arachni 1.3.2 → 1.4

data/lib/arachni/check.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/check/auditor.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -180,6 +180,15 @@ module Auditor
         self.class.max_issues
     end
 
+    FILE_SIGNATURES_PER_PLATFORM =
+        Arachni::Element::Capabilities::Analyzable::Signature::FILE_SIGNATURES_PER_PLATFORM
+
+    FILE_SIGNATURES =
+        Arachni::Element::Capabilities::Analyzable::Signature::FILE_SIGNATURES
+
+    SOURCE_CODE_SIGNATURES_PER_PLATFORM =
+        Arachni::Element::Capabilities::Analyzable::Signature::SOURCE_CODE_SIGNATURES_PER_PLATFORM
+
     # Holds constant bitfields that describe the preferred formatting of
     # injection strings.
     Format = Element::Capabilities::Mutable::Format
@@ -294,6 +303,11 @@ module Auditor
             page = self.page
         end
 
+        # Don't check the page scope, the check may have exceeded the DOM depth
+        # limit but the check is allowed to do that, only check for an out of
+        # scope response.
+        return if !page.response.parsed_url.seed_in_host? && page.response.scope.out?
+
         msg = "In #{vector.type}"
 
         active = vector.respond_to?( :affected_input_name ) && vector.affected_input_name

data/lib/arachni/check/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/check/manager.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -33,19 +33,19 @@ class Base
 
     class <<self
         def fullname
-            info[:name]
+            @fullname ||= info[:name]
         end
 
         def description
-            info[:description]
+            @description ||= info[:description]
         end
 
         def author
-            info[:author]
+            @author ||= info[:author]
         end
 
         def version
-            info[:version]
+            @version ||= info[:version]
         end
 
         def shortname=( shortname )

data/lib/arachni/component/manager.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -104,6 +104,10 @@ class Manager < Hash
     def initialize( lib, namespace )
         @lib       = lib
         @namespace = namespace
+
+        @helper_check_cache = {}
+        @name_to_path_cache = {}
+        @path_to_name_cache = {}
     end
 
     # Loads components.
@@ -236,7 +240,7 @@ class Manager < Hash
                 component[0] = ''
 
                 if component[WILDCARD]
-                    unload |= wilcard_to_names( component )
+                    unload |= glob_to_names( component )
                 else
                     unload << component
                 end
@@ -251,7 +255,7 @@ class Manager < Hash
             components.each do |component|
 
                 if component.include?( WILDCARD )
-                    load |= wilcard_to_names( component )
+                    load |= glob_to_names( component )
                 else
 
                     if avail_components.include?( component )
@@ -302,9 +306,13 @@ class Manager < Hash
     def delete( name )
         name = name.to_s
         begin
-            @namespace.send( :remove_const, fetch( name ).to_s.split( ':' ).last.to_sym )
+            @namespace.send(
+                :remove_const,
+                fetch( name ).to_s.split( ':' ).last.to_sym
+            )
         rescue
         end
+
         super( name )
     end
     alias :unload :delete
@@ -312,7 +320,7 @@ class Manager < Hash
     # @return    [Array]
     #   Names of available components.
     def available
-        paths.map{ |path| path_to_name( path ) }
+        paths.map { |path| path_to_name( path ) }
     end
 
     # @return    [Array]
@@ -329,8 +337,8 @@ class Manager < Hash
     # @return   [String]
     #   Path to component file.
     def name_to_path( name )
-        paths.each { |path| return path if name.to_s == path_to_name( path ) }
-        nil
+        @name_to_path_cache[name] ||=
+            paths.find { |path| name.to_s == path_to_name( path ) }
     end
 
     # Converts the path of a component to a component name.
@@ -341,21 +349,39 @@ class Manager < Hash
     # @return   [String]
     #   Component name.
     def path_to_name( path )
-        File.basename( path, '.rb' )
+        @path_to_name_cache[path] ||= File.basename( path, '.rb' )
     end
 
     # @return   [Array]
     #   Paths of all available components (excluding helper files).
     def paths
-        Dir.glob( File.join( "#{@lib}**", "*.rb" ) ).reject{ |path| helper?( path ) }
+        @paths_cache ||=
+            Dir.glob( File.join( "#{@lib}**", "*.rb" ) ).
+                reject{ |path| helper?( path ) }
+    end
+
+    def matches_globs?( path, globs )
+        !![globs].flatten.compact.find { |glob| matches_glob?( path, glob ) }
+    end
+
+    def matches_glob?( path, glob )
+        relative_path = File.dirname( path.gsub( @lib, '' ) )
+        relative_path << '/' if !relative_path.end_with?( '/' )
+
+        name = path_to_name( path )
+
+        Support::Glob.new( glob ) =~ name ||
+            Support::Glob.new( glob ) =~ relative_path
     end
 
     private
 
-    def wilcard_to_names( name )
-        if name[WILDCARD]
+    def glob_to_names( glob )
+        if glob[WILDCARD]
             paths.map do |path|
-                path_to_name( path ) if path.match( name.gsub( '*', '(.*)' ) )
+                next if !matches_glob?( path, glob )
+
+                path_to_name( path )
             end.compact
         end
     end
@@ -393,7 +419,7 @@ class Manager < Hash
     end
 
     def helper?( path )
-        File.exist?( File.dirname( path ) + '.rb' )
+        @helper_check_cache[path] ||= File.exist?( File.dirname( path ) + '.rb' )
     end
 
 end

data/lib/arachni/component/options.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/address.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/bool.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/float.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/int.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/multiple_choice.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/object.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/port.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/string.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/options/url.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/output.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/component/utilities.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/framework.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/framework/rpc.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/issues.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/plugins.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/data/session.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,6 +12,14 @@ module Arachni
 
 module Element
 
+def self.type_to_class( type )
+    Element.constants.each do |c|
+        klass = Element.const_get( c )
+        return klass if klass.respond_to?(:type) && klass.type == type
+    end
+    nil
+end
+
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class Error < Arachni::Error
 end
@@ -64,8 +72,6 @@ class Base
     attr_reader   :initialization_options
 
     def initialize( options )
-        options = options.my_symbolize_keys( false )
-
         if !(options[:url] || options[:action])
             fail 'Needs :url or :action option.'
         end
@@ -165,11 +171,15 @@ class Base
     # @return   [Hash]
     #   Data representing this instance that are suitable the RPC transmission.
     def to_rpc_data
-        data = marshal_dump.inject({}) { |h, (k, v)| h[k.to_s.gsub('@', '')] = v.to_rpc_data_or_self; h }
+        data = marshal_dump.inject({}) do |h, (k, v)|
+            h[k.to_s.gsub('@', '')] = v.to_rpc_data_or_self
+            h
+        end
+
         data.delete 'audit_options'
         data.delete 'scope'
-        data['class'] = self.class.to_s
 
+        data['class']                  = self.class.to_s
         data['initialization_options'] = initialization_options
 
         if data['initialization_options'].is_a? Hash
@@ -190,6 +200,10 @@ class Base
                             next if !value
                             self::DOM.from_rpc_data( value )
 
+                        when 'locator'
+                            next if !value
+                            Browser::ElementLocator.from_rpc_data( value )
+
                         when 'initialization_options'
                             value.is_a?( Hash ) ?
                                 value.my_symbolize_keys( false ) : value

data/lib/arachni/element/body.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/capabilities/analyzable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework