec/arachni/trainer_spec.rb +39 -39
  267. data/spec/arachni/typhoeus/hydra_spec.rb +2 -2
  268. data/spec/arachni/uri/scope_spec.rb +66 -66
  269. data/spec/arachni/uri_spec.rb +107 -105
  270. data/spec/arachni/utilities_spec.rb +40 -40
  271. data/spec/components/checks/active/csrf_spec.rb +8 -8
  272. data/spec/components/checks/active/no_sql_injection_spec.rb +1 -1
  273. data/spec/components/checks/active/sql_injection_spec.rb +16 -16
  274. data/spec/components/checks/active/trainer_spec.rb +4 -4
  275. data/spec/components/checks/active/unvalidated_redirect_dom_spec.rb +4 -2
  276. data/spec/components/checks/active/xpath_injection_spec.rb +1 -1
  277. data/spec/components/checks/active/xss_dom_script_context_spec.rb +51 -21
  278. data/spec/components/checks/active/xss_dom_spec.rb +46 -24
  279. data/spec/components/checks/passive/allowed_methods_spec.rb +1 -1
  280. data/spec/components/checks/passive/grep/cookie_set_for_parent_domain_spec.rb +1 -1
  281. data/spec/components/checks/passive/grep/hsts_spec.rb +2 -2
  282. data/spec/components/checks/passive/grep/http_only_cookies_spec.rb +1 -1
  283. data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +1 -1
  284. data/spec/components/checks/passive/grep/insecure_cors_policy_spec.rb +2 -2
  285. data/spec/components/checks/passive/grep/password_autocomplete_spec.rb +1 -1
  286. data/spec/components/checks/passive/grep/private_ip_spec.rb +3 -3
  287. data/spec/components/checks/passive/grep/unencrypted_password_forms_spec.rb +1 -1
  288. data/spec/components/checks/passive/grep/x_frame_options_spec.rb +2 -2
  289. data/spec/components/checks/passive/interesting_responses_spec.rb +2 -2
  290. data/spec/components/checks/passive/webdav_spec.rb +1 -1
  291. data/spec/components/checks/passive/xst_spec.rb +1 -1
  292. data/spec/components/fingerprinters/servers/apache_spec.rb +2 -2
  293. data/spec/components/path_extractors/comments_spec.rb +5 -1
  294. data/spec/components/path_extractors/scripts_spec.rb +5 -2
  295. data/spec/components/plugins/autologin_spec.rb +22 -22
  296. data/spec/components/plugins/autothrottle_spec.rb +6 -5
  297. data/spec/components/plugins/content_types_spec.rb +4 -4
  298. data/spec/components/plugins/cookie_collector_spec.rb +5 -5
  299. data/spec/components/plugins/exec_spec.rb +12 -12
  300. data/spec/components/plugins/form_dicattack_spec.rb +3 -3
  301. data/spec/components/plugins/headers_collector_spec.rb +8 -8
  302. data/spec/components/plugins/healthmap_spec.rb +3 -3
  303. data/spec/components/plugins/http_dicattack_spec.rb +3 -3
  304. data/spec/components/plugins/login_script_spec.rb +79 -22
  305. data/spec/components/plugins/meta/remedies/discovery_spec.rb +3 -2
  306. data/spec/components/plugins/meta/remedies/timing_attacks_spec.rb +3 -3
  307. data/spec/components/plugins/meta/uniformity_spec.rb +2 -2
  308. data/spec/components/plugins/restrict_to_dom_state_spec.rb +1 -1
  309. data/spec/components/plugins/script_spec.rb +1 -1
  310. data/spec/components/plugins/uncommon_headers_spec.rb +2 -2
  311. data/spec/components/plugins/vector_collector_spec.rb +2 -2
  312. data/spec/components/plugins/vector_feed_spec.rb +40 -40
  313. data/spec/components/plugins/waf_detector_spec.rb +6 -6
  314. data/spec/components/reporters/json_spec.rb +4 -4
  315. data/spec/components/reporters/marshal_spec.rb +2 -2
  316. data/spec/components/reporters/yaml_spec.rb +3 -2
  317. data/spec/external/wavsep/active/sqli_spec.rb +1 -3
  318. data/spec/spec_helper.rb +4 -0
  319. data/spec/support/factories/element/ui_form.rb +14 -0
  320. data/spec/support/factories/element/ui_input.rb +13 -0
  321. data/spec/support/factories/issue.rb +0 -13
  322. data/spec/support/fixtures/report.afr +0 -0
  323. data/spec/support/fixtures/{taint_check/taint.rb → signature_check/signature.rb} +2 -2
  324. data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +11 -11
  325. data/spec/support/helpers/framework.rb +1 -1
  326. data/spec/support/helpers/pages.rb +2 -2
  327. data/spec/support/servers/arachni/browser.rb +139 -0
  328. data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +40 -0
  329. data/spec/support/servers/arachni/element/capabilities/analyzable/{taint.rb → signature.rb} +0 -0
  330. data/spec/support/servers/arachni/element/input/input_dom.rb +102 -0
  331. data/spec/support/servers/arachni/element/ui_form/ui_form_dom.rb +238 -0
  332. data/spec/support/servers/checks/active/trainer_check.rb +7 -7
  333. data/spec/support/servers/checks/active/unvalidated_redirect_dom.rb +22 -6
  334. data/spec/support/servers/checks/active/xss_dom.rb +50 -0
  335. data/spec/support/servers/checks/active/xss_dom_script_context.rb +53 -0
  336. data/spec/support/shared/browser/javascript/taint_tracer/sink/base.rb +6 -6
  337. data/spec/support/shared/check.rb +10 -12
  338. data/spec/support/shared/component/options/base.rb +24 -24
  339. data/spec/support/shared/element/base.rb +25 -25
  340. data/spec/support/shared/element/capabilities/auditable.rb +116 -140
  341. data/spec/support/shared/element/capabilities/dom_only.rb +65 -0
  342. data/spec/support/shared/element/capabilities/inputtable.rb +71 -86
  343. data/spec/support/shared/element/capabilities/mutable.rb +122 -111
  344. data/spec/support/shared/element/capabilities/refreshable.rb +10 -10
  345. data/spec/support/shared/element/capabilities/{submitable.rb → submittable.rb} +26 -26
  346. data/spec/support/shared/element/capabilities/with_auditor.rb +10 -10
  347. data/spec/support/shared/element/capabilities/with_dom.rb +8 -8
  348. data/spec/support/shared/element/capabilities/with_node.rb +4 -6
  349. data/spec/support/shared/element/capabilities/with_scope.rb +2 -2
  350. data/spec/support/shared/element/capabilities/with_source.rb +6 -8
  351. data/spec/support/shared/element/dom.rb +144 -0
  352. data/spec/support/shared/element/dom/auditable.rb +42 -0
  353. data/spec/support/shared/element/dom/inputtable.rb +5 -0
  354. data/spec/support/shared/element/dom/mutable.rb +3 -0
  355. data/spec/support/shared/element/dom/submittable.rb +119 -0
  356. data/spec/support/shared/external/wavsep.rb +3 -3
  357. data/spec/support/shared/fingerprinter.rb +2 -2
  358. data/spec/support/shared/framework.rb +1 -1
  359. data/spec/support/shared/http/message.rb +9 -9
  360. data/spec/support/shared/option_group.rb +17 -17
  361. data/spec/support/shared/path_extractor.rb +1 -1
  362. data/spec/support/shared/plugin.rb +2 -2
  363. data/spec/support/shared/support/cache.rb +57 -57
  364. data/spec/support/shared/support/lookup.rb +25 -25
  365. data/ui/cli/framework.rb +22 -11
  366. data/ui/cli/framework/option_parser.rb +15 -0
  367. data/ui/cli/option_parser.rb +8 -1
  368. data/ui/cli/output.rb +2 -1
  369. metadata +54 -20
  370. data/components/checks/active/xss_dom_inputs.rb +0 -236
  371. data/spec/components/checks/active/xss_dom_inputs_spec.rb +0 -30
  372. data/spec/support/servers/checks/active/xss_dom_inputs.rb +0 -59
  373. data/spec/support/shared/element/capabilities/auditable/dom.rb +0 -322
@@ -11,9 +11,9 @@ shared_examples_for 'refreshable' do
11
11
  http.get( refreshable_url + '_disappear_clear', mode: :sync )
12
12
 
13
13
  response = http.get( refreshable_url + '_disappear', mode: :sync )
14
- refreshable.from_response( response ).select do |f|
14
+ expect(refreshable.from_response( response ).select do |f|
15
15
  !!f.inputs['nonce']
16
- end.first.refresh.should be_nil
16
+ end.first.refresh).to be_nil
17
17
  end
18
18
  end
19
19
 
@@ -25,7 +25,7 @@ shared_examples_for 'refreshable' do
25
25
  refreshable.from_response( response ).select do |f|
26
26
  !!f.inputs['nonce']
27
27
  end.first.refresh do |r|
28
- r.should be_nil
28
+ expect(r).to be_nil
29
29
  end
30
30
  end
31
31
  end
@@ -44,11 +44,11 @@ shared_examples_for 'refreshable' do
44
44
  f.update updates
45
45
 
46
46
  refreshed = f.refresh
47
- refreshed.inputs['nonce'].should_not == nonce
48
- refreshed.default_inputs['nonce'].should == nonce
47
+ expect(refreshed.inputs['nonce']).not_to eq(nonce)
48
+ expect(refreshed.default_inputs['nonce']).to eq(nonce)
49
49
 
50
50
  updates['nonce'] = f.refresh.inputs['nonce']
51
- f.inputs.should == updates
51
+ expect(f.inputs).to eq(updates)
52
52
  end
53
53
  end
54
54
  context 'when called with a block' do
@@ -65,17 +65,17 @@ shared_examples_for 'refreshable' do
65
65
 
66
66
  ran = false
67
67
  f.refresh do |form|
68
- form.inputs['nonce'].should_not == nonce
69
- form.default_inputs['nonce'].should == nonce
68
+ expect(form.inputs['nonce']).not_to eq(nonce)
69
+ expect(form.default_inputs['nonce']).to eq(nonce)
70
70
 
71
71
  updates['nonce'] = form.refresh.inputs['nonce']
72
- form.inputs.should == updates
72
+ expect(form.inputs).to eq(updates)
73
73
 
74
74
  ran = true
75
75
  end
76
76
 
77
77
  http.run
78
- ran.should be_true
78
+ expect(ran).to be_truthy
79
79
  end
80
80
  end
81
81
  end
@@ -18,7 +18,7 @@ shared_examples_for 'submittable' do
18
18
 
19
19
  rpc_attributes.each do |attribute|
20
20
  it "includes '#{attribute}'" do
21
- data[attribute].should == submittable.send( attribute )
21
+ expect(data[attribute]).to eq(submittable.send( attribute ))
22
22
  end
23
23
  end
24
24
  end
@@ -29,7 +29,7 @@ shared_examples_for 'submittable' do
29
29
 
30
30
  rpc_attributes.each do |attribute|
31
31
  it "restores '#{attribute}'" do
32
- restored.send( attribute ).should == submittable.send( attribute )
32
+ expect(restored.send( attribute )).to eq(submittable.send( attribute ))
33
33
  end
34
34
  end
35
35
  end
@@ -37,34 +37,34 @@ shared_examples_for 'submittable' do
37
37
  describe '#method' do
38
38
  it 'returns the HTTP method' do
39
39
  submittable.method = :stuff
40
- submittable.method.should == :stuff
40
+ expect(submittable.method).to eq(:stuff)
41
41
  end
42
42
  end
43
43
 
44
44
  describe '#http_method' do
45
45
  it 'is aliased to #method' do
46
46
  submittable.method = :stuff
47
- submittable.http_method.should == :stuff
47
+ expect(submittable.http_method).to eq(:stuff)
48
48
  end
49
49
  end
50
50
 
51
51
  describe '#method=' do
52
52
  it 'returns the HTTP method' do
53
53
  submittable.method = :stuff
54
- submittable.http_method.should == :stuff
54
+ expect(submittable.http_method).to eq(:stuff)
55
55
  end
56
56
  end
57
57
 
58
58
  describe '#http_method=' do
59
59
  it 'is aliased to #method=' do
60
60
  submittable.http_method = :stuff
61
- submittable.method.should == :stuff
61
+ expect(submittable.method).to eq(:stuff)
62
62
  end
63
63
  end
64
64
 
65
65
  describe '#platforms' do
66
66
  it 'returns platforms for the given element' do
67
- submittable.platforms.should be_kind_of Arachni::Platform::Manager
67
+ expect(submittable.platforms).to be_kind_of Arachni::Platform::Manager
68
68
  end
69
69
  end
70
70
 
@@ -77,7 +77,7 @@ shared_examples_for 'submittable' do
77
77
  end
78
78
 
79
79
  run
80
- submittable.inputs.should == submitted
80
+ expect(submittable.inputs).to eq(submitted)
81
81
  end
82
82
 
83
83
  it 'assigns the auditable element as the request performer' do
@@ -85,46 +85,46 @@ shared_examples_for 'submittable' do
85
85
  submittable.submit { |res| response = res }
86
86
 
87
87
  run
88
- response.request.performer.should == submittable
88
+ expect(response.request.performer).to eq(submittable)
89
89
  end
90
90
  end
91
91
 
92
92
  describe '#id' do
93
93
  before do
94
- described_class.any_instance.stub(:valid_input_name?) { true }
95
- described_class.any_instance.stub(:valid_input_value?) { true }
94
+ allow_any_instance_of(described_class).to receive(:valid_input_name?) { true }
95
+ allow_any_instance_of(described_class).to receive(:valid_input_value?) { true }
96
96
  end
97
97
 
98
98
  let(:action) { "#{url}/action" }
99
99
 
100
100
  it 'uniquely identifies the element based on #action' do
101
101
  e = submittable.dup
102
- e.stub(:action) { action }
102
+ allow(e).to receive(:action) { action }
103
103
 
104
104
  c = submittable.dup
105
- c.stub(:action) { "#{action}2" }
105
+ allow(c).to receive(:action) { "#{action}2" }
106
106
 
107
- e.id.should_not == c.id
107
+ expect(e.id).not_to eq(c.id)
108
108
  end
109
109
 
110
110
  it 'uniquely identifies the element based on #method' do
111
111
  e = submittable.dup
112
- e.stub(:method) { :get }
112
+ allow(e).to receive(:method) { :get }
113
113
 
114
114
  c = submittable.dup
115
- c.stub(:method) { :post }
115
+ allow(c).to receive(:method) { :post }
116
116
 
117
- e.id.should_not == c.id
117
+ expect(e.id).not_to eq(c.id)
118
118
  end
119
119
 
120
120
  it 'uniquely identifies the element based on #type' do
121
121
  e = submittable.dup
122
- e.stub(:type) { :stuff }
122
+ allow(e).to receive(:type) { :stuff }
123
123
 
124
124
  c = submittable.dup
125
- c.stub(:type) { :stoof }
125
+ allow(c).to receive(:type) { :stoof }
126
126
 
127
- e.id.should_not == c.id
127
+ expect(e.id).not_to eq(c.id)
128
128
  end
129
129
 
130
130
  it 'uniquely identifies the element based on #inputs' do
@@ -134,7 +134,7 @@ shared_examples_for 'submittable' do
134
134
  c = submittable.dup
135
135
  c.inputs = { input1: 'stuff2' }
136
136
 
137
- e.id.should_not == c.id
137
+ expect(e.id).not_to eq(c.id)
138
138
  end
139
139
  end
140
140
 
@@ -142,19 +142,19 @@ shared_examples_for 'submittable' do
142
142
  let(:dupped) { submittable.dup }
143
143
 
144
144
  it 'preserves #method' do
145
- dupped.method.should == submittable.method
145
+ expect(dupped.method).to eq(submittable.method)
146
146
  end
147
147
  it 'preserves #action' do
148
- dupped.action.should == submittable.action
148
+ expect(dupped.action).to eq(submittable.action)
149
149
  end
150
150
  end
151
151
 
152
152
  describe '#to_h' do
153
153
  it 'returns a hash representation of self' do
154
154
  hash = submittable.to_h
155
- hash[:url].should == submittable.url
156
- hash[:action].should == submittable.action
157
- hash[:method].should == submittable.method
155
+ expect(hash[:url]).to eq(submittable.url)
156
+ expect(hash[:action]).to eq(submittable.action)
157
+ expect(hash[:method]).to eq(submittable.method)
158
158
  end
159
159
  end
160
160
  end
@@ -22,42 +22,42 @@ shared_examples_for 'with_auditor' do
22
22
  let(:data) { auditable.to_rpc_data }
23
23
 
24
24
  it "does not include 'auditor'" do
25
- data.should_not include 'auditor'
25
+ expect(data).not_to include 'auditor'
26
26
  end
27
27
  end
28
28
 
29
29
  describe '#prepare_for_report' do
30
30
  it 'removes the #auditor' do
31
- auditable.auditor.should be_true
31
+ expect(auditable.auditor).to be_truthy
32
32
  auditable.prepare_for_report
33
- auditable.auditor.should be_nil
33
+ expect(auditable.auditor).to be_nil
34
34
  end
35
35
  end
36
36
 
37
37
  describe '#marshal_dump' do
38
38
  it 'excludes @auditor' do
39
- auditable.marshal_dump.should_not include :@auditor
39
+ expect(auditable.marshal_dump).not_to include :@auditor
40
40
  end
41
41
  end
42
42
 
43
43
  describe '#remove_auditor' do
44
44
  it 'removes the auditor' do
45
45
  auditable.auditor = :some_auditor
46
- auditable.auditor.should == :some_auditor
46
+ expect(auditable.auditor).to eq(:some_auditor)
47
47
  auditable.remove_auditor
48
- auditable.auditor.should be_nil
48
+ expect(auditable.auditor).to be_nil
49
49
  end
50
50
  end
51
51
 
52
52
  describe '#orphan?' do
53
53
  context 'when it has no auditor' do
54
54
  it 'returns true' do
55
- orphan.orphan?.should be_true
55
+ expect(orphan.orphan?).to be_truthy
56
56
  end
57
57
  end
58
58
  context 'when it has an auditor' do
59
59
  it 'returns true' do
60
- auditable.orphan?.should be_false
60
+ expect(auditable.orphan?).to be_falsey
61
61
  end
62
62
  end
63
63
  end
@@ -66,10 +66,10 @@ shared_examples_for 'with_auditor' do
66
66
  let(:dupped) { auditable.dup }
67
67
 
68
68
  it 'preserves the #auditor' do
69
- dupped.auditor.should == auditable.auditor
69
+ expect(dupped.auditor).to eq(auditable.auditor)
70
70
 
71
71
  subject.remove_auditor
72
- dup.auditor.should be_true
72
+ expect(dup.auditor).to be_truthy
73
73
  end
74
74
  end
75
75
  end
@@ -16,7 +16,7 @@ shared_examples_for 'with_dom' do |html = nil|
16
16
  end
17
17
 
18
18
  it 'forces #dom to return nil' do
19
- with_dom.dom.should be_nil
19
+ expect(with_dom.dom).to be_nil
20
20
  end
21
21
  end
22
22
 
@@ -26,7 +26,7 @@ shared_examples_for 'with_dom' do |html = nil|
26
26
  end
27
27
 
28
28
  it 'forces #dom to return nil' do
29
- with_dom.dom.should be_true
29
+ expect(with_dom.dom).to be_truthy
30
30
  end
31
31
  end
32
32
  end
@@ -40,7 +40,7 @@ shared_examples_for 'with_dom' do |html = nil|
40
40
  end
41
41
 
42
42
  it 'returns true' do
43
- with_dom.skip_dom?.should be_true
43
+ expect(with_dom.skip_dom?).to be_truthy
44
44
  end
45
45
  end
46
46
 
@@ -50,7 +50,7 @@ shared_examples_for 'with_dom' do |html = nil|
50
50
  end
51
51
 
52
52
  it 'forces #dom to return nil' do
53
- with_dom.skip_dom?.should be_false
53
+ expect(with_dom.skip_dom?).to be_falsey
54
54
  end
55
55
  end
56
56
  end
@@ -59,7 +59,7 @@ shared_examples_for 'with_dom' do |html = nil|
59
59
  let(:data) { with_dom.to_rpc_data }
60
60
 
61
61
  it "includes 'dom'" do
62
- data['dom'].should == with_dom.dom.to_rpc_data
62
+ expect(data['dom']).to eq(with_dom.dom.to_rpc_data)
63
63
  end
64
64
  end
65
65
 
@@ -68,13 +68,13 @@ shared_examples_for 'with_dom' do |html = nil|
68
68
  let(:data) { Arachni::RPC::Serializer.rpc_data( with_dom ) }
69
69
 
70
70
  it "restores 'dom'" do
71
- restored.dom.should == with_dom.dom
71
+ expect(restored.dom).to eq(with_dom.dom)
72
72
  end
73
73
  end
74
74
 
75
75
  describe '#dom' do
76
76
  it "returns #{described_class::DOM}" do
77
- with_dom.dom.should be_kind_of described_class::DOM
77
+ expect(with_dom.dom).to be_kind_of described_class::DOM
78
78
  end
79
79
  end
80
80
 
@@ -82,7 +82,7 @@ shared_examples_for 'with_dom' do |html = nil|
82
82
  let(:dupped) { with_dom.dup }
83
83
 
84
84
  it 'preserves #dom' do
85
- dupped.dom.should == with_dom.dom
85
+ expect(dupped.dom).to eq(with_dom.dom)
86
86
  end
87
87
  end
88
88
  end
@@ -2,16 +2,14 @@ shared_examples_for 'with_node' do |html|
2
2
  it_should_behave_like 'with_source', html
3
3
 
4
4
  let(:with_node) do
5
- dupped = subject.dup
6
- dupped.source = html
7
- dupped
5
+ subject.dup
8
6
  end
9
7
 
10
8
  describe '#node' do
11
9
  it 'returns the set node' do
12
10
  node = with_node.node
13
- node.is_a?( Nokogiri::XML::Element ).should be_true
14
- node.to_s.should == Nokogiri::HTML.fragment( html ).to_s
11
+ expect(node.is_a?( Nokogiri::XML::Element )).to be_truthy
12
+ expect(node.to_s).to eq(Nokogiri::HTML.fragment( with_node.source ).to_s)
15
13
  end
16
14
  end
17
15
 
@@ -19,7 +17,7 @@ shared_examples_for 'with_node' do |html|
19
17
  let(:dupped) { with_node.dup }
20
18
 
21
19
  it 'preserves #node' do
22
- dupped.node.to_s.should == with_node.node.to_s
20
+ expect(dupped.node.to_s).to eq(with_node.node.to_s)
23
21
  end
24
22
  end
25
23
  end
@@ -10,13 +10,13 @@ shared_examples_for 'with_scope' do
10
10
  let(:data) { with_scope.to_rpc_data }
11
11
 
12
12
  it "does not include 'scope'" do
13
- data.should_not include 'scope'
13
+ expect(data).not_to include 'scope'
14
14
  end
15
15
  end
16
16
 
17
17
  describe '#scope' do
18
18
  it 'returns scope' do
19
- subject.scope.should be_kind_of described_class::Scope
19
+ expect(subject.scope).to be_kind_of described_class::Scope
20
20
  end
21
21
  end
22
22
  end
@@ -1,16 +1,14 @@
1
1
  shared_examples_for 'with_source' do |source|
2
2
 
3
3
  let(:with_source) do
4
- dupped = subject.dup
5
- dupped.source = source if source
6
- dupped
4
+ subject.dup
7
5
  end
8
6
 
9
7
  describe '#to_rpc_data' do
10
8
  let(:data) { with_source.to_rpc_data }
11
9
 
12
10
  it "includes 'source'" do
13
- data['source'].should == with_source.source
11
+ expect(data['source']).to eq(with_source.source)
14
12
  end
15
13
  end
16
14
 
@@ -26,14 +24,14 @@ shared_examples_for 'with_source' do |source|
26
24
 
27
25
  it 'sets the #source' do
28
26
  with_source.source = string
29
- with_source.source.should == string
27
+ expect(with_source.source).to eq(string)
30
28
  end
31
29
  end
32
30
 
33
31
  context 'nil' do
34
32
  it 'sets the #html' do
35
33
  with_source.source = nil
36
- with_source.source.should be_nil
34
+ expect(with_source.source).to be_nil
37
35
  end
38
36
  end
39
37
  end
@@ -41,7 +39,7 @@ shared_examples_for 'with_source' do |source|
41
39
 
42
40
  describe '#to_h' do
43
41
  it "includes 'source'" do
44
- subject.to_h[:source].should == subject.source
42
+ expect(subject.to_h[:source]).to eq(subject.source)
45
43
  end
46
44
  end
47
45
 
@@ -49,7 +47,7 @@ shared_examples_for 'with_source' do |source|
49
47
  let(:dupped) { with_source.dup }
50
48
 
51
49
  it 'preserves #source' do
52
- dupped.source.should == with_source.source
50
+ expect(dupped.source).to eq(with_source.source)
53
51
  end
54
52
  end
55
53
  end
@@ -0,0 +1,144 @@
1
+ shared_examples_for 'element_dom' do
2
+ it_should_behave_like 'element'
3
+
4
+ def run
5
+ auditor.browser_cluster.wait
6
+ end
7
+
8
+ it "supports #{Arachni::RPC::Serializer}" do
9
+ expect(subject).to eq(Arachni::RPC::Serializer.deep_clone( subject ))
10
+ end
11
+
12
+ describe '#to_rpc_data' do
13
+ %w(parent page browser element).each do |attribute|
14
+ it "excludes #{attribute}" do
15
+ called = false
16
+
17
+ # We do this inside a #submit handler to make sure the associations
18
+ # which are added during a submit are handled successfully.
19
+ subject.submit do
20
+ expect(subject.to_rpc_data).not_to include attribute
21
+ called = true
22
+ end
23
+ run
24
+
25
+ expect(called).to be_truthy
26
+ end
27
+ end
28
+ end
29
+
30
+ describe '#marshal_dump' do
31
+ [:@parent, :@page, :@browser, :@element].each do |ivar|
32
+ it "excludes #{ivar}" do
33
+ called = false
34
+
35
+ # We do this inside a #submit handler to make sure the associations
36
+ # which are added during a submit are handled successfully.
37
+ subject.submit do
38
+ expect(subject.marshal_dump).not_to include ivar
39
+ called = true
40
+ end
41
+ run
42
+
43
+ expect(called).to be_truthy
44
+ end
45
+ end
46
+ end
47
+
48
+ describe '#prepare_for_report' do
49
+ it 'removes #page' do
50
+ expect(subject.page).to be_truthy
51
+ subject.prepare_for_report
52
+ expect(subject.page).to be_nil
53
+ end
54
+ it 'removes #parent' do
55
+ expect(subject.parent).to be_truthy
56
+ subject.prepare_for_report
57
+ expect(subject.parent).to be_nil
58
+ end
59
+ it 'removes #browser' do
60
+ called = false
61
+ subject.with_browser do |browser|
62
+ subject.browser = browser
63
+
64
+ expect(subject.browser).to be_truthy
65
+ subject.prepare_for_report
66
+ expect(subject.browser).to be_nil
67
+
68
+ called = true
69
+ end
70
+ subject.auditor.browser_cluster.wait
71
+ expect(called).to be_truthy
72
+ end
73
+ end
74
+
75
+ describe '#trigger' do
76
+ it 'does not update the page transitions' do
77
+ page = nil
78
+ pre_transitions = nil
79
+ subject.with_browser do |browser|
80
+ browser.load subject.page
81
+ subject.browser = browser
82
+ pre_transitions = browser.transitions.dup
83
+
84
+ subject.trigger
85
+ page = browser.to_page
86
+ end
87
+
88
+ subject.auditor.browser_cluster.wait
89
+ expect(page.dom.transitions).to eq(pre_transitions)
90
+ end
91
+ end
92
+
93
+ describe '#valid_input_data?' do
94
+ it 'returns true' do
95
+ expect(subject.valid_input_data?( 'stuff' )).to be_truthy
96
+ end
97
+
98
+ described_class::INVALID_INPUT_DATA.each do |invalid_data|
99
+ context "when the value contains #{invalid_data.inspect}" do
100
+ it 'returns false' do
101
+ expect(subject.valid_input_data?( "stuff #{invalid_data}" )).to be_falsey
102
+ end
103
+ end
104
+ end
105
+ end
106
+
107
+ describe '#page' do
108
+ it 'returns the page containing the element' do
109
+ expect(subject.page).to be_kind_of Arachni::Page
110
+ end
111
+ end
112
+
113
+ describe '#encode' do
114
+ it 'returns the string as is' do
115
+ v = 'blah'
116
+ expect(subject.encode( v ).object_id).to eq(v.object_id)
117
+ end
118
+ end
119
+ describe '.encode' do
120
+ it 'returns the string as is' do
121
+ v = 'blah'
122
+ expect(subject.class.encode( v ).object_id).to eq(v.object_id)
123
+ end
124
+ end
125
+
126
+ describe '#decode' do
127
+ it 'returns the string as is' do
128
+ v = 'blah'
129
+ expect(subject.decode( v ).object_id).to eq(v.object_id)
130
+ end
131
+ end
132
+ describe '.decode' do
133
+ it 'returns the string as is' do
134
+ v = 'blah'
135
+ expect(subject.class.decode( v ).object_id).to eq(v.object_id)
136
+ end
137
+ end
138
+
139
+ describe '#dup' do
140
+ it 'preserves the #parent' do
141
+ expect(subject.dup.parent).to eq(subject.parent)
142
+ end
143
+ end
144
+ end