arachni 1.3.2 → 1.4

data/spec/components/checks/active/unvalidated_redirect_spec.rb

@@ -10,8 +10,8 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Form   => 5,
-            Element::Link   => 5,
+            Element::Form   => 14,
+            Element::Link   => 10,
             Element::Cookie => 5,
             Element::Header => 5,
             Element::JSON   => 3,

data/spec/components/checks/active/xpath_injection_spec.rb

@@ -10,11 +10,11 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Form         => 125,
-            Element::Link         => 125,
+            Element::Form         => 150,
+            Element::Link         => 150,
             Element::Cookie       => 150,
             Element::Header       => 75,
-            Element::LinkTemplate => 75,
+            Element::LinkTemplate => 150,
             Element::JSON         => 75,
             Element::XML          => 150
         }

data/spec/components/checks/active/xss_dom_script_context_spec.rb

@@ -14,7 +14,7 @@ describe name_from_filename do
             Element::Link::DOM         => 2,
             Element::Cookie::DOM       => 2,
             Element::LinkTemplate::DOM => 2,
-            Element::UIInput::DOM        => 2,
+            Element::UIInput::DOM      => 2,
             Element::UIForm::DOM       => 2
         }
     end

data/spec/components/checks/active/xss_dom_spec.rb

@@ -14,7 +14,7 @@ describe name_from_filename do
             Element::Link::DOM         => 2,
             Element::Cookie::DOM       => 2,
             Element::LinkTemplate::DOM => 2,
-            Element::UIInput::DOM        => 2,
+            Element::UIInput::DOM      => 2,
             Element::UIForm::DOM       => 2
         }
     end

data/spec/components/checks/active/xss_script_context_spec.rb

@@ -10,11 +10,11 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Form   => 16,
-            Element::Link   => 16,
-            Element::Cookie => 16,
-            Element::Header => 12,
-            Element::LinkTemplate => 3
+            Element::Form         => 16,
+            Element::Link         => 16,
+            Element::Cookie       => 16,
+            Element::Header       => 12,
+            Element::LinkTemplate => 9
         }
     end
 

data/spec/components/checks/active/xss_spec.rb

@@ -10,11 +10,11 @@ describe name_from_filename do
 
     def issue_count_per_element
         {
-            Element::Link         => 13,
-            Element::Form         => 12,
-            Element::Cookie       => 12,
-            Element::Header       => 11,
-            Element::LinkTemplate => 12
+            Element::Form         => 9,
+            Element::Link         => 10,
+            Element::Cookie       => 7,
+            Element::Header       => 6,
+            Element::LinkTemplate => 9
         }
     end
 

data/spec/components/checks/passive/grep/credit_card_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         3
     end
 
-    easy_test
+    easy_test { expect(issues.find(&:trusted?)).to be_nil }
 end

data/spec/components/checks/passive/grep/emails_spec.rb

@@ -8,8 +8,18 @@ describe name_from_filename do
     end
 
     def issue_count
-        6
+        5
     end
 
-    easy_test
+    easy_test do
+        emails = issues.map(&:proof).sort
+
+        expect(emails).to eq [
+            'tasos@example.com',
+            'john@www.example.com',
+            'john32.21d@example.com',
+            'a.little.more.unusual@example.com',
+            'a.little.more.unusual[at]example[dot]com'
+        ].sort
+    end
 end

data/spec/components/checks/passive/grep/ssn_spec.rb

@@ -11,5 +11,5 @@ describe name_from_filename do
         1
     end
 
-    easy_test
+    easy_test { expect(issues.find(&:trusted?)).to be_nil }
 end

data/spec/components/path_extractors/meta_refresh_spec.rb

@@ -6,6 +6,7 @@ describe name_from_filename do
     def results
         [
             'http://test.com',
+            'http://test.com/ /d',
             'test.com',
             'http://test2.com'
         ]
@@ -16,7 +17,8 @@ describe name_from_filename do
             <meta http-equiv="refresh" content="5">
             <meta http-equiv="refreSH" content="5;URL='test.com'">
             <meta http-equiv="Refresh" content='0;URL="http://test.com"'>
-            <meta http-equiv="refResh" content='0;URL=http://test2.com'>
+            <meta http-equiv="Refresh" content='0;URL="http://test.com/ /d"'>
+            <meta http-equiv="refResh" content='0;URL= http://test2.com '>
         HTML
     end
 

data/spec/components/plugins/exec_spec.rb

@@ -37,8 +37,8 @@ describe name_from_filename do
 
         expect(during).to eq({
             "status"     => 0,
-            "executable" => "echo \"#{options.url} #{scheme} #{host} #{port} during 0 0 preparing\"",
-            "stdout"     => "#{options.url} #{scheme} #{host} #{port} during 0 0 preparing\n",
+            "executable" => "echo \"#{options.url} #{scheme} #{host} #{port} during 0 0 scanning\"",
+            "stdout"     => "#{options.url} #{scheme} #{host} #{port} during 0 0 scanning\n",
             "stderr"     => ""
         })
 

data/spec/components/plugins/login_script_spec.rb

@@ -28,14 +28,23 @@ describe name_from_filename do
             context 'when using a Ruby script' do
                 let(:script) do
                     <<EOSCRIPT
-                framework.options.datastore.browser = browser
+                framework.options.datastore.browser = browser.class.to_s
+                framework.options.datastore.screen_width = browser.execute_script( 'return window.innerWidth;' )
+                framework.options.datastore.screen_height = browser.execute_script( 'return window.innerHeight;' )
 EOSCRIPT
                 end
 
                 it "exposes a Watir::Browser interface via the 'browser' variable" do
                     run
 
-                    expect(options.datastore.browser).to be_kind_of Watir::Browser
+                    expect(options.datastore.browser).to eq 'Watir::Browser'
+                end
+
+                it 'sets the appropriate resolution' do
+                    run
+
+                    expect(framework.options.datastore.screen_width).to eq Arachni::Options.browser_cluster.screen_width
+                    expect(framework.options.datastore.screen_height).to eq Arachni::Options.browser_cluster.screen_height
                 end
             end
 
@@ -43,6 +52,8 @@ EOSCRIPT
                 let(:script) do
                     <<EOSCRIPT
                 document.cookie = 'mycookie=myvalue'
+                document.cookie = 'width=' + window.innerWidth
+                document.cookie = 'height=' + window.innerHeight
 EOSCRIPT
                 end
                 let(:script_path) { "#{super()}.js" }
@@ -53,6 +64,15 @@ EOSCRIPT
                     expect(framework.http.cookies.
                         find { |c| c.name == 'mycookie' }.value).to eq('myvalue')
                 end
+
+                it 'sets the appropriate resolution' do
+                    run
+
+                    expect(framework.http.cookies.
+                        find { |c| c.name == 'width' }.value).to eq Arachni::Options.browser_cluster.screen_width.to_s
+                    expect(framework.http.cookies.
+                        find { |c| c.name == 'height' }.value).to eq Arachni::Options.browser_cluster.screen_height.to_s
+                end
             end
         end
 

data/spec/components/plugins/vector_feed_spec.rb

@@ -168,21 +168,21 @@ describe name_from_filename do
     end
 
     context 'when setting the option' do
-        describe :vectors do
+        describe ':vectors' do
             it 'forwards the given vectors to the framework to be audited' do
                 options.plugins[component_name] = { 'vectors' => vectors.dup }
                 run_test
             end
         end
 
-        describe :yaml_string do
+        describe ':yaml_string' do
             it 'unserializes the given string and forward the given vectors to the framework to be audited' do
                 options.plugins[component_name] = { 'yaml_string' => vectors.to_yaml }
                 run_test
             end
         end
 
-        describe :yaml_file do
+        describe ':yaml_file' do
             it 'unserializes the given string and forward the given vectors to the framework to be audited' do
                 File.open( 'yaml_file.yml', 'w' ){ |f| f.write( YAML.dump( vectors ) ) }
 

data/spec/spec_helper.rb

@@ -1,12 +1,13 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
     web site for more information on licensing and terms of use.
 =end
 
-require 'simplecov'
+require 'rack/test'
+# require 'simplecov'
 require 'faker'
 
 require_relative '../lib/arachni'
@@ -21,19 +22,24 @@ Dir.glob( "#{support_path}/{lib,helpers,shared,factories}/**/*.rb" ).each { |f|
 
 # Enable extra output options in order to get full coverage...
 Arachni::UI::Output.verbose_on
-Arachni::UI::Output.debug_on( 3 )
+Arachni::UI::Output.debug_on( 999999 )
 # ...but don't actually print anything.
 Arachni::UI::Output.mute
 
 # Uncomment to show output from spawned processes.
 Arachni::Processes::Manager.preserve_output
 
+RSpec::Core::MemoizedHelpers.module_eval do
+    alias to should
+    alias to_not should_not
+end
+
 RSpec.configure do |config|
-    config.treat_symbols_as_metadata_keys_with_true_values = true
     config.run_all_when_everything_filtered = true
     config.color = true
     config.add_formatter :documentation
     config.include PageHelpers
+    config.alias_example_to :expect_it
 
     config.mock_with :rspec do |mocks|
         mocks.yield_receiver_to_any_instance_implementation_blocks = true

data/spec/support/factories/browser_cluster/job.rb

@@ -5,6 +5,7 @@ Factory.define :custom_job do
         end
 
         def run
+            sleep 0.1
             save_result my_data: 'Some stuff'
         end
     end

data/spec/support/fixtures/check_with_invalid_platforms/with_invalid_platforms.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/checks/test.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/checks/test2.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/checks/test3.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/fingerprinters/test.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins/bad.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins/defaults/default.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins/distributable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins/loop.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins/suspendable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins/wait.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins/with_options.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p0.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p00.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p1.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p2.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p22.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p222.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p_nil.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/plugins_with_priorities/p_nil2.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/reporters/base_spec/plugin_formatters/with_formatters/foobar.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework