arachni 1.3.2 → 1.4

data/lib/arachni/element/path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/server.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -69,7 +69,7 @@ class Server < Base
     # @see #remote_file_exist?
     def log_remote_file_if_exists( url, silent = false, &block )
         # Make sure the URL is valid.
-        return false if !full_and_absolute_url?( url )
+        return false if !(url.start_with?( 'http://' ) || url.start_with?( 'https://' ))
 
         auditor.print_status( "Checking for #{url}" ) if !silent
         remote_file_exist?( url ) do |bool, response|
@@ -96,7 +96,7 @@ class Server < Base
     #   * `true` if everything went fine.
     def remote_file_exist?( url, &block )
         # Make sure the URL is valid.
-        return false if !full_and_absolute_url?( url )
+        return false if !(url.start_with?( 'http://' ) || url.start_with?( 'https://' ))
 
         if http.dynamic_404_handler.needs_check?( url )
 

data/lib/arachni/element/ui_form.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -39,28 +39,20 @@ class UIForm < Base
     def self.from_browser( browser, page )
         ui_forms = []
 
-        # JS not supported on page, no sense in continuing...
-        return ui_forms if !browser.javascript.supported?
-
-        # Does the page have any buttons at all?
-        if !page.has_elements?( :button ) &&
-            !page.document.xpath( "//input[@type='button']" )&&
-            !page.document.xpath( "//input[@type='submit']" )
-            return ui_forms
-        end
+        return ui_forms if !browser.javascript.supported? || !in_html?( page.body )
 
         # Does the page have any text inputs?
         inputs, opening_tags = inputs_from_page( page )
         return ui_forms if inputs.empty?
 
         # Looks like we have input groups, get buttons with events.
-        browser.each_element_with_events false do |locator, events|
+        browser.elements_with_events.each do |locator, events|
             next if !SUPPORTED_TYPES.include?( locator.tag_name )
             next if locator.tag_name == :input &&
                 locator.attributes['type'] != 'button' &&
                 locator.attributes['type'] != 'submit'
 
-            browser.filter_events( locator.tag_name, events ).each do |event, _|
+            events.each do |event, _|
                 ui_forms << new(
                     action:       page.url,
                     source:       locator.to_s,
@@ -74,24 +66,35 @@ class UIForm < Base
         ui_forms
     end
 
+    def self.in_html?( html )
+        html.has_html_tag?( 'button' ) ||
+            html.has_html_tag?( 'input', /button|submit/ )
+    end
+
     def self.inputs_from_page( page )
         opening_tags = {}
         inputs       = {}
 
-        page.document.css( 'textarea' ).each do |textarea|
-            name = node_to_name( textarea )
+        if UIInput.with_textarea_in_html?( page.body )
+            page.document.css( 'textarea' ).each do |textarea|
+                name = node_to_name( textarea )
 
-            inputs[name]       = textarea.text
-            opening_tags[name] = Arachni::Browser::ElementLocator.from_node( textarea ).to_s
+                inputs[name]       = textarea.text
+                opening_tags[name] =
+                    Arachni::Browser::ElementLocator.from_node( textarea ).to_s
+            end
         end
 
-        page.document.css( 'input' ).each do |input|
-            next if input['type'] && input['type'] != 'text'
+        if UIInput.with_input_in_html?( page.body )
+            page.document.css( 'input' ).each do |input|
+                next if input['type'] && input['type'] != 'text'
 
-            name = node_to_name( input )
+                name = node_to_name( input )
 
-            inputs[name]       = input['value'].to_s
-            opening_tags[name] = Arachni::Browser::ElementLocator.from_node( input ).to_s
+                inputs[name]       = input['value'].to_s
+                opening_tags[name] =
+                    Arachni::Browser::ElementLocator.from_node( input ).to_s
+            end
         end
 
         [inputs, opening_tags]

data/lib/arachni/element/ui_form/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -15,6 +15,7 @@ class UIForm
 class DOM < DOM
     include Arachni::Element::Capabilities::WithNode
 
+    include Arachni::Element::DOM::Capabilities::Locatable
     include Arachni::Element::DOM::Capabilities::Mutable
     include Arachni::Element::DOM::Capabilities::Inputtable
     include Arachni::Element::DOM::Capabilities::Submittable
@@ -42,10 +43,10 @@ class DOM < DOM
         transitions = fill_in_inputs
 
         print_debug "Submitting: #{self.source}"
-        submission_transition = browser.fire_event( element, @method )
+        submission_transition = browser.fire_event( locate, @method )
         print_debug "Submitted: #{self.source}"
 
-        return if !submission_transition
+        return [] if !submission_transition
 
         transitions + [submission_transition]
     end
@@ -54,6 +55,14 @@ class DOM < DOM
         @valid_input_names.include? name.to_s
     end
 
+    def coverage_id
+        "#{super}:#{@method}:#{locator}"
+    end
+
+    def id
+        "#{super}:#{@method}:#{locator}"
+    end
+
     def type
         self.class.type
     end

data/lib/arachni/element/ui_input.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,7 +12,7 @@ module Arachni::Element
 
 # @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
 class UIInput < Base
-    require_relative 'input/dom'
+    require_relative 'ui_input/dom'
 
     include Arachni::Element::Capabilities::DOMOnly
 
@@ -25,20 +25,14 @@ class UIInput < Base
     def self.from_browser( browser, page )
         inputs = []
 
-        return inputs if !browser.javascript.supported?
+        return inputs if !browser.javascript.supported? || !in_html?( page.body )
 
-        if page.document.css( 'textarea' ).empty? &&
-            page.document.xpath( '//input[@type="text"]' ).empty? &&
-                page.document.xpath( '//input[not(@type)]' ).empty?
-            return inputs
-        end
-
-        browser.each_element_with_events false do |locator, events|
+        browser.elements_with_events.each do |locator, events|
             next if !SUPPORTED_TYPES.include?( locator.tag_name )
             next if locator.attributes['type'] &&
                 locator.attributes['type'] != 'text'
 
-            browser.filter_events( locator.tag_name, events ).each do |event, _|
+            events.each do |event, _|
                 name = locator.attributes['name'] || locator.attributes['id'] ||
                     locator.to_s
 
@@ -56,6 +50,18 @@ class UIInput < Base
         inputs
     end
 
+    def self.in_html?( html )
+        with_textarea_in_html?( html ) || with_input_in_html?( html )
+    end
+
+    def self.with_textarea_in_html?( html )
+        html.has_html_tag?( 'textarea' )
+    end
+
+    def self.with_input_in_html?( html )
+        html.has_html_tag?( 'input', /text|(?!type=)/ )
+    end
+
 end
 end
 

data/lib/arachni/element/{input → ui_input}/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -15,6 +15,7 @@ class UIInput
 class DOM < DOM
     include Arachni::Element::Capabilities::WithNode
 
+    include Arachni::Element::DOM::Capabilities::Locatable
     include Arachni::Element::DOM::Capabilities::Mutable
     include Arachni::Element::DOM::Capabilities::Inputtable
     include Arachni::Element::DOM::Capabilities::Submittable
@@ -40,7 +41,7 @@ class DOM < DOM
 
     # Submits the form using the configured {#inputs}.
     def trigger
-        [ browser.fire_event( element, @method, value: value ) ]
+        [ browser.fire_event( locate, @method, value: value ) ]
     end
 
     def name
@@ -55,6 +56,14 @@ class DOM < DOM
         @valid_input_name == name.to_s
     end
 
+    def coverage_id
+        "#{super}:#{@method}:#{locator}"
+    end
+
+    def id
+        "#{super}:#{@method}:#{locator}"
+    end
+
     def type
         self.class.type
     end

data/lib/arachni/element/xml.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -60,7 +60,7 @@ class XML < Base
     #
     #   If a {#transform_xml} callback has been set, it will return its value.
     def to_xml
-        doc = Nokogiri::XML( source )
+        doc = Arachni::Parser.parse_xml( source ).dup
 
         inputs.each do |path, content|
             doc.css( path ).each do |node|
@@ -153,7 +153,7 @@ class XML < Base
         end
 
         def parse_inputs( doc )
-            doc = doc.is_a?( Nokogiri::XML ) ? doc : Nokogiri::XML( doc )
+            doc = doc.is_a?( Nokogiri::XML ) ? doc : Arachni::Parser.parse_xml( doc )
 
             inputs = {}
             doc.traverse do |node|

data/lib/arachni/element/xml/capabilities/inputtable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -17,6 +17,12 @@ module Capabilities
 module Inputtable
     include Arachni::Element::Capabilities::Inputtable
 
+    INVALID_INPUT_DATA = [ "\0" ]
+
+    def valid_input_data?( data )
+        !INVALID_INPUT_DATA.find { |c| data.include? c }
+    end
+
     # @param    [String]    name
     #   Input name.
     #

data/lib/arachni/element/xml/capabilities/mutable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -17,21 +17,15 @@ module Capabilities
 module Mutable
     include Arachni::Element::Capabilities::Mutable
 
-    # Overrides {Arachni::Element::Capabilities::Mutable#each_mutation} to handle
-    # XML-specific limitations.
-    #
-    # @param (see Arachni::Element::Capabilities::Mutable#each_mutation)
-    # @return (see Arachni::Element::Capabilities::Mutable#each_mutation)
-    # @yield (see Arachni::Element::Capabilities::Mutable#each_mutation)
-    # @yieldparam (see Arachni::Element::Capabilities::Mutable#each_mutation)
-    #
-    # @see Arachni::Element::Capabilities::Mutable#each_mutation
-    def each_mutation( payload, options = {}, &block )
+    private
+
+    def prepare_mutation_options( options )
+        options = super( options )
+        options.delete( :with_raw_payloads )
         options.delete( :parameter_names )
         options.delete( :with_extra_parameter )
-        super( payload, options, &block )
+        options
     end
-
 end
 
 end

data/lib/arachni/element_filter.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/error.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/ethon/easy.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework.rb

@@ -1,7 +1,7 @@
 # encoding: utf-8
 
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -12,20 +12,17 @@ require 'rubygems'
 require 'monitor'
 require 'bundler/setup'
 
-require 'ap'
-require 'pp'
-
 require_relative 'options'
 
 module Arachni
 
 lib = Options.paths.lib
 require lib + 'version'
+require lib + 'support'
 require lib + 'ruby'
 require lib + 'error'
 require lib + 'scope'
 require lib + 'utilities'
-require lib + 'support'
 require lib + 'uri'
 require lib + 'component'
 require lib + 'platform'

data/lib/arachni/framework/parts/audit.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -82,7 +82,13 @@ module Audit
         add_to_sitemap( page )
 
         print_line
-        print_status "[HTTP: #{page.code}] #{page.dom.url}"
+
+        if page.response.ok?
+            print_status "[HTTP: #{page.code}] #{page.dom.url}"
+        else
+            print_error "[HTTP: #{page.code}] #{page.dom.url}"
+            print_error "[#{page.response.return_code}] #{page.response.return_message}"
+        end
 
         if page.platforms.any?
             print_info "Identified as: #{page.platforms.to_a.join( ', ' )}"

data/lib/arachni/framework/parts/browser.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -114,7 +114,7 @@ module Browser
         # needs to have a clean state.
         schedule_dom_metadata_application( page )
 
-        browser_cluster.queue( browser_job.forward( resource: page ) ) do |result|
+        browser_cluster.queue( browser_job.forward( resource: page.dom.state ) ) do |result|
             handle_browser_page result.page
         end
 
@@ -131,21 +131,20 @@ module Browser
         return if !checks.values.
             find { |c| c.check? page, [Element::Form::DOM, Element::Cookie::DOM], true }
 
-        page.clear_cache
-
+        dom = page.dom.state
         browser_cluster.with_browser do |browser|
-            apply_dom_metadata( browser, page )
+            apply_dom_metadata( browser, dom )
         end
     end
 
-    def apply_dom_metadata( browser, page )
+    def apply_dom_metadata( browser, dom )
         bp = nil
 
         begin
-            bp = browser.load( page ).to_page
+            bp = browser.load( dom ).to_page
         rescue Selenium::WebDriver::Error::WebDriverError,
             Watir::Exception::Error => e
-            print_debug "Could not apply metadata to '#{page.dom.url}'" <<
+            print_debug "Could not apply metadata to '#{dom.url}'" <<
                             " because: #{e} [#{e.class}"
             return
         end
@@ -163,7 +162,7 @@ module Browser
         #
         # Also, this job should never end so that all analysis operations
         # share the same state.
-        @browser_job ||= BrowserCluster::Jobs::ResourceExploration.new(
+        @browser_job ||= BrowserCluster::Jobs::DOMExploration.new(
             never_ending: true
         )
     end