arachni 1.4 → 1.5

data/spec/arachni/check/auditor_spec.rb

@@ -144,7 +144,7 @@ describe Arachni::Check::Auditor do
     describe '.check?' do
         context 'when elements have been provided' do
             it 'restricts the check' do
-                page = Arachni::Page.from_data( url: url, body: 'stuff' )
+                page = Arachni::Page.from_data( url: url, body: 'stuff',headers: [] )
                 allow(page).to receive(:has_script?) { true }
                 auditor.class.info[:elements] =
                     element_classes + [Arachni::Element::Body, Arachni::Element::GenericDOM]
@@ -205,6 +205,7 @@ describe Arachni::Check::Auditor do
                 let(:page) do
                     p = Arachni::Page.from_data(
                         url: url,
+                        headers: [],
                         "#{element.type}s".gsub( '_dom', '').to_sym => [Factory[element.type]]
                     )
                     allow(p.dom).to receive(:depth) { 1 }
@@ -364,7 +365,7 @@ describe Arachni::Check::Auditor do
 
     describe '#log_remote_file_if_exists' do
         it "delegates to #{Arachni::Element::Server}#log_remote_file_if_exists" do
-            sent     = [:stuff, false]
+            sent     = [:stuff, false, { blah: '1' }]
             received = nil
             b        = proc {}
 
@@ -391,6 +392,11 @@ describe Arachni::Check::Auditor do
         let(:issue) { Arachni::Data.issues.last }
         let(:vector) { Arachni::Element::Server.new( page.url ) }
 
+        it 'assigns the extra Issue options' do
+            expect(subject.log_remote_file( page, false )).to be_trusted
+            expect(subject.log_remote_file( page, false, trusted: false )).to_not be_trusted
+        end
+
         context 'given a' do
             describe Arachni::Page do
                 it 'logs it' do
@@ -627,20 +633,19 @@ describe Arachni::Check::Auditor do
         end
     end
 
-    describe '#log_issue' do
+    describe '.log_issue' do
         it 'logs an issue' do
-            auditor.log_issue( issue_data )
+            auditor.class.log_issue( issue_data )
 
             logged_issue = Arachni::Data.issues.first
 
             expect(logged_issue.to_h.tap do |h|
                 h[:page][:dom][:transitions].each { |t| t.delete :time }
-            end).to eq issue.to_h.merge( referring_page: {
-                body: auditor.page.body,
-                dom:  auditor.page.dom.to_h.tap do |h|
-                    h.delete :skip_states
-                end
-            }).tap { |h| h[:page][:dom][:transitions].each { |t| t.delete :time } }
+                h[:referring_page][:dom][:transitions].each { |t| t.delete :time }
+            end).to eq (issue.to_h.tap do |h|
+                h[:page][:dom][:transitions].each { |t| t.delete :time }
+                h[:referring_page][:dom][:transitions].each { |t| t.delete :time }
+            end)
         end
 
         it 'assigns a #referring_page' do
@@ -656,15 +661,31 @@ describe Arachni::Check::Auditor do
 
         context 'when #issue_limit_reached?' do
             it 'does not log the issue' do
-                allow(subject).to receive(:issue_limit_reached?) { true }
+                allow(auditor.class).to receive(:issue_limit_reached?) { true }
 
-                expect(auditor.log_issue( issue_data )).to be_falsey
+                expect(auditor.class.log_issue( issue_data )).to be_falsey
                 expect(Arachni::Data.issues).to be_empty
             end
         end
     end
 
-    describe '#log' do
+    describe '#log_issue' do
+        it 'forwards options to .log_issue' do
+            expect(auditor.class).to receive(:log_issue).with(
+                issue_data.merge( referring_page: auditor.page )
+            )
+            auditor.log_issue( issue_data )
+        end
+
+        it 'assigns a #referring_page' do
+            auditor.log_issue( issue_data )
+
+            logged_issue = Arachni::Data.issues.first
+            expect(logged_issue.referring_page).to eq(auditor.page)
+        end
+    end
+
+    describe '.log' do
         let(:issue_data) do
             d = super()
 
@@ -675,28 +696,28 @@ describe Arachni::Check::Auditor do
         end
 
         it 'preserves the given remarks' do
-            auditor.log( issue_data )
+            auditor.class.log( issue_data )
 
             logged_issue = Arachni::Data.issues.first
             expect(logged_issue.remarks.first).to be_any
         end
 
         it 'returns the issue' do
-            expect(auditor.log( issue_data )).to be_kind_of Arachni::Issue
+            expect(auditor.class.log( issue_data )).to be_kind_of Arachni::Issue
         end
 
         context 'when given a page' do
             after { @framework.http.run }
 
             it 'includes response data' do
-                auditor.log( issue_data )
+                auditor.class.log( issue_data )
                 expect(Arachni::Data.issues.first.response).to eq(
                     issue_data[:page].response
                 )
             end
 
             it 'includes request data' do
-                auditor.log( issue_data )
+                auditor.class.log( issue_data )
                 expect(Arachni::Data.issues.first.request).to eq(
                     issue_data[:page].request
                 )
@@ -704,14 +725,53 @@ describe Arachni::Check::Auditor do
         end
 
         context 'when not given a page' do
-            it 'uses the current page' do
-                issue_data.delete(:page)
-                auditor.log( issue_data )
+            it 'uses the referring page' do
+                issue_data[:referring_page].response.url = @opts.url
+                auditor.class.log( issue_data )
 
                 issue = Arachni::Data.issues.first
-                expect(issue.page.body).to eq(auditor.page.body)
-                expect(issue.response).to eq(auditor.page.response)
-                expect(issue.request).to eq(auditor.page.request)
+
+                expect(issue.page.body).to eq(issue_data[:referring_page].body)
+                expect(issue.response).to eq(issue_data[:referring_page].response)
+                expect(issue.request).to eq(issue_data[:referring_page].request)
+            end
+        end
+
+        context 'when :referring page has been set' do
+            it 'uses it to set the Issue#referring_page' do
+                i = auditor.class.log( issue_data )
+                expect(i.referring_page).to eq issue_data[:referring_page]
+            end
+        end
+
+        context 'when no :referring page has been set' do
+            it 'uses Element#page' do
+                issue_data[:vector].page = issue_data.delete( :referring_page )
+
+                i = auditor.class.log( issue_data )
+                expect(i.referring_page).to eq issue_data[:vector].page
+            end
+        end
+
+        context 'when no referring page data are available' do
+            it 'raises ArgumentError' do
+                expect do
+                    issue_data[:vector].page    = nil
+                    issue_data[:referring_page] = nil
+
+                    auditor.class.log( issue_data )
+                end.to raise_error ArgumentError
+            end
+        end
+
+        context 'when no referring page data are available' do
+            it 'raises ArgumentError' do
+                expect do
+                    issue_data[:vector].page    = nil
+                    issue_data[:referring_page] = nil
+
+                    auditor.class.log( issue_data )
+                end.to raise_error ArgumentError
             end
         end
 
@@ -752,6 +812,24 @@ describe Arachni::Check::Auditor do
         end
     end
 
+    describe '#log' do
+        let(:issue_data) do
+            d = super()
+
+            d[:page].response.url = @opts.url
+            d.merge( page: d[:page] )
+
+            d
+        end
+
+        it 'forwards options to .log_issue' do
+            expect(auditor.class).to receive(:log).with(
+                issue_data.merge( referring_page: auditor.page )
+            )
+            auditor.log( issue_data )
+        end
+    end
+
     describe '#audit' do
         before do
             @seed = 'my_seed'
@@ -901,17 +979,19 @@ describe Arachni::Check::Auditor do
                         # feed the new pages/elements back to the queue
                         @framework.trainer.on_new_page { |p| pages << p }
 
+                        vector = nil
                         # audit until no more new elements appear
                         while (page = pages.pop)
                             auditor = Auditor.new( page, @framework )
-                            auditor.audit( @seed )
+                            auditor.audit( @seed ) do |response, mutation|
+                                next if !response.body.include? @seed
+                                vector = mutation.affected_input_name
+                            end
                             # run audit requests
                             @framework.http.run
                         end
 
-                        expect(Arachni::Data.issues.all.find do |i|
-                            i.vector.affected_input_name == 'you_made_it'
-                        end).to be_truthy
+                        expect(vector).to eq 'you_made_it'
                     end
                 end
 
@@ -926,18 +1006,21 @@ describe Arachni::Check::Auditor do
                         # feed the new pages/elements back to the queue
                         @framework.trainer.on_new_page { |p| pages << p }
 
+                        vector = nil
                         # audit until no more new elements appear
-                        while page = pages.pop
+                        while (page = pages.pop)
                             auditor = Arachni::Check::Base.new( page, @framework )
-                            auditor.audit( @seed, submit: { train: true })
+                            auditor.audit( @seed, submit: { train: true } ) do |response, mutation|
+                                next if !response.body.include?( @seed ) ||
+                                    mutation.affected_input_name != 'you_made_it'
+
+                                vector = mutation.affected_input_name
+                            end
                             # run audit requests
                             @framework.http.run
                         end
 
-                        issue = issues.first
-                        expect(issue).to be_truthy
-                        expect(issue.vector.class).to eq(Arachni::Element::Form)
-                        expect(issue.vector.affected_input_name).to eq('you_made_it')
+                        expect(vector).to eq 'you_made_it'
                     end
                 end
 
@@ -1182,6 +1265,8 @@ describe Arachni::Check::Auditor do
 
             context 'true' do
                 it 'marks the job as done' do
+                    pending
+
                     calls = 0
                     auditor.trace_taint( url ) do
                         calls += 1

data/spec/arachni/element/capabilities/analyzable/signature_spec.rb

@@ -18,7 +18,6 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
     end
 
     describe '#signature_analysis' do
-
         before do
             @seed = 'my_seed'
             Arachni::Framework.reset
@@ -81,7 +80,7 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                     end
                 end
 
-                context 'String' do
+                context 'Regexp' do
                     it 'tries to match the provided pattern' do
                         @positive.signature_analysis(
                             @seed,
@@ -93,6 +92,17 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                         expect(issues.first.vector.seed).to eq(@seed)
                         expect(issues.first).to be_trusted
                     end
+
+                    context 'multi-line' do
+                        it 'raises error' do
+                            expect do
+                                @positive.signature_analysis(
+                                    @seed,
+                                    signatures: /ff/m
+                                )
+                            end.to raise_error ArgumentError
+                        end
+                    end
                 end
 
                 context 'Array' do
@@ -106,6 +116,17 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                         expect(issues.size).to eq(1)
                         expect(issues.first.vector.seed).to eq(@seed)
                     end
+
+                    context 'with multi-line Regexp' do
+                        it 'raises error' do
+                            expect do
+                                @positive.signature_analysis(
+                                    @seed,
+                                    signatures: [/ff/m]
+                                )
+                            end.to raise_error ArgumentError
+                        end
+                    end
                 end
 
                 context 'Hash' do
@@ -128,6 +149,28 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                         expect(issues[0].signature).to eq(regexps[:windows].source)
                     end
 
+                    context 'with multi-line Regexp' do
+                        it 'raises error' do
+                            expect do
+                                @positive.signature_analysis(
+                                    @seed,
+                                    signatures: {
+                                        windows: /ff/m
+                                    }
+                                )
+                            end.to raise_error ArgumentError
+
+                            expect do
+                                @positive.signature_analysis(
+                                    @seed,
+                                    signatures: {
+                                        windows: [/ff/m]
+                                    }
+                                )
+                            end.to raise_error ArgumentError
+                        end
+                    end
+
                     context 'when the payloads are per platform' do
                         it 'only tries to matches the regexps for that platform' do
                             issues = []
@@ -168,7 +211,7 @@ describe Arachni::Element::Capabilities::Analyzable::Signature do
                             end
                         end
 
-                        context 'when there is not a payload for the regexp platform' do
+                        context 'when there is not a payload for the platform' do
                             it 'matches against all payload responses and assigns the pattern platform to the issue' do
                                 payloads = {
                                     windows: "#{@seed} windows",

data/spec/arachni/element/cookie/dom_spec.rb

@@ -11,7 +11,7 @@ describe Arachni::Element::Cookie::DOM do
     it_should_behave_like 'auditable_dom'
 
     def auditable_extract_parameters( page )
-        Hash[[page.document.css('#container').text.split( '=' )]]
+        Hash[[Nokogiri::HTML(page.body).css('#container').text.split( '=' )]]
     end
 
     def run

data/spec/arachni/element/cookie_spec.rb

@@ -11,6 +11,8 @@ describe Arachni::Element::Cookie do
     it_should_behave_like 'inputtable', single_input: true
     it_should_behave_like 'mutable',    single_input: true
     it_should_behave_like 'auditable'
+    it_should_behave_like 'buffered_auditable'
+    it_should_behave_like 'line_buffered_auditable'
 
     before :each do
         @framework ||= Arachni::Framework.new
@@ -59,6 +61,39 @@ describe Arachni::Element::Cookie do
                 end
             end
         end
+
+        context 'domain' do
+            context 'specified' do
+                subject do
+                    described_class.new(
+                        url:     "#{url}submit",
+                        name:    inputs.keys.first,
+                        value:   inputs.values.first,
+                        expires: Time.now + 99999999999,
+                        domain:  '.localhost'
+                    )
+                end
+
+                it 'sets it to the given value' do
+                    expect(subject.domain).to eq '.localhost'
+                end
+            end
+
+            context 'missing' do
+                subject do
+                    described_class.new(
+                        url:     "#{url}submit",
+                        name:    inputs.keys.first,
+                        value:   inputs.values.first,
+                        expires: Time.now + 99999999999
+                    )
+                end
+
+                it 'sets it to the URL host' do
+                    expect(subject.domain).to eq Arachni::URI(url).host
+                end
+            end
+        end
     end
 
     describe '#to_rpc_data' do
@@ -235,7 +270,7 @@ describe Arachni::Element::Cookie do
                 comment:     nil,
                 secure:      nil,
                 path:        '/submit',
-                domain:      '127.0.0.2',
+                domain:      Arachni::URI(url).host,
                 httponly:    false
             })
         end
@@ -295,32 +330,39 @@ describe Arachni::Element::Cookie do
     end
 
     describe '#to_set_cookie' do
-        it 'returns a string suitable for the Set-Cookie HTTP response header' do
-            c = described_class.new(
-                url:      url,
-                name:     'blah=ha%',
-                value:    'some stuff ;',
-                secure:   true,
-                httponly: true
-            )
+        context 'when the cookie is for all subdomains' do
+            it 'includes a Domain attribute' do
+                c = described_class.new(
+                    url:    url,
+                    name:   'blah=ha%',
+                    value:  'some stuff ;',
+                    path:   '/stuff',
+                    domain: '.localhost'
+                )
 
-            expect(c.to_set_cookie).to eq(
-                'blah%3Dha%25=some+stuff+%3B; Path=/; Secure; HttpOnly'
-            )
-            expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
+                expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
+                expect(c.to_set_cookie).to eq(
+                    'blah%3Dha%25=some+stuff+%3B; Path=/stuff; Domain=.localhost'
+                )
+            end
+        end
 
-            c = described_class.new(
-                url:    url,
-                name:   'blah=ha%',
-                value:  'some stuff ;',
-                path:   '/stuff',
-                domain: '.localhost'
-            )
+        context 'when the cookie is for a single domain' do
+            it 'does not include a Domain attribute' do
+                c = described_class.new(
+                    url:      url,
+                    name:     'blah=ha%',
+                    value:    'some stuff ;',
+                    secure:   true,
+                    httponly: true,
+                    domain:   'localhost'
+                )
 
-            expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
-            expect(c.to_set_cookie).to eq(
-                'blah%3Dha%25=some+stuff+%3B; Path=/stuff'
-            )
+                expect(c.to_set_cookie).to eq(
+                    'blah%3Dha%25=some+stuff+%3B; Path=/; Secure; HttpOnly'
+                )
+                expect(described_class.from_set_cookie( url, c.to_set_cookie ).first).to eq(c)
+            end
         end
     end
 
@@ -337,7 +379,7 @@ describe Arachni::Element::Cookie do
         end
 
         context 'when there are raw data' do
-            context 'and is not a mutation' do
+            context 'and has not been updated' do
                 it 'returns them' do
                     c = described_class.new(
                         url:    url,
@@ -350,7 +392,7 @@ describe Arachni::Element::Cookie do
                 end
             end
 
-            context 'and is a mutation' do
+            context 'and has been updated' do
                 it 'returns the encoded name/value pair' do
                     c = described_class.new(
                         url:    url,
@@ -359,7 +401,7 @@ describe Arachni::Element::Cookie do
                         raw_name: 'blah',
                         raw_value: 'blah2'
                     )
-                    expect(c).to receive(:mutation?) { true }
+                    expect(c).to receive(:updated?) { true }
                     expect(c.to_s).to eq('blah%3Dha%25=some+stuff+%3B')
                 end
             end
@@ -412,28 +454,32 @@ describe Arachni::Element::Cookie do
             cookie = cookies.shift
             expect(cookie.action).to eq(url)
             expect(cookie.url).to eq(url)
-            expect(cookie.inputs).to eq({ 'NAME' => 'OP5jTLV6VhYHADJAbJ1ZR@L8~081210' })
-            expect(cookie.simple).to eq({ 'NAME' => 'OP5jTLV6VhYHADJAbJ1ZR@L8~081210' })
+            expect(cookie.inputs).to eq({ 'coo@ki e2' => 'blah val2@' })
+            expect(cookie.simple).to eq({ 'coo@ki e2' => 'blah val2@' })
             expect(cookie.domain).to eq('.blah-domain')
             expect(cookie.path).to eq('/')
             expect(cookie.secure).to eq(false)
             expect(cookie.session?).to eq(false)
             expect(cookie.expires).to eq(Time.parse( '2020-08-09 16:59:20 +0300' ))
-            expect(cookie.name).to eq('NAME')
-            expect(cookie.value).to eq('OP5jTLV6VhYHADJAbJ1ZR@L8~081210')
+            expect(cookie.name).to eq('coo@ki e2')
+            expect(cookie.raw_name).to eq('coo%40ki+e2')
+            expect(cookie.value).to eq('blah val2@')
+            expect(cookie.raw_value).to eq('blah+val2%40')
 
             cookie = cookies.shift
             expect(cookie.action).to eq(url)
             expect(cookie.url).to eq(url)
-            expect(cookie.inputs).to eq({ '_superapp_session' => 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg%3D%3D--810acaa3759101ed79740e25de31e0c5bad76cdc' })
-            expect(cookie.simple).to eq({ '_superapp_session' => 'BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg%3D%3D--810acaa3759101ed79740e25de31e0c5bad76cdc' })
+            expect(cookie.inputs).to eq({ '_superapp_session' => 'MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA==' })
+            expect(cookie.simple).to eq({ '_superapp_session' => 'MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA==' })
             expect(cookie.domain).to eq('192.168.1.1')
             expect(cookie.path).to eq('/')
             expect(cookie.secure).to eq(false)
             expect(cookie.session?).to eq(true)
             expect(cookie.expires).to be_nil
             expect(cookie.name).to eq('_superapp_session')
-            expect(cookie.value).to eq('BAh7CkkiD3Nlc3Npb25faWQGOgZFRiIlNWMyOWY5MjE5YmU0MWMzMWM0ZGQxNTdkNzJkOTFmZTRJIhBfY3NyZl90b2tlbgY7AEZJIjF6RStYQzdONGxScUZybWxhbUwwUDI2RWZuai9laWVsS3FKRXhZYnlQUmJjPQY7AEZJIgtsb2NhbGUGOwBGSSIHZW4GOwBGSSIVdXNlcl9jcmVkZW50aWFscwY7AEZJIgGAOThiOGU5ZTcwMDFlOGI4N2IzNjQxMjlkNWYxNGExYzg3NjY5ZjE1ZjFjMDM3MWJiNjg1OGFlOTBlNjQxM2I1Y2JiODlkNTExMjU1MzBhMDk0ZjlmN2JlNjAyZTMzMjYxNzc5OGM2OTg1ZGRlYzgxNmFlZmEzYmRjNDk4YTBjNzcGOwBUSSIYdXNlcl9jcmVkZW50aWFsc19pZAY7AEZpBg==--810acaa3759101ed79740e25de31e0c5bad76cdc')
+            expect(cookie.raw_name).to eq('_superapp_session')
+            expect(cookie.value).to eq('MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA==')
+            expect(cookie.raw_value).to eq('MzE4OjEzNzU0Mzc0OTc4NDI6MmY3YzkxMTkwZDE5MTRmNjBlYjY4OGQ5ZjczMTU1ZTQzNGM2Y2IwNA%3D%3D')
         end
     end
 
@@ -450,46 +496,61 @@ describe Arachni::Element::Cookie do
         end
     end
 
+    describe '.from_parser' do
+        let(:parser) do
+            Arachni::Parser.new(
+                Arachni::HTTP::Response.new(
+                    url:  url,
+                    body: html,
+                    headers: {
+                        'Content-Type' => 'text/html'
+                    })
+            )
+        end
 
-    describe '.from_document' do
         context 'when there are any set-cookie attributes in http-equiv' do
-            context 'with a String document' do
-                it 'returns an array of cookies' do
-                    html = <<-EOHTML
+            let(:html) do
+                <<-EOHTML
                     <html>
                     <head>
                         <meta http-equiv="Set-Cookie" content="cookie=val+1; httponly">
                         <meta http-equiv="Set-Cookie" content="cookie2+1=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly; secure">
                     </head>
                     </html>
-                    EOHTML
-
-                    cookies = described_class.from_document( 'http://test.com', html )
-                    expect(cookies.size).to eq(2)
-
-                    cookie = cookies.shift
-                    expect(cookie.name).to eq('cookie')
-                    expect(cookie.value).to eq('val 1')
-                    expect(cookie.raw_name).to eq('cookie')
-                    expect(cookie.raw_value).to eq('val+1')
-                    expect(cookie.expired?).to eq(false)
-                    expect(cookie.session?).to eq(true)
-                    expect(cookie.secure?).to eq(false)
-
-                    cookie = cookies.shift
-                    expect(cookie.name).to eq('cookie2 1')
-                    expect(cookie.value).to eq('val2')
-                    expect(cookie.raw_name).to eq('cookie2+1')
-                    expect(cookie.raw_value).to eq('val2')
-                    expect(cookie.path).to eq('/')
-                    expect(cookie.domain).to eq('.foo.com')
-                    expect(cookie.secure?).to eq(true)
-                    expect(cookie.expired?).to eq(true)
-                end
+                EOHTML
             end
+
+            it 'returns an array of cookies' do
+                cookies = described_class.from_parser( parser )
+                expect(cookies.size).to eq(2)
+
+                cookie = cookies.shift
+                expect(cookie.name).to eq('cookie')
+                expect(cookie.value).to eq('val 1')
+                expect(cookie.raw_name).to eq('cookie')
+                expect(cookie.raw_value).to eq('val+1')
+                expect(cookie.expired?).to eq(false)
+                expect(cookie.session?).to eq(true)
+                expect(cookie.secure?).to eq(false)
+
+                cookie = cookies.shift
+                expect(cookie.name).to eq('cookie2 1')
+                expect(cookie.value).to eq('val2')
+                expect(cookie.raw_name).to eq('cookie2+1')
+                expect(cookie.raw_value).to eq('val2')
+                expect(cookie.path).to eq('/')
+                expect(cookie.domain).to eq('.foo.com')
+                expect(cookie.secure?).to eq(true)
+                expect(cookie.expired?).to eq(true)
+            end
+
             context 'with an empty string' do
+                let(:html) do
+                    ''
+                end
+
                 it 'returns an empty array' do
-                     expect(described_class.from_document( '', '' )).to be_empty
+                     expect(described_class.from_parser( parser )).to be_empty
                 end
             end
         end
@@ -575,6 +636,40 @@ describe Arachni::Element::Cookie do
             end
         end
 
+        context 'when there is a domain' do
+            context 'and it starts with a dot' do
+                it 'uses it verbatim' do
+                    sc = 'coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=.test.com; HttpOnly'
+                    cookie = described_class.from_set_cookie( 'http://test.com/stuff', sc ).first
+                    expect(cookie.domain).to eq '.test.com'
+                end
+            end
+
+            context 'and it does not start with a dot' do
+                it 'prefixes it with a dot' do
+                    sc = 'coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=test.com; HttpOnly'
+                    cookie = described_class.from_set_cookie( 'http://test.com/stuff', sc ).first
+                    expect(cookie.domain).to eq '.test.com'
+                end
+            end
+
+            context 'and it is an IP address' do
+                it 'uses it verbatim' do
+                    sc = 'coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=127.0.0.2; HttpOnly'
+                    cookie = described_class.from_set_cookie( 'http://test.com/stuff', sc ).first
+                    expect(cookie.domain).to eq '127.0.0.2'
+                end
+            end
+        end
+
+        context 'when there is no domain' do
+            it 'uses it URL host' do
+                sc = 'coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly'
+                cookie = described_class.from_set_cookie( 'http://test.com/stuff', sc ).first
+                expect(cookie.domain).to eq 'test.com'
+            end
+        end
+
         context 'when its value is' do
             let(:value) { 'a' * size }
             let(:cookie) { "cookie=#{value}; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Domain=.foo.com; HttpOnly" }