arachni 1.3.2 → 1.4

data/lib/arachni/uri/scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -41,8 +41,19 @@ class Scope < Arachni::Scope
     #   `false` otherwise.
     #
     # @see OptionGroups::Scope#exclude_path_patterns
+    # @see #exclude_file_extension?
     def exclude?
-        !!options.exclude_path_patterns.find { |pattern| @url.to_s =~ pattern }
+        exclude_file_extension? ||
+            !!options.exclude_path_patterns.find { |pattern| @url.to_s =~ pattern }
+    end
+
+    # @return   [Bool]
+    #   `true` if the resource extension is in {OptionGroups::Scope#@exclude_file_extensions},
+    #   `false` otherwise.
+    #
+    # @see OptionGroups::Scope#@exclude_file_extensions
+    def exclude_file_extension?
+        options.exclude_file_extensions.include? @url.resource_extension.to_s.downcase
     end
 
     # @return   [Bool]

data/lib/arachni/utilities.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -341,9 +341,24 @@ module Utilities
     # @return   [Fixnum]
     #   Random available port number.
     def available_port
-        nil while !port_available?( port = rand_port )
-        port
+        available_port_mutex.synchronize do
+            @used_ports ||= Set.new
+
+            loop do
+                port = self.rand_port
+
+                if port_available?( port ) && !@used_ports.include?( port )
+                    @used_ports << port
+                    return port
+                end
+            end
+        end
+    end
+
+    def self.available_port_mutex
+        @available_port_mutex ||= Mutex.new
     end
+    available_port_mutex
 
     # @return   [Integer]
     #   Random port within the user specified range.
@@ -367,9 +382,11 @@ module Utilities
     # @return   [Bool]
     def port_available?( port )
         begin
-            TCPServer.new( '127.0.0.1', port ).close
+            socket = ::Socket.new( :INET, :STREAM, 0 )
+            socket.bind( ::Socket.sockaddr_in( port, '127.0.0.1' ) )
+            socket.close
             true
-        rescue
+        rescue Errno::EADDRINUSE, Errno::EACCES
             false
         end
     end

data/lib/arachni/version.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/version

@@ -1 +1 @@
-1.3.2
+1.4

data/spec/arachni/browser/element_locator_spec.rb

@@ -72,17 +72,17 @@ describe Arachni::Browser::ElementLocator do
     end
 
     describe '#initialize' do
-        describe :tag_name do
+        describe ':tag_name' do
             it 'sets #tag_name' do
                 expect(described_class.new( tag_name: :a ).tag_name).to eq(:a)
             end
 
-            it 'converts it to a Sybmol' do
+            it 'converts it to a Symbol' do
                 expect(described_class.new( tag_name: 'a' ).tag_name).to eq(:a)
             end
         end
 
-        describe :attributes do
+        describe ':attributes' do
             it 'sets #attributes' do
                 expect(described_class.new( attributes: attributes ).attributes).to eq(attributes)
             end
@@ -90,19 +90,21 @@ describe Arachni::Browser::ElementLocator do
     end
 
     describe '#locate' do
-        it "returns a #{Watir} locator" do
+        it "returns a #{Selenium::WebDriver::Element} locator" do
             browser.load "#{url}/digest"
 
             l = described_class.new( tag_name: :a, attributes: { href: '#stuff'} )
             element = l.locate( browser )
-            expect(element).to be_kind_of Watir::HTMLElement
-            expect(element.exists?).to be_truthy
+            expect(element).to be_kind_of Selenium::WebDriver::Element
         end
 
         context 'when the element cannot be located' do
-            it "returns a #{Watir} locator" do
+            it "raises #{Selenium::WebDriver::Error::NoSuchElementError}" do
                 browser.load "#{url}/digest"
-                expect(subject.locate( browser ).exists?).to be_falsey
+
+                expect do
+                    subject.locate( browser )
+                end.to raise_error Selenium::WebDriver::Error::NoSuchElementError
             end
         end
     end
@@ -128,12 +130,38 @@ describe Arachni::Browser::ElementLocator do
         context 'when there are multiple attributes' do
             it 'returns a CSS locator with the attributes' do
                 expect(described_class.new(
-                    tag_name: :a,
-                    attributes: {
-                        stuff:  'blah',
-                        stuff2: 'blah2'
-                    }
-                ).css).to eq('a[stuff="blah"][stuff2="blah2"]')
+                           tag_name: :a,
+                           attributes: {
+                               stuff:  'blah',
+                               stuff2: 'blah2'
+                           }
+                       ).css).to eq('a[stuff="blah"][stuff2="blah2"]')
+            end
+
+            context 'and an ID' do
+                it 'only includes the ID' do
+                    expect(described_class.new(
+                               tag_name: :a,
+                               attributes: {
+                                   stuff:  'blah',
+                                   stuff2: 'blah2',
+                                   id:     'my-id'
+                               }
+                           ).css).to eq('a[id="my-id"]')
+                end
+            end
+
+            context 'and includes data ones' do
+                it "excludes all but #{described_class::ARACHNI_ID}" do
+                    expect(described_class.new(
+                        tag_name: :a,
+                        attributes: {
+                            'data-stuff'                => 'blah',
+                            'data-stuff2'               => 'blah2',
+                            described_class::ARACHNI_ID => 'blah3'
+                        }
+                    ).css).to eq("a[#{described_class::ARACHNI_ID}=\"blah3\"]")
+                end
             end
         end
     end

data/spec/arachni/browser/javascript/dom_monitor_spec.rb

@@ -68,7 +68,8 @@ describe Arachni::Browser::Javascript::DOMMonitor do
     describe '#digest' do
         it 'returns a string digest of the current DOM tree' do
             load '/digest'
-            expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://javascri' <<
+            expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://' <<
+                'javascript.browser.arachni/polyfills.js><SCRIPT src=http://javascri' <<
                 'pt.browser.arachni/' <<'taint_tracer.js><SCRIPT src' <<
                 '=http://javascript.browser.arachni/dom_monitor.js><SCRIPT>' <<
                 '<BODY onload=void();><DIV id=my-id-div><DIV class=my-class' <<
@@ -78,14 +79,16 @@ describe Arachni::Browser::Javascript::DOMMonitor do
 
         it 'does not include <p> elements' do
             load '/digest/p'
-            expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://javascript' <<
+            expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://' <<
+                'javascript.browser.arachni/polyfills.js><SCRIPT src=http://javascript' <<
                 '.browser.arachni/taint_tracer.js><SCRIPT src=http://' <<
                 'javascript.browser.arachni/dom_monitor.js><SCRIPT><BODY><STRONG>')
         end
 
         it "does not include 'data-arachni-id' attributes" do
             load '/digest/data-arachni-id'
-            expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://javascript' <<
+            expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://' <<
+                'javascript.browser.arachni/polyfills.js><SCRIPT src=http://javascript' <<
                 '.browser.arachni/taint_tracer.js><SCRIPT src=http://' <<
                 'javascript.browser.arachni/dom_monitor.js><SCRIPT><BODY><DIV ' <<
                 'id=my-id-div><DIV class=my-class-div>')
@@ -147,16 +150,6 @@ describe Arachni::Browser::Javascript::DOMMonitor do
             load '/elements_with_events/with-hidden'
 
             expect(subject.elements_with_events).to eq([
-                {
-                    'tag_name' => 'html',
-                    'events' => [],
-                    'attributes' => {}
-                },
-                {
-                    'tag_name' => 'body',
-                    'events' => [],
-                    'attributes' => {}
-                },
                 {
                     'tag_name' => 'button',
                     'events' => [
@@ -178,18 +171,6 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                 load '/elements_with_events/custom-dot-delimited'
 
                 expect(subject.elements_with_events).to eq([
-                    {
-                        "tag_name"   => "html",
-                        "events"     => [],
-                        "attributes" => {}
-                    },
-                    {
-                        "tag_name"   => "body",
-                        "events"     => [],
-                        "attributes" => {
-                            "style" => ""
-                        }
-                    },
                     {
                         "tag_name"   => "button",
                         "events"     =>
@@ -197,6 +178,10 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                                 [
                                     "click",
                                     "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
+                                ],
+                                [
+                                    "load",
+                                    "function () {\n\t\tdocument.removeEventListener( \"DOMContentLoaded\", completed, false );\n\t\twindow.removeEventListener( \"load\", completed, false );\n\t\tjQuery.ready();\n\t}"
                                 ]
                             ],
                         "attributes" => {
@@ -213,11 +198,6 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                     load '/elements_with_events/attributes'
 
                     expect(subject.elements_with_events).to eq([
-                        { 'tag_name' => 'html', 'events' => [], 'attributes' => {}
-                        },
-                        {
-                            'tag_name' => 'body', 'events' => [], 'attributes' => {}
-                        },
                         {
                             'tag_name'   => 'button',
                             'events'     => [],
@@ -242,11 +222,6 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                     load '/elements_with_events/listeners'
 
                     expect(subject.elements_with_events).to eq([
-                        { 'tag_name' => 'html', 'events' => [], 'attributes' => {}
-                        },
-                        {
-                            'tag_name' => 'body', 'events' => [], 'attributes' => {}
-                        },
                         {
                             'tag_name'   => 'button',
                             'events'     => [
@@ -262,281 +237,36 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                                 ['click', 'function (my_button2_click) {}']
                             ],
                             'attributes' => { 'id' => 'my-button2' }
-                        },
-                        {
-                            'tag_name' => 'button',
-                            'events' => [],
-                            'attributes' => { 'id' => 'my-button3' }
                         }
                     ])
                 end
             end
 
-            context 'jQuery' do
-                describe 'on()' do
-                    it 'returns information about all DOM elements along with their events' do
-                        load '/elements_with_events/jQuery.on'
-
-                        expect(subject.elements_with_events).to eq([
-                            {
-                                'tag_name'   => 'html',
-                                'events'     => [],
-                                'attributes' => {}
-                            },
-                            {
-                                'tag_name'   => 'body',
-                                'events'     => [],
-                                'attributes' => {
-                                    'style' => ''
-                                }
-                            },
-                            {
-                                'tag_name'   => 'button',
-                                'events'     => [
-                                    [
-                                        'click',
-                                        "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                    ]
-                                ],
-                                'attributes' => {
-                                    'id' => 'my-button'
-                                }
-                            }
-                        ])
-                    end
-
-                    context 'when using a selector' do
-                        it 'assigns the events to elements that match it' do
-                            load '/elements_with_events/jQuery.on-selector'
-
-                            expect(subject.elements_with_events).to eq([
-                                {
-                                    "tag_name"   => "html",
-                                    "events"     => [],
-                                    "attributes" => {}
-                                },
-                                {
-                                    "tag_name"   => "body",
-                                    "events"     =>
-                                        [
-                                            [
-                                                "click",
-                                                "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                            ],
-                                            [
-                                                "hover",
-                                                "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                            ]
-                                        ],
-                                    "attributes" => {
-                                        "style" => "",
-                                        "id"    => "body"
-                                    }
-                                },
-                                {
-                                    "tag_name"   => "button",
-                                    "events"     =>
-                                        [
-                                            [
-                                                "click",
-                                                "function () {\n\n            }"
-                                            ],
-                                            [
-                                                "hover",
-                                                "function () {\n\n            }"
-                                            ]
-                                        ],
-                                    "attributes" => {
-                                        "id" => "my-button"
-                                    }
-                                },
-                                {
-                                    "tag_name"   => "button",
-                                    "events"     => [
-                                        [
-                                            "click", "function () {\n\n            }"
-                                        ]
-                                    ],
-                                    "attributes" => {
-                                        "id" => "my-button-2"
-                                    }
-                                }
-                            ])
-
-                        end
-                    end
-
-                    context 'when using object types' do
-                        it 'returns information about all DOM elements along with their events' do
-                            load '/elements_with_events/jQuery.on-object-types'
-
-                            expect(subject.elements_with_events).to eq([
-                                {
-                                    "tag_name"   => "html",
-                                    "events"     => [],
-                                    "attributes" => {}
-                                },
-                                {
-                                    "tag_name"   => "body",
-                                    "events"     => [],
-                                    "attributes" => {
-                                        "style" => ""
-                                    }
-                                },
-                                {
-                                    "tag_name"   => "button",
-                                    "events"     =>
-                                        [
-                                            [
-                                                "click",
-                                                "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                            ],
-                                            [
-                                                "hover",
-                                                "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                            ]
-                                        ],
-                                    "attributes" => {
-                                        "id" => "my-button"
-                                    }
-                                }
-                            ])
-
-                        end
-
-                        context 'when using a selector' do
-                            it 'assigns the events to elements that match it' do
-                                load '/elements_with_events/jQuery.on-object-types-selector'
-
-                                pp expect(subject.elements_with_events).to eq([
-                                    {
-                                        "tag_name"   => "html",
-                                        "events"     => [],
-                                        "attributes" => {}
-                                    },
-                                    {
-                                        "tag_name"   => "body",
-                                        "events"     => [
-                                            ["click",
-                                             "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                            ],
-                                            [
-                                                "hover",
-                                                "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                            ]
-                                        ],
-                                        "attributes" => {
-                                            "id"    => "body",
-                                            "style" => ""
-                                        }
-                                    },
-                                    {
-                                        "tag_name"   => "button",
-                                        "events"     => [
-                                            [
-                                                "click", "function () {}"
-                                            ],
-                                            [
-                                                "hover", "function () {}"
-                                            ]
-                                        ],
-                                        "attributes" => {
-                                            "id" => "my-button"
-                                        }
-                                    },
-                                    {
-                                        "tag_name"   => "button",
-                                        "events"     => [],
-                                        "attributes" => {
-                                            "id" => "my-button-2"
-                                        }
-                                    }
-                                ])
-
-                            end
-                        end
-                    end
-                end
+            context 'inherited events' do
+                it 'returns information about all DOM elements along with their events' do
+                    load 'elements_with_events/inherited'
 
-                describe 'delegate()' do
-                    it 'returns information about all DOM elements along with their events' do
-                        load '/elements_with_events/jQuery.delegate'
-
-                        expect(subject.elements_with_events).to eq([
-                            {
-                                "tag_name"   => "html",
-                                "events"     => [],
-                                "attributes" => {}
-                            },
-                            {
-                                "tag_name"   => "body",
-                                "events"     =>
-                                    [
-                                        [
-                                            "click",
-                                            "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                        ]
-                                    ],
-                                "attributes" => {
-                                    "style" => "",
-                                    "id"    => "body"
-                                }
-                            },
-                            {
-                                "tag_name"   => "button",
-                                "events"     => [
-                                    [
-                                        "click",
-                                        "function () {}"
-                                    ]
-                                ],
-                                "attributes" => {
-                                    "id" => "my-button"
-                                }
-                            }
-                        ])
-
-                    end
-
-                    context 'when using object types' do
-                        it 'returns information about all DOM elements along with their events' do
-                            load '/elements_with_events/jQuery.delegate'
-
-                            expect(subject.elements_with_events).to eq([
-                                {
-                                    "tag_name"   => "html",
-                                    "events"     => [],
-                                    "attributes" => {}
-                                },
-                                {
-                                    "tag_name"   => "body",
-                                    "events"     =>
-                                        [
-                                            [
-                                                "click",
-                                                "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
-                                            ]
-                                        ],
-                                    "attributes" => {
-                                        "id"    => "body",
-                                        "style" => ""
-                                    }
-                                },
-                                {
-                                    "tag_name"   => "button",
-                                    "events"     => [
-                                        [
-                                            "click",
-                                            "function () {}"
-                                        ]
-                                    ],
-                                    "attributes" => {
-                                        "id" => "my-button"
-                                    }
-                                }
-                            ])
-                        end
-                    end
+                    expect(subject.elements_with_events).to eq([
+                       { "tag_name"   => "div",
+                         "events"     => [["click", "function (parent_click) {}"]],
+                         "attributes" => { "id" => "parent" } },
+                       { "tag_name"   => "button",
+                         "events"     => [["click", "function (parent_click) {}"],
+                                          ["click", "function (window_click) {}"],
+                                          ["click", "function (document_click) {}"]],
+                         "attributes" => { "id" => "parent-button" } },
+                       { "tag_name"   => "div",
+                         "events"     =>
+                             [["click", "function (child_click) {}"]],
+                         "attributes" => { "id" => "child" } },
+                       { "tag_name"   => "button",
+                         "events"     =>
+                             [["click", "function (parent_click) {}"],
+                              ["click", "function (child_click) {}"],
+                              ["click", "function (window_click) {}"],
+                              ["click", "function (document_click) {}"]],
+                         "attributes" => { "id" => "child-button" } }]
+                )
                 end
             end
         end