arachni 1.3.2 → 1.4

data/spec/arachni/check/auditor_spec.rb

@@ -161,7 +161,7 @@ describe Arachni::Check::Auditor do
             end
         end
 
-        context Arachni::Element::Body do
+        context 'Arachni::Element::Body' do
             before(:each) { auditor.class.info[:elements] = Arachni::Element::Body }
 
             context 'and page with a non-empty body' do
@@ -179,19 +179,19 @@ describe Arachni::Check::Auditor do
             end
         end
 
-        context Arachni::Element::GenericDOM do
+        context 'Arachni::Element::GenericDOM' do
             before(:each) { auditor.class.info[:elements] = Arachni::Element::GenericDOM }
             let(:page) { Arachni::Page.from_data( url: url, body: 'stuff' ) }
 
             context 'and Page#has_script? is' do
-                context true do
+                context 'true' do
                     it 'returns true' do
                         allow(page).to receive(:has_script?) { true }
                         expect(auditor.class.check?( page )).to be_truthy
                     end
                 end
 
-                context false do
+                context 'false' do
                     it 'returns false' do
                         allow(page).to receive(:has_script?) { false }
                         expect(auditor.class.check?( page )).to be_falsey
@@ -213,7 +213,7 @@ describe Arachni::Check::Auditor do
                 end
                 before(:each) { auditor.class.info[:elements] = [element] }
 
-                context true do
+                context 'true' do
                     before(:each) do
                         if element.type.to_s.start_with? 'link_template'
                             Arachni::Options.audit.link_templates =
@@ -247,14 +247,14 @@ describe Arachni::Check::Auditor do
                                 end
 
                                 context 'and Page#has_script? is' do
-                                    context true do
+                                    context 'true' do
                                         it 'returns true' do
                                             allow(page).to receive(:has_script?) { true }
                                             expect(auditor.class.check?( page )).to be_truthy
                                         end
                                     end
 
-                                    context false do
+                                    context 'false' do
                                         it 'returns false' do
                                             allow(page).to receive(:has_script?) { false }
                                             expect(auditor.class.check?( page )).to be_falsey
@@ -293,7 +293,7 @@ describe Arachni::Check::Auditor do
                                         e == Arachni::Element::Cookie::DOM
 
                                     context 'and Page#has_script? is' do
-                                        context true do
+                                        context 'true' do
                                             it 'returns true' do
                                                 allow(page).to receive(:has_script?) { true }
                                                 auditor.class.info[:elements] = e
@@ -301,7 +301,7 @@ describe Arachni::Check::Auditor do
                                             end
                                         end
 
-                                        context false do
+                                        context 'false' do
                                             it 'returns false' do
                                                 allow(page).to receive(:has_script?) { false }
                                                 auditor.class.info[:elements] = e
@@ -338,7 +338,7 @@ describe Arachni::Check::Auditor do
                     end
                 end
 
-                context false do
+                context 'false' do
                     before(:each) { Arachni::Options.audit.skip_elements element.type }
 
                     context "and the page contains #{element}" do
@@ -665,6 +665,15 @@ describe Arachni::Check::Auditor do
     end
 
     describe '#log' do
+        let(:issue_data) do
+            d = super()
+
+            d[:page].response.url = @opts.url
+            d.merge( page: d[:page] )
+
+            d
+        end
+
         it 'preserves the given remarks' do
             auditor.log( issue_data )
 
@@ -705,6 +714,42 @@ describe Arachni::Check::Auditor do
                 expect(issue.request).to eq(auditor.page.request)
             end
         end
+
+        context 'when the resource is out of scope' do
+            let(:issue_data) do
+                d = super()
+
+                d[:page].response.url = 'http://stuff/'
+                d.merge( page: d[:page] )
+
+                d
+            end
+
+            it 'returns nil' do
+                expect(auditor.log( issue_data )).to be_nil
+            end
+
+            it 'does not log the issue' do
+                auditor.log( issue_data )
+                expect(issues).to be_empty
+            end
+
+            context 'and the host includes the seed' do
+                let(:issue_data) do
+                    d = super()
+
+                    d[:page].response.url = "http://#{Arachni::Utilities.random_seed}.com/"
+                    d.merge( page: d[:page] )
+
+                    d
+                end
+
+                it 'does not log the issue' do
+                    auditor.log( issue_data )
+                    expect(issues).to be_any
+                end
+            end
+        end
     end
 
     describe '#audit' do
@@ -763,7 +808,7 @@ describe Arachni::Check::Auditor do
         end
 
         context 'when called with options' do
-            describe :elements do
+            describe ':elements' do
 
                 before { auditor.load_page_from( @url + '/elem_combo' ) }
 
@@ -844,7 +889,7 @@ describe Arachni::Check::Auditor do
                 end
             end
 
-            describe :train do
+            describe ':train' do
                 context 'default' do
                     it 'parses the responses of forms submitted with their default values and feed any new elements back to the framework to be audited' do
                         # page feedback queue
@@ -870,7 +915,7 @@ describe Arachni::Check::Auditor do
                     end
                 end
 
-                context true do
+                context 'true' do
                     it 'parses all responses and feed any new elements back to the framework to be audited' do
                         # page feedback queue
                         pages = [ Arachni::Page.from_url( @url + '/train/true' ) ]
@@ -896,7 +941,7 @@ describe Arachni::Check::Auditor do
                     end
                 end
 
-                context false do
+                context 'false' do
                     it 'skips analysis' do
                         # page feedback queue
                         page = Arachni::Page.from_url( @url + '/train/true' )
@@ -984,7 +1029,7 @@ describe Arachni::Check::Auditor do
             end
 
             context 'and the resource is a' do
-                context String do
+                context 'String' do
                     it 'loads the URL and traces the taint' do
                         pages = []
                         auditor.trace_taint( url, taint: taint ) do |page|
@@ -997,7 +1042,7 @@ describe Arachni::Check::Auditor do
                     end
                 end
 
-                context Arachni::HTTP::Response do
+                context 'Arachni::HTTP::Response' do
                     it 'loads it and traces the taint' do
                         pages = []
 
@@ -1012,7 +1057,7 @@ describe Arachni::Check::Auditor do
                     end
                 end
 
-                context Arachni::Page do
+                context 'Arachni::Page' do
                     it 'loads it and traces the taint' do
                         pages = []
 
@@ -1036,7 +1081,7 @@ describe Arachni::Check::Auditor do
                 end
 
                 context 'and the resource is a' do
-                    context String do
+                    context 'String' do
                         it 'loads the URL and traces the taint' do
                             pages = []
                             auditor.trace_taint( url,
@@ -1051,7 +1096,7 @@ describe Arachni::Check::Auditor do
                         end
                     end
 
-                    context Arachni::HTTP::Response do
+                    context 'Arachni::HTTP::Response' do
                         it 'loads it and traces the taint' do
                             pages = []
                             auditor.trace_taint( Arachni::HTTP::Client.get( url, mode: :sync ),
@@ -1066,7 +1111,7 @@ describe Arachni::Check::Auditor do
                         end
                     end
 
-                    context Arachni::Page do
+                    context 'Arachni::Page' do
                         it 'loads it and traces the taint' do
                             pages = []
                             auditor.trace_taint( Arachni::Page.from_url( url ),
@@ -1091,7 +1136,7 @@ describe Arachni::Check::Auditor do
             end
 
             context 'and the resource is a' do
-                context String do
+                context 'String' do
                     it 'loads the URL and traces the taint' do
                         pages = []
                         auditor.trace_taint( url ) do |page|
@@ -1104,7 +1149,7 @@ describe Arachni::Check::Auditor do
                     end
                 end
 
-                context Arachni::HTTP::Response do
+                context 'Arachni::HTTP::Response' do
                     it 'loads it and traces the taint' do
                         pages = []
                         auditor.trace_taint( Arachni::HTTP::Client.get( url, mode: :sync ) ) do |page|
@@ -1117,7 +1162,7 @@ describe Arachni::Check::Auditor do
                     end
                 end
 
-                context Arachni::Page do
+                context 'Arachni::Page' do
                     it 'loads it and traces the taint' do
                         pages = []
                         auditor.trace_taint( Arachni::Page.from_url( url ) ) do |page|
@@ -1135,7 +1180,7 @@ describe Arachni::Check::Auditor do
         context 'when the block returns' do
             let(:url) { Arachni::Utilities.normalize_url( web_server_url_for( :browser )  ) + 'explore' }
 
-            context true do
+            context 'true' do
                 it 'marks the job as done' do
                     calls = 0
                     auditor.trace_taint( url ) do
@@ -1147,7 +1192,7 @@ describe Arachni::Check::Auditor do
                 end
             end
 
-            context false do
+            context 'false' do
                 it 'allows the job to continue' do
                     calls = 0
                     auditor.trace_taint( url ) do

data/spec/arachni/component/manager_spec.rb

@@ -38,21 +38,21 @@ describe Arachni::Component::Manager do
     describe '#load' do
         context 'when passed a' do
 
-            context String do
+            context 'String' do
                 it 'loads the component by name' do
                     @components.load( 'wait' )
                     expect(@components.loaded).to eq(%w(wait))
                 end
             end
 
-            context Symbol do
+            context 'Symbol' do
                 it 'loads the component by name' do
                     @components.load( :wait )
                     expect(@components.loaded).to eq(%w(wait))
                 end
             end
 
-            context Array do
+            context 'Array' do
                 it 'loads the components by name' do
                     @components.load( %w(bad distributable) )
                     expect(@components.loaded.sort).to eq(%w(bad distributable).sort)
@@ -60,21 +60,21 @@ describe Arachni::Component::Manager do
             end
 
             context 'vararg' do
-                context String do
+                context 'String' do
                     it 'loads components by name' do
                         @components.load( 'wait', 'bad' )
                         expect(@components.loaded.sort).to eq(%w(bad wait).sort)
                     end
                 end
 
-                context Symbol do
+                context 'Symbol' do
                     it 'loads components by name' do
                         @components.load :wait, :distributable
                         expect(@components.loaded.sort).to eq(%w(wait distributable).sort)
                     end
                 end
 
-                context Array do
+                context 'Array' do
                     it 'loads components by name' do
                         @components.load( :wait, %w(bad distributable) )
                         expect(@components.loaded.sort).to eq(%w(bad distributable wait).sort)
@@ -92,8 +92,8 @@ describe Arachni::Component::Manager do
 
                 context 'with a category name' do
                     it 'loads all of its components' do
-                        @components.load( 'plugins/*' )
-                        expect(@components.loaded.sort).to eq(@components.available.sort)
+                        @components.load( 'defaults/*' )
+                        expect(@components.loaded.sort).to eq(%w(default))
                     end
                 end
 
@@ -153,7 +153,7 @@ describe Arachni::Component::Manager do
                 end
             end
 
-            context String do
+            context 'String' do
                 it 'loads components whose tags include the given tag (as either a String or a Symbol)' do
                     expect(@components.empty?).to be_truthy
 
@@ -176,7 +176,7 @@ describe Arachni::Component::Manager do
                 end
             end
 
-            context Symbol do
+            context 'Symbol' do
                 it 'loads components whose tags include the given tag (as either a String or a Symbol)' do
                     expect(@components.empty?).to be_truthy
 
@@ -198,7 +198,7 @@ describe Arachni::Component::Manager do
                 end
             end
 
-            context Array do
+            context 'Array' do
                 it 'loads components which include any of the given tags (as either Strings or a Symbols)' do
                     expect(@components.empty?).to be_truthy
 
@@ -223,19 +223,19 @@ describe Arachni::Component::Manager do
     describe '#parse' do
         context 'when passed a' do
 
-            context String do
+            context 'String' do
                 it 'returns an array including the component\'s name' do
                     expect(@components.parse( 'wait' )).to eq(%w(wait))
                 end
             end
 
-            context Symbol do
+            context 'Symbol' do
                 it 'returns an array including the component\'s name' do
                     expect(@components.parse( :wait )).to eq(%w(wait))
                 end
             end
 
-            context Array do
+            context 'Array' do
                 it 'loads the component by name' do
                     expect(@components.parse( %w(bad distributable) ).sort).to eq(
                         %w(bad distributable).sort
@@ -252,10 +252,9 @@ describe Arachni::Component::Manager do
 
                 context 'with a category name' do
                     it 'returns all of its components' do
-                        expect(@components.parse( 'plugins/*' ).sort).to eq(@components.available.sort)
+                        expect(@components.parse( 'defaults/*' ).sort).to eq(%w(default))
                     end
                 end
-
             end
 
             context 'exclusion filter (-)' do
@@ -346,14 +345,14 @@ describe Arachni::Component::Manager do
 
     describe '#[]' do
         context 'when passed a' do
-            context String do
+            context 'String' do
                 it 'should load and return the component' do
                     expect(@components.loaded).to be_empty
                     expect(@components['wait'].name).to eq('Arachni::Plugins::Wait')
                     expect(@components.loaded).to eq(%w(wait))
                 end
             end
-            context Symbol do
+            context 'Symbol' do
                 it 'should load and return the component' do
                     expect(@components.loaded).to be_empty
                     expect(@components[:wait].name).to eq('Arachni::Plugins::Wait')
@@ -365,7 +364,7 @@ describe Arachni::Component::Manager do
 
     describe '#include?' do
         context 'when passed a' do
-            context String do
+            context 'String' do
                 context 'when the component has been loaded' do
                     it 'returns true' do
                         expect(@components.loaded).to be_empty
@@ -383,7 +382,7 @@ describe Arachni::Component::Manager do
                     end
                 end
             end
-            context Symbol do
+            context 'Symbol' do
                 context 'when the component has been loaded' do
                     it 'returns true' do
                         expect(@components.loaded).to be_empty

data/spec/arachni/data/framework/rpc_spec.rb

@@ -41,7 +41,7 @@ describe Arachni::Data::Framework::RPC do
 
             pages = []
             Dir["#{dump_directory}/distributed_page_queue/*"].each do |page_file|
-                pages << Marshal.load( IO.read( page_file ) )
+                pages << Marshal.load( IO.binread( page_file ) )
             end
             expect(pages).to eq([page, page])
         end

data/spec/arachni/data/framework_spec.rb

@@ -166,7 +166,7 @@ describe Arachni::Data::Framework do
 
             pages = []
             Dir["#{dump_directory}/page_queue/*"].each do |page_file|
-                pages << Marshal.load( IO.read( page_file ) )
+                pages << Marshal.load( IO.binread( page_file ) )
             end
             expect(pages).to eq([page, page])
         end

data/spec/arachni/data/issues_spec.rb

@@ -200,7 +200,7 @@ describe Arachni::Data::Issues do
         context 'when it does not includes the given issue' do
             it 'returns true' do
                 subject << active_issue
-                expect(subject).not_to include issue
+                expect(subject.include?(issue)).to be_falsey
             end
         end
     end
@@ -252,7 +252,7 @@ describe Arachni::Data::Issues do
                 issue_path = "#{dump_directory}/issue_#{issue.digest}"
                 expect(File.exists?( issue_path )).to be_truthy
 
-                loaded_issue = Marshal.load( IO.read( issue_path ) )
+                loaded_issue = Marshal.load( IO.binread( issue_path ) )
                 expect(issue).to eq(loaded_issue)
             end
         end
@@ -261,7 +261,7 @@ describe Arachni::Data::Issues do
             unsorted_issues.each { |i| subject << i }
             subject.dump( dump_directory )
 
-            expect(subject.digests).to eq(Marshal.load( IO.read( "#{dump_directory}/digests" ) ))
+            expect(subject.digests).to eq(Marshal.load( IO.binread( "#{dump_directory}/digests" ) ))
         end
     end