arachni 1.3.2 → 1.4

data/lib/arachni/browser/javascript/scripts/polyfills.js

@@ -0,0 +1,28 @@
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind#Polyfill
+if (!Function.prototype.bind) {
+    Function.prototype.bind = function(oThis) {
+        if (typeof this !== 'function') {
+            // closest thing possible to the ECMAScript 5
+            // internal IsCallable function
+            throw new TypeError('Function.prototype.bind - what is trying to be bound is not callable');
+        }
+
+        var aArgs   = Array.prototype.slice.call(arguments, 1),
+            fToBind = this,
+            fNOP    = function() {},
+            fBound  = function() {
+                return fToBind.apply(this instanceof fNOP
+                        ? this
+                        : oThis,
+                    aArgs.concat(Array.prototype.slice.call(arguments)));
+            };
+
+        if (this.prototype) {
+            // native functions don't have a prototype
+            fNOP.prototype = this.prototype;
+        }
+        fBound.prototype = new fNOP();
+
+        return fBound;
+    };
+}

data/lib/arachni/browser/javascript/scripts/taint_tracer.js

@@ -1,5 +1,5 @@
 /*
- * Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+ * Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
  *
  * This file is part of the Arachni Framework project and is subject to
  * redistribution and commercial restrictions. Please see the Arachni Framework
@@ -18,7 +18,7 @@ var _tokenTaintTracer = _tokenTaintTracer || {
 
     // If taints are set, the data-flow tracers will inspect their possible
     // sink's arguments and log them if they find the taint.
-    taints:               [],
+    taints:               {},
 
     // Allows the 'debug' function to operate.
     enable_debugging:     true,
@@ -182,7 +182,7 @@ var _tokenTaintTracer = _tokenTaintTracer || {
 
         _tokenTaintTracer.taints = taints;
 
-        if( taints.length > 0 ) {
+        if( !_tokenTaintTracer.isEmpty( taints ) ) {
             _tokenTaintTracer.install_tracers_from_list( _tokenTaintTracer.data_flow_sinks_to_monitor.once );
         }
 
@@ -202,13 +202,19 @@ var _tokenTaintTracer = _tokenTaintTracer || {
         })
     },
 
+    has_sinks: function ( taint ){
+        return _tokenTaintTracer.execution_flow_sinks.length > 0 ||
+            _tokenTaintTracer.data_flow_sinks[taint]
+    },
+
     log_data_flow_sink: function ( taint, frame_data ){
         _tokenTaintTracer.data_flow_sinks[taint] =
             _tokenTaintTracer.data_flow_sinks[taint] || [];
 
         _tokenTaintTracer.data_flow_sinks[taint].push({
             data:  frame_data,
-            trace: _tokenTaintTracer.trace()
+            trace: _tokenTaintTracer.taints[taint].trace ?
+                    _tokenTaintTracer.trace() : []
         });
 
         if( _tokenTaintTracer.data_flow_sinks[taint].length > _tokenTaintTracer.max_sinks ) {
@@ -392,8 +398,14 @@ var _tokenTaintTracer = _tokenTaintTracer || {
     find_and_log_taint: function ( func, arguments, object_name, function_name ) {
         var tainted;
 
-        for( var i = 0; i < _tokenTaintTracer.taints.length; i++ ) {
-            var taint = _tokenTaintTracer.taints[i];
+        for( var taint in _tokenTaintTracer.taints ) {
+            if(
+                !_tokenTaintTracer.taints.hasOwnProperty( taint ) ||
+                (
+                    _tokenTaintTracer.taints[taint].stop_at_first &&
+                    _tokenTaintTracer.data_flow_sinks[taint]
+                )
+            ) continue;
 
             tainted = _tokenTaintTracer.find_taint_in_arguments( taint, arguments );
             if( !tainted ) continue;
@@ -545,6 +557,15 @@ var _tokenTaintTracer = _tokenTaintTracer || {
         } else {
             _tokenTaintTracer.add_trace_to_namespace( entry );
         }
+    },
+
+    isEmpty: function ( obj ) {
+        for( var prop in obj ) {
+            if( obj.hasOwnProperty( prop ) )
+                return false;
+        }
+
+        return true;
     }
 };
 

data/lib/arachni/browser/javascript/taint_tracer.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/frame.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/frame/called_function.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/sink/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/sink/data_flow.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/sink/execution_flow.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser_cluster.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -69,10 +69,6 @@ class BrowserCluster
     #   Number of pending jobs.
     attr_reader :pending_job_counter
 
-    attr_reader :consumed_pids
-
-    attr_reader :job_counter
-
     # @param    [Hash]  options
     # @option   options [Integer]   :pool_size (5)
     #   Amount of {Worker browsers} to add to the pool.
@@ -120,7 +116,6 @@ class BrowserCluster
         @mutex       = Monitor.new
         @done_signal = Queue.new
 
-        @consumed_pids = []
         initialize_workers
     end
 
@@ -183,15 +178,15 @@ class BrowserCluster
     #   Resource to explore, if given a `String` it will be treated it as a URL
     #   and will be loaded.
     # @param    [Hash]  options
-    #   See {Jobs::ResourceExploration} accessors.
+    #   See {Jobs::DOMExploration} accessors.
     # @param    [Block]  block
     #   Callback to be passed the {Job::Result}.
     #
-    # @see Jobs::ResourceExploration
+    # @see Jobs::DOMExploration
     # @see #queue
     def explore( resource, options = {}, &block )
         queue(
-            Jobs::ResourceExploration.new( options.merge( resource: resource ) ),
+            Jobs::DOMExploration.new( options.merge( resource: resource ) ),
             &block
         )
     end
@@ -231,6 +226,8 @@ class BrowserCluster
                 @pending_job_counter = 0
                 @done_signal << nil
             end
+
+            Arachni.collect_young_objects
         end
 
         true
@@ -399,7 +396,8 @@ class BrowserCluster
     end
 
     def self.seconds_per_job
-        total_job_time / Float( completed_job_count )
+        n = (total_job_time / Float( completed_job_count ))
+        n.nan? ? 0 : n
     end
 
     def self.increment_queued_job_count
@@ -482,11 +480,9 @@ class BrowserCluster
                 height: Options.browser_cluster.screen_height
             )
             @workers << worker
-            @consumed_pids << worker.pid
-
-            print_status "Spawned ##{i+1} with PID #{worker.pid}."
+            print_status "Spawned ##{i+1} with PID #{worker.browser_pid} " <<
+                "[lifeline at PID #{worker.lifeline_pid}]."
         end
-        @consumed_pids.compact!
 
         print_status "Initialization completed with #{@workers.size} browsers in the pool."
     end

data/lib/arachni/browser_cluster/job.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser_cluster/job/result.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser_cluster/jobs/browser_provider.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser_cluster/jobs/{resource_exploration.rb → dom_exploration.rb}

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -13,12 +13,12 @@ module Jobs
 # Loads a {#resource} and {Browser#trigger_events explores} its DOM.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-class ResourceExploration < Job
+class DOMExploration < Job
 
-    require_relative 'resource_exploration/result'
-    require_relative 'resource_exploration/event_trigger'
+    require_relative 'dom_exploration/result'
+    require_relative 'dom_exploration/event_trigger'
 
-    # @return [Page, String, HTTP::Response]
+    # @return [Page::DOM, Page, String, HTTP::Response]
     #   Resource to explore, if given a `String` it will be treated it as a URL
     #   and will be loaded.
     attr_accessor :resource

data/lib/arachni/browser_cluster/jobs/{resource_exploration → dom_exploration}/event_trigger.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,13 +9,13 @@
 module Arachni
 class BrowserCluster
 module Jobs
-class ResourceExploration
+class DOMExploration
 
 # Loads a {#resource} and {Browser#trigger_event triggers} the specified
 # {#event} on the given {#element element}.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-class EventTrigger < ResourceExploration
+class EventTrigger < DOMExploration
 
     require_relative 'event_trigger/result'
 
@@ -32,7 +32,10 @@ class EventTrigger < ResourceExploration
         browser.on_new_page { |page| save_result( page: page ) }
 
         browser.load resource
-        browser.trigger_event( resource, element, event )
+
+        # We're disabling page restoration for the trigger as this is an one-time
+        # job situation, the browser's state is going to be discarded at the end.
+        browser.trigger_event( resource, element, event, false )
     end
 
     def to_s

data/lib/arachni/browser_cluster/jobs/{resource_exploration → dom_exploration}/event_trigger/result.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,11 +9,11 @@
 module Arachni
 class BrowserCluster
 module Jobs
-class ResourceExploration
+class DOMExploration
 class EventTrigger
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-class Result < ResourceExploration::Result
+class Result < DOMExploration::Result
 end
 
 end

data/lib/arachni/browser_cluster/jobs/{resource_exploration → dom_exploration}/result.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -9,7 +9,7 @@
 module Arachni
 class BrowserCluster
 module Jobs
-class ResourceExploration
+class DOMExploration
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class Result < Job::Result

data/lib/arachni/browser_cluster/jobs/taint_trace.rb

@@ -1,12 +1,12 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
     web site for more information on licensing and terms of use.
 =end
 
-require_relative 'resource_exploration'
+require_relative 'dom_exploration'
 
 module Arachni
 class BrowserCluster
@@ -19,7 +19,7 @@ module Jobs
 # It will pass each evaluated page with the {TaintTrace::Result result}.
 #
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-class TaintTrace < ResourceExploration
+class TaintTrace < DOMExploration
 
     require_relative 'taint_trace/result'
     require_relative 'taint_trace/event_trigger'

data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,7 +12,7 @@ module Jobs
 class TaintTrace
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-class EventTrigger < ResourceExploration::EventTrigger
+class EventTrigger < DOMExploration::EventTrigger
 
     require_relative 'event_trigger/result'
 

data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger/result.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -13,7 +13,7 @@ class TaintTrace
 class EventTrigger
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
-class Result < ResourceExploration::Result
+class Result < DOMExploration::Result
 end
 
 end

data/lib/arachni/browser_cluster/jobs/taint_trace/result.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser_cluster/worker.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -20,13 +20,6 @@ class BrowserCluster
 class Worker < Arachni::Browser
     personalize_output
 
-    # @return   [Integer]
-    #   We can't just close all windows because PhantomJS for some reason
-    #   freezes after we do it a lot of times and we can't just leave open
-    #   windows accumulate, so we've got to take more drastic measures and kill
-    #   it when the amount of open windows reaches or exceeds this setting.
-    RESPAWN_WHEN_WINDOW_COUNT_REACHES = 5
-
     # @return    [BrowserCluster]
     attr_reader   :master
 
@@ -82,6 +75,10 @@ class Worker < Arachni::Browser
         # If we can't respawn, then bail out.
         return if browser_respawn_if_necessary.nil?
 
+        # ap '=' * 250
+        # ap '=' * 250
+        # pre = $WATIR_REQ_COUNT
+
         time = Time.now
         begin
             with_timeout @job_timeout do
@@ -110,12 +107,7 @@ class Worker < Arachni::Browser
             browser_respawn
         end
 
-        begin
-            watir.cookies.clear
-        # Working window was closed by JS (probably), start from scratch.
-        rescue Selenium::WebDriver::Error::NoSuchWindowError
-            browser_respawn
-        end
+        # ap $WATIR_REQ_COUNT - pre
 
         decrease_time_to_live
         browser_respawn_if_necessary
@@ -138,24 +130,6 @@ class Worker < Arachni::Browser
         @job = nil
     end
 
-    # We change the default scheduling to distribute elements and events to all
-    # available browsers ASAP, instead of building a list and then consuming it,
-    # since we're don't have to worry about messing up our page's state in this
-    # setup.
-    #
-    # @see Browser#trigger_events
-    def trigger_events
-        root_page = to_page
-
-        each_element_with_events do |element, events|
-            events.each do |name, _|
-                distribute_event( root_page, element, name.to_sym )
-            end
-        end
-
-        true
-    end
-
     # Direct the distribution to the master and let it take it from there.
     #
     # @see Jobs::EventTrigger
@@ -183,7 +157,7 @@ class Worker < Arachni::Browser
 
         # Keep checking to see if any of the 'done' criteria are true.
         kill_check = Thread.new do
-            sleep 0.1 while browser_alive? && wait && @job
+            sleep 0.1 while alive? && wait && @job
             @done_signal << nil
         end
 
@@ -198,7 +172,7 @@ class Worker < Arachni::Browser
 
     def inspect
         s = "#<#{self.class} "
-        s << "pid=#{@pid} "
+        s << "pid=#{@lifeline_pid} "
         s << "job=#{@job.inspect} "
         s << "last-url=#{@last_url.inspect} "
         s << "transitions=#{@transitions.size}"
@@ -247,9 +221,7 @@ class Worker < Arachni::Browser
     end
 
     def browser_respawn_if_necessary
-        return false if !time_to_die? && browser_alive? &&
-            watir.windows.size < RESPAWN_WHEN_WINDOW_COUNT_REACHES
-
+        return false if !time_to_die? && alive?
         browser_respawn
     end
 
@@ -259,8 +231,9 @@ class Worker < Arachni::Browser
         begin
             # If PhantomJS is already dead this will block for quite some time so
             # beware.
-            @watir.close if browser_alive?
-        rescue Selenium::WebDriver::Error::WebDriverError
+            @watir.close if @watir && alive?
+        rescue Selenium::WebDriver::Error::WebDriverError,
+            Watir::Exception::Error
         end
 
         kill_process
@@ -269,7 +242,6 @@ class Worker < Arachni::Browser
         # that, just leave it dead and try again at the next job.
         begin
             @watir = ::Watir::Browser.new( selenium )
-            ensure_open_window
             true
         rescue Selenium::WebDriver::Error::WebDriverError,
             Browser::Error::Spawn => e