arachni 1.3.2 → 1.4

data/spec/arachni/http/cookie_jar_spec.rb

@@ -104,7 +104,7 @@ describe Arachni::HTTP::CookieJar do
         end
 
         context 'when passed a' do
-            context Arachni::Cookie do
+            context 'Arachni::Cookie' do
                 it 'updates the cookie jar with it' do
                     c = Arachni::Cookie.new( url: 'http://test.com', inputs: { name: 'value' } )
 
@@ -116,7 +116,7 @@ describe Arachni::HTTP::CookieJar do
                 end
             end
 
-            context Hash do
+            context 'Hash' do
                 it 'converts it to Cookie and update the cookie jar with it' do
                     expect(subject).to be_empty
 
@@ -127,7 +127,7 @@ describe Arachni::HTTP::CookieJar do
                 end
             end
 
-            context String do
+            context 'String' do
                 it 'parses it into a Cookie and update the cookie jar with it' do
                     expect(subject).to be_empty
 
@@ -160,7 +160,7 @@ describe Arachni::HTTP::CookieJar do
                 end
             end
 
-            context Array do
+            context 'Array' do
                 it 'iterates and if necessary parses the entries and update the cookie jar with them' do
                     expect(subject).to be_empty
 
@@ -290,12 +290,12 @@ describe Arachni::HTTP::CookieJar do
             )
         end
         describe 'include_expired' do
-            context true do
+            context 'true' do
                 it 'returns all cookies' do
                     expect(subject.cookies( true ).size).to eq(2)
                 end
             end
-            context false do
+            context 'false' do
                 it 'returns non expired cookies only' do
                     c = subject.cookies( false )
                     expect(c.size).to eq(1)

data/spec/arachni/http/proxy_server_spec.rb

@@ -6,10 +6,13 @@ describe Arachni::HTTP::ProxyServer do
         @url = web_server_url_for( :proxy_server ) + '/'
     end
 
+    let(:address) { Socket.ip_address_list.find(&:ipv4?).ip_address }
+    let(:port) { Arachni::Utilities.available_port }
+
     def via_proxy( proxy, url )
         Typhoeus::Request.get(
             url,
-            proxy: proxy.address,
+            proxy: proxy.url,
             ssl_verifypeer:  false,
             ssl_verifyhost:  0
         )
@@ -22,7 +25,7 @@ describe Arachni::HTTP::ProxyServer do
                 '1' => '2',
                 '3' => '4'
             },
-            proxy: proxy.address,
+            proxy: proxy.url,
             ssl_verifypeer:  false,
             ssl_verifyhost:  0
         )
@@ -38,7 +41,9 @@ describe Arachni::HTTP::ProxyServer do
         proxy = described_class.new
         proxy.start_async
 
-        expect(via_proxy( proxy, url ).body).to eq('HTTPS GET')
+        response = via_proxy( proxy, url )
+        expect(response.code).to eq 200
+        expect(response.body).to eq 'HTTPS GET'
     end
 
     it 'removes any size limits on the HTTP responses' do
@@ -50,69 +55,67 @@ describe Arachni::HTTP::ProxyServer do
     end
 
     describe '#initialize' do
-        describe :address do
+        describe ':address' do
             it 'sets the bind address' do
-                address = WEBrick::Utils::getservername
-
                 proxy = described_class.new( address: address )
                 proxy.start_async
 
-                expect(proxy.address.split( ':' ).first).to eq(address)
+                expect(URI(proxy.url).host).to eq(address)
                 test_proxy proxy
             end
         end
 
-        describe :port do
+        describe ':port' do
             it 'sets the listen port' do
                 port = Arachni::Utilities.available_port
 
                 proxy = described_class.new( port: port )
                 proxy.start_async
 
-                expect(proxy.address.split( ':' ).last).to eq(port.to_s)
+                expect(URI(proxy.url).port).to eq(port)
                 test_proxy proxy
             end
         end
 
-        describe :timeout do
+        describe ':timeout' do
             it 'sets the HTTP request timeout' do
-                proxy = described_class.new( timeout: 1_000 )
+                proxy = described_class.new( timeout: 1 )
                 proxy.start_async
 
                 sleep_url = @url + 'sleep'
 
                 expect(Typhoeus::Request.get( sleep_url ).code).not_to eq(0)
-                expect(via_proxy( proxy, sleep_url ).code).to eq(0)
-            end
-        end
-
-        describe :concurrency do
-            it 'sets the HTTP request concurrency' do
-                sleep_url = @url + 'sleep'
-
-                proxy = described_class.new( concurrency: 2 )
-                proxy.start_async
-                time = Time.now
-                threads = []
-                2.times do
-                    threads << Thread.new { via_proxy( proxy, sleep_url ) }
-                end
-                threads.each(&:join)
-                expect((Time.now - time).to_i).to eq(5)
-
-                proxy = described_class.new( concurrency: 1 )
-                proxy.start_async
-                time = Time.now
-                threads = []
-                2.times do
-                    threads << Thread.new { via_proxy( proxy, sleep_url ) }
-                end
-                threads.each(&:join)
-                expect((Time.now - time).to_i).to eq(10)
+                expect(via_proxy( proxy, sleep_url ).code).to eq(504)
             end
         end
 
-        describe :request_handler do
+        # describe ':concurrency' do
+        #     it 'sets the HTTP request concurrency' do
+        #         sleep_url = @url + 'sleep'
+        #
+        #         proxy = described_class.new( concurrency: 2 )
+        #         proxy.start_async
+        #         time = Time.now
+        #         threads = []
+        #         2.times do
+        #             threads << Thread.new { via_proxy( proxy, sleep_url ) }
+        #         end
+        #         threads.each(&:join)
+        #         expect((Time.now - time).to_i).to eq(5)
+        #
+        #         proxy = described_class.new( concurrency: 1 )
+        #         proxy.start_async
+        #         time = Time.now
+        #         threads = []
+        #         2.times do
+        #             threads << Thread.new { via_proxy( proxy, sleep_url ) }
+        #         end
+        #         threads.each(&:join)
+        #         expect((Time.now - time).to_i).to eq(10)
+        #     end
+        # end
+
+        describe ':request_handler' do
             it 'sets a block to handle each HTTP request before the request is forwarded to the origin server' do
                 called = false
                 proxy = described_class.new(
@@ -166,15 +169,15 @@ describe Arachni::HTTP::ProxyServer do
                 proxy.start_async
                 post_via_proxy( proxy, @url )
 
-                expect(request.headers_string).to eq(
-                    "POST / HTTP/1.1\r\n" <<
+                expect(request.headers_string.split( "\r\n" ).sort).to eq(
+                    ("POST / HTTP/1.1\r\n" <<
+                    "Host: #{request.parsed_url.host}:#{request.parsed_url.port}\r\n" <<
                     "Accept-Encoding: gzip, deflate\r\n" <<
                     "User-Agent: Typhoeus - https://github.com/typhoeus/typhoeus\r\n" <<
-                        "Host: #{request.parsed_url.host}:#{request.parsed_url.port}\r\n" <<
-                        "Accept: */*\r\n" <<
-                        "Proxy-Connection: Keep-Alive\r\n" <<
-                        "Content-Type: application/x-www-form-urlencoded\r\n" <<
-                        "Content-Length: 7\r\n\r\n"
+                    "Accept: */*\r\n" <<
+                    "Content-Length: 7\r\n" <<
+                    "Accept-Language: en-US,en;q=0.8,he;q=0.6\r\n" <<
+                    "Content-Type: application/x-www-form-urlencoded\r\n\r\n").split( "\r\n" ).sort
                 )
 
                 expect(request.effective_body).to eq('1=2&3=4')
@@ -197,14 +200,17 @@ describe Arachni::HTTP::ProxyServer do
                     )
                     proxy.start_async
 
-                    expect(via_proxy( proxy, @url ).body).to eq('stuff')
+                    response = via_proxy( proxy, @url )
+
+                    expect(response.code).to eq 200
+                    expect(response.body).to eq 'stuff'
 
                     expect(called).to be_truthy
                 end
             end
         end
 
-        describe :response_handler do
+        describe ':response_handler' do
             it 'sets a block to handle each HTTP request once the origin server has responded' do
                 called = false
                 proxy = described_class.new(
@@ -299,64 +305,61 @@ describe Arachni::HTTP::ProxyServer do
 
     describe '#address' do
         it 'returns the address of the proxy' do
-            address = 'localhost'
-            port    = Arachni::Utilities.available_port
-
             proxy = described_class.new( address: address, port: port )
-            expect(proxy.address).to eq("#{address}:#{port}")
+            expect(proxy.url).to eq "http://#{address}:#{port}"
             proxy.start_async
             test_proxy proxy
         end
     end
 
-    describe '#has_connections?' do
-        context 'when there are active connections' do
+    describe '#has_pending_requests?' do
+        context 'when there are pending requests' do
             it 'returns true' do
                 proxy = described_class.new
                 proxy.start_async
 
-                expect(proxy.has_connections?).to be_falsey
+                expect(proxy).to_not have_pending_requests
                 Thread.new { via_proxy( proxy, @url + 'sleep' ) }
                 sleep 1
-                expect(proxy.has_connections?).to be_truthy
+                expect(proxy).to have_pending_requests
             end
         end
 
-        context 'when there are no active connections' do
+        context 'when there are no pending requests' do
             it 'returns false' do
                 proxy = described_class.new
                 proxy.start_async
 
-                expect(proxy.has_connections?).to be_falsey
+                expect(proxy).to_not have_pending_requests
                 via_proxy( proxy, @url + 'sleep' )
-                expect(proxy.has_connections?).to be_falsey
+                expect(proxy).to_not have_pending_requests
             end
         end
     end
 
-    describe '#active_connections' do
-        context 'when there are active connections' do
+    describe '#pending_requests' do
+        context 'when there are pending requests' do
             it 'returns the amount' do
                 proxy = described_class.new
                 proxy.start_async
 
-                expect(proxy.active_connections).to eq(0)
+                expect(proxy.pending_requests).to eq(0)
                 3.times do
                     Thread.new { via_proxy( proxy, @url + 'sleep' ) }
                 end
                 sleep 1
-                expect(proxy.active_connections).to eq(3)
+                expect(proxy.pending_requests).to eq(3)
             end
         end
 
-        context 'when there are no active connections' do
+        context 'when there are no pending requests' do
             it 'returns 0' do
                 proxy = described_class.new
                 proxy.start_async
 
-                expect(proxy.active_connections).to eq(0)
+                expect(proxy.pending_requests).to eq(0)
                 via_proxy( proxy, @url + 'sleep' )
-                expect(proxy.active_connections).to eq(0)
+                expect(proxy.pending_requests).to eq(0)
             end
         end
     end

data/spec/arachni/http/request_spec.rb

@@ -56,7 +56,7 @@ describe Arachni::HTTP::Request do
         let(:data) { subject.to_rpc_data }
 
         %w(url method parameters body headers_string effective_body timeout
-            headers cookies username password).each do |attribute|
+            headers cookies username password raw_parameters).each do |attribute|
             it "includes '#{attribute}'" do
                 expect(data[attribute]).to eq(subject.send( attribute ))
             end
@@ -98,15 +98,15 @@ describe Arachni::HTTP::Request do
             expect(r.parameters).to eq({ 'test' => 'blah' })
         end
 
-        describe :fingerprint do
-            context true do
+        describe ':fingerprint' do
+            context 'true' do
                 it 'enables fingerprinting' do
                     r = described_class.new( options.merge( fingerprint: true ) )
                     expect(r.fingerprint?).to be_truthy
                 end
             end
 
-            context false do
+            context 'false' do
                 it 'disables fingerprinting' do
                     r = described_class.new( options.merge( fingerprint: false ) )
                     expect(r.fingerprint?).not_to be_truthy
@@ -121,6 +121,94 @@ describe Arachni::HTTP::Request do
             end
         end
 
+        describe '#raw_parameters=' do
+            it 'assigns #raw_parameters' do
+                subject.raw_parameters = ['stuff']
+                expect(subject.raw_parameters).to eq ['stuff']
+            end
+
+            context 'when nil' do
+                it 'clears #raw_parameters' do
+                    subject.raw_parameters = ['stuff']
+                    subject.raw_parameters = nil
+                    expect(subject.raw_parameters).to be_empty
+                end
+            end
+        end
+
+        describe ':raw_parameters' do
+            let(:url){ "#{@url}/raw" }
+            let(:request) { described_class.new( options ) }
+            let(:options) do
+                {
+                    url:            url,
+                    method:         method,
+                    parameters:     parameters,
+                    body:           body,
+                    raw_parameters: raw_parameters
+                }
+            end
+            let(:parameters) { { '1 ' => '2 ', '3 ' => '4 ' } }
+            let(:body) { {} }
+            let(:method) { :get }
+            let(:response) { request.run }
+
+            context 'when a query parameter name is' do
+                context 'included' do
+                    let(:raw_parameters) { ['1 '] }
+
+                    it 'does not encode it' do
+                        expect(response.request.to_s.lines.first.strip).to eq 'GET /raw?1 =2 &3%20=4%20 HTTP/1.1'
+                    end
+
+                    context 'and contains null-bytes' do
+                        let(:parameters) { { '1 ' => "\0", '3 ' => '4 ' } }
+
+                        it 'sencodes them' do
+                            expect(response.request.to_s.lines.first.strip).to eq 'GET /raw?1 =%00&3%20=4%20 HTTP/1.1'
+                        end
+                    end
+                end
+
+                context 'not included' do
+                    let(:raw_parameters) { ['stuff'] }
+
+                    it 'encodes it' do
+                        expect(response.request.to_s.lines.first.strip).to eq 'GET /raw?1%20=2%20&3%20=4%20 HTTP/1.1'
+                    end
+                end
+            end
+
+            context 'when a body parameter name is' do
+                let(:method) { :post }
+                let(:body) { { '5 ' => '6 ', '7 ' => '8 ' } }
+
+                context 'included' do
+                    let(:raw_parameters) { ['5 '] }
+
+                    it 'does not encode it' do
+                        expect(response.request.to_s.lines.last.strip).to eq '5 =6 &7%20=8%20'
+                    end
+
+                    context 'and contains null-bytes' do
+                        let(:body) { { '5 ' => "\0", '7 ' => '8 ' } }
+
+                        it 'sencodes them' do
+                            expect(response.request.to_s.lines.last.strip).to eq '5 =%00&7%20=8%20'
+                        end
+                    end
+                end
+
+                context 'not included' do
+                    let(:raw_parameters) { ['stuff'] }
+
+                    it 'encodes it' do
+                        expect(response.request.to_s.lines.last.strip).to eq '5%20=6%20&7%20=8%20'
+                    end
+                end
+            end
+        end
+
         context 'when url is not a String' do
             it 'raises ArgumentError' do
                 raised = false
@@ -199,7 +287,8 @@ describe Arachni::HTTP::Request do
             expect(described_class.new( url: @url ).run.request.headers_string).to eq(
                 "GET / HTTP/1.1\r\nHost: #{host}\r\nAccept-Encoding: gzip, " +
                     "deflate\r\nUser-Agent: Arachni/v#{Arachni::VERSION}\r\nAccept: text/html," +
-                    "application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n\r\n"
+                    "application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" +
+                    "Accept-Language: en-US,en;q=0.8,he;q=0.6\r\n\r\n"
             )
         end
 
@@ -353,7 +442,7 @@ describe Arachni::HTTP::Request do
     end
 
     describe '#effective_cookies' do
-        it 'returns the given :cookies merged with the cookies in Headers' do
+        it 'returns the given :cookies merged with the cookies in Headers and raw cookies' do
             request = described_class.new(
                 url: url,
                 headers: {
@@ -362,7 +451,16 @@ describe Arachni::HTTP::Request do
                 cookies: {
                     'cookie2' => 'updated_value',
                     'cookie3' => 'value3',
-                }
+                },
+                raw_cookies: [
+                    Arachni::Element::Cookie.new(
+                        url: url,
+                        name: 'name',
+                        value: 'value',
+                        raw_name: 'name1',
+                        raw_value: 'value1'
+                    )
+                ]
             )
 
             expect(request.cookies).to eq({
@@ -372,7 +470,8 @@ describe Arachni::HTTP::Request do
             expect(request.effective_cookies).to eq({
                 'my_cookie' => 'my_value',
                 'cookie2'   => 'updated_value',
-                'cookie3'   => 'value3'
+                'cookie3'   => 'value3',
+                'name1'     => 'value1'
             })
         end
     end
@@ -411,35 +510,60 @@ describe Arachni::HTTP::Request do
             expect(subject).to be_kind_of Typhoeus::Request
         end
 
-        context 'when the request is blocking' do
-            let(:request) { described_class.new( url: url, mode: :sync ) }
+        # context 'when the request is blocking' do
+        #     let(:request) { described_class.new( url: url, mode: :sync ) }
+        #
+        #     it 'forbids socket reuse' do
+        #         expect(subject.options[:forbid_reuse]).to be_truthy
+        #     end
+        # end
+        #
+        # context 'when the request is non-blocking' do
+        #     let(:request) { described_class.new( url: url, mode: :async ) }
+        #
+        #     it 'reuses sockets' do
+        #         expect(subject.options[:forbid_reuse]).to be_falsey
+        #     end
+        # end
 
-            it 'forbids socket reuse' do
-                expect(subject.options[:forbid_reuse]).to be_truthy
+        context 'when cookies are available' do
+            let(:request) do
+                described_class.new(
+                    url:     url,
+                    cookies: {
+                        'na me'  => 'stu ff',
+                        'na me2' => 'stu ff2'
+                    }
+                )
             end
-        end
-
-        context 'when the request is non-blocking' do
-            let(:request) { described_class.new( url: url, mode: :async ) }
 
-            it 'reuses sockets' do
-                expect(subject.options[:forbid_reuse]).to be_falsey
+            it 'encodes and puts them in the Cookie header' do
+                expect(subject.options[:headers]['Cookie']).to eq('na+me=stu+ff;na+me2=stu+ff2')
             end
         end
 
-        context 'when cookies are available' do
+        context 'when raw cookies are available' do
             let(:request) do
                 described_class.new(
                     url:     url,
                     cookies: {
                         'na me'  => 'stu ff',
                         'na me2' => 'stu ff2'
-                    }
+                    },
+                    raw_cookies: [
+                        Arachni::Element::Cookie.new(
+                            url: url,
+                            name: 'name',
+                            value: 'value',
+                            raw_name: 'name1',
+                            raw_value: '"v alue1"'
+                        )
+                    ]
                 )
             end
 
-            it 'encodes and puts them in the Cookie header' do
-                expect(subject.options[:headers]['Cookie']).to eq('na+me=stu+ff;na+me2=stu+ff2')
+            it 'places raw data in the Cookie header' do
+                expect(subject.options[:headers]['Cookie']).to eq('na+me=stu+ff;na+me2=stu+ff2;name1="v alue1"')
             end
         end
 
@@ -694,7 +818,7 @@ describe Arachni::HTTP::Request do
 
     describe '#body_parameters' do
         context 'when #method is' do
-            context :post do
+            context ':post' do
                 context 'and there are #parameters' do
                     it 'returns #parameters' do
                         parameters = { 'stuff' => 'here' }