arachni 1.4 → 1.6.0

data/spec/arachni/platform/list_spec.rb

@@ -224,8 +224,7 @@ describe Arachni::Platform::List do
         context 'with valid platforms' do
             it 'returns a copy of self including the given platforms' do
                 platforms << :unix
-                platforms.merge( [:php, :unix] ).to_a.sort == [:unix, :php].sort
-                expect(platforms.to_a).to eq([:unix])
+                expect(platforms.merge( [:php, :unix] ).to_a.sort).to eq([:unix, :php].sort)
             end
         end
         context 'with invalid platforms' do

data/spec/arachni/report_spec.rb

@@ -30,7 +30,7 @@ describe Arachni::Report do
         let(:subject) { report }
         let(:data) { subject.to_rpc_data }
 
-        %w(sitemap version).each do |attribute|
+        %w(seed sitemap version).each do |attribute|
             it "includes '#{attribute}'" do
                 expect(data[attribute]).to eq(subject.send( attribute ))
             end
@@ -70,7 +70,7 @@ describe Arachni::Report do
         let(:restored) { described_class.from_rpc_data data }
         let(:data) { Arachni::RPC::Serializer.rpc_data( subject ) }
 
-        %w(sitemap issues plugins version).each do |attribute|
+        %w(seed sitemap issues plugins version).each do |attribute|
             it "restores '#{attribute}'" do
                 expect(restored.send( attribute )).to eq(subject.send( attribute ))
             end
@@ -97,6 +97,12 @@ describe Arachni::Report do
         end
     end
 
+    describe '#seed' do
+        it 'returns the scan seed' do
+            expect(report.seed).to eq(Arachni::Utilities.random_seed)
+        end
+    end
+
     describe '#url' do
         it 'returns the targeted URL' do
             expect(report.url).to eq(report.options[:url])
@@ -253,6 +259,7 @@ describe Arachni::Report do
         it 'returns the object as a hash' do
             expect(report.to_h).to eq({
                 version:         report.version,
+                seed:            report.seed,
                 options:         Arachni::Options.hash_to_rpc_data( report.options ),
                 sitemap:         report.sitemap,
                 start_datetime:  report.start_datetime.to_s,

data/spec/arachni/reporter/options_spec.rb

@@ -31,18 +31,4 @@ describe Arachni::Reporter::Options do
         end
     end
 
-    describe '#skip_responses' do
-        it 'returns a :skip_responses reporter option' do
-            expect(subject.skip_responses.name).to eq(:skip_responses)
-        end
-
-        it "defaults to 'false'" do
-            expect(subject.skip_responses.default).to eq(false)
-        end
-
-        it 'has a description' do
-            expect(subject.skip_responses.description).to be_truthy
-        end
-    end
-
 end

data/spec/arachni/rest/server_spec.rb

@@ -4,18 +4,27 @@ require "#{Arachni::Options.paths.lib}/rest/server"
 describe Arachni::Rest::Server do
     include RequestHelpers
 
-    let(:scan_url) { 'http://testfire.net' }
+    let(:scan_url) { @scan_url }
     let(:url) { tpl_url % id }
     let(:id) { @id }
     let(:non_existent_id) { 'stuff' }
 
     before do
+        @scan_url = web_server_url_for(:framework)
         reset_options
     end
 
+    after do
+        FileUtils.rm @afr_path if @afr_path
+    end
+
     def create_scan
         post '/scans',
-             url: scan_url,
+             url:             scan_url,
+             checks:          ['test'],
+             audit:           {
+                 elements:    [:links, :forms, :cookies]
+             },
              browser_cluster: {
                  pool_size: 0
              }
@@ -83,7 +92,7 @@ describe Arachni::Rest::Server do
         end
     end
 
-    describe 'SSL options', if: !Arachni.jruby? && !Arachni.windows? do
+    describe 'SSL options', if: !Arachni.jruby? && !Arachni.windows? && false do
         let(:ssl_key) { nil }
         let(:ssl_cert) { nil }
         let(:ssl_ca) { nil }
@@ -98,7 +107,7 @@ describe Arachni::Rest::Server do
             Arachni::Options.rpc.server_port = Arachni::Utilities.available_port
             Arachni::Processes::Manager.spawn( :rest_service )
 
-            sleep 0.1 while Typhoeus.get( url ).return_code == :couldnt_connect
+            sleep 0.1 while Typhoeus.get( url, timeout: 5 ).return_code == :couldnt_connect
         end
 
         after do
@@ -210,11 +219,19 @@ describe Arachni::Rest::Server do
         end
 
         it 'gets progress info' do
-            get url
+            loop do
+                get url
+                break if !response_data['busy']
+                sleep 0.5
+            end
 
-            %w(issues sitemap errors status busy statistics messages).each do |key|
+            %w(errors status busy messages statistics).each do |key|
                 expect(response_data).to include key
             end
+
+            %w(issues sitemap statistics).each do |key|
+                expect(response_data).to be_any
+            end
         end
 
         context 'when a session is maintained' do
@@ -239,6 +256,39 @@ describe Arachni::Rest::Server do
         end
     end
 
+    describe 'GET /scans/:id/summary' do
+        let(:tpl_url) { '/scans/%s/summary' }
+
+        before do
+            @id = create_scan
+        end
+
+        it 'does not include issues and sitemap' do
+            loop do
+                get url
+                break if !response_data['busy']
+                sleep 0.5
+            end
+
+            %w(status busy messages statistics).each do |key|
+                expect(response_data).to include key
+            end
+
+            %w(issues sitemap errors).each do |key|
+                expect(response_data).to_not include key
+            end
+        end
+
+        context 'when passed a non-existent id' do
+            let(:id) { non_existent_id }
+
+            it 'returns 404' do
+                get url
+                expect(response_code).to eq 404
+            end
+        end
+    end
+
     describe 'GET /scans/:id/report.:format' do
         let(:tpl_url) { "/scans/%s/report.#{format}" }
 
@@ -273,6 +323,39 @@ describe Arachni::Rest::Server do
             end
         end
 
+        describe 'afr' do
+            let(:format) { 'afr' }
+
+            before do
+                @id = create_scan
+            end
+
+            it 'returns scan report as an AFR file' do
+                get url
+
+                @afr_path = "#{Arachni::Options.paths.tmpdir}/#{Process.pid}.afr"
+                IO.write( @afr_path, last_response.body )
+
+                expect do
+                    Arachni::Report.load( @afr_path )
+                end.to_not raise_error
+            end
+
+            it 'has content-type application/octet-stream' do
+                get url
+                expect(last_response.headers['content-type']).to eq 'application/octet-stream'
+            end
+
+            context 'when passed a non-existent id' do
+                let(:id) { non_existent_id }
+
+                it 'returns 404' do
+                    get url
+                    expect(response_code).to eq 404
+                end
+            end
+        end
+
         describe 'json' do
             let(:format) { 'json' }
 
@@ -423,7 +506,7 @@ describe Arachni::Rest::Server do
             put url
             get "/scans/#{id}"
 
-            expect(response_data['status']).to eq 'pausing'
+            expect(['pausing', 'paused']).to include response_data['status']
         end
 
         context 'when passed a non-existent id' do
@@ -447,7 +530,7 @@ describe Arachni::Rest::Server do
             put "/scans/#{id}/pause"
             get "/scans/#{id}"
 
-            expect(response_data['status']).to eq 'pausing'
+            expect(['pausing', 'paused']).to include response_data['status']
 
             put url
             get "/scans/#{id}"

data/spec/arachni/rpc/server/active_options_spec.rb

@@ -36,7 +36,7 @@ describe Arachni::RPC::Server::ActiveOptions do
                         'name'  => 'value',
                         'name2' => 'value2'
                     },
-                    'cookie_string' => 'name3=value3;name4=value4'
+                    'cookie_string' => 'name3=value3,name4=value4'
                 }
             }
 

data/spec/arachni/rpc/server/framework/distributor_spec.rb

@@ -413,7 +413,7 @@ describe Arachni::RPC::Server::Framework::Distributor do
 
             raised = false
             begin
-                Timeout::timeout( 5 ) { expect(q.pop).to eq([true, true]) }
+                Timeout.timeout( 5 ) { expect(q.pop).to eq([true, true]) }
             rescue Timeout::Error
                 raised = true
             end
@@ -435,7 +435,7 @@ describe Arachni::RPC::Server::Framework::Distributor do
 
             raised = false
             begin
-                Timeout::timeout( 5 ) { expect([q.pop, q.pop]).to eq([true, true]) }
+                Timeout.timeout( 5 ) { expect([q.pop, q.pop]).to eq([true, true]) }
             rescue Timeout::Error
                 raised = true
             end
@@ -458,7 +458,7 @@ describe Arachni::RPC::Server::Framework::Distributor do
 
                 raised = false
                 begin
-                    Timeout::timeout( 5 ) { expect([q.pop, q.pop, q.pop]).to eq([true, true, :after]) }
+                    Timeout.timeout( 5 ) { expect([q.pop, q.pop, q.pop]).to eq([true, true, :after]) }
                 rescue Timeout::Error
                     raised = true
                 end
@@ -482,7 +482,7 @@ describe Arachni::RPC::Server::Framework::Distributor do
 
             raised = false
             begin
-                Timeout::timeout( 5 ) { expect([q.pop, q.pop].sort).to eq(urls) }
+                Timeout.timeout( 5 ) { expect([q.pop, q.pop].sort).to eq(urls) }
             rescue Timeout::Error
                 raised = true
             end
@@ -504,7 +504,7 @@ describe Arachni::RPC::Server::Framework::Distributor do
 
             raised = false
             begin
-                Timeout::timeout( 5 ) { expect([q.pop, q.pop].sort).to eq(urls) }
+                Timeout.timeout( 5 ) { expect([q.pop, q.pop].sort).to eq(urls) }
             rescue Timeout::Error
                 raised = true
             end
@@ -563,7 +563,7 @@ describe Arachni::RPC::Server::Framework::Distributor do
             raised = false
             begin
                 Timeout.timeout( 10 ) { pref_dispatchers = q.pop }
-            rescue TimeoutError
+            rescue Timeout::Error
                 raised = true
             end
 

data/spec/arachni/ruby/string_spec.rb

@@ -185,6 +185,12 @@ describe String do
         end
     end
 
+    describe '#escape_double_quote' do
+        it 'escapes double quotes' do
+            expect('stuff" here'.escape_double_quote).to eq 'stuff\" here'
+        end
+    end
+
     describe '#words' do
         context 'when strict is set to true' do
             it 'does not include boundaries' do

data/spec/arachni/session_spec.rb

@@ -22,8 +22,9 @@ describe Arachni::Session do
         subject.configure(
             url:    "#{@url}/login",
             inputs: {
-                username: 'john',
-                password: 'doe'
+                username:  'john',
+                password:  'doe',
+                submit_me: 'Login!'
             }
         )
 
@@ -172,7 +173,8 @@ describe Arachni::Session do
                         url:    "#{@url}/javascript_login",
                         inputs: {
                             username: 'john',
-                            password: 'doe'
+                            password: 'doe',
+                            submit_me: 'Login!'
                         }
                     )
 
@@ -187,13 +189,15 @@ describe Arachni::Session do
                 it 'returns the resulting browser evaluated page' do
                     expect(configured.login).to be_kind_of Arachni::Page
 
-                    transition = configured.login.dom.transitions.first
+                    transitions = configured.login.dom.transitions
+
+                    transition = transitions[0]
                     expect(transition.event).to eq(:load)
                     expect(transition.element).to eq(:page)
                     expect(transition.options[:url]).to eq(configured.configuration[:url])
 
-                    transition = configured.login.dom.transitions.last
-                    expect(transition.event).to eq(:submit)
+                    transition = transitions[1]
+                    expect(transition.event).to eq(:fill)
                     expect(transition.element.tag_name).to eq(:form)
 
                     expect(transition.options[:inputs]['username']).to eq(
@@ -203,6 +207,62 @@ describe Arachni::Session do
                     expect(transition.options[:inputs]['password']).to eq(
                         configured.configuration[:inputs][:password]
                     )
+
+                    expect(transition.options[:inputs]['submit_me']).to eq(
+                        configured.configuration[:inputs][:submit_me]
+                    )
+
+                    transition = transitions[2]
+                    expect(transition.event).to eq(:click)
+                    expect(transition.element).to eq(
+                        Arachni::Browser::ElementLocator.new(
+                            tag_name:   :input,
+                            attributes: {
+                                "name" => "submit_me",
+                                "type" => "submit",
+                                "value" => "Login!"
+                            }
+                        )
+                    )
+                end
+
+                context 'when a parameter is a submit input' do
+                    it 'clicks it' do
+                        subject.configure(
+                            url:    "#{@url}/login",
+                            inputs: {
+                                username: 'john',
+                                password: 'doe',
+                                submit_me: 'Login!'
+                            }
+                        )
+
+                        @opts.session.check_url     = @url
+                        @opts.session.check_pattern = 'logged-in user'
+
+                        subject.login
+
+                        expect(subject).to be_logged_in
+                    end
+                end
+
+                context 'when no parameters match a submit input' do
+                    it 'submits the form' do
+                        subject.configure(
+                            url:    "#{@url}/without_button",
+                            inputs: {
+                                username: 'john',
+                                password: 'doe'
+                            }
+                        )
+
+                        @opts.session.check_url     = @url
+                        @opts.session.check_pattern = 'logged-in user'
+
+                        subject.login
+
+                        expect(subject).to be_logged_in
+                    end
                 end
             end
         end
@@ -333,7 +393,7 @@ describe Arachni::Session do
     end
 
     describe '#find_login_form' do
-        before { @id = "#{@url}/login:form:[\"password\", \"token\", \"username\"]" }
+        before { @id = "#{@url}/login:form:[\"password\", \"submit_me\", \"token\", \"username\"]" }
         context 'when passed an array of :pages' do
             it 'should go through its forms and locate the login one' do
                 p = Arachni::Page.from_url( @url + '/login' )
@@ -462,7 +522,8 @@ describe Arachni::Session do
                     url:    "#{@url}/disappearing_login",
                     inputs: {
                         username: 'john',
-                        password: 'doe'
+                        password: 'doe',
+                        submit_me: 'Login!'
                     }
                 )
 

data/spec/arachni/snapshot_spec.rb

@@ -8,7 +8,7 @@ describe Arachni::Snapshot do
 
     subject { described_class }
     let(:dump_archive) do
-        @dump_archive = "#{Arachni.tmpdir}/snapshot-#{Arachni::Utilities.generate_token}.afs"
+        @dump_archive = "#{Arachni::Options.paths.tmpdir}/snapshot-#{Arachni::Utilities.generate_token}.afs"
     end
 
     describe '.summary' do

data/spec/arachni/state/framework_spec.rb

@@ -741,10 +741,10 @@ describe Arachni::State::Framework do
 
             subject.pause( :caller, false )
             subject.paused
-            subject.status == :paused
+            expect(subject.status).to be :paused
 
             subject.resume( :caller )
-            subject.status == :my_status
+            expect(subject.status).to be :my_status
         end
 
         context 'when called before a #pause signal has been sent' do

data/spec/arachni/support/signature_spec.rb

@@ -89,6 +89,50 @@ describe Arachni::Support::Signature do
             signature = described_class.new( string_with_noise )
             expect(signature.refine!( string_with_noise ).object_id).to eq(signature.object_id)
         end
+
+        it 'resets #hash' do
+            signature = described_class.new( string_with_noise )
+
+            ph = signature.hash
+
+            signature.refine!( string_with_noise )
+            h = signature.hash
+
+            expect(ph).not_to eq h
+        end
+    end
+
+    describe '#<<' do
+        it 'pushes new data to the signature' do
+            string = string_with_noise
+            d1 = string.lines[0..-3].join
+            d2 = string.lines[-2..-1].join
+
+            signature = described_class.new( d1 )
+            t1 = signature.tokens.dup
+
+            signature << d2
+
+            t2 = signature.tokens.dup
+
+            expect(t1).to be_subset t2
+        end
+
+        it 'returns self' do
+            signature = described_class.new( string_with_noise )
+            expect((signature << string_with_noise ).object_id).to eq(signature.object_id)
+        end
+
+        it 'resets #hash' do
+            signature = described_class.new( string_with_noise )
+
+            ph = signature.hash
+
+            signature << string_with_noise
+            h = signature.hash
+
+            expect(ph).not_to eq h
+        end
     end
 
     describe '#differences' do
@@ -107,6 +151,20 @@ describe Arachni::Support::Signature do
         end
     end
 
+    describe '#empty?' do
+        context 'when the signature is empty' do
+            subject { described_class.new( '' ) }
+
+            expect_it { to be_empty }
+        end
+
+        context 'when the signature is not empty' do
+            subject { described_class.new( string_with_noise ) }
+
+            expect_it { to_not be_empty }
+        end
+    end
+
     describe '#==' do
         context 'when the signature are identical' do
             it 'returns true' do

data/spec/arachni/trainer_spec.rb

@@ -65,6 +65,7 @@ describe Arachni::Trainer do
     end
 
     before( :each ) do
+        Arachni::ElementFilter.reset
         Arachni::Options.reset
 
         @page = Arachni::Page.from_url( @url )
@@ -75,46 +76,126 @@ describe Arachni::Trainer do
 
     describe 'HTTP requests with "train" set to' do
         describe 'nil' do
-            it 'skips the Trainer' do
-                expect(@framework.pages.size).to eq(0)
+            context 'and is not buffered' do
+                it 'skips the Trainer' do
+                    expect(@framework.pages.size).to eq(0)
 
-                Arachni::HTTP::Client.request( @url + '/elems' )
-                @framework.run
+                    Arachni::HTTP::Client.request( @url + '/elems' )
+                    @framework.run
+
+                    expect(@framework.pages.size).to eq(0)
+                end
+            end
+
+            context 'and is buffered' do
+                it 'skips the Trainer' do
+                    expect(@framework.pages.size).to eq(0)
+
+                    Arachni::HTTP::Client.request(
+                        @url + '/elems',
+                        on_body: proc {}
+                    )
+                    @framework.run
 
-                expect(@framework.pages.size).to eq(0)
+                    expect(@framework.pages.size).to eq(0)
+                end
             end
         end
         describe 'false' do
-            it 'skips the Trainer' do
-                expect(@framework.pages.size).to eq(0)
+            context 'and is not buffered' do
+                it 'skips the Trainer' do
+                    expect(@framework.pages.size).to eq(0)
 
-                Arachni::HTTP::Client.request( @url + '/elems', train: false )
-                @framework.run
+                    Arachni::HTTP::Client.request( @url + '/elems', train: false )
+                    @framework.run
 
-                expect(@framework.pages.size).to eq(0)
+                    expect(@framework.pages.size).to eq(0)
+                end
             end
-        end
-        describe 'true' do
-            it 'passes the response to the Trainer' do
-                expect(@framework.pages.size).to eq(0)
 
-                Arachni::HTTP::Client.request( @url + '/elems', train: true )
+            context 'and is buffered' do
+                it 'skips the Trainer' do
+                    expect(@framework.pages.size).to eq(0)
+
+                    Arachni::HTTP::Client.request(
+                        @url + '/elems',
+                        train:   false,
+                        on_body: proc {}
+                    )
+                    @framework.run
 
-                expect(@trainer).to receive(:push)
-                @framework.run
+                    expect(@framework.pages.size).to eq(0)
+                end
             end
+        end
 
-            context 'when a redirection leads to new elements' do
+        describe 'true' do
+            context 'and is not buffered' do
                 it 'passes the response to the Trainer' do
                     expect(@framework.pages.size).to eq(0)
 
-                    Arachni::HTTP::Client.request( @url + '/train/redirect', train: true )
+                    Arachni::HTTP::Client.request( @url + '/elems', train: true )
+
+                    expect(@trainer).to receive(:push)
                     @framework.run
+                end
 
-                    page = @framework.pages.first
-                    expect(page.links.first.inputs.include?( 'msg' )).to be_truthy
+                context 'when a redirection leads to new elements' do
+                    it 'passes the response to the Trainer' do
+                        expect(@framework.pages.size).to eq(0)
+
+                        Arachni::HTTP::Client.request( @url + '/train/redirect', train: true )
+                        @framework.run
+
+                        page = @framework.pages.first
+                        expect(page.links.first.inputs.include?( 'msg' )).to be_truthy
+                    end
                 end
             end
+
+            context 'and is buffered' do
+                it 'is ignored' do
+                    expect(@framework.pages.size).to eq(0)
+
+                    Arachni::HTTP::Client.request(
+                        @url + '/elems',
+                        train:   true,
+                        on_body: proc {}
+                    )
+
+                    expect(@trainer).to_not receive(:analyze)
+                    @framework.run
+                end
+
+                # it 'passes the response to the Trainer' do
+                #     expect(@framework.pages.size).to eq(0)
+                #
+                #     Arachni::HTTP::Client.request(
+                #         @url + '/elems',
+                #         train:   true,
+                #         on_body: proc {}
+                #     )
+                #
+                #     expect(@trainer).to receive(:analyze)
+                #     @framework.run
+                # end
+                #
+                # context 'when a redirection leads to new elements' do
+                #     it 'passes the response to the Trainer' do
+                #         expect(@framework.pages.size).to eq(0)
+                #
+                #         Arachni::HTTP::Client.request(
+                #             @url + '/train/redirect',
+                #             train:   true,
+                #             on_body: proc {}
+                #         )
+                #         @framework.run
+                #
+                #         page = @framework.pages.first
+                #         expect(page.links.first.inputs.include?( 'msg' )).to be_truthy
+                #     end
+                # end
+            end
         end
     end