arachni 1.4 → 1.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +5 -5
- data/CHANGELOG.md +195 -0
- data/Gemfile +4 -4
- data/LICENSE.md +1 -1
- data/README.md +7 -3
- data/Rakefile +1 -43
- data/arachni.gemspec +35 -30
- data/bin/arachni +1 -1
- data/bin/arachni_console +1 -1
- data/bin/arachni_multi +6 -1
- data/bin/arachni_reporter +1 -1
- data/bin/arachni_reproduce +12 -0
- data/bin/arachni_rest_server +1 -1
- data/bin/arachni_restore +1 -1
- data/bin/arachni_rpc +6 -1
- data/bin/arachni_rpcd +1 -1
- data/bin/arachni_rpcd_monitor +6 -1
- data/bin/arachni_script +1 -1
- data/components/checks/active/code_injection.rb +1 -1
- data/components/checks/active/code_injection_php_input_wrapper.rb +1 -1
- data/components/checks/active/code_injection_timing.rb +1 -1
- data/components/checks/active/csrf.rb +20 -75
- data/components/checks/active/file_inclusion.rb +1 -1
- data/components/checks/active/ldap_injection.rb +1 -1
- data/components/checks/active/no_sql_injection.rb +1 -1
- data/components/checks/active/no_sql_injection_differential.rb +3 -3
- data/components/checks/active/os_cmd_injection.rb +1 -1
- data/components/checks/active/os_cmd_injection_timing.rb +1 -1
- data/components/checks/active/path_traversal.rb +3 -3
- data/components/checks/active/response_splitting.rb +1 -1
- data/components/checks/active/rfi.rb +1 -1
- data/components/checks/active/session_fixation.rb +1 -1
- data/components/checks/active/source_code_disclosure.rb +1 -1
- data/components/checks/active/sql_injection/regexps/hsqldb.yaml +1 -0
- data/components/checks/active/sql_injection/substrings/hsqldb +1 -0
- data/components/checks/active/sql_injection/substrings/java +4 -0
- data/components/checks/active/sql_injection/substrings/oracle +0 -1
- data/components/checks/active/sql_injection/substrings/sqlite +1 -0
- data/components/checks/active/sql_injection.rb +1 -1
- data/components/checks/active/sql_injection_differential.rb +3 -3
- data/components/checks/active/sql_injection_timing.rb +1 -1
- data/components/checks/active/trainer.rb +1 -1
- data/components/checks/active/unvalidated_redirect.rb +34 -11
- data/components/checks/active/unvalidated_redirect_dom.rb +4 -4
- data/components/checks/active/xpath_injection.rb +1 -1
- data/components/checks/active/xss.rb +54 -29
- data/components/checks/active/xss_dom.rb +15 -11
- data/components/checks/active/xss_dom_script_context.rb +4 -6
- data/components/checks/active/xss_event.rb +46 -34
- data/components/checks/active/xss_path.rb +9 -6
- data/components/checks/active/xss_script_context.rb +100 -47
- data/components/checks/active/xss_tag.rb +41 -15
- data/components/checks/active/xxe.rb +1 -1
- data/components/checks/passive/allowed_methods.rb +1 -1
- data/components/checks/passive/backdoors.rb +1 -1
- data/components/checks/passive/backup_directories.rb +15 -3
- data/components/checks/passive/backup_files.rb +39 -6
- data/components/checks/passive/common_admin_interfaces/admin-panels.txt +1 -0
- data/components/checks/passive/common_admin_interfaces.rb +1 -1
- data/components/checks/passive/common_directories/directories.txt +1 -0
- data/components/checks/passive/common_directories.rb +1 -1
- data/components/checks/passive/common_files.rb +1 -1
- data/components/checks/passive/directory_listing.rb +1 -1
- data/components/checks/passive/grep/captcha.rb +8 -9
- data/components/checks/passive/grep/cookie_set_for_parent_domain.rb +1 -1
- data/components/checks/passive/grep/credit_card.rb +1 -1
- data/components/checks/passive/grep/cvs_svn_users.rb +1 -1
- data/components/checks/passive/grep/emails.rb +1 -1
- data/components/checks/passive/grep/form_upload.rb +3 -5
- data/components/checks/passive/grep/hsts.rb +1 -1
- data/components/checks/passive/grep/html_objects.rb +1 -1
- data/components/checks/passive/grep/http_only_cookies.rb +1 -1
- data/components/checks/passive/grep/insecure_cookies.rb +5 -5
- data/components/checks/passive/grep/insecure_cors_policy.rb +1 -1
- data/components/checks/passive/grep/mixed_resource.rb +4 -4
- data/components/checks/passive/grep/password_autocomplete.rb +1 -1
- data/components/checks/passive/grep/private_ip.rb +1 -1
- data/components/checks/passive/grep/ssn.rb +1 -1
- data/components/checks/passive/grep/unencrypted_password_forms.rb +3 -3
- data/components/checks/passive/grep/x_frame_options.rb +4 -4
- data/components/checks/passive/htaccess_limit.rb +1 -1
- data/components/checks/passive/http_put.rb +1 -1
- data/components/checks/passive/insecure_client_access_policy.rb +2 -2
- data/components/checks/passive/insecure_cross_domain_policy_access.rb +2 -2
- data/components/checks/passive/insecure_cross_domain_policy_headers.rb +2 -2
- data/components/checks/passive/interesting_responses.rb +1 -1
- data/components/checks/passive/localstart_asp.rb +1 -1
- data/components/checks/passive/origin_spoof_access_restriction_bypass.rb +1 -1
- data/components/checks/passive/webdav.rb +1 -1
- data/components/checks/passive/xst.rb +10 -12
- data/components/fingerprinters/frameworks/aspx_mvc.rb +1 -1
- data/components/fingerprinters/frameworks/cakephp.rb +1 -1
- data/components/fingerprinters/frameworks/cherrypy.rb +1 -1
- data/components/fingerprinters/frameworks/django.rb +1 -1
- data/components/fingerprinters/frameworks/jsf.rb +1 -1
- data/components/fingerprinters/frameworks/nette.rb +1 -1
- data/components/fingerprinters/frameworks/rack.rb +1 -1
- data/components/fingerprinters/frameworks/rails.rb +1 -1
- data/components/fingerprinters/frameworks/symfony.rb +1 -1
- data/components/fingerprinters/languages/asp.rb +1 -1
- data/components/fingerprinters/languages/aspx.rb +1 -1
- data/components/fingerprinters/languages/java.rb +1 -1
- data/components/fingerprinters/languages/php.rb +1 -1
- data/components/fingerprinters/languages/python.rb +1 -1
- data/components/fingerprinters/languages/ruby.rb +1 -1
- data/components/fingerprinters/os/bsd.rb +1 -1
- data/components/fingerprinters/os/linux.rb +1 -1
- data/components/fingerprinters/os/solaris.rb +1 -1
- data/components/fingerprinters/os/unix.rb +1 -1
- data/components/fingerprinters/os/windows.rb +1 -1
- data/components/fingerprinters/servers/apache.rb +1 -1
- data/components/fingerprinters/servers/gunicorn.rb +1 -1
- data/components/fingerprinters/servers/iis.rb +1 -1
- data/components/fingerprinters/servers/jetty.rb +1 -1
- data/components/fingerprinters/servers/nginx.rb +1 -1
- data/components/fingerprinters/servers/tomcat.rb +1 -1
- data/components/path_extractors/anchors.rb +3 -5
- data/components/path_extractors/areas.rb +3 -4
- data/components/path_extractors/comments.rb +4 -5
- data/components/path_extractors/data_url.rb +4 -5
- data/components/path_extractors/forms.rb +3 -4
- data/components/path_extractors/frames.rb +3 -5
- data/components/path_extractors/generic.rb +3 -1
- data/components/path_extractors/links.rb +3 -4
- data/components/path_extractors/meta_refresh.rb +11 -17
- data/components/path_extractors/scripts.rb +18 -15
- data/components/plugins/autologin.rb +3 -2
- data/components/plugins/beep_notify.rb +1 -1
- data/components/plugins/content_types.rb +1 -1
- data/components/plugins/cookie_collector.rb +1 -1
- data/components/plugins/debug/browser_cluster_job_monitor.rb +60 -0
- data/components/plugins/defaults/autothrottle.rb +1 -1
- data/components/plugins/defaults/healthmap.rb +3 -1
- data/components/plugins/defaults/meta/remedies/discovery.rb +1 -1
- data/components/plugins/defaults/meta/remedies/timing_attacks.rb +1 -1
- data/components/plugins/defaults/meta/uniformity.rb +1 -1
- data/components/plugins/email_notify.rb +26 -9
- data/components/plugins/exec.rb +1 -1
- data/components/plugins/form_dicattack.rb +3 -4
- data/components/plugins/headers_collector.rb +1 -1
- data/components/plugins/http_dicattack.rb +4 -5
- data/components/plugins/login_script.rb +2 -2
- data/components/plugins/metrics.rb +44 -18
- data/components/plugins/page_dump.rb +60 -0
- data/components/plugins/proxy/panel/verify_login_sequence.html.erb +1 -1
- data/components/plugins/proxy/template_scope.rb +6 -1
- data/components/plugins/proxy.rb +44 -31
- data/components/plugins/rate_limiter.rb +80 -0
- data/components/plugins/restrict_to_dom_state.rb +1 -1
- data/components/plugins/script.rb +1 -1
- data/components/plugins/uncommon_headers.rb +1 -1
- data/components/plugins/vector_collector.rb +1 -1
- data/components/plugins/vector_feed.rb +1 -1
- data/components/plugins/waf_detector.rb +3 -3
- data/components/plugins/webhook_notify.rb +99 -0
- data/components/reporters/ap.rb +1 -1
- data/components/reporters/html/default/configuration.erb +2 -0
- data/components/reporters/html/default.erb +3 -2
- data/components/reporters/html.rb +5 -8
- data/components/reporters/json.rb +1 -1
- data/components/reporters/marshal.rb +1 -1
- data/components/reporters/plugin_formatters/html/autologin.rb +1 -1
- data/components/reporters/plugin_formatters/html/content_types.rb +1 -1
- data/components/reporters/plugin_formatters/html/cookie_collector.rb +1 -1
- data/components/reporters/plugin_formatters/html/exec.rb +1 -1
- data/components/reporters/plugin_formatters/html/form_dicattack.rb +1 -1
- data/components/reporters/plugin_formatters/html/healthmap.rb +1 -1
- data/components/reporters/plugin_formatters/html/http_dicattack.rb +1 -1
- data/components/reporters/plugin_formatters/html/login_script.rb +1 -1
- data/components/reporters/plugin_formatters/html/metrics.rb +46 -1
- data/components/reporters/plugin_formatters/html/uncommon_headers.rb +1 -1
- data/components/reporters/plugin_formatters/html/uniformity.rb +1 -1
- data/components/reporters/plugin_formatters/html/vector_collector.rb +1 -1
- data/components/reporters/plugin_formatters/html/waf_detector.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/autologin.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/content_types.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/cookie_collector.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/exec.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/form_dicattack.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/healthmap.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/http_dicattack.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/login_script.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/metrics.rb +11 -1
- data/components/reporters/plugin_formatters/stdout/uncommon_headers.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/uniformity.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/vector_collector.rb +1 -1
- data/components/reporters/plugin_formatters/stdout/waf_detector.rb +1 -1
- data/components/reporters/plugin_formatters/xml/autologin.rb +1 -1
- data/components/reporters/plugin_formatters/xml/content_types.rb +10 -7
- data/components/reporters/plugin_formatters/xml/cookie_collector.rb +6 -3
- data/components/reporters/plugin_formatters/xml/exec.rb +1 -1
- data/components/reporters/plugin_formatters/xml/form_dicattack.rb +1 -1
- data/components/reporters/plugin_formatters/xml/healthmap.rb +1 -1
- data/components/reporters/plugin_formatters/xml/http_dicattack.rb +1 -1
- data/components/reporters/plugin_formatters/xml/login_script.rb +1 -1
- data/components/reporters/plugin_formatters/xml/metrics.rb +1 -1
- data/components/reporters/plugin_formatters/xml/uncommon_headers.rb +5 -2
- data/components/reporters/plugin_formatters/xml/uniformity.rb +1 -1
- data/components/reporters/plugin_formatters/xml/vector_collector.rb +8 -5
- data/components/reporters/plugin_formatters/xml/waf_detector.rb +1 -1
- data/components/reporters/stdout.rb +3 -2
- data/components/reporters/txt.rb +1 -1
- data/components/reporters/xml/schema.xsd +29 -13
- data/components/reporters/xml.rb +40 -23
- data/components/reporters/yaml.rb +1 -1
- data/config/write_paths.yml +4 -0
- data/lib/arachni/banner.rb +1 -1
- data/lib/arachni/browser/element_locator.rb +9 -5
- data/lib/arachni/browser/javascript/dom_monitor.rb +1 -1
- data/lib/arachni/browser/javascript/proxy/stub.rb +1 -1
- data/lib/arachni/browser/javascript/proxy.rb +1 -1
- data/lib/arachni/browser/javascript/scripts/dom_monitor.js +329 -72
- data/lib/arachni/browser/javascript/scripts/polyfills.js +0 -28
- data/lib/arachni/browser/javascript/scripts/taint_tracer.js +81 -25
- data/lib/arachni/browser/javascript/taint_tracer/frame/called_function.rb +1 -1
- data/lib/arachni/browser/javascript/taint_tracer/frame.rb +1 -1
- data/lib/arachni/browser/javascript/taint_tracer/sink/base.rb +1 -1
- data/lib/arachni/browser/javascript/taint_tracer/sink/data_flow.rb +1 -1
- data/lib/arachni/browser/javascript/taint_tracer/sink/execution_flow.rb +1 -1
- data/lib/arachni/browser/javascript/taint_tracer.rb +1 -1
- data/lib/arachni/browser/javascript.rb +111 -198
- data/lib/arachni/browser.rb +309 -382
- data/lib/arachni/browser_cluster/job/result.rb +1 -1
- data/lib/arachni/browser_cluster/job.rb +9 -2
- data/lib/arachni/browser_cluster/jobs/browser_provider.rb +8 -2
- data/lib/arachni/browser_cluster/jobs/dom_exploration/event_trigger/result.rb +1 -1
- data/lib/arachni/browser_cluster/jobs/dom_exploration/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/jobs/dom_exploration/result.rb +1 -1
- data/lib/arachni/browser_cluster/jobs/dom_exploration.rb +13 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger/result.rb +1 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace/event_trigger.rb +1 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace/result.rb +1 -1
- data/lib/arachni/browser_cluster/jobs/taint_trace.rb +1 -1
- data/lib/arachni/browser_cluster/worker.rb +97 -87
- data/lib/arachni/browser_cluster.rb +79 -62
- data/lib/arachni/check/auditor.rb +161 -155
- data/lib/arachni/check/base.rb +1 -1
- data/lib/arachni/check/manager.rb +1 -1
- data/lib/arachni/check.rb +1 -1
- data/lib/arachni/component/base.rb +3 -1
- data/lib/arachni/component/manager.rb +1 -1
- data/lib/arachni/component/options/address.rb +1 -1
- data/lib/arachni/component/options/base.rb +1 -1
- data/lib/arachni/component/options/bool.rb +1 -1
- data/lib/arachni/component/options/float.rb +1 -1
- data/lib/arachni/component/options/int.rb +1 -1
- data/lib/arachni/component/options/multiple_choice.rb +1 -1
- data/lib/arachni/component/options/object.rb +1 -1
- data/lib/arachni/component/options/path.rb +1 -1
- data/lib/arachni/component/options/port.rb +1 -1
- data/lib/arachni/component/options/string.rb +1 -1
- data/lib/arachni/component/options/url.rb +1 -1
- data/lib/arachni/component/options.rb +1 -1
- data/lib/arachni/component/output.rb +8 -2
- data/lib/arachni/component/utilities.rb +1 -1
- data/lib/arachni/component.rb +1 -1
- data/lib/arachni/data/framework/rpc.rb +2 -2
- data/lib/arachni/data/framework.rb +3 -2
- data/lib/arachni/data/issues.rb +1 -1
- data/lib/arachni/data/plugins.rb +1 -1
- data/lib/arachni/data/session.rb +1 -1
- data/lib/arachni/data.rb +1 -1
- data/lib/arachni/element/base.rb +1 -1
- data/lib/arachni/element/body.rb +1 -1
- data/lib/arachni/element/capabilities/analyzable/differential.rb +142 -175
- data/lib/arachni/element/capabilities/analyzable/signature.rb +40 -18
- data/lib/arachni/element/capabilities/analyzable/timeout.rb +1 -1
- data/lib/arachni/element/capabilities/analyzable.rb +1 -1
- data/lib/arachni/element/capabilities/auditable/buffered.rb +92 -0
- data/lib/arachni/element/capabilities/auditable/line_buffered.rb +103 -0
- data/lib/arachni/element/capabilities/auditable.rb +2 -8
- data/lib/arachni/element/capabilities/dom_only.rb +1 -1
- data/lib/arachni/element/capabilities/inputtable.rb +6 -2
- data/lib/arachni/element/capabilities/mutable.rb +1 -1
- data/lib/arachni/element/capabilities/refreshable.rb +1 -1
- data/lib/arachni/element/capabilities/submittable.rb +1 -1
- data/lib/arachni/element/capabilities/with_auditor/output.rb +4 -3
- data/lib/arachni/element/capabilities/with_auditor.rb +1 -1
- data/lib/arachni/element/capabilities/with_dom.rb +1 -1
- data/lib/arachni/element/capabilities/with_node.rb +3 -3
- data/lib/arachni/element/capabilities/with_scope/scope.rb +1 -1
- data/lib/arachni/element/capabilities/with_scope.rb +1 -1
- data/lib/arachni/element/capabilities/with_source.rb +2 -2
- data/lib/arachni/element/cookie/capabilities/inputtable.rb +1 -1
- data/lib/arachni/element/cookie/capabilities/mutable.rb +1 -1
- data/lib/arachni/element/cookie/capabilities/with_dom.rb +1 -1
- data/lib/arachni/element/cookie/dom.rb +1 -1
- data/lib/arachni/element/cookie.rb +49 -24
- data/lib/arachni/element/dom/capabilities/auditable.rb +44 -3
- data/lib/arachni/element/dom/capabilities/inputtable.rb +1 -1
- data/lib/arachni/element/dom/capabilities/locatable.rb +1 -1
- data/lib/arachni/element/dom/capabilities/mutable.rb +7 -3
- data/lib/arachni/element/dom/capabilities/submittable.rb +51 -22
- data/lib/arachni/element/dom.rb +1 -1
- data/lib/arachni/element/form/capabilities/auditable.rb +1 -1
- data/lib/arachni/element/form/capabilities/mutable.rb +16 -11
- data/lib/arachni/element/form/capabilities/submittable.rb +1 -1
- data/lib/arachni/element/form/capabilities/with_dom.rb +1 -1
- data/lib/arachni/element/form/dom.rb +1 -1
- data/lib/arachni/element/form.rb +21 -32
- data/lib/arachni/element/generic_dom.rb +1 -1
- data/lib/arachni/element/header/capabilities/inputtable.rb +1 -1
- data/lib/arachni/element/header/capabilities/mutable.rb +1 -1
- data/lib/arachni/element/header.rb +3 -1
- data/lib/arachni/element/json/capabilities/inputtable.rb +1 -1
- data/lib/arachni/element/json/capabilities/mutable.rb +1 -1
- data/lib/arachni/element/json.rb +4 -8
- data/lib/arachni/element/link/capabilities/auditable.rb +1 -1
- data/lib/arachni/element/link/capabilities/submittable.rb +1 -1
- data/lib/arachni/element/link/capabilities/with_dom.rb +1 -1
- data/lib/arachni/element/link/dom/capabilities/submittable.rb +1 -1
- data/lib/arachni/element/link/dom.rb +1 -1
- data/lib/arachni/element/link.rb +11 -30
- data/lib/arachni/element/link_template/capabilities/auditable.rb +1 -1
- data/lib/arachni/element/link_template/capabilities/inputtable.rb +1 -1
- data/lib/arachni/element/link_template/capabilities/with_dom.rb +1 -1
- data/lib/arachni/element/link_template/dom/capabilities/submittable.rb +1 -1
- data/lib/arachni/element/link_template/dom.rb +2 -2
- data/lib/arachni/element/link_template.rb +10 -19
- data/lib/arachni/element/nested_cookie/capabilities/submittable.rb +35 -0
- data/lib/arachni/element/nested_cookie.rb +370 -0
- data/lib/arachni/element/path.rb +1 -1
- data/lib/arachni/element/server.rb +11 -11
- data/lib/arachni/element/ui_form/dom.rb +1 -1
- data/lib/arachni/element/ui_form.rb +5 -6
- data/lib/arachni/element/ui_input/dom.rb +1 -1
- data/lib/arachni/element/ui_input.rb +4 -6
- data/lib/arachni/element/xml/capabilities/inputtable.rb +1 -1
- data/lib/arachni/element/xml/capabilities/mutable.rb +1 -1
- data/lib/arachni/element/xml.rb +3 -7
- data/lib/arachni/element_filter.rb +1 -1
- data/lib/arachni/error.rb +1 -1
- data/lib/arachni/ethon/easy.rb +1 -1
- data/lib/arachni/framework/parts/audit.rb +6 -1
- data/lib/arachni/framework/parts/browser.rb +14 -14
- data/lib/arachni/framework/parts/check.rb +1 -1
- data/lib/arachni/framework/parts/data.rb +1 -1
- data/lib/arachni/framework/parts/platform.rb +1 -1
- data/lib/arachni/framework/parts/plugin.rb +1 -1
- data/lib/arachni/framework/parts/report.rb +3 -3
- data/lib/arachni/framework/parts/scope.rb +1 -1
- data/lib/arachni/framework/parts/state.rb +1 -1
- data/lib/arachni/framework.rb +1 -1
- data/lib/arachni/http/client/dynamic_404_handler.rb +74 -16
- data/lib/arachni/http/client.rb +38 -11
- data/lib/arachni/http/cookie_jar.rb +13 -8
- data/lib/arachni/http/headers.rb +11 -5
- data/lib/arachni/http/message/scope.rb +1 -1
- data/lib/arachni/http/message.rb +10 -9
- data/lib/arachni/http/proxy_server/connection.rb +110 -82
- data/lib/arachni/http/proxy_server/ssl-interceptor-cacert.pem +18 -32
- data/lib/arachni/http/proxy_server/ssl-interceptor-cakey.pem +28 -49
- data/lib/arachni/http/proxy_server/ssl_interceptor.rb +8 -6
- data/lib/arachni/http/proxy_server/tunnel.rb +4 -4
- data/lib/arachni/http/proxy_server.rb +44 -11
- data/lib/arachni/http/request/scope.rb +1 -1
- data/lib/arachni/http/request.rb +239 -41
- data/lib/arachni/http/response/scope.rb +1 -1
- data/lib/arachni/http/response.rb +73 -10
- data/lib/arachni/http.rb +1 -1
- data/lib/arachni/issue/severity/base.rb +1 -1
- data/lib/arachni/issue/severity.rb +1 -1
- data/lib/arachni/issue.rb +42 -14
- data/lib/arachni/option_group.rb +1 -1
- data/lib/arachni/option_groups/audit.rb +11 -2
- data/lib/arachni/option_groups/browser_cluster.rb +32 -4
- data/lib/arachni/option_groups/datastore.rb +1 -1
- data/lib/arachni/option_groups/dispatcher.rb +1 -1
- data/lib/arachni/option_groups/http.rb +39 -10
- data/lib/arachni/option_groups/input.rb +1 -1
- data/lib/arachni/option_groups/output.rb +1 -1
- data/lib/arachni/option_groups/paths.rb +12 -1
- data/lib/arachni/option_groups/rpc.rb +1 -1
- data/lib/arachni/option_groups/scope.rb +58 -4
- data/lib/arachni/option_groups/session.rb +1 -1
- data/lib/arachni/option_groups/snapshot.rb +1 -1
- data/lib/arachni/option_groups.rb +1 -1
- data/lib/arachni/options.rb +23 -4
- data/lib/arachni/page/dom/transition.rb +5 -2
- data/lib/arachni/page/dom.rb +46 -54
- data/lib/arachni/page/scope.rb +1 -1
- data/lib/arachni/page.rb +10 -8
- data/lib/arachni/parser/document.rb +34 -0
- data/lib/arachni/parser/extractors/base.rb +48 -0
- data/lib/arachni/parser/nodes/base.rb +22 -0
- data/lib/arachni/parser/nodes/comment.rb +32 -0
- data/lib/arachni/parser/nodes/element/with_attributes/attributes.rb +31 -0
- data/lib/arachni/parser/nodes/element/with_attributes.rb +35 -0
- data/lib/arachni/parser/nodes/element.rb +48 -0
- data/lib/arachni/parser/nodes/text.rb +32 -0
- data/lib/arachni/parser/nodes/with_value.rb +29 -0
- data/lib/arachni/parser/sax.rb +76 -0
- data/lib/arachni/parser/with_children/search.rb +92 -0
- data/lib/arachni/parser/with_children.rb +35 -0
- data/lib/arachni/parser.rb +181 -78
- data/lib/arachni/platform/fingerprinter.rb +1 -1
- data/lib/arachni/platform/list.rb +1 -1
- data/lib/arachni/platform/manager.rb +2 -2
- data/lib/arachni/platform.rb +1 -1
- data/lib/arachni/plugin/base.rb +2 -2
- data/lib/arachni/plugin/formatter.rb +1 -1
- data/lib/arachni/plugin/manager.rb +8 -5
- data/lib/arachni/plugin.rb +1 -1
- data/lib/arachni/processes/dispatchers.rb +1 -1
- data/lib/arachni/processes/executables/base.rb +2 -1
- data/lib/arachni/processes/executables/browser.rb +0 -2
- data/lib/arachni/processes/helpers/dispatchers.rb +1 -1
- data/lib/arachni/processes/helpers/instances.rb +1 -1
- data/lib/arachni/processes/helpers/processes.rb +1 -1
- data/lib/arachni/processes/helpers.rb +1 -1
- data/lib/arachni/processes/instances.rb +1 -1
- data/lib/arachni/processes/manager.rb +18 -9
- data/lib/arachni/processes.rb +1 -1
- data/lib/arachni/report.rb +8 -1
- data/lib/arachni/reporter/base.rb +1 -1
- data/lib/arachni/reporter/formatter_manager.rb +1 -1
- data/lib/arachni/reporter/manager.rb +1 -1
- data/lib/arachni/reporter/options.rb +1 -10
- data/lib/arachni/reporter.rb +1 -1
- data/lib/arachni/rest/server/instance_helpers.rb +10 -1
- data/lib/arachni/rest/server.rb +13 -1
- data/lib/arachni/rpc/client/base.rb +1 -1
- data/lib/arachni/rpc/client/dispatcher.rb +1 -1
- data/lib/arachni/rpc/client/instance/framework.rb +1 -1
- data/lib/arachni/rpc/client/instance/service.rb +1 -1
- data/lib/arachni/rpc/client/instance.rb +1 -1
- data/lib/arachni/rpc/serializer.rb +1 -1
- data/lib/arachni/rpc/server/active_options.rb +1 -1
- data/lib/arachni/rpc/server/base.rb +1 -1
- data/lib/arachni/rpc/server/check/manager.rb +1 -1
- data/lib/arachni/rpc/server/dispatcher/node.rb +1 -1
- data/lib/arachni/rpc/server/dispatcher/service.rb +1 -1
- data/lib/arachni/rpc/server/dispatcher.rb +1 -1
- data/lib/arachni/rpc/server/framework/distributor.rb +1 -1
- data/lib/arachni/rpc/server/framework/master.rb +1 -1
- data/lib/arachni/rpc/server/framework/multi_instance.rb +1 -1
- data/lib/arachni/rpc/server/framework/slave.rb +1 -1
- data/lib/arachni/rpc/server/framework.rb +1 -1
- data/lib/arachni/rpc/server/instance.rb +1 -1
- data/lib/arachni/rpc/server/output.rb +1 -1
- data/lib/arachni/rpc/server/plugin/manager.rb +1 -1
- data/lib/arachni/ruby/array.rb +1 -1
- data/lib/arachni/ruby/hash.rb +1 -1
- data/lib/arachni/ruby/object.rb +1 -1
- data/lib/arachni/ruby/set.rb +1 -1
- data/lib/arachni/ruby/string.rb +9 -5
- data/lib/arachni/ruby/webrick/cookie.rb +1 -1
- data/lib/arachni/ruby/webrick/httprequest.rb +1 -1
- data/lib/arachni/ruby/webrick.rb +1 -1
- data/lib/arachni/ruby.rb +1 -1
- data/lib/arachni/scope.rb +1 -1
- data/lib/arachni/selenium/webdriver/element.rb +4 -4
- data/lib/arachni/selenium/webdriver/remote/typhoeus.rb +59 -0
- data/lib/arachni/session.rb +32 -13
- data/lib/arachni/snapshot.rb +2 -2
- data/lib/arachni/state/audit.rb +1 -1
- data/lib/arachni/state/element_filter.rb +1 -1
- data/lib/arachni/state/framework/rpc.rb +1 -1
- data/lib/arachni/state/framework.rb +1 -1
- data/lib/arachni/state/http.rb +2 -2
- data/lib/arachni/state/options.rb +1 -1
- data/lib/arachni/state/plugins.rb +1 -1
- data/lib/arachni/state.rb +1 -1
- data/lib/arachni/support/buffer/autoflush.rb +1 -1
- data/lib/arachni/support/buffer/base.rb +1 -1
- data/lib/arachni/support/buffer.rb +1 -1
- data/lib/arachni/support/cache/base.rb +1 -1
- data/lib/arachni/support/cache/least_cost_replacement.rb +1 -1
- data/lib/arachni/support/cache/least_recently_pushed.rb +1 -1
- data/lib/arachni/support/cache/least_recently_used.rb +1 -1
- data/lib/arachni/support/cache/preference.rb +1 -1
- data/lib/arachni/support/cache/random_replacement.rb +1 -1
- data/lib/arachni/support/cache.rb +1 -1
- data/lib/arachni/support/crypto/rsa_aes_cbc.rb +1 -1
- data/lib/arachni/support/crypto.rb +1 -1
- data/lib/arachni/support/database/base.rb +16 -10
- data/lib/arachni/support/database/hash.rb +1 -1
- data/lib/arachni/support/database/queue.rb +1 -1
- data/lib/arachni/support/database.rb +1 -1
- data/lib/arachni/support/glob.rb +1 -1
- data/lib/arachni/support/lookup/base.rb +1 -1
- data/lib/arachni/support/lookup/hash_set.rb +1 -1
- data/lib/arachni/support/lookup/moolb.rb +1 -1
- data/lib/arachni/support/lookup.rb +1 -1
- data/lib/arachni/support/mixins/observable.rb +1 -1
- data/lib/arachni/support/mixins/terminal.rb +1 -1
- data/lib/arachni/support/mixins.rb +1 -1
- data/lib/arachni/support/profiler.rb +52 -13
- data/lib/arachni/support/signature.rb +18 -6
- data/lib/arachni/support.rb +1 -1
- data/lib/arachni/trainer.rb +55 -39
- data/lib/arachni/ui/foo/output.rb +1 -1
- data/lib/arachni/uri/scope.rb +15 -13
- data/lib/arachni/uri.rb +129 -103
- data/lib/arachni/utilities.rb +10 -10
- data/lib/arachni/version.rb +1 -1
- data/lib/arachni.rb +1 -7
- data/lib/version +1 -1
- data/spec/arachni/browser/element_locator_spec.rb +42 -18
- data/spec/arachni/browser/javascript/dom_monitor_spec.rb +264 -109
- data/spec/arachni/browser/javascript/polyfills_spec.rb +0 -15
- data/spec/arachni/browser/javascript/proxy_spec.rb +0 -10
- data/spec/arachni/browser/javascript/taint_tracer_spec.rb +43 -118
- data/spec/arachni/browser/javascript_spec.rb +95 -60
- data/spec/arachni/browser_cluster/job_spec.rb +23 -8
- data/spec/arachni/browser_cluster/jobs/dom_exploration_spec.rb +6 -1
- data/spec/arachni/browser_cluster/worker_spec.rb +29 -87
- data/spec/arachni/browser_cluster_spec.rb +124 -43
- data/spec/arachni/browser_spec.rb +463 -421
- data/spec/arachni/check/auditor_spec.rb +162 -198
- data/spec/arachni/data/framework/rpc_spec.rb +1 -1
- data/spec/arachni/data/framework_spec.rb +1 -1
- data/spec/arachni/element/capabilities/analyzable/signature_spec.rb +46 -3
- data/spec/arachni/element/cookie/dom_spec.rb +1 -1
- data/spec/arachni/element/cookie_spec.rb +159 -64
- data/spec/arachni/element/form/dom_spec.rb +1 -1
- data/spec/arachni/element/form_spec.rb +101 -54
- data/spec/arachni/element/header_spec.rb +3 -1
- data/spec/arachni/element/json_spec.rb +2 -0
- data/spec/arachni/element/link/dom_spec.rb +2 -2
- data/spec/arachni/element/link_spec.rb +46 -15
- data/spec/arachni/element/link_template/dom_spec.rb +1 -1
- data/spec/arachni/element/link_template_spec.rb +36 -12
- data/spec/arachni/element/nested_cookie_spec.rb +687 -0
- data/spec/arachni/element/server_spec.rb +22 -5
- data/spec/arachni/element/ui_form/dom_spec.rb +1 -1
- data/spec/arachni/element/ui_form_spec.rb +2 -2
- data/spec/arachni/element/ui_input/dom_spec.rb +1 -1
- data/spec/arachni/element/ui_input_spec.rb +1 -1
- data/spec/arachni/element/xml_spec.rb +5 -3
- data/spec/arachni/framework/parts/audit_spec.rb +2 -14
- data/spec/arachni/framework/parts/data_spec.rb +0 -6
- data/spec/arachni/http/client/dynamic_404_handlers_spec.rb +126 -0
- data/spec/arachni/http/client_spec.rb +96 -36
- data/spec/arachni/http/cookie_jar_spec.rb +2 -2
- data/spec/arachni/http/headers_spec.rb +59 -12
- data/spec/arachni/http/proxy_server_spec.rb +58 -25
- data/spec/arachni/http/request_spec.rb +382 -35
- data/spec/arachni/http/response_spec.rb +135 -7
- data/spec/arachni/issue_spec.rb +21 -2
- data/spec/arachni/option_groups/browser_cluster_spec.rb +17 -0
- data/spec/arachni/option_groups/http_spec.rb +21 -6
- data/spec/arachni/option_groups/paths_spec.rb +23 -1
- data/spec/arachni/option_groups/scope_spec.rb +27 -7
- data/spec/arachni/options_spec.rb +8 -1
- data/spec/arachni/page/dom_spec.rb +20 -6
- data/spec/arachni/page_spec.rb +8 -7
- data/spec/arachni/parser/document_spec.rb +49 -0
- data/spec/arachni/parser/nodes/comment_spec.rb +24 -0
- data/spec/arachni/parser/nodes/element/with_attributes/attributes_spec.rb +40 -0
- data/spec/arachni/parser/nodes/element/with_attributes_spec.rb +50 -0
- data/spec/arachni/parser/nodes/element_spec.rb +18 -0
- data/spec/arachni/parser/nodes/text_spec.rb +24 -0
- data/spec/arachni/parser/sax_spec.rb +88 -0
- data/spec/arachni/parser/with_children/search_spec.rb +146 -0
- data/spec/arachni/parser/with_children_spec.rb +37 -0
- data/spec/arachni/parser_spec.rb +211 -27
- data/spec/arachni/platform/list_spec.rb +1 -2
- data/spec/arachni/report_spec.rb +9 -2
- data/spec/arachni/reporter/options_spec.rb +0 -14
- data/spec/arachni/rest/server_spec.rb +91 -8
- data/spec/arachni/rpc/server/active_options_spec.rb +1 -1
- data/spec/arachni/rpc/server/framework/distributor_spec.rb +6 -6
- data/spec/arachni/ruby/string_spec.rb +6 -0
- data/spec/arachni/session_spec.rb +69 -8
- data/spec/arachni/snapshot_spec.rb +1 -1
- data/spec/arachni/state/framework_spec.rb +2 -2
- data/spec/arachni/support/signature_spec.rb +58 -0
- data/spec/arachni/trainer_spec.rb +102 -21
- data/spec/arachni/uri_spec.rb +11 -8
- data/spec/arachni/utilities_spec.rb +3 -3
- data/spec/components/checks/active/code_injection_spec.rb +12 -7
- data/spec/components/checks/active/code_injection_timing_spec.rb +4 -3
- data/spec/components/checks/active/csrf_spec.rb +1 -21
- data/spec/components/checks/active/file_inclusion_spec.rb +15 -10
- data/spec/components/checks/active/ldap_injection_spec.rb +5 -4
- data/spec/components/checks/active/no_sql_injection_differential_spec.rb +1 -1
- data/spec/components/checks/active/no_sql_injection_spec.rb +5 -4
- data/spec/components/checks/active/os_cmd_injection_spec.rb +6 -4
- data/spec/components/checks/active/os_cmd_injection_timing_spec.rb +4 -3
- data/spec/components/checks/active/path_traversal_spec.rb +18 -15
- data/spec/components/checks/active/response_splitting_spec.rb +5 -4
- data/spec/components/checks/active/rfi_spec.rb +9 -8
- data/spec/components/checks/active/source_code_disclosure_spec.rb +33 -10
- data/spec/components/checks/active/sql_injection_differential_spec.rb +1 -1
- data/spec/components/checks/active/sql_injection_spec.rb +61 -35
- data/spec/components/checks/active/sql_injection_timing_spec.rb +11 -8
- data/spec/components/checks/active/unvalidated_redirect_spec.rb +9 -8
- data/spec/components/checks/active/xpath_injection_spec.rb +5 -4
- data/spec/components/checks/active/xss_dom_script_context_spec.rb +6 -10
- data/spec/components/checks/active/xss_dom_spec.rb +2 -2
- data/spec/components/checks/active/xss_event_spec.rb +11 -3
- data/spec/components/checks/active/xss_script_context_spec.rb +8 -7
- data/spec/components/checks/active/xss_spec.rb +7 -6
- data/spec/components/checks/active/xss_tag_spec.rb +11 -3
- data/spec/components/checks/passive/backup_directories_spec.rb +3 -1
- data/spec/components/checks/passive/backup_files_spec.rb +4 -1
- data/spec/components/checks/passive/grep/insecure_cookies_spec.rb +2 -2
- data/spec/components/checks/passive/grep/x_frame_options_spec.rb +6 -0
- data/spec/components/path_extractors/comments_spec.rb +3 -1
- data/spec/components/path_extractors/data_url_spec.rb +6 -2
- data/spec/components/path_extractors/links_spec.rb +1 -1
- data/spec/components/plugins/autologin_spec.rb +2 -2
- data/spec/components/plugins/webhook_notify_spec.rb +69 -0
- data/spec/spec_helper.rb +2 -1
- data/spec/support/factories/http/response.rb +1 -1
- data/spec/support/factories/issue.rb +1 -2
- data/spec/support/factories/page/dom.rb +6 -0
- data/spec/support/factories/scan_report.rb +1 -0
- data/spec/support/factories/vector.rb +7 -3
- data/spec/support/fixtures/check_with_invalid_platforms/with_invalid_platforms.rb +1 -1
- data/spec/support/fixtures/checks/test.rb +4 -4
- data/spec/support/fixtures/checks/test2.rb +1 -1
- data/spec/support/fixtures/checks/test3.rb +1 -1
- data/spec/support/fixtures/cookies.txt +2 -2
- data/spec/support/fixtures/executables/node.rb +2 -3
- data/spec/support/fixtures/fingerprinters/test.rb +1 -1
- data/spec/support/fixtures/nested_cookies.txt +11 -0
- data/spec/support/fixtures/plugins/bad.rb +1 -1
- data/spec/support/fixtures/plugins/defaults/default.rb +1 -1
- data/spec/support/fixtures/plugins/distributable.rb +1 -1
- data/spec/support/fixtures/plugins/loop.rb +1 -1
- data/spec/support/fixtures/plugins/suspendable.rb +1 -1
- data/spec/support/fixtures/plugins/wait.rb +1 -1
- data/spec/support/fixtures/plugins/with_options.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p0.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p00.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p1.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p2.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p22.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p222.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p_nil.rb +1 -1
- data/spec/support/fixtures/plugins_with_priorities/p_nil2.rb +1 -1
- data/spec/support/fixtures/report.afr +0 -0
- data/spec/support/fixtures/reporters/base_spec/plugin_formatters/with_formatters/foobar.rb +1 -1
- data/spec/support/fixtures/reporters/base_spec/with_formatters.rb +1 -1
- data/spec/support/fixtures/reporters/base_spec/with_outfile.rb +1 -1
- data/spec/support/fixtures/reporters/base_spec/without_outfile.rb +1 -1
- data/spec/support/fixtures/reporters/manager_spec/afr.rb +1 -1
- data/spec/support/fixtures/reporters/manager_spec/error.rb +1 -1
- data/spec/support/fixtures/reporters/manager_spec/foo.rb +1 -1
- data/spec/support/fixtures/run_check/body.rb +1 -1
- data/spec/support/fixtures/run_check/cookies.rb +1 -1
- data/spec/support/fixtures/run_check/empty.rb +1 -1
- data/spec/support/fixtures/run_check/flch.rb +1 -1
- data/spec/support/fixtures/run_check/forms.rb +1 -1
- data/spec/support/fixtures/run_check/headers.rb +1 -1
- data/spec/support/fixtures/run_check/links.rb +1 -1
- data/spec/support/fixtures/run_check/nil.rb +1 -1
- data/spec/support/fixtures/run_check/path.rb +1 -1
- data/spec/support/fixtures/run_check/server.rb +1 -1
- data/spec/support/fixtures/signature_check/signature.rb +1 -1
- data/spec/support/fixtures/wait_check/wait.rb +1 -1
- data/spec/support/helpers/browser_cluster/jobs/taint_tracer.rb +0 -3
- data/spec/support/helpers/framework.rb +1 -1
- data/spec/support/helpers/misc.rb +1 -1
- data/spec/support/helpers/paths.rb +1 -1
- data/spec/support/helpers/requires.rb +1 -1
- data/spec/support/helpers/resets.rb +1 -1
- data/spec/support/helpers/web_server.rb +1 -1
- data/spec/support/lib/factory.rb +1 -1
- data/spec/support/lib/web_server_client.rb +1 -1
- data/spec/support/lib/web_server_dispatcher.rb +1 -1
- data/spec/support/lib/web_server_manager.rb +4 -2
- data/spec/support/servers/arachni/browser/javascript/dom_monitor.rb +48 -0
- data/spec/support/servers/arachni/browser/javascript/taint_tracer.rb +15 -3
- data/spec/support/servers/arachni/browser.rb +275 -4
- data/spec/support/servers/arachni/check/auditor.rb +9 -0
- data/spec/support/servers/arachni/element/cookie.rb +34 -0
- data/spec/support/servers/arachni/element/form/form_dom.rb +1 -0
- data/spec/support/servers/arachni/element/form.rb +36 -2
- data/spec/support/servers/arachni/element/header.rb +36 -1
- data/spec/support/servers/arachni/element/json.rb +33 -0
- data/spec/support/servers/arachni/element/link.rb +33 -1
- data/spec/support/servers/arachni/element/link_template.rb +37 -5
- data/spec/support/servers/arachni/element/nested_cookie.rb +84 -0
- data/spec/support/servers/arachni/element/xml.rb +33 -0
- data/spec/support/servers/arachni/http/client/dynamic_404_handler.rb +36 -0
- data/spec/support/servers/arachni/http/client/dynamic_404_handler_redirect_1.rb +18 -0
- data/spec/support/servers/arachni/http/client/dynamic_404_handler_redirect_2.rb +11 -0
- data/spec/support/servers/arachni/http/client.rb +43 -4
- data/spec/support/servers/arachni/http/proxy_server.rb +12 -0
- data/spec/support/servers/arachni/parser.rb +6 -0
- data/spec/support/servers/arachni/session.rb +24 -1
- data/spec/support/servers/checks/active/code_injection.rb +18 -0
- data/spec/support/servers/checks/active/code_injection_timing.rb +18 -0
- data/spec/support/servers/checks/active/csrf.rb +0 -76
- data/spec/support/servers/checks/active/file_inclusion.rb +19 -1
- data/spec/support/servers/checks/active/ldap_injection.rb +18 -0
- data/spec/support/servers/checks/active/no_sql_injection.rb +27 -0
- data/spec/support/servers/checks/active/no_sql_injection_differential.rb +19 -0
- data/spec/support/servers/checks/active/os_cmd_injection.rb +29 -0
- data/spec/support/servers/checks/active/os_cmd_injection_timing.rb +18 -1
- data/spec/support/servers/checks/active/path_traversal.rb +30 -3
- data/spec/support/servers/checks/active/response_splitting.rb +30 -1
- data/spec/support/servers/checks/active/rfi.rb +30 -2
- data/spec/support/servers/checks/active/session_fixation.rb +1 -3
- data/spec/support/servers/checks/active/source_code_disclosure.rb +16 -0
- data/spec/support/servers/checks/active/sql_injection/java +2 -0
- data/spec/support/servers/checks/active/sql_injection.rb +27 -0
- data/spec/support/servers/checks/active/sql_injection_differential.rb +19 -0
- data/spec/support/servers/checks/active/sql_injection_timing.rb +19 -1
- data/spec/support/servers/checks/active/unvalidated_redirect.rb +121 -1
- data/spec/support/servers/checks/active/xpath_injection.rb +27 -0
- data/spec/support/servers/checks/active/xss.rb +40 -0
- data/spec/support/servers/checks/active/xss_event.rb +23 -2
- data/spec/support/servers/checks/active/xss_script_context.rb +18 -0
- data/spec/support/servers/checks/active/xss_tag.rb +40 -0
- data/spec/support/servers/checks/passive/backup_files.rb +20 -1
- data/spec/support/servers/checks/passive/grep/cookie_set_for_parent_domain.rb +3 -5
- data/spec/support/servers/checks/passive/grep/insecure_cookies_https.rb +9 -0
- data/spec/support/servers/checks/passive/grep/x_frame_options.rb +5 -0
- data/spec/support/servers/plugins/autologin.rb +17 -1
- data/spec/support/servers/plugins/webhook_notify.rb +9 -0
- data/spec/support/shared/check.rb +1 -0
- data/spec/support/shared/element/capabilities/auditable/buffered.rb +791 -0
- data/spec/support/shared/element/capabilities/auditable/line_buffered.rb +797 -0
- data/spec/support/shared/element/capabilities/auditable.rb +28 -34
- data/spec/support/shared/element/capabilities/inputtable.rb +26 -0
- data/spec/support/shared/element/capabilities/with_node.rb +2 -2
- data/spec/support/shared/element/dom/submittable.rb +10 -10
- data/spec/support/shared/path_extractor.rb +17 -5
- data/ui/cli/framework/option_parser.rb +78 -13
- data/ui/cli/framework.rb +29 -8
- data/ui/cli/option_parser.rb +1 -1
- data/ui/cli/output.rb +10 -3
- data/ui/cli/reporter/option_parser.rb +1 -1
- data/ui/cli/reporter.rb +1 -1
- data/ui/cli/reproduce/option_parser.rb +90 -0
- data/ui/cli/reproduce.rb +228 -0
- data/ui/cli/rest/server/option_parser.rb +1 -1
- data/ui/cli/rest/server.rb +1 -1
- data/ui/cli/restored_framework/option_parser.rb +1 -1
- data/ui/cli/restored_framework.rb +1 -1
- data/ui/cli/rpc/client/dispatcher_monitor/option_parser.rb +1 -1
- data/ui/cli/rpc/client/dispatcher_monitor.rb +9 -11
- data/ui/cli/rpc/client/instance.rb +7 -4
- data/ui/cli/rpc/client/local/option_parser.rb +1 -1
- data/ui/cli/rpc/client/local.rb +1 -1
- data/ui/cli/rpc/client/remote/option_parser.rb +1 -1
- data/ui/cli/rpc/client/remote.rb +1 -1
- data/ui/cli/rpc/server/dispatcher/option_parser.rb +1 -1
- data/ui/cli/rpc/server/dispatcher.rb +1 -1
- data/ui/cli/utilities.rb +1 -1
- metadata +178 -79
- data/ACKNOWLEDGMENTS.md +0 -21
- data/AUTHORS.md +0 -3
- data/CONTRIBUTORS.md +0 -22
|
@@ -17,6 +17,8 @@ describe Arachni::Element::Form do
|
|
|
17
17
|
it_should_behave_like 'inputtable'
|
|
18
18
|
it_should_behave_like 'mutable'
|
|
19
19
|
it_should_behave_like 'auditable'
|
|
20
|
+
it_should_behave_like 'buffered_auditable'
|
|
21
|
+
it_should_behave_like 'line_buffered_auditable'
|
|
20
22
|
|
|
21
23
|
before :each do
|
|
22
24
|
@framework ||= Arachni::Framework.new
|
|
@@ -56,6 +58,17 @@ describe Arachni::Element::Form do
|
|
|
56
58
|
}
|
|
57
59
|
end
|
|
58
60
|
|
|
61
|
+
let(:parser) do
|
|
62
|
+
Arachni::Parser.new(
|
|
63
|
+
Arachni::HTTP::Response.new(
|
|
64
|
+
url: url,
|
|
65
|
+
body: form_html,
|
|
66
|
+
headers: {
|
|
67
|
+
'Content-Type' => 'text/html'
|
|
68
|
+
})
|
|
69
|
+
)
|
|
70
|
+
end
|
|
71
|
+
|
|
59
72
|
it 'assigned to Arachni::Form for easy access' do
|
|
60
73
|
expect(Arachni::Form).to eq(described_class)
|
|
61
74
|
end
|
|
@@ -340,8 +353,8 @@ describe Arachni::Element::Form do
|
|
|
340
353
|
|
|
341
354
|
describe '#requires_password?' do
|
|
342
355
|
context 'when the form has a password field' do
|
|
343
|
-
|
|
344
|
-
|
|
356
|
+
let(:form_html) do
|
|
357
|
+
'
|
|
345
358
|
<html>
|
|
346
359
|
<body>
|
|
347
360
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -351,14 +364,17 @@ describe Arachni::Element::Form do
|
|
|
351
364
|
|
|
352
365
|
</body>
|
|
353
366
|
</html>'
|
|
367
|
+
end
|
|
354
368
|
|
|
355
|
-
|
|
369
|
+
it 'returns true' do
|
|
370
|
+
expect(described_class.from_parser( parser ).
|
|
356
371
|
first.requires_password?).to be_truthy
|
|
357
372
|
end
|
|
358
373
|
end
|
|
374
|
+
|
|
359
375
|
context 'when the form does not have a password field' do
|
|
360
|
-
|
|
361
|
-
|
|
376
|
+
let(:form_html) do
|
|
377
|
+
'
|
|
362
378
|
<html>
|
|
363
379
|
<body>
|
|
364
380
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -367,8 +383,10 @@ describe Arachni::Element::Form do
|
|
|
367
383
|
|
|
368
384
|
</body>
|
|
369
385
|
</html>'
|
|
386
|
+
end
|
|
370
387
|
|
|
371
|
-
|
|
388
|
+
it 'returns false' do
|
|
389
|
+
expect(described_class.from_parser( parser ).
|
|
372
390
|
first.requires_password?).to be_falsey
|
|
373
391
|
end
|
|
374
392
|
end
|
|
@@ -480,15 +498,17 @@ describe Arachni::Element::Form do
|
|
|
480
498
|
end
|
|
481
499
|
|
|
482
500
|
context 'when it contains more than 1 password field' do
|
|
483
|
-
|
|
484
|
-
|
|
501
|
+
let(:form_html) do
|
|
502
|
+
<<-EOHTML
|
|
485
503
|
<form>
|
|
486
504
|
<input type="password" name="my_pass" />
|
|
487
505
|
<input type="password" name="my_pass_validation" />
|
|
488
506
|
</form>
|
|
489
507
|
EOHTML
|
|
508
|
+
end
|
|
490
509
|
|
|
491
|
-
|
|
510
|
+
it 'includes mutations which have the same values for all of them' do
|
|
511
|
+
e = described_class.from_parser( parser ).first
|
|
492
512
|
|
|
493
513
|
expect(e.mutations( 'seed' ).select do |m|
|
|
494
514
|
m.inputs['my_pass'] == m.inputs['my_pass_validation']
|
|
@@ -497,8 +517,8 @@ describe Arachni::Element::Form do
|
|
|
497
517
|
end
|
|
498
518
|
|
|
499
519
|
context 'when it contains select inputs with multiple values' do
|
|
500
|
-
|
|
501
|
-
|
|
520
|
+
let(:form_html) do
|
|
521
|
+
'
|
|
502
522
|
<html>
|
|
503
523
|
<body>
|
|
504
524
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -516,8 +536,10 @@ describe Arachni::Element::Form do
|
|
|
516
536
|
|
|
517
537
|
</body>
|
|
518
538
|
</html>'
|
|
539
|
+
end
|
|
519
540
|
|
|
520
|
-
|
|
541
|
+
it 'includes mutations with all of them' do
|
|
542
|
+
form = described_class.from_parser( parser ).first
|
|
521
543
|
|
|
522
544
|
mutations = form.mutations( '' )
|
|
523
545
|
|
|
@@ -674,10 +696,14 @@ describe Arachni::Element::Form do
|
|
|
674
696
|
end
|
|
675
697
|
end
|
|
676
698
|
|
|
677
|
-
describe '.
|
|
699
|
+
describe '.from_parser' do
|
|
678
700
|
context 'when the response does not contain any forms' do
|
|
701
|
+
let(:form_html) do
|
|
702
|
+
''
|
|
703
|
+
end
|
|
704
|
+
|
|
679
705
|
it 'returns an empty array' do
|
|
680
|
-
expect(described_class.
|
|
706
|
+
expect(described_class.from_parser( parser )).to be_empty
|
|
681
707
|
end
|
|
682
708
|
end
|
|
683
709
|
|
|
@@ -700,7 +726,7 @@ EOHTML
|
|
|
700
726
|
it 'ignores them' do
|
|
701
727
|
Arachni::Options.scope.exclude_path_patterns = [/exclude/]
|
|
702
728
|
|
|
703
|
-
forms = described_class.
|
|
729
|
+
forms = described_class.from_parser( parser )
|
|
704
730
|
expect(forms.size).to eq(1)
|
|
705
731
|
expect(forms.first.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
706
732
|
end
|
|
@@ -709,7 +735,7 @@ EOHTML
|
|
|
709
735
|
it 'includes them' do
|
|
710
736
|
Arachni::Options.scope.exclude_path_patterns = [/exclude/]
|
|
711
737
|
|
|
712
|
-
forms = described_class.
|
|
738
|
+
forms = described_class.from_parser( parser, true )
|
|
713
739
|
expect(forms.size).to eq(2)
|
|
714
740
|
end
|
|
715
741
|
end
|
|
@@ -717,8 +743,8 @@ EOHTML
|
|
|
717
743
|
|
|
718
744
|
context 'when the response contains forms' do
|
|
719
745
|
context 'with text inputs' do
|
|
720
|
-
|
|
721
|
-
|
|
746
|
+
let(:form_html) do
|
|
747
|
+
'
|
|
722
748
|
<html>
|
|
723
749
|
<body>
|
|
724
750
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -728,8 +754,10 @@ EOHTML
|
|
|
728
754
|
|
|
729
755
|
</body>
|
|
730
756
|
</html>'
|
|
757
|
+
end
|
|
731
758
|
|
|
732
|
-
|
|
759
|
+
it 'returns an array of forms' do
|
|
760
|
+
form = described_class.from_parser( parser ).first
|
|
733
761
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
734
762
|
expect(form.name).to eq('my_form')
|
|
735
763
|
expect(form.url).to eq(url)
|
|
@@ -745,8 +773,8 @@ EOHTML
|
|
|
745
773
|
end
|
|
746
774
|
|
|
747
775
|
context 'with checkbox inputs' do
|
|
748
|
-
|
|
749
|
-
|
|
776
|
+
let(:form_html) do
|
|
777
|
+
'
|
|
750
778
|
<html>
|
|
751
779
|
<body>
|
|
752
780
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -756,8 +784,10 @@ EOHTML
|
|
|
756
784
|
|
|
757
785
|
</body>
|
|
758
786
|
</html>'
|
|
787
|
+
end
|
|
759
788
|
|
|
760
|
-
|
|
789
|
+
it 'returns an array of forms' do
|
|
790
|
+
form = described_class.from_parser( parser ).first
|
|
761
791
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
762
792
|
expect(form.name).to eq('my_form')
|
|
763
793
|
expect(form.url).to eq(url)
|
|
@@ -773,8 +803,8 @@ EOHTML
|
|
|
773
803
|
end
|
|
774
804
|
|
|
775
805
|
context 'with radio inputs' do
|
|
776
|
-
|
|
777
|
-
|
|
806
|
+
let(:form_html) do
|
|
807
|
+
'
|
|
778
808
|
<html>
|
|
779
809
|
<body>
|
|
780
810
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -784,8 +814,10 @@ EOHTML
|
|
|
784
814
|
|
|
785
815
|
</body>
|
|
786
816
|
</html>'
|
|
817
|
+
end
|
|
787
818
|
|
|
788
|
-
|
|
819
|
+
it 'returns an array of forms' do
|
|
820
|
+
form = described_class.from_parser( parser ).first
|
|
789
821
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
790
822
|
expect(form.name).to eq('my_form')
|
|
791
823
|
expect(form.url).to eq(url)
|
|
@@ -801,8 +833,8 @@ EOHTML
|
|
|
801
833
|
end
|
|
802
834
|
|
|
803
835
|
context 'with button inputs' do
|
|
804
|
-
|
|
805
|
-
|
|
836
|
+
let(:form_html) do
|
|
837
|
+
'
|
|
806
838
|
<html>
|
|
807
839
|
<body>
|
|
808
840
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -811,8 +843,10 @@ EOHTML
|
|
|
811
843
|
|
|
812
844
|
</body>
|
|
813
845
|
</html>'
|
|
846
|
+
end
|
|
814
847
|
|
|
815
|
-
|
|
848
|
+
it 'returns an array of forms' do
|
|
849
|
+
form = described_class.from_parser( parser ).first
|
|
816
850
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
817
851
|
expect(form.name).to eq('my_form')
|
|
818
852
|
expect(form.url).to eq(url)
|
|
@@ -823,8 +857,8 @@ EOHTML
|
|
|
823
857
|
end
|
|
824
858
|
|
|
825
859
|
context 'with multiple submit inputs' do
|
|
826
|
-
|
|
827
|
-
|
|
860
|
+
let(:form_html) do
|
|
861
|
+
'
|
|
828
862
|
<html>
|
|
829
863
|
<body>
|
|
830
864
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -833,8 +867,10 @@ EOHTML
|
|
|
833
867
|
</form>
|
|
834
868
|
</body>
|
|
835
869
|
</html>'
|
|
870
|
+
end
|
|
836
871
|
|
|
837
|
-
|
|
872
|
+
it 'returns forms for each value' do
|
|
873
|
+
forms = described_class.from_parser( parser )
|
|
838
874
|
expect(forms.size).to eq(2)
|
|
839
875
|
|
|
840
876
|
form = forms.first
|
|
@@ -857,8 +893,8 @@ EOHTML
|
|
|
857
893
|
|
|
858
894
|
context 'with selects' do
|
|
859
895
|
context 'with values' do
|
|
860
|
-
|
|
861
|
-
|
|
896
|
+
let(:form_html) do
|
|
897
|
+
'
|
|
862
898
|
<html>
|
|
863
899
|
<body>
|
|
864
900
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -876,8 +912,10 @@ EOHTML
|
|
|
876
912
|
|
|
877
913
|
</body>
|
|
878
914
|
</html>'
|
|
915
|
+
end
|
|
879
916
|
|
|
880
|
-
|
|
917
|
+
it 'returns an array of forms' do
|
|
918
|
+
form = described_class.from_parser( parser ).first
|
|
881
919
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
882
920
|
expect(form.name).to eq('my_form')
|
|
883
921
|
expect(form.url).to eq(url)
|
|
@@ -893,8 +931,8 @@ EOHTML
|
|
|
893
931
|
end
|
|
894
932
|
|
|
895
933
|
context 'without values' do
|
|
896
|
-
|
|
897
|
-
|
|
934
|
+
let(:form_html) do
|
|
935
|
+
'
|
|
898
936
|
<html>
|
|
899
937
|
<body>
|
|
900
938
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -910,8 +948,10 @@ EOHTML
|
|
|
910
948
|
|
|
911
949
|
</body>
|
|
912
950
|
</html>'
|
|
951
|
+
end
|
|
913
952
|
|
|
914
|
-
|
|
953
|
+
it 'uses the element texts' do
|
|
954
|
+
form = described_class.from_parser( parser ).first
|
|
915
955
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
916
956
|
expect(form.name).to eq('my_form')
|
|
917
957
|
expect(form.url).to eq(url)
|
|
@@ -927,8 +967,8 @@ EOHTML
|
|
|
927
967
|
end
|
|
928
968
|
|
|
929
969
|
context 'with selected options' do
|
|
930
|
-
|
|
931
|
-
|
|
970
|
+
let(:form_html) do
|
|
971
|
+
'
|
|
932
972
|
<html>
|
|
933
973
|
<body>
|
|
934
974
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -946,8 +986,10 @@ EOHTML
|
|
|
946
986
|
|
|
947
987
|
</body>
|
|
948
988
|
</html>'
|
|
989
|
+
end
|
|
949
990
|
|
|
950
|
-
|
|
991
|
+
it 'uses their values' do
|
|
992
|
+
form = described_class.from_parser( parser ).first
|
|
951
993
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
952
994
|
expect(form.name).to eq('my_form')
|
|
953
995
|
expect(form.url).to eq(url)
|
|
@@ -963,8 +1005,8 @@ EOHTML
|
|
|
963
1005
|
end
|
|
964
1006
|
|
|
965
1007
|
context 'without any options' do
|
|
966
|
-
|
|
967
|
-
|
|
1008
|
+
let(:form_html) do
|
|
1009
|
+
'
|
|
968
1010
|
<html>
|
|
969
1011
|
<body>
|
|
970
1012
|
<form method="get" action="form_action" name="my_form">
|
|
@@ -973,8 +1015,10 @@ EOHTML
|
|
|
973
1015
|
|
|
974
1016
|
</body>
|
|
975
1017
|
</html>'
|
|
1018
|
+
end
|
|
976
1019
|
|
|
977
|
-
|
|
1020
|
+
it 'uses an empty value' do
|
|
1021
|
+
form = described_class.from_parser( parser ).first
|
|
978
1022
|
expect(form.action).to eq(utilities.normalize_url( url + '/form_action' ))
|
|
979
1023
|
expect(form.name).to eq('my_form')
|
|
980
1024
|
expect(form.url).to eq(url)
|
|
@@ -988,9 +1032,9 @@ EOHTML
|
|
|
988
1032
|
end
|
|
989
1033
|
|
|
990
1034
|
context 'with a base attribute' do
|
|
991
|
-
|
|
992
|
-
|
|
993
|
-
|
|
1035
|
+
let(:base_url) { "/this_is_the_base/" }
|
|
1036
|
+
let(:form_html) do
|
|
1037
|
+
'
|
|
994
1038
|
<html>
|
|
995
1039
|
<head>
|
|
996
1040
|
<base href="' + base_url + '" />
|
|
@@ -1005,8 +1049,10 @@ EOHTML
|
|
|
1005
1049
|
</form>
|
|
1006
1050
|
</body>
|
|
1007
1051
|
</html>'
|
|
1052
|
+
end
|
|
1008
1053
|
|
|
1009
|
-
|
|
1054
|
+
it 'respects it and adjust the action accordingly' do
|
|
1055
|
+
forms = described_class.from_parser( parser )
|
|
1010
1056
|
expect(forms.size).to eq(2)
|
|
1011
1057
|
|
|
1012
1058
|
form = forms.shift
|
|
@@ -1035,10 +1081,9 @@ EOHTML
|
|
|
1035
1081
|
end
|
|
1036
1082
|
|
|
1037
1083
|
context 'which are not properly closed' do
|
|
1038
|
-
|
|
1039
|
-
|
|
1040
|
-
|
|
1041
|
-
html = '
|
|
1084
|
+
let(:base_url) { "/this_is_the_base/" }
|
|
1085
|
+
let(:form_html) do
|
|
1086
|
+
'
|
|
1042
1087
|
<html>
|
|
1043
1088
|
<head>
|
|
1044
1089
|
<base href="' + base_url + '" />
|
|
@@ -1063,12 +1108,14 @@ EOHTML
|
|
|
1063
1108
|
</select>
|
|
1064
1109
|
</body>
|
|
1065
1110
|
</html>'
|
|
1111
|
+
end
|
|
1066
1112
|
|
|
1067
|
-
|
|
1113
|
+
it 'sanitizes and return an array of forms' do
|
|
1114
|
+
forms = described_class.from_parser( parser )
|
|
1068
1115
|
expect(forms.size).to eq(3)
|
|
1069
1116
|
|
|
1070
1117
|
form = forms.shift
|
|
1071
|
-
expect(form.action).to eq(utilities.
|
|
1118
|
+
expect(form.action).to eq(utilities.to_absolute( base_url + 'form_2', url ))
|
|
1072
1119
|
expect(form.name).to eq('my_form_2')
|
|
1073
1120
|
expect(form.url).to eq(url)
|
|
1074
1121
|
expect(form.method).to eq(:get)
|
|
@@ -1097,7 +1144,7 @@ EOHTML
|
|
|
1097
1144
|
end
|
|
1098
1145
|
|
|
1099
1146
|
context 'when its value is' do
|
|
1100
|
-
let(:form) { described_class.
|
|
1147
|
+
let(:form) { described_class.from_parser( parser ).first }
|
|
1101
1148
|
let(:value) { 'a' * size }
|
|
1102
1149
|
let(:form_html) do
|
|
1103
1150
|
'<html>
|
|
@@ -8,7 +8,9 @@ describe Arachni::Element::Header do
|
|
|
8
8
|
it_should_behave_like 'submittable'
|
|
9
9
|
it_should_behave_like 'inputtable', single_input: true
|
|
10
10
|
it_should_behave_like 'mutable', supports_nulls: false
|
|
11
|
-
it_should_behave_like 'auditable'
|
|
11
|
+
it_should_behave_like 'auditable', supports_nulls: false
|
|
12
|
+
it_should_behave_like 'buffered_auditable'
|
|
13
|
+
it_should_behave_like 'line_buffered_auditable'
|
|
12
14
|
|
|
13
15
|
before :each do
|
|
14
16
|
@framework ||= Arachni::Framework.new
|
|
@@ -10,6 +10,8 @@ describe Arachni::Element::JSON do
|
|
|
10
10
|
it_should_behave_like 'inputtable'
|
|
11
11
|
it_should_behave_like 'mutable'
|
|
12
12
|
it_should_behave_like 'auditable'
|
|
13
|
+
it_should_behave_like 'buffered_auditable'
|
|
14
|
+
it_should_behave_like 'line_buffered_auditable'
|
|
13
15
|
|
|
14
16
|
before :each do
|
|
15
17
|
@framework ||= Arachni::Framework.new
|
|
@@ -4,7 +4,7 @@ describe Arachni::Element::Link::DOM do
|
|
|
4
4
|
inputs = { 'param' => '1' }
|
|
5
5
|
|
|
6
6
|
it_should_behave_like 'element_dom'
|
|
7
|
-
|
|
7
|
+
#
|
|
8
8
|
it_should_behave_like 'with_node'
|
|
9
9
|
it_should_behave_like 'with_auditor'
|
|
10
10
|
|
|
@@ -15,7 +15,7 @@ describe Arachni::Element::Link::DOM do
|
|
|
15
15
|
it_should_behave_like 'auditable_dom'
|
|
16
16
|
|
|
17
17
|
def auditable_extract_parameters( page )
|
|
18
|
-
{ 'param' => page.
|
|
18
|
+
{ 'param' => Nokogiri::HTML(page.body).css('#container').text }
|
|
19
19
|
end
|
|
20
20
|
|
|
21
21
|
def run
|
|
@@ -14,6 +14,8 @@ describe Arachni::Element::Link do
|
|
|
14
14
|
it_should_behave_like 'inputtable'
|
|
15
15
|
it_should_behave_like 'mutable'
|
|
16
16
|
it_should_behave_like 'auditable'
|
|
17
|
+
it_should_behave_like 'buffered_auditable'
|
|
18
|
+
it_should_behave_like 'line_buffered_auditable'
|
|
17
19
|
|
|
18
20
|
before :each do
|
|
19
21
|
@framework ||= Arachni::Framework.new
|
|
@@ -208,29 +210,50 @@ describe Arachni::Element::Link do
|
|
|
208
210
|
end
|
|
209
211
|
end
|
|
210
212
|
|
|
211
|
-
describe '.
|
|
213
|
+
describe '.from_parser' do
|
|
214
|
+
let(:parser) do
|
|
215
|
+
Arachni::Parser.new(
|
|
216
|
+
Arachni::HTTP::Response.new(
|
|
217
|
+
url: url,
|
|
218
|
+
body: link_html,
|
|
219
|
+
headers: {
|
|
220
|
+
'Content-Type' => 'text/html'
|
|
221
|
+
})
|
|
222
|
+
)
|
|
223
|
+
end
|
|
224
|
+
|
|
212
225
|
context 'when the response does not contain any links' do
|
|
226
|
+
let(:link_html) do
|
|
227
|
+
html = '
|
|
228
|
+
<html>
|
|
229
|
+
<body>
|
|
230
|
+
</body>
|
|
231
|
+
</html>'
|
|
232
|
+
end
|
|
233
|
+
|
|
213
234
|
it 'should return an empty array' do
|
|
214
|
-
expect(described_class.
|
|
235
|
+
expect(described_class.from_parser( parser )).to be_empty
|
|
215
236
|
end
|
|
216
237
|
end
|
|
217
238
|
|
|
218
239
|
context 'when links have actions that just fragments' do
|
|
219
|
-
|
|
240
|
+
let(:link_html) do
|
|
220
241
|
html = '
|
|
221
242
|
<html>
|
|
222
243
|
<body>
|
|
223
244
|
<a href="#stuff"></a>
|
|
224
245
|
</body>
|
|
225
246
|
</html>'
|
|
247
|
+
end
|
|
226
248
|
|
|
227
|
-
|
|
249
|
+
it 'ignores them' do
|
|
250
|
+
expect(described_class.from_parser( parser )).to be_empty
|
|
228
251
|
end
|
|
229
252
|
end
|
|
230
253
|
|
|
231
254
|
context 'when links have actions that are out of scope' do
|
|
232
|
-
|
|
233
|
-
|
|
255
|
+
let(:link_html) do
|
|
256
|
+
'
|
|
234
257
|
<html>
|
|
235
258
|
<body>
|
|
236
259
|
<a href="' + url + '/exclude?param_one=value_one¶m_two=value_two"></a>
|
|
@@ -238,25 +261,29 @@ describe Arachni::Element::Link do
|
|
|
238
261
|
<a href="' + url + '/stuff?param_one=value_one¶m_two=value_two"></a>
|
|
239
262
|
</body>
|
|
240
263
|
</html>'
|
|
264
|
+
end
|
|
241
265
|
|
|
266
|
+
it 'ignores them' do
|
|
242
267
|
Arachni::Options.scope.exclude_path_patterns = [/exclude/]
|
|
243
268
|
|
|
244
|
-
links = described_class.
|
|
269
|
+
links = described_class.from_parser( parser )
|
|
245
270
|
expect(links.size).to eq(1)
|
|
246
271
|
expect(links.first.action).to eq(url + 'stuff')
|
|
247
272
|
end
|
|
248
273
|
end
|
|
249
274
|
|
|
250
275
|
context 'when the response contains links' do
|
|
251
|
-
|
|
252
|
-
|
|
276
|
+
let(:link_html) do
|
|
277
|
+
'
|
|
253
278
|
<html>
|
|
254
279
|
<body>
|
|
255
280
|
<a href="' + url + '/test2?param_one=value_one¶m_two=value_two"></a>
|
|
256
281
|
</body>
|
|
257
282
|
</html>'
|
|
283
|
+
end
|
|
258
284
|
|
|
259
|
-
|
|
285
|
+
it 'should return an array of links' do
|
|
286
|
+
link = described_class.from_parser( parser ).first
|
|
260
287
|
expect(link.action).to eq(url + 'test2')
|
|
261
288
|
expect(link.url).to eq(url)
|
|
262
289
|
expect(link.inputs).to eq({
|
|
@@ -266,9 +293,8 @@ describe Arachni::Element::Link do
|
|
|
266
293
|
end
|
|
267
294
|
|
|
268
295
|
context 'and includes a base attribute' do
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
html = '
|
|
296
|
+
let(:link_html) do
|
|
297
|
+
'
|
|
272
298
|
<html>
|
|
273
299
|
<head>
|
|
274
300
|
<base href="' + base_url + '" />
|
|
@@ -277,8 +303,13 @@ describe Arachni::Element::Link do
|
|
|
277
303
|
<a href="test?param_one=value_one¶m_two=value_two"></a>
|
|
278
304
|
</body>
|
|
279
305
|
</html>'
|
|
306
|
+
end
|
|
307
|
+
let(:base_url) { "#{url}this_is_the_base/" }
|
|
308
|
+
|
|
309
|
+
it 'should return an array of links with adjusted URIs' do
|
|
310
|
+
ap parser.base
|
|
280
311
|
|
|
281
|
-
link = described_class.
|
|
312
|
+
link = described_class.from_parser( parser ).first
|
|
282
313
|
expect(link.action).to eq(base_url + 'test')
|
|
283
314
|
expect(link.url).to eq(url)
|
|
284
315
|
expect(link.inputs).to eq({
|
|
@@ -290,7 +321,7 @@ describe Arachni::Element::Link do
|
|
|
290
321
|
end
|
|
291
322
|
|
|
292
323
|
context 'when its value is' do
|
|
293
|
-
let(:link) { described_class.
|
|
324
|
+
let(:link) { described_class.from_parser( parser ).first }
|
|
294
325
|
let(:value) { 'a' * size }
|
|
295
326
|
let(:href) { "test?param=#{value}" }
|
|
296
327
|
let(:link_html) do
|
|
@@ -15,7 +15,7 @@ describe Arachni::Element::LinkTemplate::DOM do
|
|
|
15
15
|
it_should_behave_like 'auditable_dom'
|
|
16
16
|
|
|
17
17
|
def auditable_extract_parameters( page )
|
|
18
|
-
{ 'param' => page.
|
|
18
|
+
{ 'param' => Nokogiri::HTML(page.body).css('#container').text }
|
|
19
19
|
end
|
|
20
20
|
|
|
21
21
|
def run
|