arachni 1.5.1 → 1.6.0

data/spec/arachni/element/ui_form_spec.rb

@@ -173,7 +173,7 @@ describe Arachni::Element::UIForm do
 
             context 'as <input type="button">' do
                 let(:url) { "#{super()}/input-button" }
-                let(:source) { '<input type="button" id="insert" value="Insert into DOM">' }
+                let(:source) { '<input id="insert" type="button" value="Insert into DOM">' }
 
                 context 'without inputs' do
                     let(:url) { "#{super()}/without-inputs" }
@@ -240,7 +240,7 @@ describe Arachni::Element::UIForm do
 
             context 'as <input type="submit">' do
                 let(:url) { "#{super()}/input-submit" }
-                let(:source) { '<input type="submit" id="insert" value="Insert into DOM">' }
+                let(:source) { '<input id="insert" type="submit" value="Insert into DOM">' }
 
                 context 'without inputs' do
                     let(:url) { "#{super()}/without-inputs" }

data/spec/arachni/element/ui_input_spec.rb

@@ -57,7 +57,7 @@ describe Arachni::Element::UIInput do
 
                 context 'with events' do
                     let(:url) { "#{super()}/with_events" }
-                    let(:source) { '<input type="text" id="my-input" value="stuff">' }
+                    let(:source) { '<input id="my-input" type="text" value="stuff">' }
 
                     it 'returns array of elements' do
                         input = described_class.from_browser( @browser, page ).first

data/spec/arachni/http/client_spec.rb

@@ -137,19 +137,10 @@ describe Arachni::HTTP::Client do
 
     describe Arachni::OptionGroups::HTTP do
         describe '#request_concurrency' do
-            context 'Integer' do
-                it 'uses it as a max_concurrency' do
-                    @opts.http.request_concurrency = 34
-                    subject.reset
-                    expect(subject.max_concurrency).to eq(34)
-                end
-            end
-            context 'nil' do
-                it 'uses a default max concurrency setting' do
-                    @opts.http.request_concurrency = nil
-                    subject.reset
-                    expect(subject.max_concurrency).to eq(Arachni::HTTP::Client::MAX_CONCURRENCY)
-                end
+            it 'uses it as a max_concurrency' do
+                @opts.http.request_concurrency = 34
+                subject.reset
+                expect(subject.max_concurrency).to eq(34)
             end
         end
 
@@ -329,7 +320,7 @@ describe Arachni::HTTP::Client do
         it 'provides access to default headers' do
             headers = subject.headers
             expect(headers['Accept']).to eq('text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8')
-            expect(headers['User-Agent']).to eq('Arachni/v' + Arachni::VERSION)
+            expect(headers['User-Agent']).to include 'Arachni/v' + Arachni::VERSION
         end
 
         context "when #{Arachni::OptionGroups::HTTP}#request_headers is set" do
@@ -568,18 +559,15 @@ describe Arachni::HTTP::Client do
 
     describe '#original_max_concurrency' do
         it 'returns the original max concurrency' do
-            expect(subject.original_max_concurrency).to eq(20)
+            expect(subject.original_max_concurrency).to eq(10)
             expect(subject.original_max_concurrency).to eq(subject.max_concurrency)
 
-            subject.max_concurrency = 10
-            expect(subject.original_max_concurrency).to eq(20)
+            subject.max_concurrency = 5
+            expect(subject.original_max_concurrency).to eq(10)
         end
     end
 
     describe '#max_concurrency' do
-        it 'defaults to 20' do
-            expect(subject.max_concurrency).to eq(20)
-        end
         it 'respects the http_request_concurrency option' do
             @opts.http.request_concurrency = 50
             subject.reset
@@ -612,8 +600,8 @@ describe Arachni::HTTP::Client do
         it "fills in #{Arachni::HTTP::Request}#headers_string" do
             host = "#{Arachni::URI(@url).host}:#{Arachni::URI(@url).port}"
             expect(subject.request( @url, mode: :sync ).request.headers_string).to eq(
-                "GET / HTTP/1.1\r\nHost: #{host}\r\nAccept-Encoding: gzip, " +
-                    "deflate\r\nUser-Agent: Arachni/v#{Arachni::VERSION}\r\nAccept: text/html," +
+                "GET / HTTP/1.1\r\nHost: #{host}\r\nAuthorization: Basic Og==\r\nAccept-Encoding: gzip, " +
+                    "deflate\r\nUser-Agent: #{Arachni::Options.http.user_agent}\r\nAccept: text/html," +
                     "application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" +
                     "Accept-Language: en-US,en;q=0.8,he;q=0.6\r\n" +
                     "X-Arachni-Scan-Seed: #{Arachni::Utilities.random_seed}\r\n\r\n"
@@ -803,21 +791,21 @@ describe Arachni::HTTP::Client do
                                          response_max_size: 0
                         )
 
-                        expect(r.headers).not_to include 'Content-Type'
+                        expect(r.headers['Content-Type']).to be_empty
                         expect(r.body).to be_empty
 
                         r = subject.request( @url + '/http_response_max_size/without_content_length',
                                          mode: :sync,
                                          response_max_size: 1
                         )
-                        expect(r.headers).not_to include 'Content-Type'
+                        expect(r.headers['Content-Type']).to be_empty
                         expect(r.body).to be_empty
 
                         r = subject.request( @url + '/http_response_max_size/without_content_length',
                                          mode: :sync,
                                          response_max_size: 999999
                         )
-                        expect(r.headers).not_to include 'Content-Type'
+                        expect(r.headers['Content-Type']).to be_empty
                         expect(r.body).to be_empty
 
                         r = subject.request( @url + '/http_response_max_size/without_content_length',
@@ -825,7 +813,7 @@ describe Arachni::HTTP::Client do
                                          response_max_size: 1000000
                         )
 
-                        expect(r.headers).not_to include 'Content-Type'
+                        expect(r.headers['Content-Type']).to be_empty
                         expect(r.body).not_to be_empty
                     end
                 end

data/spec/arachni/http/cookie_jar_spec.rb

@@ -142,7 +142,7 @@ describe Arachni::HTTP::CookieJar do
                         expect(subject).to be_empty
 
                         Arachni::Options.url = 'http://test.com'
-                        subject.update( 'some_param=9e4ca2cc0f18a49f7c1881f78bebf7df; path=/; expires=Wed, 02-Oct-2020 23:53:46 GMT; HttpOnly' )
+                        subject.update( 'some_param=9e4ca2cc0f18a49f7c1881f78bebf7df; path=/; expires=Wed, 02-Oct-2030 23:53:46 GMT; HttpOnly' )
                         expect(subject.cookies.first.name).to eq('some_param')
                         expect(subject.cookies.first.value).to eq('9e4ca2cc0f18a49f7c1881f78bebf7df')
                     end
@@ -153,7 +153,7 @@ describe Arachni::HTTP::CookieJar do
                         expect(subject).to be_empty
 
                         Arachni::Options.url = 'http://test.com'
-                        subject.update( 'some_param=9e4ca2cc0f18a49f7c1881f78bebf7df; path=/; expires=Wed, 02-Oct-2020 23:53:46 GMT; HttpOnly' )
+                        subject.update( 'some_param=9e4ca2cc0f18a49f7c1881f78bebf7df; path=/; expires=Wed, 02-Oct-2030 23:53:46 GMT; HttpOnly' )
                         expect(subject.cookies.first.name).to eq('some_param')
                         expect(subject.cookies.first.value).to eq('9e4ca2cc0f18a49f7c1881f78bebf7df')
                     end

data/spec/arachni/http/proxy_server_spec.rb

@@ -202,12 +202,14 @@ describe Arachni::HTTP::ProxyServer do
 
                 expect(request.headers_string.split( "\r\n" ).sort).to eq(
                     ("POST / HTTP/1.1\r\n" <<
+                    "Authorization: Basic Og==\r\n" <<
                     "Host: #{request.parsed_url.host}:#{request.parsed_url.port}\r\n" <<
                     "Accept-Encoding: gzip, deflate\r\n" <<
                     "User-Agent: Typhoeus - https://github.com/typhoeus/typhoeus\r\n" <<
                     "Accept: */*\r\n" <<
                     "Content-Length: 7\r\n" <<
                     "Accept-Language: en-US,en;q=0.8,he;q=0.6\r\n" <<
+                    "#{Arachni::HTTP::Client::SEED_HEADER_NAME}: #{Arachni::Utilities.random_seed}\r\n" <<
                     "Content-Type: application/x-www-form-urlencoded\r\n\r\n").split( "\r\n" ).sort
                 )
 

data/spec/arachni/http/request_spec.rb

@@ -323,8 +323,9 @@ describe Arachni::HTTP::Request do
         it "fills in #{Arachni::HTTP::Request}#headers_string" do
             host = "#{Arachni::URI(@url).host}:#{Arachni::URI(@url).port}"
             expect(described_class.new( url: @url ).run.request.headers_string).to eq(
-                "GET / HTTP/1.1\r\nHost: #{host}\r\nAccept-Encoding: gzip, " +
-                    "deflate\r\nUser-Agent: Arachni/v#{Arachni::VERSION}\r\nAccept: text/html," +
+                "GET / HTTP/1.1\r\nHost: #{host}\r\nAuthorization: Basic Og==\r\n" +
+                    "Accept-Encoding: gzip, deflate\r\n" +
+                    "User-Agent: #{Arachni::Options.http.user_agent}\r\nAccept: text/html," +
                     "application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n" +
                     "Accept-Language: en-US,en;q=0.8,he;q=0.6\r\n\r\n"
             )

data/spec/arachni/option_groups/browser_cluster_spec.rb

@@ -52,4 +52,21 @@ describe Arachni::OptionGroups::BrowserCluster do
             end
         end
     end
+
+    describe '#session_storage' do
+        context 'when passed a Hash' do
+            it 'sets it' do
+                subject.session_storage = { 1 => 2 }
+                expect(subject.session_storage).to eq({ 1 => 2 })
+            end
+        end
+
+        context 'when passed anything other than Hash' do
+            it 'raises ArgumentError' do
+                expect do
+                    subject.session_storage = 1
+                end.to raise_error ArgumentError
+            end
+        end
+    end
 end

data/spec/arachni/option_groups/http_spec.rb

@@ -14,20 +14,20 @@ describe Arachni::OptionGroups::HTTP do
     end
 
     describe '#user_agent' do
-        it "defaults to Arachni/v#{Arachni::VERSION}" do
-            expect(subject.user_agent).to eq('Arachni/v' + Arachni::VERSION.to_s)
+        it "defaults to Mozilla/5.0 (Gecko) Arachni/v#{Arachni::VERSION}" do
+            expect(subject.user_agent).to eq('Mozilla/5.0 (Gecko) Arachni/v' + Arachni::VERSION.to_s)
         end
     end
 
     describe '#request_concurrency' do
-        it 'defaults to 20' do
-            expect(subject.request_concurrency).to eq(20)
+        it 'defaults to 10' do
+            expect(subject.request_concurrency).to eq(10)
         end
     end
 
     describe '#request_timeout' do
-        it 'defaults to 10000' do
-            expect(subject.request_timeout).to eq(10000)
+        it 'defaults to 20000' do
+            expect(subject.request_timeout).to eq(20000)
         end
     end
 

data/spec/arachni/option_groups/scope_spec.rb

@@ -54,12 +54,7 @@ describe Arachni::OptionGroups::Scope do
         end
         describe 'when #auto_redundant_paths has been disabled' do
             it 'returns false' do
-                subject.auto_redundant_paths = nil
-                expect(subject.auto_redundant?).to be_falsey
-            end
-        end
-        describe 'by default' do
-            it 'returns false' do
+                subject.auto_redundant_paths = 0
                 expect(subject.auto_redundant?).to be_falsey
             end
         end

data/spec/arachni/page_spec.rb

@@ -644,13 +644,14 @@ describe Arachni::Page do
 
     describe '#elements' do
         it 'returns all page elements' do
-            expect(page.elements).to eq(page.links | page.forms | page.cookies | page.headers)
+            expect(page.elements).to eq(page.links | page.forms | page.cookies |
+                                            page.nested_cookies | page.headers)
         end
     end
 
     describe '#elements_within_scope' do
         it 'returns all elements that are within scope' do
-            Arachni::Options.audit.elements :links, :forms, :cookies, :headers
+            Arachni::Options.audit.elements :links, :forms, :cookies, :nested_cookies, :headers
 
             elements = page.elements
             element = elements.pop

data/spec/arachni/parser_spec.rb

@@ -378,9 +378,35 @@ describe Arachni::Parser do
         end
     end
 
+    describe '#nested_cookies' do
+        it 'returns an array of nested cookies' do
+            expect(subject.nested_cookies.size).to eq(2)
+
+            cookies = subject.nested_cookies.sort_by { |cookie| cookie.name }.reverse
+
+            cookie = cookies.pop
+            expect(cookie.action).to eq(@url)
+            expect(cookie.name).to eq('http_equiv_ns_cookie_name')
+            expect(cookie.inputs).to eq({ "name2" => "value2" })
+            expect(cookie.secure?).to be_truthy
+            expect(cookie.http_only?).to be_truthy
+            expect(cookie.method).to eq(:get)
+            expect(cookie.url).to eq(@url)
+
+            cookie = cookies.pop
+            expect(cookie.action).to eq(@url)
+            expect(cookie.name).to eq('ns_cookie')
+            expect(cookie.inputs).to eq({ 'name' => 'value' })
+            expect(cookie.method).to eq(:get)
+            expect(cookie.secure?).to be_falsey
+            expect(cookie.http_only?).to be_falsey
+            expect(cookie.url).to eq(@url)
+        end
+    end
+
     describe '#cookies' do
         it 'returns an array of cookies' do
-            expect(subject.cookies.size).to eq(3)
+            expect(subject.cookies.size).to eq(5)
 
             cookies = subject.cookies.sort_by { |cookie| cookie.name }.reverse
 
@@ -407,6 +433,24 @@ describe Arachni::Parser do
             expect(cookie.http_only?).to be_truthy
             expect(cookie.method).to eq(:get)
             expect(cookie.url).to eq(@url)
+
+            cookie = cookies.pop
+            expect(cookie.action).to eq(@url)
+            expect(cookie.name).to eq('http_equiv_ns_cookie_name')
+            expect(cookie.inputs).to eq({ 'http_equiv_ns_cookie_name' => 'name2=value2' })
+            expect(cookie.method).to eq(:get)
+            expect(cookie.secure?).to be_truthy
+            expect(cookie.http_only?).to be_truthy
+            expect(cookie.url).to eq(@url)
+
+            cookie = cookies.pop
+            expect(cookie.action).to eq(@url)
+            expect(cookie.name).to eq('ns_cookie')
+            expect(cookie.inputs).to eq({ 'ns_cookie' => 'name=value' })
+            expect(cookie.method).to eq(:get)
+            expect(cookie.secure?).to be_falsey
+            expect(cookie.http_only?).to be_falsey
+            expect(cookie.url).to eq(@url)
         end
     end
 

data/spec/arachni/reporter/options_spec.rb

@@ -31,18 +31,4 @@ describe Arachni::Reporter::Options do
         end
     end
 
-    describe '#skip_responses' do
-        it 'returns a :skip_responses reporter option' do
-            expect(subject.skip_responses.name).to eq(:skip_responses)
-        end
-
-        it "defaults to 'false'" do
-            expect(subject.skip_responses.default).to eq(false)
-        end
-
-        it 'has a description' do
-            expect(subject.skip_responses.description).to be_truthy
-        end
-    end
-
 end

data/spec/arachni/rest/server_spec.rb

@@ -14,6 +14,10 @@ describe Arachni::Rest::Server do
         reset_options
     end
 
+    after do
+        FileUtils.rm @afr_path if @afr_path
+    end
+
     def create_scan
         post '/scans',
              url:             scan_url,
@@ -88,7 +92,7 @@ describe Arachni::Rest::Server do
         end
     end
 
-    describe 'SSL options', if: !Arachni.jruby? && !Arachni.windows? do
+    describe 'SSL options', if: !Arachni.jruby? && !Arachni.windows? && false do
         let(:ssl_key) { nil }
         let(:ssl_cert) { nil }
         let(:ssl_ca) { nil }
@@ -103,7 +107,7 @@ describe Arachni::Rest::Server do
             Arachni::Options.rpc.server_port = Arachni::Utilities.available_port
             Arachni::Processes::Manager.spawn( :rest_service )
 
-            sleep 0.1 while Typhoeus.get( url ).return_code == :couldnt_connect
+            sleep 0.1 while Typhoeus.get( url, timeout: 5 ).return_code == :couldnt_connect
         end
 
         after do
@@ -319,6 +323,39 @@ describe Arachni::Rest::Server do
             end
         end
 
+        describe 'afr' do
+            let(:format) { 'afr' }
+
+            before do
+                @id = create_scan
+            end
+
+            it 'returns scan report as an AFR file' do
+                get url
+
+                @afr_path = "#{Arachni::Options.paths.tmpdir}/#{Process.pid}.afr"
+                IO.write( @afr_path, last_response.body )
+
+                expect do
+                    Arachni::Report.load( @afr_path )
+                end.to_not raise_error
+            end
+
+            it 'has content-type application/octet-stream' do
+                get url
+                expect(last_response.headers['content-type']).to eq 'application/octet-stream'
+            end
+
+            context 'when passed a non-existent id' do
+                let(:id) { non_existent_id }
+
+                it 'returns 404' do
+                    get url
+                    expect(response_code).to eq 404
+                end
+            end
+        end
+
         describe 'json' do
             let(:format) { 'json' }
 

data/spec/arachni/uri_spec.rb

@@ -79,7 +79,7 @@ describe Arachni::URI do
            "http://test.com/stuff?name=val&name2=val2"=>
                "http://test.com/stuff?name=val&name2=val2",
            "http://testfire.net/bank/queryxpath.aspx?__EVENTVALIDATION=%2FwEWAwLNx%2B2YBwKw59eKCgKcjoPABw%3D%3D&__VIEWSTATE=%2FwEPDwUKMTEzMDczNTAxOWRk&_ctl0%3A_ctl0%3AContent%3AMain%3AButton1=Query&_ctl0%3A_ctl0%3AContent%3AMain%3ATextBox1=Enter+title+%28e.g.+IBM%29%27%3Becho+287630581954%2B4196403186331128%3B%23"=>
-               "http://testfire.net/bank/queryxpath.aspx?__EVENTVALIDATION=/wEWAwLNx%202YBwKw59eKCgKcjoPABw==&__VIEWSTATE=/wEPDwUKMTEzMDczNTAxOWRk&_ctl0:_ctl0:Content:Main:Button1=Query&_ctl0:_ctl0:Content:Main:TextBox1=Enter%20title%20(e.g.%20IBM)';echo%20287630581954%204196403186331128;%23",
+               "http://testfire.net/bank/queryxpath.aspx?__EVENTVALIDATION=/wEWAwLNx%2B2YBwKw59eKCgKcjoPABw==&__VIEWSTATE=/wEPDwUKMTEzMDczNTAxOWRk&_ctl0:_ctl0:Content:Main:Button1=Query&_ctl0:_ctl0:Content:Main:TextBox1=Enter%20title%20(e.g.%20IBM)';echo%20287630581954%2B4196403186331128;%23",
            "http://192.168.0.232/dvwa/phpinfo.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000%23%5E%28%24%21%40%24%29%28%28%29%29%29%2A%2A%2A%2A%2A%2A&_arachni_trainer_c987fdb6d3955bd60191449bc465bb5ca760f60661fa4bcdf28736ae04aa2a1e=c987fdb6d3955bd60191449bc465bb5ca760f60661fa4bcdf28736ae04aa2a1e"=>
                "http://192.168.0.232/dvwa/phpinfo.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000%23%5E($!@$)(()))******&_arachni_trainer_c987fdb6d3955bd60191449bc465bb5ca760f60661fa4bcdf28736ae04aa2a1e=c987fdb6d3955bd60191449bc465bb5ca760f60661fa4bcdf28736ae04aa2a1e",
            "http://foo.com/user/login?user%5Bname%5D=bar&user%5Bpass%5D=asdasd%26asdihbasd"=>

data/spec/components/checks/active/code_injection_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -21,7 +21,8 @@ describe name_from_filename do
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 4,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 8
             },
             perl:    {
                 Element::Form         => 8,
@@ -30,7 +31,8 @@ describe name_from_filename do
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 4,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 8
             },
             python:  {
                 Element::Form         => 4,
@@ -39,7 +41,8 @@ describe name_from_filename do
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 2,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 4
             },
             asp:    {
                 Element::Form         => 8,
@@ -48,7 +51,8 @@ describe name_from_filename do
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 4,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 8
             },
             ruby:    {
                 Element::Form         => 4,
@@ -57,7 +61,8 @@ describe name_from_filename do
                 Element::Header       => 4,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 4
             }
         }
     end

data/spec/components/checks/active/code_injection_timing_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -20,7 +20,8 @@ describe name_from_filename do
             Element::Header       => 3,
             Element::LinkTemplate => 4,
             Element::JSON         => 4,
-            Element::XML          => 8
+            Element::XML          => 8,
+            Element::NestedCookie => 4
         }
     end
 

data/spec/components/checks/active/file_inclusion_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -21,16 +21,18 @@ describe name_from_filename do
                 Element::Header       => 8,
                 Element::LinkTemplate => 16,
                 Element::JSON         => 16,
-                Element::XML          => 16
+                Element::XML          => 16,
+                Element::NestedCookie => 32
             },
             windows: {
                 Element::Form         => 192,
-                Element::Link         => 192,
+                Element::Link         => 190,
                 Element::Cookie       => 96,
                 Element::Header       => 48,
                 Element::LinkTemplate => 96,
                 Element::JSON         => 96,
-                Element::XML          => 96
+                Element::XML          => 96,
+                Element::NestedCookie => 192
             },
             java:    {
                 Element::Form         => 16,
@@ -39,25 +41,28 @@ describe name_from_filename do
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 8,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 16
             },
             php:  {
                 Element::Form         => 240,
-                Element::Link         => 240,
+                Element::Link         => 238,
                 Element::Cookie       => 112,
                 Element::Header       => 56,
                 Element::LinkTemplate => 120,
                 Element::JSON         => 112,
-                Element::XML          => 112
+                Element::XML          => 112,
+                Element::NestedCookie => 224
             },
             perl:  {
                 Element::Form         => 240,
-                Element::Link         => 240,
+                Element::Link         => 238,
                 Element::Cookie       => 120,
                 Element::Header       => 60,
                 Element::LinkTemplate => 120,
                 Element::JSON         => 120,
-                Element::XML          => 120
+                Element::XML          => 120,
+                Element::NestedCookie => 240
             }
         }
     end

data/spec/components/checks/active/ldap_injection_spec.rb

@@ -4,8 +4,8 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -14,11 +14,12 @@ describe name_from_filename do
         {
             Element::Form         => i,
             Element::Link         => i,
-            Element::Cookie       => i,
+            Element::Cookie       => i * 2,
             Element::Header       => i,
             Element::LinkTemplate => i * 2,
             Element::JSON         => i,
-            Element::XML          => i * 2
+            Element::XML          => i * 2,
+            Element::NestedCookie => i * 2
         }
     end
     easy_test

data/spec/components/checks/active/no_sql_injection_differential_spec.rb

@@ -8,7 +8,7 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie ]
     end
 
     def issue_count

data/spec/components/checks/active/no_sql_injection_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -17,11 +17,12 @@ describe name_from_filename do
             mongodb: {
                 Element::Form         => 2,
                 Element::Link         => 2,
-                Element::Cookie       => 2,
+                Element::Cookie       => 4,
                 Element::Header       => 1,
                 Element::LinkTemplate => 2,
                 Element::JSON         => 2,
-                Element::XML          => 2
+                Element::XML          => 2,
+                Element::NestedCookie => 3
             }
         }
     end