arachni 1.3.2 → 1.4

data/lib/arachni/element/form/capabilities/auditable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/form/capabilities/mutable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -87,23 +87,24 @@ module Mutable
         yield elem if !generated.include?( elem )
         generated << elem
 
-        # Default values, in case they reveal new resources.
-        if node
-            inputs.keys.each do |input|
-                next if field_type_for( input ) != :select
-
-                escape = "'#{input.split( "'" ).join( "', \"'\", '" )}', ''"
-                node.xpath( "select[@name=concat(#{escape})]" ).css('option').each do |option|
-                    try_input do
-                        elem = self.dup
-                        elem.mutation_with_original_values
-                        elem.affected_input_name  = input
-                        elem.affected_input_value = option['value'] || option.text
-                        yield elem if !generated.include?( elem )
-                        generated << elem
-                    end
+        # Default select values, in case they reveal new resources.
+        inputs.keys.each do |input|
+            next if field_type_for( input ) != :select
+
+            # We do the break inside the loop because #node is lazy parsed
+            # and we don't want to parse it unless we have a select input.
+            break if !node
+
+            escape = "'#{input.split( "'" ).join( "', \"'\", '" )}', ''"
+            node.xpath( "select[@name=concat(#{escape})]" ).css('option').each do |option|
+                try_input do
+                    elem = self.dup
+                    elem.mutation_with_original_values
+                    elem.affected_input_name  = input
+                    elem.affected_input_value = option['value'] || option.text
+                    yield elem if !generated.include?( elem )
+                    generated << elem
                 end
-
             end
         end
 

data/lib/arachni/element/form/capabilities/submittable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/form/capabilities/with_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -19,6 +19,7 @@ module WithDOM
 
     # @return   [DOM]
     def dom
+        return if skip_dom?
         return @dom if @dom
         return if !node || inputs.empty?
         super

data/lib/arachni/element/form/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -18,6 +18,7 @@ class Form
 class DOM < DOM
     include Arachni::Element::Capabilities::WithNode
 
+    include Arachni::Element::DOM::Capabilities::Locatable
     include Arachni::Element::DOM::Capabilities::Mutable
     include Arachni::Element::DOM::Capabilities::Inputtable
     include Arachni::Element::DOM::Capabilities::Submittable
@@ -35,7 +36,7 @@ class DOM < DOM
 
     # Submits the form using the configured {#inputs}.
     def trigger
-        [ browser.fire_event( element, :submit, inputs: inputs.dup ) ]
+        [ browser.fire_event( locate, :submit, inputs: inputs.dup ) ]
     end
 
     def valid_input_name?( name )

data/lib/arachni/element/generic_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/header.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -32,6 +32,9 @@ class Header < Base
     ENCODE_CHARACTERS      = ["\n", "\r"]
     ENCODE_CHARACTERS_LIST = ENCODE_CHARACTERS.join
 
+    ENCODE_CACHE = Arachni::Support::Cache::LeastRecentlyPushed.new( 1_000 )
+    DECODE_CACHE = Arachni::Support::Cache::LeastRecentlyPushed.new( 1_000 )
+
     def initialize( options )
         super( options )
 
@@ -59,13 +62,22 @@ class Header < Base
     class <<self
         def encode( str )
             str = str.to_s
-            return str if !ENCODE_CHARACTERS.find { |c| str.include? c }
 
-            ::URI.encode( str, ENCODE_CHARACTERS_LIST )
+            ENCODE_CACHE.fetch( str ) do
+                if !ENCODE_CHARACTERS.find { |c| str.include? c }
+                    str
+                else
+                    ::URI.encode( str, ENCODE_CHARACTERS_LIST )
+                end
+            end
         end
 
         def decode( header )
-            ::URI.decode( header.to_s )
+            header = header.to_s
+
+            DECODE_CACHE.fetch( header ) do
+                ::URI.decode( header )
+            end
         end
     end
 

data/lib/arachni/element/header/capabilities/inputtable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/header/capabilities/mutable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -27,7 +27,9 @@ module Mutable
     #
     # @see Capabilities::Mutable#each_mutation
     def each_mutation( payload, options = {}, &block )
+        options = options.dup
         parameter_names = options.delete( :parameter_names )
+
         super( payload, options, &block )
 
         return if !parameter_names
@@ -44,6 +46,14 @@ module Mutable
         yield elem
     end
 
+    private
+
+    def prepare_mutation_options( options )
+        options = super( options )
+        options.delete( :with_raw_payloads )
+        options
+    end
+
 end
 
 end

data/lib/arachni/element/json.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -84,7 +84,7 @@ class JSON < Base
     end
 
     def dup
-        super.tap { |e| e.inputs = @inputs.deep_clone }
+        super.tap { |e| e.inputs = @inputs.rpc_clone }
     end
 
     class <<self

data/lib/arachni/element/json/capabilities/inputtable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/json/capabilities/mutable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -56,7 +56,7 @@ module Mutable
         print_debug_formatting( options )
 
         options   = prepare_mutation_options( options )
-        generated = Arachni::Support::LookUp::HashSet.new( hasher: :mutable_id )
+        generated = Arachni::Support::LookUp::HashSet.new
 
         if options[:parameter_values]
             options[:format].each do |format|
@@ -107,6 +107,12 @@ module Mutable
 
     private
 
+    def prepare_mutation_options( options )
+        options = super( options )
+        options.delete( :with_raw_payloads )
+        options
+    end
+
     def immutable_input?( path )
         [path].flatten.each do |name|
             return true if immutables.include?( name )

data/lib/arachni/element/link.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -32,6 +32,8 @@ class Link < Base
     include Capabilities::Submittable
     include Capabilities::Auditable
 
+    DECODE_CACHE = Arachni::Support::Cache::LeastRecentlyPushed.new( 1_000 )
+
     # @param    [Hash]    options
     # @option   options [String]    :url
     #   URL of the page which includes the link.
@@ -112,9 +114,9 @@ class Link < Base
             if !document.is_a?( Nokogiri::HTML::Document )
                 document = document.to_s
 
-                return [] if !(document =~ /\?.*=/)
+                return [] if !in_html?( document )
 
-                document = Nokogiri::HTML( document )
+                document = Arachni::Parser.parse( document )
             end
 
             base_url =  begin
@@ -129,9 +131,8 @@ class Link < Base
                 href = to_absolute( link['href'], base_url )
                 next if !href
 
-                if (parsed_url = Arachni::URI( href ))
-                    next if parsed_url.scope.out?
-                end
+                next if !(parsed_url = Arachni::URI( href )) ||
+                    parsed_url.scope.out?
 
                 new(
                     url:    url.freeze,
@@ -141,12 +142,18 @@ class Link < Base
             end.compact
         end
 
+        def in_html?( html )
+            html.has_html_tag? 'a', /\?.*=/
+        end
+
         def encode( string )
             Arachni::HTTP::Request.encode string
         end
 
         def decode( *args )
-            ::URI.decode( *args )
+            DECODE_CACHE.fetch( args ) do
+                ::URI.decode( *args )
+            end
         end
     end
 

data/lib/arachni/element/link/capabilities/auditable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/link/capabilities/submittable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/link/capabilities/with_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -28,8 +28,15 @@ module WithDOM
     private
 
     def dom_data
+        return if !@source
         return @dom_data if @dom_data
         return if @dom_data == false
+
+        # Don't bother parsing the source if it doesn't have anything interesting.
+        if !(@source =~ /href=['"]?.*#.*?>/mi)
+            return @dom_data = false
+        end
+
         return if !node
 
         @dom_data ||= (self.class::DOM.data_from_node( node ) || false)

data/lib/arachni/element/link/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -22,6 +22,7 @@ class DOM < DOM
 
     # Generic element capabilities.
     include Arachni::Element::Capabilities::WithNode
+    include Arachni::Element::DOM::Capabilities::Locatable
     include Arachni::Element::DOM::Capabilities::Mutable
     include Arachni::Element::DOM::Capabilities::Inputtable
     include Arachni::Element::DOM::Capabilities::Auditable

data/lib/arachni/element/link/dom/capabilities/submittable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/link_template.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -100,11 +100,13 @@ class LinkTemplate < Base
 
     def to_rpc_data
         data = super
+        data.delete 'dom_data'
+
         return data if !@template
 
         data.merge!( 'template' => @template.source )
         data['initialization_options']['template'] = data['template']
-        data.delete 'dom_data'
+
         data
     end
 
@@ -160,7 +162,10 @@ class LinkTemplate < Base
         def from_document( url, document, templates = Arachni::Options.audit.link_templates )
             return [] if templates.empty?
 
-            document = Nokogiri::HTML( document.to_s ) if !document.is_a?( Nokogiri::HTML::Document )
+            if !document.is_a?( Nokogiri::HTML::Document )
+                document = Arachni::Parser.parse( document.to_s )
+            end
+
             base_url = begin
                 document.search( '//base[@href]' )[0]['href']
             rescue

data/lib/arachni/element/link_template/capabilities/auditable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/link_template/capabilities/inputtable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/link_template/capabilities/with_dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/link_template/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -22,6 +22,7 @@ class DOM < DOM
 
     # Generic element capabilities.
     include Arachni::Element::Capabilities::WithNode
+    include Arachni::Element::DOM::Capabilities::Locatable
     include Arachni::Element::DOM::Capabilities::Mutable
     include Arachni::Element::DOM::Capabilities::Inputtable
     include Arachni::Element::DOM::Capabilities::Auditable

data/lib/arachni/element/link_template/dom/capabilities/submittable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework