arachni 1.3.2 → 1.4

data/spec/arachni/browser/javascript/polyfills_spec.rb

@@ -0,0 +1,35 @@
+require 'spec_helper'
+
+describe 'Arachni::Browser::Javascript::Polyfiils' do
+
+    before( :all ) do
+        @url = Arachni::Utilities.normalize_url( web_server_url_for( :browser ) )
+    end
+
+    before( :each ) do
+        @browser = Arachni::Browser.new
+        @browser.load @url
+    end
+
+    after( :each ) do
+        @browser.shutdown
+    end
+
+    subject { @browser.javascript }
+
+    describe 'Function.prototype.bind' do
+        it 'is implemented' do
+            expect(subject.run(
+                <<EOJS
+this.x = 9;
+var module = {
+    x: 81,
+    getX: function() { return this.x; }
+};
+return module.getX.bind( module )()
+EOJS
+            )).to eq 81
+        end
+    end
+
+end

data/spec/arachni/browser/javascript/taint_tracer_spec.rb

@@ -63,7 +63,17 @@ describe Arachni::Browser::Javascript::TaintTracer do
                 taint1 = 'taint1'
                 taint2 = 'taint2'
 
-                @javascript.custom_code = @taint_tracer.stub.function( :taints=, [taint1, taint2] )
+                @javascript.custom_code = @taint_tracer.stub.function(
+                    :taints=,
+                    {
+                        taint1 => {
+                            trace: true
+                        },
+                        taint2 => {
+                            trace: true
+                        }
+                    }
+                )
 
                 load "/data_trace/multiple-taints?taint1=#{taint1}&taint2=#{taint2}"
 
@@ -1198,8 +1208,8 @@ describe Arachni::Browser::Javascript::TaintTracer do
 
     describe '#taints' do
         context 'by default' do
-            it 'returns []' do
-                expect(subject.taints).to eq([])
+            it 'returns {' do
+                expect(subject.taints).to eq({})
             end
         end
     end
@@ -1235,6 +1245,8 @@ describe Arachni::Browser::Javascript::TaintTracer do
 
     describe '#data_flow_sinks' do
         it 'returns sink data' do
+            @javascript.taint = 'taint'
+
             load "debug?input=#{subject.stub.function(:log_data_flow_sink, 'taint', { function: 'blah' })}"
             @browser.watir.form.submit
             expect(subject.data_flow_sinks['taint']).to be_any
@@ -1248,6 +1260,10 @@ describe Arachni::Browser::Javascript::TaintTracer do
     end
 
     describe '#flush_data_flow_sinks' do
+        before do
+            @javascript.taint = 'taint'
+        end
+
         it 'returns sink data' do
             load "debug?input=#{subject.stub.function(:log_data_flow_sink, 'taint', { function: { name: 'blah' } })}"
             @browser.watir.form.submit
@@ -1278,7 +1294,7 @@ describe Arachni::Browser::Javascript::TaintTracer do
         end
 
         it 'empties the sink' do
-            load "debug?input=#{subject.stub.function(:log_data_flow_sink, { function: { name: 'blah' } })}"
+            load "debug?input=#{subject.stub.function(:log_data_flow_sink, 'taint', { function: { name: 'blah' } })}"
             @browser.watir.form.submit
             subject.flush_data_flow_sinks
             expect(subject.data_flow_sinks).to be_empty
@@ -1370,6 +1386,10 @@ describe Arachni::Browser::Javascript::TaintTracer do
     end
 
     describe '#log_data_flow_sink' do
+        before do
+            @javascript.taint = 'taint'
+        end
+
         it 'logs a sink' do
             load "debug?input=#{subject.stub.function(:log_data_flow_sink, 'taint', { function: { name: 'blah' } })}"
             @browser.watir.form.submit

data/spec/arachni/browser/javascript_spec.rb

@@ -14,6 +14,7 @@ describe Arachni::Browser::Javascript do
     after( :each ) do
         Arachni::Options.reset
         @browser.shutdown
+        Arachni::Browser.asset_domains.clear
     end
 
     subject { @browser.javascript }
@@ -21,11 +22,25 @@ describe Arachni::Browser::Javascript do
     describe '.events_for' do
         it 'returns events for the given element' do
             described_class::EVENTS_PER_ELEMENT.each do |element, events|
-                expect(described_class.events_for( element )).to eq(described_class::GLOBAL_EVENTS | events)
+                expect(described_class.events_for( element )).to eq(Set.new(described_class::GLOBAL_EVENTS | events))
             end
         end
     end
 
+    describe '.select_events' do
+        it 'selects only events valid for the given element' do
+            events = {
+                onclick:   'blah();',
+                mouseover: 'blah2();',
+                onselect:  'my-id'
+            }
+            expect(described_class.select_events( :div, events )).to eq({
+                onclick:   'blah();',
+                mouseover: 'blah2();',
+            })
+        end
+    end
+
     describe '.select_event_attributes' do
         it 'selects only attributes that are events' do
             attributes = {
@@ -157,28 +172,25 @@ describe Arachni::Browser::Javascript do
                 @browser.load @dom_monitor_url + 'elements_with_events/attributes'
 
                 expect(subject.dom_elements_with_events).to eq([
-                    {
-                        'tag_name' => 'body', 'events' => [], 'attributes' => {}
-                    },
                     {
                         'tag_name'   => 'button',
-                        'events'     => [
-                            [:onclick, 'handler_1()']
-                        ],
+                        'events'     => {
+                            onclick: [ 'handler_1()' ]
+                        },
                         'attributes' => { 'onclick' => 'handler_1()', 'id' => 'my-button' }
                     },
                     {
                         'tag_name'   => 'button',
-                        'events'     => [
-                            [:onclick, 'handler_2()']
-                        ],
+                        'events'     => {
+                            onclick: ['handler_2()']
+                        },
                         'attributes' => { 'onclick' => 'handler_2()', 'id' => 'my-button2' }
                     },
                     {
                         'tag_name'   => 'button',
-                        'events'     => [
-                            [:onclick, 'handler_3()']
-                        ],
+                        'events'     => {
+                            onclick: ['handler_3()']
+                        },
                         'attributes' => { 'onclick' => 'handler_3()', 'id' => 'my-button3' }
                     }
                 ])
@@ -190,44 +202,25 @@ describe Arachni::Browser::Javascript do
                 @browser.load @dom_monitor_url + 'elements_with_events/listeners'
 
                 expect(subject.dom_elements_with_events).to eq([
-                    {
-                        'tag_name' => 'body', 'events' => [], 'attributes' => {}
-                    },
                     {
                         'tag_name'   => 'button',
-                        'events'     => [
-                            [:click, 'function (my_button_click) {}'],
-                            [:click, 'function (my_button_click2) {}'],
-                            [:onmouseover, 'function (my_button_onmouseover) {}']
-                        ],
+                        'events'     => {
+                            click: ['function (my_button_click) {}', 'function (my_button_click2) {}'],
+                            onmouseover: ['function (my_button_onmouseover) {}']
+                        },
                         'attributes' => { 'id' => 'my-button' } },
                     {
                         'tag_name'   => 'button',
-                        'events'     => [
-                            [:click, 'function (my_button2_click) {}']
-                        ],
-                        'attributes' => { 'id' => 'my-button2' } },
-                    {
-                        'tag_name'   => 'button',
-                        'events'     => [],
-                        'attributes' => { 'id' => 'my-button3' }
-                    }
+                        'events'     => {
+                            click: ['function (my_button2_click) {}']
+                        },
+                        'attributes' => { 'id' => 'my-button2' } }
                 ])
             end
 
             it 'does not include custom events' do
                 @browser.load @dom_monitor_url + 'elements_with_events/listeners/custom'
-
-                expect(subject.dom_elements_with_events).to eq([
-                    {
-                        'tag_name' => 'body', 'events' => [], 'attributes' => {}
-                    },
-                    {
-                        'tag_name'   => 'button',
-                        'events'     => [],
-                        'attributes' => { 'id' => 'my-button' }
-                    }
-                ])
+                expect(subject.dom_elements_with_events).to be_empty
             end
         end
     end
@@ -246,6 +239,52 @@ describe Arachni::Browser::Javascript do
         end
     end
 
+    describe '#has_sinks?' do
+        context 'when there are execution-flow sinks' do
+            it 'returns true' do
+                expect(subject).to_not have_sinks
+
+                @browser.load "#{@taint_tracer_url}/debug?input=#{subject.log_execution_flow_sink_stub(1)}"
+                @browser.watir.form.submit
+
+                expect(subject).to have_sinks
+            end
+        end
+
+        context 'when there are data-flow sinks' do
+            context 'for the given taint' do
+                it 'returns true' do
+                    expect(subject).to_not have_sinks
+
+                    subject.taint = 'taint'
+                    @browser.load "#{@taint_tracer_url}/debug?input=#{subject.log_data_flow_sink_stub( subject.taint, function: { name: 'blah' } )}"
+                    @browser.watir.form.submit
+
+                    expect(subject).to have_sinks
+                end
+            end
+
+            context 'for other taints' do
+                it 'returns false' do
+                    expect(subject).to_not have_sinks
+
+                    subject.taint = 'taint'
+                    @browser.load "#{@taint_tracer_url}/debug?input=#{subject.log_data_flow_sink_stub( subject.taint, function: { name: 'blah' } )}"
+                    @browser.watir.form.submit
+
+                    subject.taint = 'taint2'
+                    expect(subject).to_not have_sinks
+                end
+            end
+        end
+
+        context 'when there are no sinks' do
+            it 'returns false' do
+                expect(subject).to_not have_sinks
+            end
+        end
+    end
+
     describe '#debugging_data' do
         it 'returns debugging information' do
             @browser.load "#{@taint_tracer_url}/debug?input=#{subject.debug_stub(1)}"
@@ -425,17 +464,6 @@ EOHTML
                 it 'appends a semicolon and newline to the body' do
                     expect(injected.body).to include "#{response.body};\n"
                 end
-
-                it 'updates the Content-Length' do
-                    old_content_length = response.headers['content-length'].to_i
-
-                    subject.inject( response )
-
-                    new_content_length = response.headers['content-length'].to_i
-
-                    expect(new_content_length).to be > old_content_length
-                    expect(new_content_length).to eq(response.body.bytesize)
-                end
             end
 
             context 'HTML' do
@@ -452,17 +480,6 @@ EOHTML
                     )
                 end
 
-                it 'updates the Content-Length' do
-                    old_content_length = response.headers['content-length'].to_i
-
-                    subject.inject( response )
-
-                    new_content_length = response.headers['content-length'].to_i
-
-                    expect(new_content_length).to be > old_content_length
-                    expect(new_content_length).to eq(response.body.bytesize)
-                end
-
                 context 'when the response does not already contain the JS code' do
                     it 'injects the system\'s JS interfaces in the response body' do
                         subject.inject( response )
@@ -506,11 +523,17 @@ EOHTML
                         subject.inject( response )
 
                         presponse = response.deep_clone
-                        pintializer = subject.taint_tracer.stub.function( :initialize, [] )
+                        pintializer = subject.taint_tracer.stub.function( :initialize, {} )
 
                         subject.taint = [ 'taint1', 'taint2' ]
                         subject.inject( response )
-                        intializer = subject.taint_tracer.stub.function( :initialize, subject.taint )
+                        intializer = subject.taint_tracer.stub.function(
+                            :initialize,
+                            {
+                                "taint1" => { "stop_at_first" => false, "trace" => true },
+                                "taint2" => { "stop_at_first" => false, "trace" => true }
+                            }
+                        )
 
                         expect(response.body).to eq(presponse.body.gsub( pintializer, intializer ))
                     end
@@ -555,6 +578,10 @@ EOHTML
             it 'returns false'
         end
 
+        context 'when it starts with an HTML doctype' do
+            it 'returns true'
+        end
+
         context 'when it matches the last loaded URL' do
             it 'returns true'
         end

data/spec/arachni/browser_cluster/job_spec.rb

@@ -100,21 +100,21 @@ describe Arachni::BrowserCluster::Job do
         subject { JobTest.new }
 
         context 'when #never_ending is' do
-            context true do
+            context 'true' do
                 it 'returns true' do
                     subject.never_ending = true
                     expect(subject.never_ending?).to be_truthy
                 end
             end
 
-            context false do
+            context 'false' do
                 it 'returns false' do
                     subject.never_ending = false
                     expect(subject.never_ending?).to be_falsey
                 end
             end
 
-            context nil do
+            context 'nil' do
                 it 'returns false' do
                     expect(subject.never_ending?).to be_falsey
                 end

data/spec/arachni/browser_cluster/jobs/{resource_exploration → dom_exploration}/event_trigger/result_spec.rb

@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe Arachni::BrowserCluster::Jobs::ResourceExploration::EventTrigger::Result do
+describe Arachni::BrowserCluster::Jobs::DOMExploration::EventTrigger::Result do
     subject { described_class.new }
     it { is_expected.to respond_to :page }
     it { is_expected.to respond_to :page= }

data/spec/arachni/browser_cluster/jobs/{resource_exploration → dom_exploration}/event_trigger_spec.rb

@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe Arachni::BrowserCluster::Jobs::ResourceExploration::EventTrigger do
+describe Arachni::BrowserCluster::Jobs::DOMExploration::EventTrigger do
     before do
         @cluster = Arachni::BrowserCluster.new
 
@@ -40,13 +40,13 @@ describe Arachni::BrowserCluster::Jobs::ResourceExploration::EventTrigger do
     end
 
     context 'when the resource is a' do
-        context String do
+        context 'String' do
             it 'loads the URL and triggers the given event on the given element' do
                 test described_class.new( resource: url, event: event, element: element )
             end
         end
 
-        context Arachni::HTTP::Response do
+        context 'Arachni::HTTP::Response' do
             it 'loads it and triggers the given event on the given element' do
                 test described_class.new(
                          resource: Arachni::HTTP::Client.get( url, mode: :sync ),
@@ -56,7 +56,7 @@ describe Arachni::BrowserCluster::Jobs::ResourceExploration::EventTrigger do
             end
         end
 
-        context Arachni::Page do
+        context 'Arachni::Page' do
             it 'loads it and triggers the given event on the given element' do
                 test described_class.new(
                     resource: Arachni::Page.from_url( url ),

data/spec/arachni/browser_cluster/jobs/{resource_exploration → dom_exploration}/result_spec.rb

@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe Arachni::BrowserCluster::Jobs::ResourceExploration::Result do
+describe Arachni::BrowserCluster::Jobs::DOMExploration::Result do
     subject { described_class.new }
     it { is_expected.to respond_to :page }
     it { is_expected.to respond_to :page= }

data/spec/arachni/browser_cluster/jobs/{resource_exploration_spec.rb → dom_exploration_spec.rb}

@@ -1,6 +1,6 @@
 require 'spec_helper'
 
-describe Arachni::BrowserCluster::Jobs::ResourceExploration do
+describe Arachni::BrowserCluster::Jobs::DOMExploration do
     before { @cluster = Arachni::BrowserCluster.new }
 
     let(:url) do
@@ -31,13 +31,13 @@ describe Arachni::BrowserCluster::Jobs::ResourceExploration do
     end
 
     context 'when the resource is a' do
-        context String do
+        context 'String' do
             it 'loads the URL and explores the DOM' do
                 test described_class.new( resource: url )
             end
         end
 
-        context Arachni::HTTP::Response do
+        context 'Arachni::HTTP::Response' do
             subject do
                 described_class.new(
                     resource: Arachni::HTTP::Client.get( url, mode: :sync )
@@ -59,7 +59,7 @@ describe Arachni::BrowserCluster::Jobs::ResourceExploration do
             end
         end
 
-        context Arachni::Page do
+        context 'Arachni::Page' do
             subject { described_class.new( resource: Arachni::Page.from_url( url ) ) }
 
             it 'loads it and explores the DOM' do