arachni 1.5.1 → 1.6.1.1

data/lib/arachni/browser/javascript/proxy/stub.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/proxy.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/scripts/dom_monitor.js

@@ -1,5 +1,5 @@
 /*
- * Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+ * Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
  *
  * This file is part of the Arachni Framework project and is subject to
  * redistribution and commercial restrictions. Please see the Arachni Framework
@@ -23,6 +23,8 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
     // for this document.
     initialized:         false,
 
+    event_inheritance_limit: null,
+
     // Keeps track of setTimeout() calls.
     timeouts:            [],
 
@@ -149,9 +151,11 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         "input" : true
     },
 
-    initialize: function () {
+    initialize: function ( event_inheritance_limit ) {
         if( _tokenDOMMonitor.initialized ) return;
 
+        _tokenDOMMonitor.event_inheritance_limit = event_inheritance_limit;
+
         _tokenDOMMonitor.track_setTimeout();
         _tokenDOMMonitor.track_addEventListener();
 
@@ -191,6 +195,8 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         // `offset` and `batch_size`.
         var relevant_element_index = 0;
 
+        var event_inheritance_limit   = 0;
+
         for( var i = 0; i < length; i++ ) {
             var element = elements[i];
 
@@ -205,7 +211,7 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
             if( tag_name_whitelist.length > 0 && !whitelist[tag_name] ) continue;
 
             // Skip invisible elements.
-            if( element.offsetWidth <= 0 && element.offsetHeight <= 0 ) continue;
+            if( !_tokenDOMMonitor.is_visible( element ) ) continue;
 
             var e = {
                 tag_name:   tag_name,
@@ -213,11 +219,19 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
                 attributes: {}
             };
 
-            // If the current element is allowed to have inherited events
-            // merge them with its own.
-            if( _tokenDOMMonitor.is_allowed_element_with_inherited_events( e.tag_name ) ) {
+            // If we haven't reached the event bubbling depth limit and the
+            // current element is allowed to have inherited events, merge them
+            // with its own.
+            if(
+                (
+                    !_tokenDOMMonitor.event_inheritance_limit ||
+                    event_inheritance_limit < _tokenDOMMonitor.event_inheritance_limit
+                ) && _tokenDOMMonitor.is_allowed_element_with_inherited_events( e.tag_name )
+            ) {
                 e.events = e.events.concat( element._arachni_inherited_events || [] );
                 e.events = _tokenDOMMonitor.arrayUnique( e.events.concat( global_events ) );
+
+                event_inheritance_limit++;
             }
 
             var attributes  = element.attributes;
@@ -265,7 +279,7 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
                 }
 
                 grouped_events[event_name] = grouped_events[event_name] || [];
-                grouped_events[event_name].push( event_handler );
+                grouped_events[event_name].push( event_handler.toString() );
             }
             e.events = grouped_events;
 
@@ -379,7 +393,15 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
 
         window.setTimeout = function() {
             arguments[1] = parseInt( arguments[1] );
-            _tokenDOMMonitor.timeouts.push( arguments );
+
+            args = [];
+            for( i = 0; i < arguments.length; i++ ) {
+                args[i] = arguments[i];
+            }
+            args[0] = args[0].toString();
+
+            _tokenDOMMonitor.timeouts.push( args );
+
             original_setTimeout.apply( this, arguments );
         };
     },
@@ -477,7 +499,7 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         }
 
         // All is well, register the event with the element.
-        element['_arachni_events'].push( [event, handler] );
+        element['_arachni_events'].push( [event, handler.toString()] );
     },
 
     // Sets a unique enough custom ID attribute to elements that lack proper IDs.
@@ -506,6 +528,14 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         }
     },
 
+    is_visible: function( element ) {
+        return !!(
+            element.offsetWidth  ||
+            element.offsetHeight ||
+            element.getClientRects().length
+        );
+    },
+
     is_valid_event: function ( event ) {
         return Object.prototype.hasOwnProperty.call(
             _tokenDOMMonitor.valid_events,
@@ -561,5 +591,3 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         return hash;
     }
 };
-
-_tokenDOMMonitor.initialize();

data/lib/arachni/browser/javascript/scripts/taint_tracer.js

@@ -1,5 +1,5 @@
 /*
- * Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+ * Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
  *
  * This file is part of the Arachni Framework project and is subject to
  * redistribution and commercial restrictions. Please see the Arachni Framework
@@ -70,7 +70,6 @@ var _tokenTaintTracer = _tokenTaintTracer || {
                     'decodeURI', 'escape', 'unescape'
                 ]
             ],
-            [Text.prototype, ['replaceWholeText']],
             [Document.prototype, ['createTextNode']],
             [HTMLDocument.prototype, ['write', 'writeln']],
             [Element.prototype, ['setAttribute']],
@@ -260,13 +259,15 @@ var _tokenTaintTracer = _tokenTaintTracer || {
             trace = [];
 
         depth_offset = parseInt( depth_offset ) || 3;
-        for( var i = 0; i < depth_offset - 1; i++ ) {
+        for( var i = 0; i < depth_offset - 2; i++ ) {
             if( f ) f = f.caller;
         }
 
         var error = _tokenTaintTracer.get_error_object();
         var stackArrayOffset = depth_offset;
 
+        var current_url = window.location.href;
+
         var stack_messages = error.stack.split( '\n' );
         while( stackArrayOffset <= stack_messages.length - 1 ) {
             // Skip our own functions from the trace.
@@ -276,37 +277,41 @@ var _tokenTaintTracer = _tokenTaintTracer || {
                 };
 
                 if( f ) {
-                    frame.function.source = f;
+                    frame.function.source = f.toString();
 
                     // Scripts with 'use strict' don't let us access arguments.
                     try {
                         frame.function.arguments =
                             _tokenTaintTracer.sanitize_arguments( f.arguments );
-                    } catch(e){}
+                    } catch( e ){ console.log( e ) }
                 }
 
-                var stack = stack_messages[stackArrayOffset];
+                var stack_frame = stack_messages[stackArrayOffset].split( 'at ', 2 ).pop();
 
-                var name_rest_splits;
-                if( stack.indexOf( '@' ) !== -1 ) {
-                    name_rest_splits = stack.split( '@', 2 );
-                    frame.function.name = name_rest_splits.shift();
-                } else {
-                    name_rest_splits = [stack];
+                var name_rest_splits = stack_frame.split( ' (' );
+                if( name_rest_splits.length > 1 ) {
+                    frame.function.name = name_rest_splits.shift().split( '.', 2 ).pop();
                 }
 
-                if( name_rest_splits.length > 0 ) {
-                    stack = name_rest_splits.shift();
-                    var url_line_splits = stack.split( ':' );
+                var url_line_col_splits = name_rest_splits.pop().split( ':' );
+
+                // Remove the column.
+                url_line_col_splits.pop();
+                var url_line_splits = url_line_col_splits;
+
+                frame.line = parseInt( url_line_splits.pop() );
 
-                    // Remove the column.
-                    url_line_splits.pop();
+                frame.url = url_line_splits.join( ':' ).split( ' (' ).pop();
 
-                    frame.line = parseInt( url_line_splits.pop() );
-                    frame.url = url_line_splits.join( ':' );
+                // Line numbers in the current page will be off by one after the
+                // JS env has been removed, adjust accordingly.
+                if( frame.url == current_url && frame.line > 0 ) {
+                    frame.line--;
                 }
 
-                trace.push( frame );
+                if( frame.url != '<anonymous>' ) {
+                    trace.push( frame );
+                }
             }
 
             // Scripts with 'use strict' don't let us access function callers.
@@ -429,7 +434,7 @@ var _tokenTaintTracer = _tokenTaintTracer || {
 
             _tokenTaintTracer.log_data_flow_sink( taint, {
                 function:               {
-                    source:    func,
+                    source:    func.toString(),
                     name:      func.name || function_name,
                     arguments: arguments
                 },
@@ -506,19 +511,25 @@ var _tokenTaintTracer = _tokenTaintTracer || {
         for( var name in namespace ){
             if( !namespace.hasOwnProperty( name ) ) continue;
 
-            var potentialFunction = namespace[name];
+            try {
+                var potentialFunction = namespace[name];
 
-            if( Object.prototype.toString.call(potentialFunction) !== '[object Function]' )
-                continue;
+                if (Object.prototype.toString.call(potentialFunction) !== '[object Function]')
+                    continue;
 
-            if( _tokenTaintTracer.ignore[potentialFunction.name] ) continue;
+                if (_tokenTaintTracer.ignore[potentialFunction.name]) continue;
 
-            var namespace_function_name = Object.prototype.toString.call(namespace) +
-                '-' + potentialFunction.name;
-            if( _tokenTaintTracer.traced[namespace_function_name] ) continue;
+                var namespace_function_name = Object.prototype.toString.call(namespace) +
+                    '-' + potentialFunction.name;
+                if (_tokenTaintTracer.traced[namespace_function_name]) continue;
 
-            _tokenTaintTracer.add_trace_to_function( namespace, name, _tokenTaintTracer.object_to_name(namespace) );
-            _tokenTaintTracer.traced[namespace_function_name] = true;
+                _tokenTaintTracer.add_trace_to_function(
+                    namespace, name, _tokenTaintTracer.object_to_name( namespace )
+                );
+                _tokenTaintTracer.traced[namespace_function_name] = true;
+            } catch(e) {
+                console.log( e )
+            }
         }
     },
 

data/lib/arachni/browser/javascript/taint_tracer/frame/called_function.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/frame.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/sink/base.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/sink/data_flow.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer/sink/execution_flow.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript/taint_tracer.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/browser/javascript.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -25,7 +25,7 @@ class Javascript
 
     # @return   [String]
     #   URL to use when requesting our custom JS scripts.
-    SCRIPT_BASE_URL = 'http://javascript.browser.arachni/'
+    SCRIPT_BASE_URL = 'https://javascript.browser.arachni/'
 
     # @return   [String]
     #   Filesystem directory containing the JS scripts.
@@ -166,6 +166,7 @@ class Javascript
         end
 
         t = Time.now
+
         while !ready?
             sleep 0.1
 
@@ -182,7 +183,7 @@ class Javascript
     # @return   [Bool]
     #   `true` if our custom JS environment has been initialized.
     def ready?
-        !!run( "return window._#{token}" )
+        run( "return (typeof window._#{token} !== 'undefined' && document.readyState === 'complete')" )
     rescue => e
         print_debug_exception e, 2
         false
@@ -382,6 +383,7 @@ class Javascript
 <script src="#{script_url_for( :taint_tracer )}"></script> #{html_comment}
 <script src="#{script_url_for( :dom_monitor )}"></script> #{html_comment}
 <script>
+#{wrapped_dom_monitor_initializer}
 #{wrapped_taint_tracer_initializer( response )}
 #{js_initialization_signal};
 
@@ -399,32 +401,9 @@ class Javascript
     end
 
     def html?( response )
-        return false if response.body.empty?
-
-        # We only care about HTML responses.
-        return false if !response.html?
-
-        # The last check isn't fool-proof, so don't do it when loading the page
-        # for the first time, but only when the page loads stuff via AJAX and whatnot.
-        #
-        # Well, we can be pretty sure that the root page will be HTML anyways.
-        return true if @browser.last_url == response.url
-
-        # Finally, verify that we're really working with markup (hopefully HTML)
-        # and that the previous checks weren't just flukes matching some other
-        # kind of document.
-        #
-        # For example, it may have been JSON with the wrong content-type that
-        # includes HTML -- it happens.
-        #
-        # Beware, if there's a doctype in the beginning this will get fooled.
-        if !Parser.markup?( response.body )
-            print_debug "Does not look like HTML: #{response.url}"
-            print_debug "\n#{response.body}"
-            return false
-        end
-
-        true
+        # If the server says it's HTML dig deeper to ensure it.
+        # We don't want wrong response headers messing up the JS env.
+        response.html? && Parser.html?( response.body )
     end
 
     private
@@ -489,6 +468,12 @@ class Javascript
         )
     end
 
+    def wrapped_dom_monitor_initializer
+        "/* #{token}_tokenDOMMonitor_initialize_start */ " <<
+            "#{@dom_monitor.stub.function( :initialize, Options.scope.dom_event_inheritance_limit )} " <<
+            "/* #{token}_tokenDOMMonitor_initialize_stop */"
+    end
+
     def wrapped_taint_tracer_initializer( response )
         "/* #{token}_initialize_start */ " <<
             "#{@taint_tracer.stub.function( :initialize, taints( response ) )} " <<