arachni 1.3.2 → 1.4

data/spec/support/fixtures/reporters/base_spec/with_formatters.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/reporters/base_spec/with_outfile.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/reporters/base_spec/without_outfile.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/reporters/manager_spec/afr.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/reporters/manager_spec/error.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/reporters/manager_spec/foo.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/body.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/cookies.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/empty.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/flch.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/forms.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/headers.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/links.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/nil.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/run_check/server.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/signature_check/signature.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/fixtures/wait_check/wait.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/helpers/framework.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/helpers/misc.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/helpers/paths.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/helpers/request_helpers.rb

@@ -0,0 +1,38 @@
+module RequestHelpers
+    include Rack::Test::Methods
+
+    def app
+        Arachni::Rest::Server
+    end
+
+    def response_data
+        JSON.load response.body
+    rescue => e
+        ap response
+        raise
+    end
+
+    def pretty_response_body
+        JSON.pretty_generate( response_data )
+    end
+
+    def response_body
+        response.body
+    end
+
+    def response_code
+        response.status
+    end
+
+    def response
+        last_response
+    end
+
+    %w(get post put delete).each do |m|
+        define_method m do |path, parameters = nil, headers = {}|
+            super( path, (parameters.to_json if parameters), headers )
+        end
+    end
+
+    extend self
+end

data/spec/support/helpers/requires.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/helpers/resets.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/helpers/web_server.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/lib/factory.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/lib/web_server_client.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/lib/web_server_dispatcher.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/spec/support/lib/web_server_manager.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -19,7 +19,7 @@ class WebServerManager
         @consumed_ports = Set.new
 
         Dir.glob( File.join( @lib + '**', '*.rb' ) ) do |path|
-            {} while @consumed_ports.include?( (port = available_port) )
+            {} while @consumed_ports.include?( (port = Arachni::Utilities.available_port) )
             @consumed_ports << port
 
             @servers[normalize_name( File.basename( path, '.rb' ) )] = {

data/spec/support/servers/arachni/browser.rb

@@ -20,6 +20,7 @@ get '/' do
     <body>
         <div>
             <script type="text/javascript">
+                document.cookie = 'cookie_name="cookie value"';
                 document.write( navigator.userAgent );
             </script>
         </div>
@@ -28,6 +29,66 @@ get '/' do
 HTML
 end
 
+get '/cookies/under/path' do
+    <<HTML
+<html>
+    <body>
+        <script type="text/javascript">
+            document.cookie = 'cookie_under_path=value';
+        </script>
+    </body>
+</html>
+HTML
+end
+
+get '/cookies/httpOnly' do
+    cookies[:http_only] = 'stuff'
+end
+
+get '/cookies/domains' do
+    response.set_cookie(
+        :include_subdomains,
+        value:   'bar1',
+        domain: ".#{request.host}"
+    )
+
+    response.set_cookie(
+        :no_subdomains,
+        value:   'bar2',
+        domain: request.host
+    )
+
+    response.set_cookie(
+        :other_domain,
+        value:   'bar3',
+        domain: 'blah.blah'
+    )
+end
+
+get '/cookies/expires' do
+    cookies[:without_expiration] = 'stuff'
+
+    response.set_cookie(
+        :with_expiration,
+        value:   'bar',
+        expires: Time.parse( '2047-08-01 09:30:12 +0000' )
+    )
+end
+
+get '/open-new-window' do
+    <<HTML
+<html>
+    <body>
+        <script>
+            window.open( "/with-ajax" );
+        </script>
+
+        <a href="/">Click me!</a>
+    </body>
+</html>
+HTML
+end
+
 get '/If-None-Match' do
     etag '1'
 
@@ -193,6 +254,22 @@ get '/snapshot_id/default' do
     EOHTML
 end
 
+get '/each_element_with_events/set-cookie' do
+    <<-EOHTML
+    <html>
+        <script type="text/javascript">
+            function setCookie() {
+                document.cookie = 'cookie_name="cookie value"';
+            }
+        </script>
+
+        <body>
+            <button onclick="setCookie()">Set cookie</button>
+        </body>
+    </html>
+    EOHTML
+end
+
 get '/each_element_with_events/a/href/javascript' do
     <<-EOHTML
     <html>
@@ -394,6 +471,7 @@ end
 
 get '/test.png' do
     @@image_hit_count += 1
+    200
 end
 
 Arachni::Browser::Javascript::EVENTS_PER_ELEMENT[:input].each do |event|
@@ -416,7 +494,6 @@ Arachni::Browser::Javascript::EVENTS_PER_ELEMENT[:input].each do |event|
 </html>
         EOHTML
     end
-
 end
 
 get '/lots_of_sinks' do
@@ -651,7 +728,8 @@ get '/level2' do
         <div id="level3">
         </div>
 
-        <a onmouseover="writeButton();" href="javascript:level3();">level3 link</a>
+        <a onmouseover="writeButton();" href="#">Write button</a>
+        <a href="javascript:level3();">level3 link</a>
     </div>
 HTML
 end
@@ -754,14 +832,27 @@ get '/update-cookies' do
     cookies[:update] = 'this'
 end
 
-get '/update-cookies' do
-    cookies[:update] = 'this'
-end
-
 get '/dom-cookies-names' do
-    cookies['my-cookie']  = 'stuff'
-    cookies['my-cookie2'] = 'stuff'
-    cookies['my-cookie3'] = 'stuff'
+    cookies['http_only_cookie'] = 'stuff1'
+
+    response.set_cookie(
+        :js_cookie1,
+        value: 'stuff2'
+    )
+    response.set_cookie(
+        :js_cookie2,
+        value: 'stuff3'
+    )
+    response.set_cookie(
+        :js_cookie3,
+        value: 'blah'
+    )
+
+    response.set_cookie(
+        :other_path,
+        value: 'stuff4',
+        path: '/blah/'
+    )
 
     <<HTML
     <html>
@@ -781,18 +872,37 @@ get '/dom-cookies-names' do
                 return '';
             }
 
-            getCookie('my-cookie');
-            getCookie('my-cookie2');
+            getCookie('http_only_cookie');
+            getCookie('js_cookie1');
+            getCookie('js_cookie2');
+            getCookie('other_path');
         </script>
     </html>
 HTML
 end
 
 get '/dom-cookies-values' do
-    cookies['my-cookie']  = 'stuff1'
-    cookies['my-cookie2'] = 'stuff2'
-    cookies['my-cookie3'] = 'stuff3'
-
+    cookies['http_only_cookie'] = 'stuff1'
+
+    response.set_cookie(
+        :js_cookie1,
+        value: 'stuff2'
+    )
+    response.set_cookie(
+        :js_cookie2,
+        value: 'stuff3'
+    )
+
+    response.set_cookie(
+        :js_cookie3,
+        value: 'blah'
+    )
+
+    response.set_cookie(
+        :other_path,
+        value: 'stuff4',
+        path: '/blah/'
+    )
     <<HTML
     <html>
         <script>
@@ -802,6 +912,8 @@ get '/dom-cookies-values' do
 
             cookiesHaveValue('stuff1');
             cookiesHaveValue('stuff2');
+            cookiesHaveValue('stuff3');
+            cookiesHaveValue('stuff4');
         </script>
     </html>
 HTML
@@ -959,6 +1071,18 @@ post '/href-ajax-sleep' do
     sleep 4
 end
 
+get '/5_windows' do
+    <<HTML
+    <script>
+        window.open();
+        window.open();
+        window.open();
+        window.open();
+        window.open();
+    </script>
+HTML
+end
+
 get '/trigger_events' do
     <<HTML
 <html>
@@ -994,6 +1118,49 @@ get '/trigger_events' do
 HTML
 end
 
+get '/trigger_events/with_new_timers/:delay' do |delay|
+    <<HTML
+<html>
+    <head>
+        <script>
+            function addForm() {
+                get_ajax = new XMLHttpRequest();
+                get_ajax.onreadystatechange = function() {
+                    if( get_ajax.readyState == 4 && get_ajax.status == 200 ) {
+                        document.getElementById( "my-div" ).innerHTML = get_ajax.responseText;
+                    }
+                }
+
+                get_ajax.open( "GET", "/get-ajax?ajax-token=my-token", true );
+                get_ajax.send();
+            }
+
+            function addFormAfterDelay() {
+                setTimeout( addForm, #{delay} )
+            }
+        </script>
+    <head>
+
+    <body>
+
+        <div id="my-div" onclick="addFormAfterDelay();">
+            Test
+        </div>
+    </body>
+</html>
+HTML
+end
+
+get '/trigger_events/invisible-div' do
+    <<HTML
+<html>
+    <body>
+        <div id="invisible-div" style="display: none">
+        </div>
+    </body>
+</html>
+HTML
+end
 
 get '/trigger_events-wait-for-ajax' do
     <<HTML