arachni 1.4 → 1.6.0

data/spec/arachni/browser/javascript_spec.rb

@@ -19,39 +19,24 @@ describe Arachni::Browser::Javascript do
 
     subject { @browser.javascript }
 
-    describe '.events_for' do
-        it 'returns events for the given element' do
-            described_class::EVENTS_PER_ELEMENT.each do |element, events|
-                expect(described_class.events_for( element )).to eq(Set.new(described_class::GLOBAL_EVENTS | events))
-            end
-        end
-    end
+    describe '#wait_till_ready' do
+        it 'waits until the JS environment is #ready?'
 
-    describe '.select_events' do
-        it 'selects only events valid for the given element' do
-            events = {
-                onclick:   'blah();',
-                mouseover: 'blah2();',
-                onselect:  'my-id'
-            }
-            expect(described_class.select_events( :div, events )).to eq({
-                onclick:   'blah();',
-                mouseover: 'blah2();',
-            })
-        end
-    end
+        context 'when it exceeds Options.browser_cluster.job_timeout' do
+            it 'returns' do
+                Arachni::Options.browser_cluster.job_timeout = 5
+                t = Time.now
+
+                @browser.load "#{@taint_tracer_url}/debug"
 
-    describe '.select_event_attributes' do
-        it 'selects only attributes that are events' do
-            attributes = {
-                onclick:     'blah();',
-                onmouseover: 'blah2();',
-                id:          'my-id'
-            }
-            expect(described_class.select_event_attributes( attributes )).to eq({
-                onclick:     'blah();',
-                onmouseover: 'blah2();'
-            })
+                allow(subject).to receive(:ready?) { false }
+
+                subject.wait_till_ready
+                passed = (Time.now - t).floor
+
+                expect(passed).to be >= 5
+                expect(passed).to be <= 6
+            end
         end
     end
 
@@ -166,53 +151,103 @@ describe Arachni::Browser::Javascript do
         end
     end
 
-    describe '#dom_elements_with_events' do
+    describe '#each_dom_element_with_events' do
+        context 'when given a whitelist of tag names' do
+            it 'only returns those types of elements' do
+                @browser.load @dom_monitor_url + 'elements_with_events/whitelist'
+
+                e = []
+                subject.each_dom_element_with_events ['span'] do |element|
+                    e << element
+                end
+
+                expect(e).to eq([
+                    {
+                     'tag_name'   => 'span',
+                     'events'     =>
+                         {
+                             click: [
+                                 'function( parent_click ){}',
+                                 'function( child_click ){}',
+                                 'function( window_click ){}',
+                                 'function( document_click ){}'
+                             ]
+                         },
+                     'attributes' => { 'id' => 'child-span' }
+                    }
+                ])
+            end
+        end
+
         context 'when using event attributes' do
             it 'returns information about all DOM elements along with their events' do
                 @browser.load @dom_monitor_url + 'elements_with_events/attributes'
 
-                expect(subject.dom_elements_with_events).to eq([
+                e = []
+                subject.each_dom_element_with_events do |element|
+                    e << element
+                end
+
+                expect(e).to eq([
                     {
                         'tag_name'   => 'button',
                         'events'     => {
-                            onclick: [ 'handler_1()' ]
+                            click: [ 'handler_1()' ]
                         },
                         'attributes' => { 'onclick' => 'handler_1()', 'id' => 'my-button' }
                     },
                     {
                         'tag_name'   => 'button',
                         'events'     => {
-                            onclick: ['handler_2()']
+                            click: ['handler_2()']
                         },
                         'attributes' => { 'onclick' => 'handler_2()', 'id' => 'my-button2' }
                     },
                     {
                         'tag_name'   => 'button',
                         'events'     => {
-                            onclick: ['handler_3()']
+                            click: ['handler_3()']
                         },
                         'attributes' => { 'onclick' => 'handler_3()', 'id' => 'my-button3' }
                     }
                 ])
             end
+
+            context 'with inappropriate events for the element' do
+                it 'ignores them' do
+                    @browser.load @dom_monitor_url + 'elements_with_events/attributes/inappropriate'
+
+                    e = []
+                    subject.each_dom_element_with_events do |element|
+                        e << element
+                    end
+
+                    expect(e).to be_empty
+                end
+            end
         end
 
         context 'when using event listeners' do
             it 'returns information about all DOM elements along with their events' do
                 @browser.load @dom_monitor_url + 'elements_with_events/listeners'
 
-                expect(subject.dom_elements_with_events).to eq([
+                e = []
+                subject.each_dom_element_with_events do |element|
+                    e << element
+                end
+
+                expect(e).to eq([
                     {
                         'tag_name'   => 'button',
                         'events'     => {
-                            click: ['function (my_button_click) {}', 'function (my_button_click2) {}'],
-                            onmouseover: ['function (my_button_onmouseover) {}']
+                            click: ['function( my_button_click ){}', 'function( my_button_click2 ){}'],
+                            mouseover: ['function( my_button_onmouseover ){}']
                         },
                         'attributes' => { 'id' => 'my-button' } },
                     {
                         'tag_name'   => 'button',
                         'events'     => {
-                            click: ['function (my_button2_click) {}']
+                            click: ['function( my_button2_click ){}']
                         },
                         'attributes' => { 'id' => 'my-button2' } }
                 ])
@@ -220,7 +255,26 @@ describe Arachni::Browser::Javascript do
 
             it 'does not include custom events' do
                 @browser.load @dom_monitor_url + 'elements_with_events/listeners/custom'
-                expect(subject.dom_elements_with_events).to be_empty
+
+                e = []
+                subject.each_dom_element_with_events do |element|
+                    e << element
+                end
+
+                expect(e).to be_empty
+            end
+
+            context 'with inappropriate events for the element' do
+                it 'ignores them' do
+                    @browser.load @dom_monitor_url + 'elements_with_events/listeners/inappropriate'
+
+                    e = []
+                    subject.each_dom_element_with_events do |element|
+                        e << element
+                    end
+
+                    expect(e).to be_empty
+                end
             end
         end
     end
@@ -232,13 +286,6 @@ describe Arachni::Browser::Javascript do
         end
     end
 
-    describe '#intervals' do
-        it 'keeps track of setInterval() timers' do
-            @browser.load( @dom_monitor_url + 'interval-tracker' )
-            expect(subject.intervals).to eq(subject.dom_monitor.intervals)
-        end
-    end
-
     describe '#has_sinks?' do
         context 'when there are execution-flow sinks' do
             it 'returns true' do
@@ -570,18 +617,6 @@ EOHTML
             it 'returns false'
         end
 
-        context 'when the Content-Type does not include text/html' do
-            it 'returns false'
-        end
-
-        context 'when the body does not include HTML identifiers such as' do
-            it 'returns false'
-        end
-
-        context 'when it starts with an HTML doctype' do
-            it 'returns true'
-        end
-
         context 'when it matches the last loaded URL' do
             it 'returns true'
         end

data/spec/arachni/browser_cluster/job_spec.rb

@@ -83,6 +83,7 @@ end
 describe Arachni::BrowserCluster::Job do
     let(:browser_cluster) { MockBrowserCluster.new }
     let(:worker) { MockWorker.new }
+    let(:args) { [1, 2] }
 
     describe '#id' do
         it 'gets incremented with each initialization' do
@@ -164,7 +165,7 @@ describe Arachni::BrowserCluster::Job do
     end
 
     describe '#dup' do
-        subject { JobDupTest.new( never_ending: true, my_data: 'stuff' ) }
+        subject { JobDupTest.new( never_ending: true, my_data: 'stuff', args: args ) }
 
         it 'copies the Job' do
             expect(subject.my_data).to eq('stuff')
@@ -191,13 +192,19 @@ describe Arachni::BrowserCluster::Job do
             expect(dup.time).to eq 10
             expect(subject).to be_timed_out
         end
+
+        it 'preserves #args' do
+            expect(subject.args).to eq args
+
+            dup = subject.dup
+            expect(dup.args).to eq args
+        end
     end
 
     describe '#forward' do
-        subject { JobForwardTest.new( my_data: 'stuff' ) }
+        subject { JobForwardTest.new( args: args, my_data: 'stuff' ) }
 
         it 'sets the original Job as the #forwarder' do
-            id = subject.id
             expect(subject.forward.forwarder).to eq(subject)
         end
 
@@ -218,10 +225,14 @@ describe Arachni::BrowserCluster::Job do
             expect(job.forward.never_ending?).to be_falsey
         end
 
-        it 'does not preserve any existing data' do
+        it 'does not preserve arbitrary data' do
             expect(subject.forward.my_data).to be_nil
         end
 
+        it 'preserves #args' do
+            expect(subject.forward.args).to eq args
+        end
+
         context 'when options are given' do
             it 'sets initialization options' do
                 expect(subject.forward( my_data: 'stuff2' ).my_data).to eq('stuff2')
@@ -230,21 +241,21 @@ describe Arachni::BrowserCluster::Job do
     end
 
     describe '#forward_as' do
-        subject { JobForwardTest.new( my_data: 'stuff' ) }
+        subject { JobForwardTest.new( args: args, my_data: 'stuff' ) }
 
         it 'sets the original Job as the #forwarder' do
             id = subject.id
             expect(subject.forward_as( JobForwardAsTest ).forwarder).to eq(subject)
         end
 
-        it 'creates a new Job type with the same #id' do
+        it 'creates a new Job type with a new #id' do
             expect(subject).not_to be_kind_of JobForwardAsTest
 
             id = subject.id
 
             forwarded = subject.forward_as( JobForwardAsTest )
 
-            expect(forwarded.id).to eq(id)
+            expect(forwarded.id).to_not eq(id)
             expect(forwarded).to be_kind_of JobForwardAsTest
         end
 
@@ -260,7 +271,7 @@ describe Arachni::BrowserCluster::Job do
             expect(job.forward_as( JobForwardAsTest ).never_ending?).to be_falsey
         end
 
-        it 'does not preserve any existing data' do
+        it 'does not preserve arbitrary existing data' do
             expect(subject).not_to be_kind_of JobForwardAsTest
 
             forwarded = subject.forward_as( JobForwardAsTest )
@@ -269,6 +280,10 @@ describe Arachni::BrowserCluster::Job do
             expect(forwarded).to be_kind_of JobForwardAsTest
         end
 
+        it 'preserves #args' do
+            expect(subject.forward.args).to eq args
+        end
+
         context 'when options are given' do
             it 'sets initialization options' do
                 expect(subject).not_to be_kind_of JobForwardAsTest

data/spec/arachni/browser_cluster/jobs/dom_exploration_spec.rb

@@ -60,7 +60,12 @@ describe Arachni::BrowserCluster::Jobs::DOMExploration do
         end
 
         context 'Arachni::Page' do
-            subject { described_class.new( resource: Arachni::Page.from_url( url ) ) }
+            let(:page) { Arachni::Page.from_url( url ) }
+            subject { described_class.new( resource: page ) }
+
+            it 'only stores the DOM' do
+                expect(subject.resource).to eq page.dom
+            end
 
             it 'loads it and explores the DOM' do
                 test subject

data/spec/arachni/browser_cluster/worker_spec.rb

@@ -18,27 +18,15 @@ describe Arachni::BrowserCluster::Worker do
     let(:url) { Arachni::Utilities.normalize_url( web_server_url_for( :browser ) ) }
     let(:job) do
         Arachni::BrowserCluster::Jobs::DOMExploration.new(
-            resource: Arachni::HTTP::Client.get( url + 'explore', mode: :sync )
+            resource: Arachni::Page.from_url( url + 'explore', mode: :sync )
         )
     end
     let(:custom_job) { Factory[:custom_job] }
+    let(:another_custom_job) { Factory[:custom_job] }
     let(:sleep_job) { Factory[:sleep_job] }
     let(:subject) { @cluster.workers.first }
 
     describe '#initialize' do
-        describe ':job_timeout' do
-            it 'sets how much time to allow each job to run' do
-                @worker = described_class.new( job_timeout: 10 )
-                expect(@worker.job_timeout).to eq(10)
-            end
-
-            it "defaults to #{Arachni::OptionGroups::BrowserCluster}#job_timeout" do
-                Arachni::Options.browser_cluster.job_timeout = 5
-                @worker = described_class.new
-                expect(@worker.job_timeout).to eq(5)
-            end
-        end
-
         describe ':max_time_to_live' do
             it 'sets how many jobs should be run before respawning' do
                 @worker = described_class.new( max_time_to_live: 10 )
@@ -57,7 +45,7 @@ describe Arachni::BrowserCluster::Worker do
         it 'processes jobs from #master' do
             expect(subject).to receive(:run_job).with(custom_job)
             @cluster.queue( custom_job ){}
-            @cluster.wait
+            sleep 1
         end
 
         it 'assigns #job to the running job' do
@@ -70,40 +58,16 @@ describe Arachni::BrowserCluster::Worker do
         end
 
         context 'before running the job' do
-            context 'when PhantomJS is dead' do
-                it 'spawns a new one' do
-                    Arachni::Processes::Manager.kill subject.browser_pid
-
-                    dead_lifeline_pid = subject.lifeline_pid
-                    dead_browser_pid  = subject.browser_pid
-
-                    @cluster.queue( custom_job ){}
-                    @cluster.wait
-
-                    expect(subject.browser_pid).not_to eq(dead_browser_pid)
-                    expect(subject.lifeline_pid).not_to eq(dead_lifeline_pid)
-
-                    expect(Arachni::Processes::Manager.alive?( subject.lifeline_pid )).to be_truthy
-                    expect(Arachni::Processes::Manager.alive?( subject.browser_pid )).to be_truthy
-                end
-            end
-
-            context 'when the lifeline is dead' do
+            context 'when the browser is dead' do
                 it 'spawns a new one' do
-                    Arachni::Processes::Manager << subject.browser_pid
-                    Arachni::Processes::Manager.kill subject.lifeline_pid
-
-                    dead_lifeline_pid = subject.lifeline_pid
-                    dead_browser_pid  = subject.browser_pid
+                    pending
 
                     @cluster.queue( custom_job ){}
                     @cluster.wait
 
-                    expect(subject.browser_pid).not_to eq(dead_browser_pid)
-                    expect(subject.lifeline_pid).not_to eq(dead_lifeline_pid)
+                    expect(browser_pid).not_to eq(dead_browser_pid)
 
-                    expect(Arachni::Processes::Manager.alive?( subject.lifeline_pid )).to be_truthy
-                    expect(Arachni::Processes::Manager.alive?( subject.browser_pid )).to be_truthy
+                    expect(Arachni::Processes::Manager.alive?( browser_pid )).to be_truthy
                 end
             end
         end
@@ -116,21 +80,18 @@ describe Arachni::BrowserCluster::Worker do
 
             context 'Selenium::WebDriver::Error::WebDriverError' do
                 it 'respawns' do
-                    expect(custom_job).to receive(:configure_and_run) do
-                        raise Selenium::WebDriver::Error::WebDriverError
-                    end
+                    pending
 
-                    expect(subject.watir).to receive(:close) do
+                    expect(custom_job).to receive(:configure_and_run) do
                         raise Selenium::WebDriver::Error::WebDriverError
                     end
 
                     watir = subject.watir
-                    pid   = subject.browser_pid
 
                     subject.run_job( custom_job )
 
                     expect(watir).not_to eq(subject.watir)
-                    expect(pid).not_to eq(subject.browser_pid)
+                    expect(browser_pid).not_to eq(old_browser_pid)
                 end
             end
         end
@@ -157,16 +118,6 @@ describe Arachni::BrowserCluster::Worker do
                 expect(subject.preloads).to be_empty
             end
 
-            it 'clears #cache' do
-                subject.cache page
-                expect(subject.cache).to be_any
-
-                @cluster.queue( custom_job ) {}
-                @cluster.wait
-
-                expect(subject.cache).to be_empty
-            end
-
             it 'clears #captured_pages' do
                 subject.captured_pages << page
 
@@ -257,52 +208,43 @@ describe Arachni::BrowserCluster::Worker do
 
                     subject.max_time_to_live = 1
 
-                    watir         = subject.watir
-                    pid = subject.browser_pid
+                    watir = subject.watir
 
                     @cluster.queue( custom_job ) {}
+                    @cluster.queue( another_custom_job ) {}
                     @cluster.wait
 
                     expect(watir).not_to eq(subject.watir)
-                    expect(pid).not_to eq(subject.browser_pid)
-                end
-            end
-
-            context 'when cookie clearing raises' do
-                context 'Selenium::WebDriver::Error::NoSuchWindowError' do
-                    it 'respawns' do
-                        allow(subject.watir).to receive(:cookies) do
-                            raise Selenium::WebDriver::Error::NoSuchWindowError
-                        end
-
-                        watir = subject.watir
-                        pid   = subject.browser_pid
-
-                        subject.run_job( custom_job )
-
-                        expect(watir).not_to eq(subject.watir)
-                        expect(pid).not_to eq(subject.browser_pid)
-                    end
                 end
             end
         end
 
-        context 'when the job takes more than #job_timeout' do
+        context 'when a Selenium request takes more than OptionGroup::BrowserCluster#job_timeout' do
             before do
-                subject.job_timeout = 1
+                allow(subject).to receive(:trigger_events) { raise Timeout::Error }
             end
 
             it 'sets Job#time' do
-                @cluster.queue( sleep_job ) {}
+                @cluster.queue( job ) {}
                 @cluster.wait
-                expect(sleep_job.time).to be > 1
-                expect(sleep_job.time).to be < 1.1
+
+                expect(job.time).to be > 0
             end
 
             it 'sets Job#timed_out?' do
-                @cluster.queue( sleep_job ) {}
+                @cluster.queue( job ) {}
+                @cluster.wait
+
+                expect(job).to be_timed_out
+            end
+
+            it 'increments the BrowserCluster timeout count' do
+                time_out_count = Arachni::BrowserCluster.statistics[:time_out_count]
+
+                @cluster.queue( job ) {}
                 @cluster.wait
-                expect(sleep_job).to be_timed_out
+
+                expect(Arachni::BrowserCluster.statistics[:time_out_count]).to eq time_out_count+1
             end
         end
     end