arachni 1.3.2 → 1.4

data/spec/support/shared/element/capabilities/submittable.rb

@@ -87,6 +87,18 @@ shared_examples_for 'submittable' do
             run
             expect(response.request.performer).to eq(submittable)
         end
+
+        it 'sets Request#raw_parameters from #raw_inputs',
+           if: !described_class.ancestors.include?( Arachni::Element::DOM ) do
+
+            response = nil
+
+            submittable.raw_inputs = [submittable.inputs.keys.first]
+            submittable.submit { |res| response = res }
+
+            run
+            expect(response.request.raw_parameters).to eq([submittable.inputs.keys.first])
+        end
     end
 
     describe '#id' do

data/spec/support/shared/element/capabilities/with_dom.rb

@@ -10,7 +10,7 @@ shared_examples_for 'with_dom' do |html = nil|
 
     describe '#skip_dom' do
         context 'when' do
-            context true do
+            context 'true' do
                 before do
                     with_dom.skip_dom = true
                 end
@@ -20,7 +20,7 @@ shared_examples_for 'with_dom' do |html = nil|
                 end
             end
 
-            context false do
+            context 'false' do
                 before do
                     with_dom.skip_dom = false
                 end
@@ -34,7 +34,7 @@ shared_examples_for 'with_dom' do |html = nil|
 
     describe '#skip_dom?' do
         context 'when #skip_dom is' do
-            context true do
+            context 'true' do
                 before do
                     with_dom.skip_dom = true
                 end
@@ -44,7 +44,7 @@ shared_examples_for 'with_dom' do |html = nil|
                 end
             end
 
-            context false do
+            context 'false' do
                 before do
                     with_dom.skip_dom = false
                 end
@@ -76,6 +76,15 @@ shared_examples_for 'with_dom' do |html = nil|
         it "returns #{described_class::DOM}" do
             expect(with_dom.dom).to be_kind_of described_class::DOM
         end
+
+        context "when #{described_class::DOM}.new raises Inputtable::Error" do
+            it 'returns nil' do
+                subject.auditor = nil
+
+                allow(described_class::DOM).to receive(:new) { raise Arachni::Element::Capabilities::Inputtable::Error }
+                expect(subject.dom).to be_nil
+            end
+        end
     end
 
     describe '#dup' do

data/spec/support/shared/element/capabilities/with_node.rb

@@ -9,7 +9,7 @@ shared_examples_for 'with_node' do |html|
         it 'returns the set node' do
             node = with_node.node
             expect(node.is_a?( Nokogiri::XML::Element )).to be_truthy
-            expect(node.to_s).to eq(Nokogiri::HTML.fragment( with_node.source ).to_s)
+            expect(node.to_s).to eq(Nokogiri::HTML.fragment( with_node.source.dup ).to_s)
         end
     end
 

data/spec/support/shared/element/capabilities/with_source.rb

@@ -14,14 +14,9 @@ shared_examples_for 'with_source' do |source|
 
     describe '#source=' do
         context 'when given' do
-            context String do
+            context 'String' do
                 let(:string) { 'stuff' }
 
-                it 'recodes it' do
-                    expect(string).to receive(:recode)
-                    with_source.source = string
-                end
-
                 it 'sets the #source' do
                     with_source.source = string
                     expect(with_source.source).to eq(string)

data/spec/support/shared/element/dom/locatable.rb

@@ -0,0 +1,20 @@
+shared_examples_for 'locatable_dom' do
+
+    describe '#locate' do
+        it 'locates the live element' do
+            called = false
+            subject.with_browser do |browser|
+                subject.browser = browser
+                browser.load subject.page
+
+                element = subject.locate
+                expect(element).to be_kind_of Selenium::WebDriver::Element
+                called = true
+            end
+
+            subject.auditor.browser_cluster.wait
+            expect(called).to be_truthy
+        end
+    end
+
+end

data/spec/support/shared/element/dom/submittable.rb

@@ -38,19 +38,6 @@ shared_examples_for 'submittable_dom' do
             expect(called).to be_truthy
         end
 
-        it 'sets the #element on the #performer',
-           if: described_class.ancestors.include?( Arachni::Element::Capabilities::WithNode ) do
-
-            called = false
-            subject.submit do |page|
-                expect(page.performer.element).to be_kind_of Watir::HTMLElement
-                called = true
-            end
-
-            subject.auditor.browser_cluster.wait
-            expect(called).to be_truthy
-        end
-
         it 'adds the submission transitions to the Page::DOM#transitions' do
             transitions = []
             subject.with_browser do |browser|
@@ -74,7 +61,7 @@ shared_examples_for 'submittable_dom' do
 
         context 'when the element could not be submitted' do
             it 'does not call the block' do
-                allow(subject).to receive( :trigger ) { false }
+                allow(subject).to receive( :trigger ) { [nil] }
 
                 called = false
                 subject.submit do
@@ -85,8 +72,8 @@ shared_examples_for 'submittable_dom' do
             end
         end
 
-        describe :options do
-            describe :custom_code do
+        describe ':options' do
+            describe ':custom_code' do
                 it 'injects the given code' do
                     called = false
                     title = 'Injected title'
@@ -101,7 +88,7 @@ shared_examples_for 'submittable_dom' do
                 end
             end
 
-            describe :taint do
+            describe ':taint' do
                 it 'sets the Browser::Javascript#taint' do
                     taint = Arachni::Utilities.generate_token
 

data/spec/support/shared/http/message.rb

@@ -11,6 +11,7 @@ shared_examples_for 'Arachni::HTTP::Message' do
                     'X-Stuff' => 'Blah'
                 }
             }
+
             r = described_class.new(options)
             expect(r.headers).to eq(options[:headers])
         end
@@ -41,11 +42,42 @@ shared_examples_for 'Arachni::HTTP::Message' do
             expect(r.url).to be_frozen
         end
 
-        it 'normalizes it' do
-            url = 'HttP://Stuff.Com/'
-            r = described_class.new( url: url )
-            r.url = url
-            expect(r.url).to eq(url.downcase)
+        context 'when :normalize_url is' do
+            context 'not given' do
+                it 'normalizes it' do
+                    url = 'HttP://Stuff.Com/'
+                    r = described_class.new( url: url )
+                    r.url = url
+                    expect(r.url).to eq(url.downcase)
+                end
+            end
+
+            context 'nil' do
+                it 'normalizes it' do
+                    url = 'HttP://Stuff.Com/'
+                    r = described_class.new( url: url, normalize_url: nil )
+                    r.url = url
+                    expect(r.url).to eq(url.downcase)
+                end
+            end
+
+            context 'true' do
+                it 'normalizes it' do
+                    url = 'HttP://Stuff.Com/'
+                    r = described_class.new( url: url, normalize_url: true )
+                    r.url = url
+                    expect(r.url).to eq(url.downcase)
+                end
+            end
+
+            context 'false' do
+                it 'does not normalize it' do
+                    url = 'HttP://Stuff.Com/'
+                    r = described_class.new( url: url, normalize_url: false )
+                    r.url = url
+                    expect(r.url).to eq(url)
+                end
+            end
         end
     end
 

data/spec/support/shared/support/cache.rb

@@ -10,7 +10,8 @@ shared_examples_for 'cache' do
                     expect(described_class.new.capped?).to be_falsey
                 end
             end
-            describe Integer do
+
+            describe 'Integer' do
                 it 'imposes a limit to the size of the cache' do
                     expect(described_class.new( 10 ).capped?).to be_truthy
                 end
@@ -175,7 +176,7 @@ shared_examples_for 'cache' do
         end
     end
 
-    describe '#fetch_or_store' do
+    describe '#fetch' do
         context 'when the passed key exists' do
             it 'returns its value' do
                 old_val = 'my val'
@@ -183,7 +184,7 @@ shared_examples_for 'cache' do
 
                 cache = described_class.new
                 cache[:my_key] = old_val
-                cache.fetch_or_store( :my_key ) { new_val }
+                cache.fetch(:my_key ) { new_val }
 
                 expect(cache[:my_key]).to eq(old_val)
             end
@@ -193,7 +194,7 @@ shared_examples_for 'cache' do
             it 'assigns to it the return value of the given block' do
                 new_val = 'new val'
                 cache = described_class.new
-                cache.fetch_or_store( :my_key ) { new_val }
+                cache.fetch(:my_key ) { new_val }
 
                 expect(cache[:my_key]).to eq(new_val)
             end

data/ui/cli/framework.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -54,7 +54,8 @@ class Framework
     def run
         print_status 'Initializing...'
 
-        get_user_command
+        # Won't work properly on MS Windows.
+        get_user_command if !Arachni.windows?
 
         begin
             # We may need to kill the audit so put it in a thread.
@@ -203,7 +204,7 @@ class Framework
                         'g'     => 'generate a report',
                         'v'     => "#{verbose? ? 'dis' : 'en'}able verbose messages",
                         'd'     => "#{debug? ? 'dis' : 'en'}able debugging messages.\n" <<
-                            "#{' ' * 11}(You can set it to the desired level by sending d[1-3]," <<
+                            "#{' ' * 11}(You can set it to the desired level by sending d[1-4]," <<
                             " current level is #{debug_level})"
                     }.each do |key, action|
                         next if %w(Enter s p).include?( key ) && !@framework.scanning?

data/ui/cli/framework/option_parser.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -43,7 +43,7 @@ class OptionParser < UI::CLI::OptionParser
             verbose_on
         end
 
-        on( '--output-debug [LEVEL 1-3]', Integer, 'Show debugging information.' ) do |level|
+        on( '--output-debug [LEVEL 1-4]', Integer, 'Show debugging information.' ) do |level|
             debug_on( level || 1 )
         end
 
@@ -76,6 +76,12 @@ class OptionParser < UI::CLI::OptionParser
             options.scope.exclude_path_patterns << pattern
         end
 
+        on( '--scope-exclude-file-extensions EXTENSION,EXTENSION2,..',
+            'Exclude resources with the specified extensions.'
+        ) do |extensions|
+            options.scope.exclude_file_extensions = extensions.split(',')
+        end
+
         on( '--scope-exclude-content-pattern PATTERN', Regexp,
                'Exclude pages whose content matches PATTERN.',
                '(Can be used multiple times.)'
@@ -223,6 +229,12 @@ class OptionParser < UI::CLI::OptionParser
             options.audit.parameter_names = true
         end
 
+        on( '--audit-with-raw-payloads',
+            'Inject payloads with and without HTTP encoding.'
+        ) do
+            options.audit.with_raw_payloads = true
+        end
+
         on( '--audit-with-extra-parameter',
             'Inject payloads into extra element parameters.'
         ) do
@@ -403,9 +415,9 @@ class OptionParser < UI::CLI::OptionParser
         separator ''
         separator 'Checks'
 
-        on( '--checks-list [PATTERN]', Regexp,
-               'List available checks based on the provided pattern.',
-               '(If no pattern is provided all checks will be listed.)'
+        on( '--checks-list [GLOB]',
+               'List available checks based on the provided glob.',
+               '(If no glob is provided all checks will be listed.)'
         ) do |pattern|
             list_checks( framework.list_checks( pattern ) )
             exit
@@ -434,9 +446,9 @@ class OptionParser < UI::CLI::OptionParser
         separator ''
         separator 'Plugins'
 
-        on( '--plugins-list [PATTERN]', Regexp,
-               'List available plugins based on the provided pattern.',
-               '(If no pattern is provided all plugins will be listed.)'
+        on( '--plugins-list [GLOB]',
+               'List available plugins based on the provided glob.',
+               '(If no glob is provided all plugins will be listed.)'
         ) do |pattern|
             list_plugins( framework.list_plugins( pattern ) )
             exit

data/ui/cli/option_parser.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/ui/cli/output.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -98,8 +98,8 @@ module Output
     #
     # @param    [String]    str
     def print_error( str = '' )
-        print_color( '[-]', 31, str, $stderr )
-        log_error( str )
+        print_color( "[-] #{caller_location}", 31, str, $stderr )
+        log_error( "#{caller_location}#{str}" )
     end
 
     # Prints the backtrace of an exception as error messages.
@@ -204,7 +204,36 @@ module Output
     def print_debug( str = '', level = 1 )
         return if !debug?( level )
 
-        print_color( "[#{'!' * level}]", 36, str, $stderr )
+        print_color( "[#{'!' * level}] #{caller_location}", 36, str, $stderr )
+    end
+
+    def caller_location
+        file = nil
+        line = nil
+        caller_method = nil
+        Kernel.caller.each do |c|
+            file, line, method = *c.scan( /(.*):(\d+):in `(?:.*\s)?(.*)'/ ).flatten
+            next if file == __FILE__
+
+            caller_method = method
+            break
+        end
+
+        context = nil
+        if caller_method
+            file.gsub!( Options.paths.lib, '' )
+            file.gsub!( Options.paths.root, '' )
+
+            dir = File.dirname( file )
+            dir = '' if dir == '.'
+            dir << File::SEPARATOR if !dir.empty?
+
+            file = "#{dir}#{File.basename( file, '.rb' )}"
+
+            context = "[#{file}##{caller_method}:#{line}]"
+        end
+
+        context
     end
 
     def print_debug_level_1( str = '' )
@@ -219,6 +248,10 @@ module Output
         print_debug( str, 3 )
     end
 
+    def print_debug_level_4( str = '' )
+        print_debug( str, 4 )
+    end
+
     def print_debug_exception( e, level = 1 )
         return if !debug?
 
@@ -327,6 +360,9 @@ module Output
     def debug_level_3?
         debug? 3
     end
+    def debug_level_4?
+        debug? 4
+    end
 
     # Mutes everything but {#print_ok} messages.
     def only_positives

data/ui/cli/reporter.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/ui/cli/reporter/option_parser.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2015 Tasos Laskos <tasos.laskos@arachni-scanner.com>
+    Copyright 2010-2016 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -39,9 +39,9 @@ class OptionParser < UI::CLI::OptionParser
         separator ''
         separator 'Reporters'
 
-        on( '--reporters-list [PATTERN]', Regexp,
-            'List available reporters based on the provided pattern.',
-            '(If no pattern is provided all will be listed.)'
+        on( '--reporters-list [GLOB]',
+            'List available reporters based on the provided glob.',
+            '(If no glob is provided all will be listed.)'
         ) do |pattern|
             list_reporters( framework.list_reporters( pattern ) )
             exit