arachni 1.3.2 → 1.4

data/lib/arachni/browser/element_locator.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -14,6 +14,8 @@ class Browser
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class ElementLocator
 
+    ARACHNI_ID = 'data-arachni-id'
+
     # @return   [Symbol]
     #   Tag name of the element.
     attr_accessor :tag_name
@@ -62,14 +64,31 @@ class ElementLocator
         end
     end
 
-    # @return   [Watir::HTMLElement]
-    #   Locates and returns the element based on {#tag_name} and {#attributes}.
+    # @return   [Selenium::WebDriver::Element]
+    #   Locates and returns the element based on {#css}.
     def locate( browser )
-        browser.watir.element( css: css )
+        browser.selenium.find_element( :css, css )
     end
 
     def css
-        "#{tag_name}#{attributes.map { |k, v| "[#{k}=#{v.inspect}]"}.join}"
+        attrs = {}
+
+        # If there's an ID attribute that's good enough, don't include anything
+        # else to avoid risking broken selectors due to dynamic attributes and
+        # values.
+        if attributes['id']
+            attrs['id'] = attributes['id']
+
+        # Alternatively, exclude data attributes (except from ours ) to prevent
+        # issues and use whatever other attributes are available.
+        else
+            attrs = attributes.reject do |k, v|
+                k = k.to_s
+                k.start_with?( 'data-' ) && k != ARACHNI_ID
+            end
+        end
+
+        "#{tag_name}#{attrs.map { |k, v| "[#{k}=#{v.inspect}]"}.join}"
     end
 
     # @return   [String]
@@ -114,7 +133,7 @@ class ElementLocator
     end
 
     def self.from_html( html )
-        from_node Nokogiri::HTML.fragment( html ).children.first
+        from_node Parser.parse_fragment( html )
     end
 
     def self.from_node( node )

data/lib/arachni/browser/javascript.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -22,7 +22,8 @@ class Javascript
     require_relative 'javascript/dom_monitor'
 
     CACHE = {
-        select_event_attributes: Support::Cache::LeastRecentlyPushed.new( 1_000 )
+        events_for:    Support::Cache::LeastRecentlyPushed.new( 1_000 ),
+        select_events: Support::Cache::LeastRecentlyPushed.new( 1_000 )
     }
 
     TOKEN = 'arachni_js_namespace'
@@ -43,7 +44,7 @@ class Javascript
 
     NO_EVENTS_FOR_ELEMENTS = Set.new([
         :base, :bdo, :br, :head, :html, :iframe, :meta, :param, :script, :style,
-        :title, :link
+        :title, :link, :hr
     ])
 
     # Events that apply to all elements.
@@ -68,7 +69,7 @@ class Javascript
                   :onreset
               ],
 
-        # These need to be covered via Watir's API, #send_keys etc.
+        # These need to be covered via Selenium's API, #send_keys etc.
         input: [
                   :onselect,
                   :onchange,
@@ -80,7 +81,7 @@ class Javascript
                   :oninput
               ],
 
-        # These need to be covered via Watir's API, #send_keys etc.
+        # These need to be covered via Selenium's API, #send_keys etc.
         textarea: [
                   :onselect,
                   :onchange,
@@ -138,12 +139,31 @@ class Javascript
         @event_whitelist ||= Set.new( events.flatten.map(&:to_s) )
     end
 
-    # @param    [Symbol]    element
+    # @param    [Symbol]    tag_name
     #
-    # @return   [Array<Symbol>]
+    # @return   [Set<Symbol>]
     #   Events for `element`.
-    def self.events_for( element )
-        GLOBAL_EVENTS | EVENTS_PER_ELEMENT[element.to_sym]
+    def self.events_for( tag_name )
+        CACHE[:events_for].fetch tag_name.to_sym do
+            Set.new(
+                GLOBAL_EVENTS + (EVENTS_PER_ELEMENT[tag_name.to_sym] || [])
+            ).freeze
+        end
+    end
+
+    # @param    [Symbol]    tag_name
+    # @param    [Hash]    events
+    #   Event data with the event name as the key.
+    #
+    # @return   [Hash]
+    #   `events` filtered to only include valid events for the given element type.
+    def self.select_events( tag_name, events )
+        CACHE[:select_events].fetch [tag_name, events] do
+            supported = events_for( tag_name )
+            events.reject do |name, _|
+                !supported.include?( ('on' + name.to_s.gsub( /^on/, '' )).to_sym )
+            end.freeze
+        end
     end
 
     # @param    [Hash]  attributes
@@ -152,11 +172,13 @@ class Javascript
     # @return   [Hash]
     #   `attributes` that include {.events}.
     def self.select_event_attributes( attributes = {} )
-        CACHE[:select_event_attributes][attributes] ||=
-            attributes.inject({}) do |h, (event, handler)|
-                next h if !event_whitelist.include?( event.to_s )
-                h.merge!( event.to_sym => handler )
-            end
+        # NOTICE: Don't cache this, attributes can include all kinds of weird
+        # random crap (framework-specific data nonce attributes etc.) which will
+        # keep filling the cache due to constant misses.
+        attributes.inject({}) do |h, (event, handler)|
+            next h if !event_whitelist.include?( event.to_s )
+            h.merge!( event.to_sym => handler )
+        end.freeze
     end
 
     # @param    [Browser]   browser
@@ -231,8 +253,8 @@ class Javascript
     #
     # @return   [Object]
     #   Result of `script`.
-    def run( script )
-        @browser.watir.execute_script script
+    def run( *args )
+        @browser.selenium.execute_script *args
     end
 
     # Executes the given code but unwraps Watir elements.
@@ -242,8 +264,13 @@ class Javascript
     #
     # @return   [Object]
     #   Result of `script`.
-    def run_without_elements( script )
-        unwrap_elements run( script )
+    def run_without_elements( *args )
+        unwrap_elements run( *args )
+    end
+
+    def has_sinks?
+        return false if !supported?
+        taint_tracer.has_sinks( @taint )
     end
 
     # @return   (see TaintTracer#debug)
@@ -300,8 +327,6 @@ class Javascript
         dom_monitor.elements_with_events.map do |element|
             next if NO_EVENTS_FOR_ELEMENTS.include? element['tag_name'].to_sym
 
-            attributes = element['attributes']
-
             element['events'] = (element['events'].map do |event, fn|
                 next if !(self.class.event_whitelist.include?( event ) ||
                     self.class.event_whitelist.include?( "on#{event}" ))
@@ -309,7 +334,15 @@ class Javascript
                 [event.to_sym, fn]
             end.compact)
 
-            element['events'] |= self.class.select_event_attributes( attributes ).to_a
+            element['events'] |= self.class.select_event_attributes( element['attributes'] ).to_a
+            element['events']  = self.class.select_events( element['tag_name'], element['events'] ).dup
+
+            categorized = {}
+            element['events'].each do |event, callback|
+                categorized[event] ||= []
+                categorized[event] << callback
+            end
+            element['events'] = categorized
 
             element
         end.compact
@@ -382,7 +415,7 @@ class Javascript
 
             body = response.body.dup
 
-            update_taints( body )
+            update_taints( body, response )
             update_custom_code( body )
 
             response.body = body
@@ -410,10 +443,11 @@ class Javascript
 
             # Include and initialize our JS interfaces.
             response.body = <<-EOHTML
+<script src="#{script_url_for( :polyfills )}"></script> #{html_comment}
 <script src="#{script_url_for( :taint_tracer )}"></script> #{html_comment}
 <script src="#{script_url_for( :dom_monitor )}"></script> #{html_comment}
 <script>
-#{wrapped_taint_tracer_initializer}
+#{wrapped_taint_tracer_initializer( response )}
 #{js_initialization_signal};
 
 #{wrapped_custom_code}
@@ -423,8 +457,6 @@ class Javascript
             EOHTML
         end
 
-        response.headers['content-length'] = response.body.size
-
         true
     end
 
@@ -440,9 +472,12 @@ class Javascript
 
         # Let's check that the response at least looks like it contains HTML
         # code of interest.
-        body = response.body.downcase
+        body = response.body.downcase.strip
         return false if !HTML_IDENTIFIERS.find { |tag| body.include? tag.downcase }
 
+        # If there's a doctype then we're good to go.
+        return true if body.start_with?( '<!doctype html' )
+
         # The last check isn't fool-proof, so don't do it when loading the page
         # for the first time, but only when the page loads stuff via AJAX and whatnot.
         #
@@ -455,8 +490,10 @@ class Javascript
         #
         # For example, it may have been JSON with the wrong content-type that
         # includes HTML -- it happens.
+        #
+        # Beware, if there's a doctype in the beginning this will fail.
         begin
-            return false if Nokogiri::XML( response.body ).children.empty?
+            return false if Parser.parse_xml( response.body ).children.empty?
         rescue => e
             print_debug "Does not look like HTML: #{response.url}"
             print_debug "\n#{response.body}"
@@ -477,22 +514,48 @@ class Javascript
         "<!-- Injected by #{self.class} -->"
     end
 
-    def taints
-        taints = [@taint]
+    def taints( response )
+        taints = {}
+
+        [@taint].flatten.compact.each do |t|
+            taints[t] = {
+                stop_at_first: false,
+                trace:         true
+            }
+        end
 
         # Include cookie names and values in the trace so that the browser will
         # be able to infer if they're being used, to avoid unnecessary audits.
         if Options.audit.cookie_doms?
-            taints |= HTTP::Client.cookies.map { |c| c.inputs.to_a }.flatten
+            cookies = begin
+                HTTP::Client.cookie_jar.for_url( response.url )
+            rescue
+                print_debug "Could not get cookies for URL '#{response.url}' from Cookiejar (#{e})."
+                print_debug_exception e
+                HTTP::Client.cookies
+            end
+
+            cookies.each do |c|
+                next if c.http_only?
+
+                c.inputs.to_a.flatten.each do |input|
+                    next if input.empty?
+
+                    taints[input] ||= {
+                        stop_at_first: true,
+                        trace:         false
+                    }
+                end
+            end
         end
 
-        taints.flatten.reject { |v| v.to_s.empty? }
+        taints
     end
 
-    def update_taints( body )
+    def update_taints( body, response )
         body.gsub!(
             /\/\* #{token}_initialize_start \*\/(.*)\/\* #{token}_initialize_stop \*\//,
-            wrapped_taint_tracer_initializer
+            wrapped_taint_tracer_initializer( response )
         )
     end
 
@@ -503,9 +566,9 @@ class Javascript
         )
     end
 
-    def wrapped_taint_tracer_initializer
+    def wrapped_taint_tracer_initializer( response )
         "/* #{token}_initialize_start */ " <<
-            "#{@taint_tracer.stub.function( :initialize, taints )} " <<
+            "#{@taint_tracer.stub.function( :initialize, taints( response ) )} " <<
             "/* #{token}_initialize_stop */"
     end
 
@@ -548,6 +611,9 @@ class Javascript
             when Watir::Element
                 unwrap_element( obj )
 
+            when Selenium::WebDriver::Element
+                unwrap_element( obj )
+
             when Array
                 obj.map { |e| unwrap_elements( e ) }
 
@@ -562,6 +628,8 @@ class Javascript
 
     def unwrap_element( element )
         element.html
+    rescue Selenium::WebDriver::Error::StaleElementReferenceError
+        ''
     end
 
 end

data/lib/arachni/browser/javascript/dom_monitor.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/proxy.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -34,7 +34,6 @@ class Proxy < BasicObject
         @javascript = javascript
         @object     = object
         @stub       = Stub.new( self )
-        @isFunction = {}
     end
 
     # @param    [#to_sym] name
@@ -44,20 +43,7 @@ class Proxy < BasicObject
     #   `true` if the `name` property of the current object points to a function,
     #   `false` otherwise.
     def function?( name )
-        return @isFunction[name.to_sym] if @isFunction.include?( name.to_sym )
-
-        if name.to_s.end_with? '='
-            name = name.to_s
-            return @isFunction[name.to_sym] = @javascript.run(
-                "return ('#{name[0...-1]}' in #{js_object})"
-            )
-        end
-
-        @isFunction[name.to_sym] =
-            @javascript.run(
-                "return Object.prototype.toString.call( #{js_object}." <<
-                    "#{name} ) == '[object Function]'"
-            )
+        self.class.function?( @javascript, js_object, name )
     end
 
     # @return   [String]
@@ -86,6 +72,32 @@ class Proxy < BasicObject
     def class
         Proxy
     end
+
+    def self.function?( env, object, name )
+        mutex.synchronize do
+            @isFunction ||= {}
+            key = "#{object}.#{name}".hash
+
+            return @isFunction[key] if @isFunction.include?( key )
+
+            if name.to_s.end_with? '='
+                name = name.to_s
+                return @isFunction[key] = env.run(
+                    "return ('#{name[0...-1]}' in #{object})"
+                )
+            end
+
+            @isFunction[key] = env.run(
+                "return Object.prototype.toString.call( #{object}." <<
+                    "#{name} ) == '[object Function]'"
+            )
+        end
+    end
+    def self.mutex
+        @mutex ||= ::Mutex.new
+    end
+    mutex
+
 end
 
 end

data/lib/arachni/browser/javascript/proxy/stub.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/scripts/dom_monitor.js

@@ -1,11 +1,18 @@
 /*
- * Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+ * Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
  *
  * This file is part of the Arachni Framework project and is subject to
  * redistribution and commercial restrictions. Please see the Arachni Framework
  * web site for more information on licensing and terms of use.
  */
 
+//if( !window.onerror ) {
+//    window.errors = [];
+//    window.onerror = function() {
+//        window.errors.push( arguments )
+//    };
+//}
+
 /*
  * Allows the system to optimize DOM/JS/AJAX analysis by overriding JS prototypes
  * and tracking things like bound events and timers.
@@ -26,7 +33,46 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
     
     exclude_attributes_from_digest:  ['data-arachni-id'],
 
-    // Initialize.
+    event_attributes: {
+        "click" : true,
+        "dblclick" : true,
+        "mousedown" : true,
+        "mousemove" : true,
+        "mouseout" : true,
+        "mouseover" : true,
+        "mouseup" : true,
+        "load" : true,
+        "submit" : true,
+        "reset" : true,
+        "select" : true,
+        "change" : true,
+        "focus" : true,
+        "blur" : true,
+        "keydown" : true,
+        "keypress" : true,
+        "keyup" : true,
+        "input" : true
+    },
+
+    allowed_elements_without_events: {
+        "a": true,
+        "input": true,
+        "textarea": true,
+        "select": true,
+        "form": true
+    },
+
+    allowed_elements_with_inherited_events: {
+        "a": true,
+        "input": true,
+        "textarea": true,
+        "select": true,
+        "form": true,
+        "li": true,
+        "span": true,
+        "button": true
+    },
+
     initialize: function () {
         if( _tokenDOMMonitor.initialized ) return;
 
@@ -38,36 +84,57 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
     },
 
     update_trackers: function () {
-        _tokenDOMMonitor.track_jQuery_delegated_events();
     },
 
-    // Returns information about all DOM elements, their attributes and registered
-    // events.
+    // Returns information about all DOM elements that have events, along with
+    // some elements that
     elements_with_events: function () {
         var events_with_elements = [];
         var elements = document.getElementsByTagName("*");
         var length   = elements.length;
 
+        var global_events = window._arachni_events || [];
+        global_events = global_events.concat( document._arachni_events || [] );
+        global_events = _tokenDOMMonitor.arrayUnique( global_events );
+
         for( var i = 0; i < length; i++ ) {
+            var has_events = false;
             var element = elements[i];
 
+            _tokenDOMMonitor.bequeath_events( element );
+
             // Skip invisible elements.
             if( element.offsetWidth <= 0 && element.offsetHeight <= 0 ) continue;
 
-            _tokenDOMMonitor.apply_jQuery_delegated_events( element );
-
             var e = {
                 tag_name:   element.tagName.toLowerCase(),
                 events:     element._arachni_events || [],
                 attributes: {}
             };
 
+            if( _tokenDOMMonitor.is_allowed_element_with_inherited_events( e.tag_name ) ) {
+                e.events = e.events.concat( element._arachni_inherited_events || [] );
+                e.events = _tokenDOMMonitor.arrayUnique( e.events.concat( global_events ) );
+            }
+
             var attributes  = element.attributes;
             var attr_length = attributes.length;
 
             for( var j = 0; j < attr_length; j++ ){
-                e.attributes[attributes[j].nodeName] = attributes[j].nodeValue;
+                var attr_name = attributes[j].nodeName;
+
+                if( _tokenDOMMonitor.is_valid_event( attr_name ) ) {
+                    has_events = true;
+                }
+
+                e.attributes[attr_name] = attributes[j].nodeValue;
+            }
+
+            if( !_tokenDOMMonitor.is_allowed_element_without_event( e.tag_name ) &&
+                !has_events && e.events.length == 0 ) {
+                continue
             }
+            has_events = false;
 
             events_with_elements.push( e );
         }
@@ -75,6 +142,27 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         return events_with_elements;
     },
 
+    is_valid_event: function ( event ) {
+        return Object.prototype.hasOwnProperty.call(
+            _tokenDOMMonitor.event_attributes,
+            event.replace( 'on', '' )
+        );
+    },
+
+    is_allowed_element_without_event: function ( tag_name ) {
+        return Object.prototype.hasOwnProperty.call(
+            _tokenDOMMonitor.allowed_elements_without_events,
+            tag_name
+        );
+    },
+
+    is_allowed_element_with_inherited_events: function ( tag_name ) {
+        return Object.prototype.hasOwnProperty.call(
+            _tokenDOMMonitor.allowed_elements_with_inherited_events,
+            tag_name
+        );
+    },
+
     // Returns a string digest of the current DOM tree (i.e. node names and their
     // attributes without text-nodes).
     digest: function () {
@@ -128,54 +216,6 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         };
     },
 
-    track_jQuery_delegated_events: function () {
-        if( _tokenDOMMonitor.tracked_jQuery_delegated_events || !window.jQuery ) return;
-        _tokenDOMMonitor.tracked_jQuery_delegated_events = true;
-
-        var original = window.jQuery.fn.on;
-
-        // We only care for calls with selectors, as any other will attach the
-        // events to the DOM element immediately and thus be captured by the
-        // addEventListener tracker.
-        window.jQuery.fn.on = function ( types, selector, data, fn, one ) {
-
-            // Types can be a map of types/handlers, in that case just run
-            // the original as it'll act recursively and pass itself (which is
-            // this override, really) each type.
-            if ( typeof types === "object" ) {
-                return original.apply( this, [].slice.call( arguments ) );
-            }
-
-            if ( data == null && fn == null ) {
-                // ( types, fn ) -- no selector, bail out.
-                return original.apply( this, [].slice.call( arguments ) );
-            } else if ( fn == null ) {
-                if ( typeof selector === "string" ) {
-                    // ( types, selector, fn ) -- with selector, proceed.
-                    fn = data;
-                } else {
-                    // ( types, data, fn ) -- no selector, bail out.
-                    return original.apply( this, [].slice.call( arguments ) );
-                }
-            }
-
-            if( selector ) {
-                this.each( function( i, e ){
-                    e['_arachni_jquery_delegated_event'] =
-                        e['_arachni_jquery_delegated_event'] || [];
-
-                    e['_arachni_jquery_delegated_event'].push({
-                        selector: selector,
-                        event:    types,
-                        handler:  fn
-                    });
-                });
-            }
-
-            return original.apply( this, [].slice.call( arguments ) );
-        };
-    },
-
     // Overrides window.addEventListener and Node.prototype.addEventListener
     // to intercept event binds so that we can keep track of them in order to
     // optimize DOM analysis.
@@ -188,6 +228,14 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
             original_Window_addEventListener.apply( window, [].slice.call( arguments ) );
         };
 
+        // Override document.addEventListener
+        var original_Document_addEventListener = document.addEventListener;
+
+        document.addEventListener = function ( event, listener, useCapture ) {
+            _tokenDOMMonitor.registerEvent( document, event, listener );
+            original_Document_addEventListener.apply( document, [].slice.call( arguments ) );
+        };
+
         // Override Node.prototype.addEventListener
         var original_Node_addEventListener = Node.prototype.addEventListener;
 
@@ -197,21 +245,40 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         };
     },
 
-    apply_jQuery_delegated_events: function ( element ){
-        if( !element['_arachni_jquery_delegated_event'] ) return;
+    bequeath_events: function( element ) {
+        var children = element.childNodes;
+
+        for( var i = 0; i < children.length; i++ ) {
+            var child = children[i];
+
+            if( !('_arachni_inherited_events' in child) ) child['_arachni_inherited_events'] = [];
+
+            if( element['_arachni_events'] ) {
+                child['_arachni_inherited_events'] =
+                    element['_arachni_events'].concat( child['_arachni_inherited_events'] );
+            }
+
+            if( element['_arachni_inherited_events'] ) {
+                child['_arachni_inherited_events'] =
+                    element['_arachni_inherited_events'].concat( child['_arachni_inherited_events'] );
+            }
 
-        var event_data     = element['_arachni_jquery_delegated_event'];
-        var jquery_element = jQuery( element );
+            child['_arachni_inherited_events'] =
+                _tokenDOMMonitor.arrayUnique( child['_arachni_inherited_events'] )
+        }
+    },
 
-        for( var i = 0; i < event_data.length; i++ ) {
-            var data = event_data[i];
+    arrayUnique: function( array ) {
+        var a = array.concat();
 
-            jquery_element.find( data.selector ).each( function ( j, child ){
-                _tokenDOMMonitor.registerEvent( child, data.event, data.handler );
-            });
+        for( var i = 0; i < a.length; ++i ) {
+            for( var j = i + 1; j < a.length; ++j ) {
+                if( a[i] === a[j] )
+                    a.splice( j--, 1 );
+            }
         }
 
-        element['_arachni_jquery_delegated_event'] = undefined;
+        return a;
     },
 
     // Registers an event and its handler for the given element.
@@ -219,7 +286,11 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         if( !('_arachni_events' in element) ) element['_arachni_events'] = [];
 
         // Custom events are usually in the form of "click.delegateEventsview13".
-        element['_arachni_events'].push( [event.split( '.' )[0], handler] );
+        event = event.split( '.' )[0];
+
+        if( _tokenDOMMonitor.is_valid_event( event ) ) {
+            element['_arachni_events'].push( [event, handler] );
+        }
     },
 
     // Sets a unique enough custom ID attribute to elements that lack proper IDs.