arachni 1.5.1 → 1.6.0

data/lib/arachni/support/glob.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/lookup/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/lookup/hash_set.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/lookup/moolb.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/lookup.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/mixins/observable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/mixins/terminal.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/mixins.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/profiler.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support/signature.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/support.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/trainer.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/ui/foo/output.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/uri/scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/uri.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -93,6 +93,7 @@ class URI
                     *[string, good_characters].compact
                 )
                 s.recode!
+                s.gsub!( '+', '%2B' )
                 s
             end
         end
@@ -104,13 +105,8 @@ class URI
         # @return   [String]
         def decode( string )
             CACHE[__method__].fetch( string ) do
-                s = Addressable::URI.unencode( string )
-
-                if s
-                    s.recode!
-                    s.gsub!( '+', ' ' )
-                end
-
+                s = Addressable::URI.unencode( string.gsub( '+', '%20' ) )
+                s.recode! if s
                 s
             end
         end
@@ -650,7 +646,8 @@ class URI
         @query_parameters ||= begin
             q.split( '&' ).inject( {} ) do |h, pair|
                 name, value = pair.split( '=', 2 )
-                h[::URI.decode( name.to_s )] = ::URI.decode( value.to_s )
+                h[::URI.decode_www_form_component( name.to_s )] =
+                  ::URI.decode_www_form_component( value.to_s )
                 h
             end
         end

data/lib/arachni/utilities.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/version.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/version

@@ -1 +1 @@
-1.5.1
+1.6.0

data/spec/arachni/browser/javascript/dom_monitor_spec.rb

@@ -43,22 +43,22 @@ describe Arachni::Browser::Javascript::DOMMonitor do
         expect(javascript.run( "return document.getElementById('my-button')._arachni_events")).to eq([
             [
                 'click',
-                'function (my_button_click) {}'
+                'function( my_button_click ){}'
             ],
             [
                 'click',
-                'function (my_button_click2) {}'
+                'function( my_button_click2 ){}'
             ],
             [
                 'onmouseover',
-                'function (my_button_onmouseover) {}'
+                'function( my_button_onmouseover ){}'
             ]
         ])
 
         expect(javascript.run( "return document.getElementById('my-button2')._arachni_events")).to eq([
             [
                 'click',
-                'function (my_button2_click) {}'
+                'function( my_button2_click ){}'
             ]
         ])
 
@@ -68,12 +68,12 @@ describe Arachni::Browser::Javascript::DOMMonitor do
     describe '#digest' do
         it 'returns a string digest of the current DOM tree' do
             load '/digest'
-            expect(subject.digest).to eq(1754753071)
+            expect(subject.digest).to eq(-1011738060)
 
-            # expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://' <<
-            #     'javascript.browser.arachni/polyfills.js><SCRIPT src=http://javascri' <<
+            # expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=https://' <<
+            #     'javascript.browser.arachni/polyfills.js><SCRIPT src=https://javascri' <<
             #     'pt.browser.arachni/' <<'taint_tracer.js><SCRIPT src' <<
-            #     '=http://javascript.browser.arachni/dom_monitor.js><SCRIPT>' <<
+            #     '=https://javascript.browser.arachni/dom_monitor.js><SCRIPT>' <<
             #     '<BODY onload=void();><DIV id=my-id-div><DIV class=my-class' <<
             #     '-div><STRONG><EM><I><B><STRONG><SCRIPT><SCRIPT type=text/' <<
             #     'javascript><A href=#stuff>')
@@ -81,53 +81,77 @@ describe Arachni::Browser::Javascript::DOMMonitor do
 
         it 'does not include <p> elements' do
             load '/digest/p'
-            expect(subject.digest).to eq(422148765)
+            expect(subject.digest).to eq(-22431432)
 
-            # expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://' <<
-            #     'javascript.browser.arachni/polyfills.js><SCRIPT src=http://javascript' <<
-            #     '.browser.arachni/taint_tracer.js><SCRIPT src=http://' <<
+            # expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=https://' <<
+            #     'javascript.browser.arachni/polyfills.js><SCRIPT src=https://javascript' <<
+            #     '.browser.arachni/taint_tracer.js><SCRIPT src=https://' <<
             #     'javascript.browser.arachni/dom_monitor.js><SCRIPT><BODY><STRONG>')
         end
 
         it "does not include 'data-arachni-id' attributes" do
             load '/digest/data-arachni-id'
-            expect(subject.digest).to eq(822535290)
+            expect(subject.digest).to eq(2050210901)
 
-            # expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=http://' <<
-            #     'javascript.browser.arachni/polyfills.js><SCRIPT src=http://javascript' <<
-            #     '.browser.arachni/taint_tracer.js><SCRIPT src=http://' <<
+            # expect(subject.digest).to eq('<HTML><HEAD><SCRIPT src=https://' <<
+            #     'javascript.browser.arachni/polyfills.js><SCRIPT src=https://javascript' <<
+            #     '.browser.arachni/taint_tracer.js><SCRIPT src=https://' <<
             #     'javascript.browser.arachni/dom_monitor.js><SCRIPT><BODY><DIV ' <<
             #     'id=my-id-div><DIV class=my-class-div>')
         end
     end
 
     describe '#timeouts' do
-        it 'keeps track of setTimeout() timers' do
-            load '/timeouts'
-
-            expect(subject.timeouts).to eq([
-                [
-                    "function (name, value) {\n            document.cookie = name + \"=post-\" + value;\n        }",
-                    1000, 'timeout1', 1000
-                ],
-                [
-                    "function (name, value) {\n            document.cookie = name + \"=post-\" + value;\n        }",
-                    1500, 'timeout2', 1500
-                ],
-                [
-                    "function (name, value) {\n            document.cookie = name + \"=post-\" + value;\n        }",
-                    2000, 'timeout3', 2000
-                ]
-            ])
+        context "when #{Arachni::OptionGroups::BrowserCluster}#wait_for_timers is" do
+            context 'true' do
+                before do
+                    Arachni::Options.browser_cluster.wait_for_timers = true
+                end
+
+                it 'keeps track of setTimeout() timers' do
+                    load '/timeouts'
+
+                    expect(subject.timeouts).to eq([
+                                                     [
+                                                       "function( name, value ){\n            document.cookie = name + \"=post-\" + value\n        }",
+                                                       1000, 'timeout1', 1000
+                                                     ],
+                                                     [
+                                                       "function( name, value ){\n            document.cookie = name + \"=post-\" + value\n        }",
+                                                       1500, 'timeout2', 1500
+                                                     ],
+                                                     [
+                                                       "function( name, value ){\n            document.cookie = name + \"=post-\" + value\n        }",
+                                                       2000, 'timeout3', 2000
+                                                     ]
+                                                   ])
+
+                    expect(@browser.load_delay).to eq(2000)
+                    expect(@browser.cookies.size).to eq(4)
+                    expect(@browser.cookies.map { |c| c.to_s }.sort).to eq([
+                                                                             'timeout3=post-2000',
+                                                                             'timeout2=post-1500',
+                                                                             'timeout1=post-1000',
+                                                                             'timeout=pre'
+                                                                           ].sort)
+                end
+            end
+
+            context 'false' do
+                before do
+                    Arachni::Options.browser_cluster.wait_for_timers = false
+                end
+
+                it 'does not keeps track of setTimeout() timers' do
+                    load '/timeouts'
+
+                    expect(@browser.cookies.size).to eq(1)
+                    expect(@browser.cookies.map { |c| c.to_s }.sort).to eq([
+                        'timeout=pre'
+                    ].sort)
+                end
+            end
 
-            expect(@browser.load_delay).to eq(2000)
-            expect(@browser.cookies.size).to eq(4)
-            expect(@browser.cookies.map { |c| c.to_s }.sort).to eq([
-                'timeout3=post-2000',
-                'timeout2=post-1500',
-                'timeout1=post-1000',
-                'timeout=pre'
-            ].sort)
         end
     end
 
@@ -140,7 +164,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                     'tag_name' => 'button',
                     'events' => {
                         'click' =>  [
-                            'function (my_button_click) {}',
+                            'function( my_button_click ){}',
                             'handler_1()'
                         ]
                     },
@@ -162,10 +186,10 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                         'events'     =>
                             {
                                 'click' => [
-                                    'function (parent_click) {}',
-                                    'function (child_click) {}',
-                                    'function (window_click) {}',
-                                    'function (document_click) {}'
+                                    'function( parent_click ){}',
+                                    'function( child_click ){}',
+                                    'function( window_click ){}',
+                                    'function( document_click ){}'
                                 ]
                             },
                         'attributes' => { 'id' => 'child-span' }
@@ -183,7 +207,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                         "tag_name"   => "button",
                         "events"     => {
                             "click"=> [
-                                "function (e) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
+                                "function( e ) {\n\t\t\t\t// Discard the second event of a jQuery.event.trigger() and\n\t\t\t\t// when an event is called after a page has unloaded\n\t\t\t\treturn typeof jQuery !== core_strundefined && (!e || jQuery.event.triggered !== e.type) ?\n\t\t\t\t\tjQuery.event.dispatch.apply( eventHandle.elem, arguments ) :\n\t\t\t\t\tundefined;\n\t\t\t}"
                             ]
                         },
                         "attributes" => {
@@ -234,17 +258,17 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                             'tag_name'   => 'button',
                             'events'     => {
                                 'click' => [
-                                    'function (my_button_click) {}',
-                                    'function (my_button_click2) {}'
+                                    'function( my_button_click ){}',
+                                    'function( my_button_click2 ){}'
                                 ],
-                                'mouseover' => ['function (my_button_onmouseover) {}']
+                                'mouseover' => ['function( my_button_onmouseover ){}']
                             },
                             'attributes' => { 'id' => 'my-button' }
                         },
                         {
                             'tag_name'   => 'button',
                             'events'     => {
-                                'click' => ['function (my_button2_click) {}']
+                                'click' => ['function( my_button2_click ){}']
                             },
                             'attributes' => { 'id' => 'my-button2' }
                         }
@@ -261,7 +285,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                            "tag_name"   => "div",
                            "events"     => {
                                "click" => [
-                                   "function (parent_click) {}"
+                                   "function( parent_click ){}"
                                ]
                            },
                            "attributes" => { "id" => "parent" } },
@@ -269,9 +293,9 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                            "tag_name"   => "button",
                            "events"     => {
                                "click" => [
-                                   "function (parent_click) {}",
-                                   "function (window_click) {}",
-                                   "function (document_click) {}"
+                                   "function( parent_click ){}",
+                                   "function( window_click ){}",
+                                   "function( document_click ){}"
                                ]
                            },
                            "attributes" => { "id" => "parent-button" }
@@ -279,7 +303,7 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                         {
                            "tag_name"   => "div",
                            "events"     => {
-                               "click" => ["function (child_click) {}"]
+                               "click" => ["function( child_click ){}"]
                            },
                            "attributes" => { "id" => "child" }
                         },
@@ -287,10 +311,10 @@ describe Arachni::Browser::Javascript::DOMMonitor do
                            "tag_name"   => "button",
                            "events"     => {
                                "click" => [
-                                   "function (parent_click) {}",
-                                   "function (child_click) {}",
-                                   "function (window_click) {}",
-                                   "function (document_click) {}"
+                                   "function( parent_click ){}",
+                                   "function( child_click ){}",
+                                   "function( window_click ){}",
+                                   "function( document_click ){}"
                                ]
                            },
                            "attributes" => { "id" => "child-button" }

data/spec/arachni/browser/javascript/proxy_spec.rb

@@ -51,16 +51,6 @@ describe Arachni::Browser::Javascript::Proxy do
         end
     end
 
-    describe '#js_object' do
-        it 'returns the JS-side object of the proxied object' do
-            expect(subject.js_object).to eq("_#{@javascript.token}ProxyTest")
-
-            js_object = @javascript.run( "return #{subject.js_object}" )
-            expect(js_object).to include 'my_property'
-            expect(js_object['my_function']).to start_with 'function ('
-        end
-    end
-
     describe '#function?' do
         context 'when dealing with setters' do
             context 'for existing properties' do