arachni 1.2.1 → 1.3

data/components/checks/active/xss_dom_inputs.rb

@@ -1,236 +0,0 @@
-=begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
-
-    This file is part of the Arachni Framework project and is subject to
-    redistribution and commercial restrictions. Please see the Arachni Framework
-    web site for more information on licensing and terms of use.
-=end
-
-# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-# @version 0.2
-class Arachni::Checks::XssDomInputs < Arachni::Check::Base
-
-    INPUTS = Set.new([:input, :textarea])
-
-    def tag_name
-        "some_dangerous_input_#{random_seed}"
-    end
-
-    def tag
-        # The trailing space is important, keypress and keyup events are always
-        # one character short.
-        "<#{tag_name}></#{tag_name}> "
-    end
-
-    def run
-        return if !page.document
-
-        # Everything past this point requires inputs to be present.
-        return if !page.has_elements?( INPUTS.to_a )
-
-        # Fill in inputs and trigger their associated events.
-        trigger_inputs
-
-        return if !page.has_elements?( :button )
-
-        # Fill in inputs and hit buttons.
-        trigger_buttons
-    end
-
-    def trigger_inputs
-        with_browser do |browser|
-            browser.load( page ).each_element_with_events do |locator, events|
-
-                locator_id = "#{page.url}:#{locator.css}"
-                next if !INPUTS.include?( locator.tag_name ) || audited?( locator_id )
-                audited locator_id
-
-                filter_events( locator.tag_name, events ).each do |event, _|
-
-                    print_status "Scheduling '#{event}' on '#{locator}'"
-
-                    # Instead of working with the same browser we do it this way
-                    # in order to distribute the workload via the browser cluster.
-                    with_browser do |b|
-                        print_status "Triggering '#{event}' on '#{locator}'"
-
-                        b.javascript.taint = self.tag_name
-                        b.load page
-
-                        transition = b.fire_event( locator, event, value: self.tag )
-                        if !transition
-                            print_bad "Could not '#{event}' on '#{locator}'"
-                            next
-                        end
-
-                        # Page may be out of scope, some sort of JS redirection.
-                        if !(p = b.to_page)
-                            print_bad "Could not capture page snapshot after '#{event}' on '#{locator}'"
-                        end
-
-                        p.dom.transitions << transition
-
-                        check_and_log( p )
-
-                        print_status "Finished '#{event}' on '#{locator}'"
-                    end
-                end
-            end
-        end
-    end
-
-    def trigger_buttons
-        with_browser do |browser|
-            browser.load( page ).each_element_with_events do |locator, events|
-
-                locator_id = "#{page.url}:#{locator.css}"
-                next if locator.tag_name != :button || audited?( locator_id )
-                audited locator_id
-
-                events.each do |event, _|
-                    print_status "Scheduling '#{event}' on '#{locator}' after filling in inputs"
-
-                    with_browser do |b|
-                        print_status "Triggering '#{event}' on '#{locator}' after filling in inputs"
-
-                        b.javascript.taint = self.tag_name
-                        b.load page
-
-                        transitions = fill_in_inputs( b )
-                        if transitions.empty?
-                            print_bad "Could not fill in any inputs for '#{event}' on '#{locator}'"
-                            next
-                        end
-
-                        transition = b.fire_event( locator, event )
-                        if !transition
-                            print_bad "Could not '#{event}' on '#{locator}'"
-                            next
-                        end
-
-                        transitions << transition
-
-                        # Page may be out of scope, some sort of JS redirection.
-                        if !(p = b.to_page)
-                            print_bad "Could not capture page snapshot after '#{event}' on '#{locator}'"
-                        end
-
-                        transitions.each do |t|
-                            p.dom.transitions << t
-                        end
-
-                        check_and_log( p )
-
-                        print_status "Finished '#{event}' on '#{locator}' after filling in inputs"
-                    end
-                end
-            end
-        end
-    end
-
-    def fill_in_inputs( browser )
-        transitions = []
-
-        INPUTS.each do |tag|
-            browser.watir.send("#{tag}s").each do |locator|
-                print_status "Filling in '#{locator.opening_tag}'"
-
-                transitions << fill_in_input( browser, locator )
-            end
-        end
-
-        transitions.compact
-    end
-
-    def fill_in_input( browser, locator )
-        browser.fire_event( locator, :input, value: self.tag )
-    end
-
-    def check_and_log( page )
-        return if !(proof = find_proof( page ))
-
-        log(
-            vector: Element::GenericDOM.new(
-                url:        page.url,
-                transition: page.dom.transitions.last
-            ),
-            proof:  proof,
-            page:   page
-        )
-    end
-
-    def find_proof( page )
-        return if !page.has_elements?( self.tag_name )
-
-        proof = page.document.css( self.tag_name )
-        return if proof.empty?
-
-        proof.to_s
-    end
-
-    def filter_events( element, events )
-        supported = Set.new( Arachni::Browser::Javascript.events_for( element ) )
-        events.reject { |name, _| !supported.include? ('on' + name.to_s.gsub( /^on/, '' )).to_sym }
-    end
-
-    def self.info
-        {
-            name:        'DOM XSS via input field',
-            description: %q{
-Injects an HTML element into page text fields, triggers their associated events
-and inspects the DOM for proof of vulnerability.
-},
-            author:      'Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>',
-            version:     '0.2',
-            elements:    [Element::GenericDOM],
-
-            issue:       {
-                name:            %q{DOM-based Cross-Site Scripting (XSS) via input fields},
-                description:     %q{
-Client-side scripts are used extensively by modern web applications.
-They perform from simple functions (such as the formatting of text) up to full
-manipulation of client-side data and Operating System interaction.
-
-Unlike traditional Cross-Site Scripting (XSS), where the client is able to inject
-scripts into a request and have the server return the script to the client, DOM
-XSS does not require that a request be sent to the server and may be abused entirely
-within the loaded page.
-
-This occurs when elements of the DOM (known as the sources) are able to be
-manipulated to contain untrusted data, which the client-side scripts (known as the
-sinks) use or execute an unsafe way.
-
-Arachni has discovered that by inserting an HTML element into the pages DOM inputs
-(sources) it was possible to then have the HTML element rendered as part of the
-page by the sink.
-},
-                references:  {
-                    'WASC'  => 'http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting',
-                    'OWASP' => 'https://www.owasp.org/index.php/DOM_Based_XSS',
-                    'OWASP - Prevention'  => 'https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet'
-                },
-                tags:            %w(xss dom injection script),
-                cwe:             79,
-                severity:        Severity::HIGH,
-                remedy_guidance: %q{
-Client-side document rewriting, redirection, or other sensitive action, using
-untrusted data, should be avoided wherever possible, as these may not be inspected
-by server side filtering.
-
-To remedy DOM XSS vulnerabilities where these sensitive document actions must be
-used, it is essential to:
-
-1. Ensure any untrusted data is treated as text, as opposed to being interpreted
-    as code or mark-up within the page.
-2. Escape untrusted data prior to being used within the page. Escaping methods
-    will vary depending on where the untrusted data is being used.
-    (See references for details.)
-3. Use `document.createElement`, `element.setAttribute`, `element.appendChild`,
-    etc. to build dynamic interfaces as opposed to HTML rendering methods such as
-    `document.write`, `document.writeIn`, `element.innerHTML`, or `element.outerHTML `etc.
-}
-            }
-        }
-    end
-
-end

data/spec/components/checks/active/xss_dom_inputs_spec.rb

@@ -1,30 +0,0 @@
-require 'spec_helper'
-
-describe name_from_filename do
-    include_examples 'check'
-
-    def self.elements
-        [Element::GenericDOM]
-    end
-
-    def issue_count_per_element
-        {
-            Element::GenericDOM => 9
-        }
-    end
-
-    def find_issue( event )
-        issues.find do |issue|
-            "on#{issue.vector.method}" == event.to_s
-        end
-    end
-
-    easy_test do
-        issues.select { |i| i.vector.type == :input }.size.should == 8
-        issues.select { |i| i.vector.type == :button }.size.should == 1
-
-        Arachni::Browser::Javascript::EVENTS_PER_ELEMENT[:input].each do |event|
-            find_issue( event ).vector.action.should end_with event.to_s
-        end
-    end
-end

data/spec/support/servers/checks/active/xss_dom_inputs.rb

@@ -1,59 +0,0 @@
-require 'sinatra'
-require 'sinatra/contrib'
-require_relative '../../../../../lib/arachni'
-
-EVENTS = Arachni::Browser::Javascript::EVENTS_PER_ELEMENT[:input]
-
-get '/' do
-    html = '<html><body>'
-
-    EVENTS.each do |event|
-        html << "<a href='/#{event}'>#{event}</a>"
-    end
-
-    html << "<a href='/with_button'>With button</a>"
-    html + '</body></html>'
-end
-
-EVENTS.each do |event|
-    get "/#{event}" do
-        <<-EOHTML
-    <html>
-        <script>
-            function handle#{event}() {
-                document.getElementById("container").innerHTML =
-                    document.getElementById("my-input").value;
-            }
-        </script>
-
-        <body>
-            <input #{event}="handle#{event}();" id="my-input" name="my-input" />
-
-            <div id="container">
-            </div>
-        </body>
-    </html>
-        EOHTML
-    end
-end
-
-get '/with_button' do
-    <<-EOHTML
-    <html>
-        <body>
-            <input id="my-input" type="text">
-            <button id="insert">Insert into DOM</button>
-
-            <div id="container">
-            </div>
-
-            <script>
-               document.getElementById('insert').addEventListener('click', function() {
-                    document.getElementById("container").innerHTML =
-                        document.getElementById("my-input").value;
-               });
-            </script>
-        </body>
-    </html>
-    EOHTML
-end

data/spec/support/shared/element/capabilities/auditable/dom.rb

@@ -1,322 +0,0 @@
-shared_examples_for 'element_dom' do |options = {}|
-    it_should_behave_like 'element', options
-    it_should_behave_like 'auditable', options.merge( supports_nulls: false )
-
-    before :each do
-        begin
-            Arachni::Options.audit.elements described_class.type
-        rescue Arachni::OptionGroups::Audit::Error
-        end
-    end
-
-    def run
-        auditor.browser_cluster.wait
-    end
-
-    it "supports #{Arachni::RPC::Serializer}" do
-        subject.should == Arachni::RPC::Serializer.deep_clone( subject )
-    end
-
-    describe '#to_rpc_data' do
-        %w(parent page browser element).each do |attribute|
-            it "excludes #{attribute}" do
-                called = false
-
-                # We do this inside a #submit handler to make sure the associations
-                # which are added during a submit are handled successfully.
-                subject.submit do
-                    subject.to_rpc_data.should_not include attribute
-                    called = true
-                end
-                run
-
-                called.should be_true
-            end
-        end
-    end
-
-    describe '#marshal_dump' do
-        [:@parent, :@page, :@browser, :@element].each do |ivar|
-            it "excludes #{ivar}" do
-                called = false
-
-                # We do this inside a #submit handler to make sure the associations
-                # which are added during a submit are handled successfully.
-                subject.submit do
-                    subject.marshal_dump.should_not include ivar
-                    called = true
-                end
-                run
-
-                called.should be_true
-            end
-        end
-    end
-
-    describe '#prepare_for_report' do
-        it 'removes #page' do
-            subject.page.should be_true
-            subject.prepare_for_report
-            subject.page.should be_nil
-        end
-        it 'removes #parent' do
-            subject.parent.should be_true
-            subject.prepare_for_report
-            subject.parent.should be_nil
-        end
-        it 'removes #browser' do
-            called = false
-            subject.with_browser do |browser|
-                subject.browser = browser
-
-                subject.browser.should be_true
-                subject.prepare_for_report
-                subject.browser.should be_nil
-
-                called = true
-            end
-            subject.auditor.browser_cluster.wait
-            called.should be_true
-        end
-    end
-
-    describe '#with_browser_cluster' do
-        context 'when a browser cluster is' do
-            context 'available' do
-                it 'passes a BrowserCluster to the given block' do
-                    worker = nil
-
-                    subject.with_browser_cluster do |cluster|
-                        worker = cluster
-                    end
-
-                    worker.should == subject.auditor.browser_cluster
-                end
-            end
-        end
-    end
-
-    describe '#with_browser' do
-        context 'when a browser cluster is' do
-            context 'available' do
-                it 'passes a BrowserCluster::Worker to the given block' do
-                    worker = nil
-
-                    subject.with_browser do |browser|
-                        worker = browser
-                    end.should be_true
-                    subject.auditor.browser_cluster.wait
-
-                    worker.should be_kind_of Arachni::BrowserCluster::Worker
-                end
-            end
-        end
-    end
-
-    describe '#trigger' do
-        it 'does not update the page transitions' do
-            page = nil
-            pre_transitions = nil
-            subject.with_browser do |browser|
-                browser.load subject.page
-                subject.browser = browser
-                pre_transitions = browser.transitions.dup
-
-                subject.trigger
-                page = browser.to_page
-            end
-
-            subject.auditor.browser_cluster.wait
-            page.dom.transitions.should == pre_transitions
-        end
-    end
-
-    describe '#submit' do
-        it 'submits the element' do
-            inputs = { 'param' => 'stuff' }
-            subject.inputs = inputs
-
-            called = false
-            subject.submit do |page|
-                inputs.should == auditable_extract_parameters( page )
-                called = true
-            end
-
-            subject.auditor.browser_cluster.wait
-            called.should be_true
-        end
-
-        it 'sets the #performer on the returned page' do
-            called = false
-            subject.submit do |page|
-                page.performer.should be_kind_of described_class
-                called = true
-            end
-
-            subject.auditor.browser_cluster.wait
-            called.should be_true
-        end
-
-        it 'sets the #browser on the #performer' do
-            called = false
-            subject.submit do |page|
-                page.performer.browser.should be_kind_of Arachni::BrowserCluster::Worker
-                called = true
-            end
-
-            subject.auditor.browser_cluster.wait
-            called.should be_true
-        end
-
-        it 'sets the #element on the #performer', if: !options[:without_node] do
-            called = false
-            subject.submit do |page|
-                page.performer.element.should be_kind_of Watir::HTMLElement
-                called = true
-            end
-
-            subject.auditor.browser_cluster.wait
-            called.should be_true
-        end
-
-        it 'adds the submission transition to the Page::DOM#transitions' do
-            transition = nil
-            subject.with_browser do |browser|
-                subject.browser = browser
-                browser.load subject.page
-                transition = subject.trigger
-            end
-            subject.auditor.browser_cluster.wait
-
-            submitted_page = nil
-            subject.dup.submit do |page|
-                submitted_page = page
-            end
-            subject.auditor.browser_cluster.wait
-
-            subject.page.dom.transitions.should_not include transition
-            submitted_page.dom.transitions.should include transition
-        end
-
-        context 'when the element could not be submitted' do
-            it 'does not call the block' do
-                subject.stub( :trigger ) { false }
-
-                called = false
-                subject.submit do
-                    called = true
-                end
-                subject.auditor.browser_cluster.wait
-                called.should be_false
-            end
-        end
-
-        describe :options do
-            describe :custom_code do
-                it 'injects the given code' do
-                    called = false
-                    title = 'Injected title'
-
-                    subject.submit custom_code: "document.title = #{title.inspect}" do |page|
-                        page.document.css('title').text.should == title
-                        called = true
-                    end
-
-                    subject.auditor.browser_cluster.wait
-                    called.should be_true
-                end
-            end
-
-            describe :taint do
-                it 'sets the Browser::Javascript#taint' do
-                    taint = Arachni::Utilities.generate_token
-
-                    set_taint = nil
-                    subject.submit taint: taint do |page|
-                        set_taint = page.performer.browser.javascript.taint
-                    end
-
-                    subject.auditor.browser_cluster.wait
-                    set_taint.should == taint
-                end
-            end
-        end
-    end
-
-    describe '#audit' do
-        it 'submits all element mutations' do
-            called = false
-            subject.audit 'seed' do |page, element|
-                auditable_extract_parameters( page ).should == element.inputs
-                called = true
-            end
-
-            subject.auditor.browser_cluster.wait
-            called.should be_true
-        end
-    end
-
-    describe '#valid_input_data?' do
-        it 'returns true' do
-            subject.valid_input_data?( 'stuff' ).should be_true
-        end
-
-        described_class::INVALID_INPUT_DATA.each do |invalid_data|
-            context "when the value contains #{invalid_data.inspect}" do
-                it 'returns false' do
-                    subject.valid_input_data?( "stuff #{invalid_data}" ).should be_false
-                end
-            end
-        end
-    end
-
-    describe '#page' do
-        it 'returns the page containing the element' do
-            subject.page.should be_kind_of Arachni::Page
-        end
-    end
-
-    describe '#node', if: !options[:without_node] do
-        it 'returns the Nokogiri node of the element' do
-            subject.node.is_a?( Nokogiri::XML::Element ).should be_true
-        end
-    end
-
-    describe '#auditor' do
-        it 'returns the assigned auditor' do
-            subject.auditor.should be_kind_of Arachni::Check::Auditor
-        end
-    end
-
-    describe '#encode' do
-        it 'returns the string as is' do
-            v = 'blah'
-            subject.encode( v ).object_id.should == v.object_id
-        end
-    end
-    describe '.encode' do
-        it 'returns the string as is' do
-            v = 'blah'
-            subject.class.encode( v ).object_id.should == v.object_id
-        end
-    end
-
-    describe '#decode' do
-        it 'returns the string as is' do
-            v = 'blah'
-            subject.decode( v ).object_id.should == v.object_id
-        end
-    end
-    describe '.decode' do
-        it 'returns the string as is' do
-            v = 'blah'
-            subject.class.decode( v ).object_id.should == v.object_id
-        end
-    end
-
-    describe '#dup' do
-        it 'preserves the #parent' do
-            subject.dup.parent.should == subject.parent
-        end
-    end
-end