arachni 1.3.2 → 1.4

data/spec/arachni/element/capabilities/analyzable/differential_spec.rb

@@ -190,6 +190,50 @@ describe Arachni::Element::Capabilities::Analyzable::Differential do
                 expect(issues).to be_empty
             end
         end
+
+        context 'when a true response is incomplete' do
+            let(:url) { @url + '/partial_true' }
+
+            it 'does not log any issues' do
+                subject.differential_analysis( @opts )
+                auditor.http.run
+
+                expect(issues).to be_empty
+            end
+        end
+
+        context 'when a true response is incomplete' do
+            let(:url) { @url + '/partial_false' }
+
+            it 'does not log any issues' do
+                subject.differential_analysis( @opts )
+                auditor.http.run
+
+                expect(issues).to be_empty
+            end
+        end
+
+        context 'when a true response is incomplete' do
+            let(:url) { @url + '/partial_stream_true' }
+
+            it 'does not log any issues' do
+                subject.differential_analysis( @opts )
+                auditor.http.run
+
+                expect(issues).to be_empty
+            end
+        end
+
+        context 'when a true response is incomplete' do
+            let(:url) { @url + '/partial_stream_false' }
+
+            it 'does not log any issues' do
+                subject.differential_analysis( @opts )
+                auditor.http.run
+
+                expect(issues).to be_empty
+            end
+        end
     end
 
 end

data/spec/arachni/element/capabilities/analyzable/signature_spec.rb

@@ -49,7 +49,7 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                     php:     @seed,
                 }
 
-                @positive.signature_analysis( payloads, substring: @seed )
+                @positive.signature_analysis( payloads, signature: @seed )
                 @auditor.http.run
                 expect(issues.size).to eq(1)
                 issue = issues.first
@@ -67,24 +67,40 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
         end
 
         context 'when called with option' do
-            describe :regexp do
-                context String do
+            describe ':signatures' do
+                context 'String' do
                     it 'tries to match the provided pattern' do
-                        @positive.signature_analysis( @seed,
-                                                  regexp: @seed,
-                                                  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
+                        @positive.signature_analysis(
+                            @seed,
+                            signatures: @seed,
+                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
+                        )
+                        @auditor.http.run
+                        expect(issues.size).to eq(1)
+                        expect(issues.first.vector.seed).to eq(@seed)
+                    end
+                end
+
+                context 'String' do
+                    it 'tries to match the provided pattern' do
+                        @positive.signature_analysis(
+                            @seed,
+                            signatures: Regexp.new( @seed ),
+                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
                         )
                         @auditor.http.run
                         expect(issues.size).to eq(1)
                         expect(issues.first.vector.seed).to eq(@seed)
+                        expect(issues.first).to be_trusted
                     end
                 end
 
-                context Array do
+                context 'Array' do
                     it 'tries to match the provided patterns' do
-                        @positive.signature_analysis( @seed,
-                                                  regexp: [@seed],
-                                                  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
+                        @positive.signature_analysis(
+                            @seed,
+                            signatures: [@seed],
+                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
                         )
                         @auditor.http.run
                         expect(issues.size).to eq(1)
@@ -92,7 +108,7 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                     end
                 end
 
-                context Hash do
+                context 'Hash' do
                     it 'assigns the relevant platform to the issue' do
                         regexps = {
                             windows: /#{@seed} w.*/,
@@ -101,7 +117,7 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
 
                         @positive.signature_analysis(
                             "#{@seed} windows",
-                            regexp: regexps.dup,
+                            signatures: regexps.dup,
                             format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
                         )
 
@@ -136,7 +152,7 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
 
                             @positive.signature_analysis(
                                 payloads.dup,
-                                regexp: regexps.dup,
+                                signatures: regexps.dup,
                                 format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
                             )
 
@@ -167,7 +183,7 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
 
                                 @positive.signature_analysis(
                                     payloads.dup,
-                                    regexp: regexps.dup,
+                                    signatures: regexps.dup,
                                     format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
                                 )
 
@@ -186,152 +202,19 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                 context 'when the page matches the regexp even before we audit it' do
                     it 'does not log an issue' do
                         @positive.signature_analysis( 'Inject here',
-                            regexp: 'Inject he[er]',
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
-                        )
-                        @auditor.http.run
-                        expect(issues).to be_empty
-                    end
-                end
-            end
-
-            describe :substring do
-                context String do
-                    it 'tries to match the provided pattern' do
-                        @positive.signature_analysis( @seed,
-                                                  substring: @seed,
-                                                  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
-                        )
-                        @auditor.http.run
-                        expect(issues.size).to eq(1)
-                        expect(issues.first.vector.seed).to eq(@seed)
-                        expect(issues.first).to be_trusted
-                    end
-                end
-
-                context Array do
-                    it 'tries to match the provided patterns' do
-                        @positive.signature_analysis( @seed,
-                                                  substring: [@seed],
-                                                  format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
-                        )
-                        @auditor.http.run
-                        expect(issues.size).to eq(1)
-                        expect(issues.first.vector.seed).to eq(@seed)
-                        expect(issues.first).to be_trusted
-                    end
-                end
-
-                context Hash do
-                    it 'assigns the relevant platform to the issue' do
-                        substrings = {
-                            windows: "#{@seed} w",
-                            php:     "#{@seed} p",
-                        }
-
-                        @positive.signature_analysis(
-                            "#{@seed} windows",
-                            substring: substrings.dup,
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
-                        )
-
-                        @auditor.http.run
-
-                        expect(issues.size).to eq(1)
-                        expect(issues[0].platform_name).to eq(:windows)
-                        expect(issues[0].signature).to eq(substrings[:windows].to_s)
-                        expect(issues[0]).to be_trusted
-                    end
-
-                    context 'when the payloads are per platform' do
-                        it 'only tries to matches the regexps for that platform' do
-                            issues = []
-                            Arachni::Data.issues.on_new_pre_deduplication do |issue|
-                                issues << issue
-                            end
-
-                            payloads = {
-                                windows: "#{@seed} windows",
-                                php:     "#{@seed} php",
-                                asp:     "#{@seed} asp"
-                            }
-
-                            substrings = {
-                                windows: "#{@seed} w",
-                                php:     "#{@seed} p",
-
-                                # Can match all but should only match
-                                # against responses of the ASP payload.
-                                asp:     @seed
-                            }
-
-                            @positive.signature_analysis(
-                                payloads.dup,
-                                substring: substrings.dup,
-                                format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
-                            )
-
-                            @auditor.http.run
-
-                            expect(issues.size).to eq(3)
-                            payloads.keys.each do |platform|
-                                issue = issues.find{ |i| i.platform_name == platform }
-
-                                expect(issue.vector.seed).to eq(payloads[platform])
-                                expect(issue.platform_name).to eq(platform)
-                                expect(issue.signature).to eq(substrings[platform].to_s)
-                                expect(issue).to be_trusted
-                            end
-                        end
-                    end
-                end
-
-                context 'when the page includes the substring even before we audit it' do
-                    it 'does not log any issues' do
-                        @positive.signature_analysis( 'Inject here',
-                            regexp: 'Inject here',
+                            signatures: 'Inject he[er]',
                             format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
                         )
                         @auditor.http.run
                         expect(issues).to be_empty
                     end
                 end
-
-                context 'when there is not a payload for the substring platform' do
-                    it 'matches against all payload responses and assigns the pattern platform to the issue' do
-                        payloads = {
-                            windows: "#{@seed} windows",
-                            php:     "#{@seed} php",
-                        }
-
-                        substrings = {
-                            # Can match all but should only match
-                            # against responses of the ASP payload.
-                            asp: @seed
-                        }
-
-                        @positive.signature_analysis(
-                            payloads.dup,
-                            substring: substrings.dup,
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
-                        )
-
-                        @auditor.http.run
-
-                        expect(issues.size).to eq(1)
-                        issue = issues.first
-
-                        expect(issue.platform_name).to eq(:asp)
-                        expect(issue.signature).to eq(substrings[:asp].to_s)
-                        expect(issue).to be_trusted
-                    end
-                end
             end
 
-            describe :ignore do
+            describe ':ignore' do
                 it 'ignores matches whose response also matches the ignore patterns' do
                     @positive.signature_analysis( @seed,
-                        substring: @seed,
+                        signatures: @seed,
                         format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
                         ignore: @seed
                     )
@@ -339,18 +222,6 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                     expect(issues).to be_empty
                 end
             end
-
-            describe :longest_word_optimization do
-                it 'optimizes the pattern matching process by first matching against the largest word in the regexp' do
-                    @positive.signature_analysis(
-                        @seed,
-                        regexp: @seed,
-                        longest_word_optimization: true
-                    )
-                    @auditor.http.run
-                    expect(issues).to be_any
-                end
-            end
         end
     end
 

data/spec/arachni/element/capabilities/analyzable/timeout_spec.rb

@@ -398,7 +398,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
             end
         end
 
-        describe :timeout do
+        describe ':timeout' do
             it 'sets the delay' do
                 c = Arachni::Element::Link.new(
                     url:    @url + '/true',
@@ -415,7 +415,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
             end
         end
 
-        describe :timeout_divider do
+        describe ':timeout_divider' do
             it 'modifies the final timeout value' do
                 subject.timeout_analysis( '__TIME__',
                                             options.merge(
@@ -430,7 +430,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
             end
         end
 
-        describe :add do
+        describe ':add' do
             it 'adds the given integer to the expected webapp delay' do
                 c = Arachni::Element::Link.new( url: @url + '/add', inputs: inputs )
                 c.auditor = auditor
@@ -446,7 +446,7 @@ describe Arachni::Element::Capabilities::Analyzable::Timeout do
                 run
 
                 expect(issues).to be_any
-                expect(issues.flatten.first.response.time.to_i).to eq(11)
+                expect(issues.flatten.first.request.timeout).to eq(11_000)
             end
         end
     end

data/spec/arachni/element/cookie_spec.rb

@@ -84,7 +84,7 @@ describe Arachni::Element::Cookie do
     end
 
     describe '#mutations' do
-        describe :parameter_names do
+        describe ':parameter_names' do
             it 'creates a new cookie' do
                 expect(subject.mutations( 'seed', parameter_names: true ).last.inputs.keys).to eq(
                     %w(seed)
@@ -223,6 +223,8 @@ describe Arachni::Element::Cookie do
             expect(subject.data).to eq({
                 name:        'mycookie',
                 value:       'myvalue',
+                raw_name:    nil,
+                raw_value:   nil,
                 url:         subject.action,
                 expires:     subject.expires_at,
                 version:     0,
@@ -263,42 +265,22 @@ describe Arachni::Element::Cookie do
     describe '.encode' do
 
         it 'encodes the string in a way that makes is suitable to be included in a cookie header' do
-            expect(described_class.encode( 'some stuff \'";%=&' )).to eq('some+stuff+\'%22%3B%25=%26')
+            expect(described_class.encode( 'some stuff \'";%=&' )).to eq('some+stuff+\'%22%3B%25%3D%26')
         end
 
-        context 'when encoding values' do
-            %w(! = ' / : ).each do |character|
-                it "preserves '#{character}'" do
-                    expect(described_class.encode( character )).to eq(character)
-                end
-            end
-
-            ['+', ';', '%', "\0", '&', '"', "\n", "\r"].each do |character|
-                it "encodes '#{character}'" do
-                    expect(described_class.encode( character )).to eq("%#{character.unpack('H*')[0]}".upcase)
-                end
-
-                it "encodes space as '+'" do
-                    expect(described_class.encode( ' ' )).to eq('+')
-                end
+        %w(! ' / : ).each do |character|
+            it "preserves '#{character}'" do
+                expect(described_class.encode( character )).to eq(character)
             end
         end
 
-        context 'when encoding names' do
-            %w(! ' / : ).each do |character|
-                it "preserves '#{character}'" do
-                    expect(described_class.encode( character, true )).to eq(character)
-                end
+        ['+', ';', '%', "\0", '&', '"', "\n", "\r", '='].each do |character|
+            it "encodes '#{character}'" do
+                expect(described_class.encode( character )).to eq("%#{character.unpack('H*')[0]}".upcase)
             end
 
-            ['=', '+', ';', '%', "\0", '&', '"', "\n", "\r"].each do |character|
-                it "encodes '#{character}'" do
-                    expect(described_class.encode( character, true )).to eq("%#{character.unpack('H*')[0]}".upcase)
-                end
-
-                it "encodes space as '+'" do
-                    expect(described_class.encode( ' ', true )).to eq('+')
-                end
+            it "encodes space as '+'" do
+                expect(described_class.encode( ' ' )).to eq('+')
             end
         end
     end
@@ -323,32 +305,64 @@ describe Arachni::Element::Cookie do
             )
 
             expect(c.to_set_cookie).to eq(
-                'blah%3Dha%25=some+stuff+%3B; Path=/; Domain=127.0.0.2; Secure; HttpOnly'
+                'blah%3Dha%25=some+stuff+%3B; Path=/; Secure; HttpOnly'
             )
             expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
 
             c = described_class.new(
                 url:    url,
-                name:  'blah=ha%',
-                value: 'some stuff ;',
-                path:  '/stuff'
+                name:   'blah=ha%',
+                value:  'some stuff ;',
+                path:   '/stuff',
+                domain: '.localhost'
             )
 
             expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
             expect(c.to_set_cookie).to eq(
-                'blah%3Dha%25=some+stuff+%3B; Path=/stuff; Domain=127.0.0.2'
+                'blah%3Dha%25=some+stuff+%3B; Path=/stuff'
             )
         end
     end
 
     describe '#to_s' do
-        it 'returns a string representation of the cookie' do
-            c = described_class.new(
-                url:    url,
-                name:  'blah=ha%',
-                value: 'some stuff ;',
-            )
-            expect(c.to_s).to eq('blah%3Dha%25=some+stuff+%3B')
+        context 'when there are no raw data' do
+            it 'returns the encoded name/value pair' do
+                c = described_class.new(
+                    url:    url,
+                    name:  'blah=ha%',
+                    value: 'some stuff ;',
+                )
+                expect(c.to_s).to eq('blah%3Dha%25=some+stuff+%3B')
+            end
+        end
+
+        context 'when there are raw data' do
+            context 'and is not a mutation' do
+                it 'returns them' do
+                    c = described_class.new(
+                        url:    url,
+                        name:  'blah=ha%',
+                        value: 'some stuff ;',
+                        raw_name: 'blah',
+                        raw_value: 'blah2'
+                    )
+                    expect(c.to_s).to eq('blah=blah2')
+                end
+            end
+
+            context 'and is a mutation' do
+                it 'returns the encoded name/value pair' do
+                    c = described_class.new(
+                        url:    url,
+                        name:  'blah=ha%',
+                        value: 'some stuff ;',
+                        raw_name: 'blah',
+                        raw_value: 'blah2'
+                    )
+                    expect(c).to receive(:mutation?) { true }
+                    expect(c.to_s).to eq('blah%3Dha%25=some+stuff+%3B')
+                end
+            end
         end
     end
 
@@ -444,8 +458,8 @@ describe Arachni::Element::Cookie do
                     html = <<-EOHTML
                     <html>
                     <head>
-                        <meta http-equiv="Set-Cookie" content="cookie=val; httponly">
-                        <meta http-equiv="Set-Cookie" content="cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly; secure">
+                        <meta http-equiv="Set-Cookie" content="cookie=val+1; httponly">
+                        <meta http-equiv="Set-Cookie" content="cookie2+1=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly; secure">
                     </head>
                     </html>
                     EOHTML
@@ -455,14 +469,18 @@ describe Arachni::Element::Cookie do
 
                     cookie = cookies.shift
                     expect(cookie.name).to eq('cookie')
-                    expect(cookie.value).to eq('val')
+                    expect(cookie.value).to eq('val 1')
+                    expect(cookie.raw_name).to eq('cookie')
+                    expect(cookie.raw_value).to eq('val+1')
                     expect(cookie.expired?).to eq(false)
                     expect(cookie.session?).to eq(true)
                     expect(cookie.secure?).to eq(false)
 
                     cookie = cookies.shift
-                    expect(cookie.name).to eq('cookie2')
+                    expect(cookie.name).to eq('cookie2 1')
                     expect(cookie.value).to eq('val2')
+                    expect(cookie.raw_name).to eq('cookie2+1')
+                    expect(cookie.raw_value).to eq('val2')
                     expect(cookie.path).to eq('/')
                     expect(cookie.domain).to eq('.foo.com')
                     expect(cookie.secure?).to eq(true)
@@ -489,6 +507,8 @@ describe Arachni::Element::Cookie do
                     expect(cookies.size).to eq(1)
                     expect(cookies.first.name).to eq('coo@ki e2')
                     expect(cookies.first.value).to eq('blah val2@')
+                    expect(cookies.first.raw_name).to eq('coo%40ki+e2')
+                    expect(cookies.first.raw_value).to eq('blah+val2%40')
                 end
             end
             context 'with an empty string' do
@@ -513,24 +533,44 @@ describe Arachni::Element::Cookie do
             expect(c1.name).to eq('SomeCookie')
             expect(c1.value).to eq('MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA==')
 
+            expect(c1.raw_name).to eq('SomeCookie')
+            expect(c1.raw_value).to eq('MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA%3D%3D')
+
+            expect(c2.raw_name).to eq('SomeCookie')
+            expect(c2.raw_value).to eq('"MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA=="')
+
             sc3 = "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/stuff; Domain=.foo.com; HttpOnly"
             cookies = described_class.from_set_cookie( 'http://test.com', sc3 )
             expect(cookies.size).to eq(1)
             cookie = cookies.first
             expect(cookie.name).to eq('coo@ki e2')
             expect(cookie.value).to eq('blah val2@')
+            expect(cookie.raw_name).to eq('coo%40ki+e2')
+            expect(cookie.raw_value).to eq('blah+val2%40')
             expect(cookie.path).to eq('/stuff')
             expect(cookie.source).to eq(sc3)
         end
 
+        it 'can handle v1 values' do
+            cookie = described_class.from_set_cookie(
+                'http://owner-url.com',
+                'cookie="blah stuff"'
+            ).first
+
+            expect(cookie.value).to eq('blah stuff')
+            expect(cookie.raw_value).to eq('"blah stuff"')
+        end
+
         context 'when there is no path' do
-            it 'reverts to \'/\'' do
+            it "'reverts to '/'" do
                 sc3 = "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=.foo.com; HttpOnly"
                 cookies = described_class.from_set_cookie( 'http://test.com/stuff', sc3 )
                 expect(cookies.size).to eq(1)
                 cookie = cookies.first
                 expect(cookie.name).to eq('coo@ki e2')
                 expect(cookie.value).to eq('blah val2@')
+                expect(cookie.raw_name).to eq('coo%40ki+e2')
+                expect(cookie.raw_value).to eq('blah+val2%40')
                 expect(cookie.path).to eq('/')
             end
         end
@@ -583,21 +623,30 @@ describe Arachni::Element::Cookie do
              c = cookies.shift
              expect(c.name).to eq('coo@ki e2')
              expect(c.value).to eq('blah val2@')
+             expect(c.raw_name).to eq('coo%40ki+e2')
+             expect(c.raw_value).to eq('blah+val2%40')
 
              c = cookies.shift
              expect(c.name).to eq('name')
              expect(c.value).to eq('value')
+             expect(c.raw_name).to eq('name')
+             expect(c.raw_value).to eq('value')
 
              c = cookies.shift
              expect(c.name).to eq('name2')
              expect(c.value).to eq('value2')
+             expect(c.raw_name).to eq('name2')
+             expect(c.raw_value).to eq('value2')
         end
 
         it 'can handle v1 values' do
-            expect(described_class.from_string(
+            cookie = described_class.from_string(
                 'http://owner-url.com',
                 'cookie="blah stuff"'
-            ).first.value).to eq('blah stuff')
+            ).first
+
+            expect(cookie.value).to eq('blah stuff')
+            expect(cookie.raw_value).to eq('"blah stuff"')
         end
 
         context 'when its value is' do