arachni 1.5 → 1.5.1

data/lib/arachni/element/capabilities/analyzable/signature.rb

@@ -109,7 +109,7 @@ module Signature
     #       {Element::Capabilities::Submittable#platforms applicable platforms}
     #       for the {Element::Capabilities::Submittable#action resource} to be audited.
     # @param  [Hash]    opts
-    #   Options as described in {Arachni::Check::Auditor::OPTIONS} and
+    #   Options as described in {Arachni::Element::Auditable::OPTIONS} and
     #   {SIGNATURE_OPTIONS}.
     #
     # @return   [Bool]

data/lib/arachni/framework/parts/report.rb

@@ -79,7 +79,7 @@ module Report
                      "Reporter '#{name}' cannot format the audit results as a String."
             end
 
-            outfile = "#{Arachni.tmpdir}/#{generate_token}"
+            outfile = "#{Options.paths.tmpdir}/#{generate_token}"
             @reporters.run( name, external_report, outfile: outfile )
 
             IO.binread( outfile )

data/lib/arachni/http/message.rb

@@ -73,7 +73,7 @@ class Message
 
     def url=( url )
         if @normalize_url || @normalize_url.nil?
-            @url = URI.normalize_url( url ).to_s.freeze
+            @url = URI.normalize( url ).to_s.freeze
         else
             @url = url.to_s.freeze
         end

data/lib/arachni/http/response.rb

@@ -286,7 +286,7 @@ class Response < Message
         redirections = response.redirections.map do |redirect|
             rurl   = URI.to_absolute( redirect.headers['Location'],
                                       response.effective_url )
-            rurl ||= response.effective_url
+            rurl ||= URI.normalize( response.effective_url )
 
             # Broken redirection, skip it...
             next if !rurl
@@ -296,7 +296,7 @@ class Response < Message
                 code:          redirect.code,
                 headers:       redirect.headers
             ))
-        end
+        end.compact
 
         return_code    = response.return_code
         return_message = response.return_message

data/lib/arachni/option_groups/paths.rb

@@ -7,6 +7,7 @@
 =end
 
 require 'fileutils'
+require 'tmpdir'
 
 module Arachni::OptionGroups
 
@@ -75,6 +76,16 @@ class Paths < Arachni::OptionGroup
         File.expand_path( File.dirname( __FILE__ ) + '/../../..' ) + '/'
     end
 
+    def tmpdir
+        if config['framework']['tmpdir'].to_s.empty?
+            # On MS Windows Dir.tmpdir can return the path with a shortname,
+            # better avoid that as it can be insonsistent with other paths.
+            Arachni.get_long_win32_filename( Dir.tmpdir )
+        else
+            Arachni.get_long_win32_filename( config['framework']['tmpdir'] )
+        end
+    end
+
     def config
         self.class.config
     end

data/lib/arachni/options.rb

@@ -221,7 +221,7 @@ class Options
         elsif parsed.host == 'localhost' || parsed.host.start_with?( '127.' )
 
             fail Error::ReservedHostname,
-                 "Loopback interfaces (like #{parsed.host}) are nor supported," <<
+                 "Loopback interfaces (like #{parsed.host}) are not supported," <<
                      ' please use a different IP address or hostname.'
 
         else

data/lib/arachni/parser.rb

@@ -237,16 +237,10 @@ class Parser
     #   `nil` if the response data wasn't {#text? text-based} or the response
     #   couldn't be parsed.
     def document
+        return @document if @document
         return if !text?
 
-        if from_document?
-            @document
-        else
-            @document = self.class.parse(
-                body,
-                whitelist: WHITELIST
-            )
-        end
+        @document = self.class.parse( body, filter: true )
     end
 
     # @note It will include common request headers as well headers from the HTTP

data/lib/arachni/parser/nodes/text.rb

@@ -17,7 +17,7 @@ class Text < Base
     include WithValue
 
     def text
-        @value
+        @value.to_s
     end
 
     def to_html( indentation = 2, level = 0 )

data/lib/arachni/parser/with_children.rb

@@ -20,7 +20,7 @@ module WithChildren
 
     def text
         txt = children.find { |n| n.is_a? Parser::Nodes::Text }
-        return if !txt
+        return '' if !txt
 
         txt.value
     end

data/lib/arachni/snapshot.rb

@@ -149,7 +149,7 @@ class <<self
     end
 
     def get_temporary_directory
-        "#{Arachni.tmpdir}/Arachni_Snapshot_#{Utilities.generate_token}/"
+        "#{Options.paths.tmpdir}/Arachni_Snapshot_#{Utilities.generate_token}/"
     end
 
     def extract( archive, directory )

data/lib/arachni/support/database/base.rb

@@ -6,8 +6,6 @@
     web site for more information on licensing and terms of use.
 =end
 
-require 'tmpdir'
-
 module Arachni
 module Support::Database
 
@@ -96,7 +94,7 @@ class Base
 
     def generate_filename
         # Should be unique enough...
-        "#{Arachni.tmpdir}/#{self.class.name}_#{Process.pid}_#{object_id}_#{@filename_counter}".gsub( '::', '_' )
+        "#{Options.paths.tmpdir}/#{self.class.name}_#{Process.pid}_#{object_id}_#{@filename_counter}".gsub( '::', '_' )
     ensure
         @filename_counter += 1
     end

data/lib/version

@@ -1 +1 @@
-1.5
+1.5.1

data/spec/arachni/browser/javascript/dom_monitor_spec.rb

@@ -131,26 +131,6 @@ describe Arachni::Browser::Javascript::DOMMonitor do
         end
     end
 
-    describe '#intervals' do
-        it 'keeps track of setInterval() timers' do
-            load '/intervals'
-
-            expect(subject.intervals).to eq([
-                [
-                    "function (name, value) {\n            document.cookie = name + \"=post-\" + value;\n        }",
-                    2000, 'timeout1', 2000
-                ]
-            ])
-
-            sleep 2
-            expect(@browser.cookies.size).to eq(2)
-            expect(@browser.cookies.map { |c| c.to_s }.sort).to eq([
-                'timeout1=post-2000',
-                'timeout=pre'
-            ].sort)
-        end
-    end
-
     describe '#elements_with_events' do
         it 'skips non visible elements' do
             load '/elements_with_events/with-hidden'

data/spec/arachni/browser/javascript_spec.rb

@@ -285,13 +285,6 @@ describe Arachni::Browser::Javascript do
         end
     end
 
-    describe '#intervals' do
-        it 'keeps track of setInterval() timers' do
-            @browser.load( @dom_monitor_url + 'interval-tracker' )
-            expect(subject.intervals).to eq(subject.dom_monitor.intervals)
-        end
-    end
-
     describe '#has_sinks?' do
         context 'when there are execution-flow sinks' do
             it 'returns true' do

data/spec/arachni/check/auditor_spec.rb

@@ -428,62 +428,41 @@ describe Arachni::Check::Auditor do
         end
 
         it 'sets the auditor' do
-            auditor.each_candidate_element [ Arachni::Link ] do |element|
+            auditor.each_candidate_element do |element|
                 expect(element.auditor).to eq(auditor)
             end
         end
 
-        context 'when types have been provided' do
-            it 'provides those types of elements' do
-                elements = []
-                auditor.each_candidate_element [ Arachni::Link, Arachni::Header ] do |element|
-                    elements << element
-                end
+        it 'provides the types of elements specified by the check' do
+            auditor.class.info[:elements] = [Arachni::Link, Arachni::Form]
 
-                expect(elements).to eq((auditor.page.links | auditor.page.headers).
-                    select { |e| e.inputs.any? })
+            elements = []
+            auditor.each_candidate_element do |element|
+                elements << element
             end
 
-            context 'and are not supported' do
-                it 'raises ArgumentError' do
-                    expect {
-                        auditor.each_candidate_element [Arachni::Link::DOM]
-                    }.to raise_error ArgumentError
-                end
-            end
+            expect(auditor.class.elements).to eq([Arachni::Link, Arachni::Form])
+            expect(elements).to eq((auditor.page.links | auditor.page.forms).
+                select { |e| e.inputs.any? })
         end
-        context 'when types have not been provided' do
-            it 'provides the types of elements specified by the check' do
-                auditor.class.info[:elements] = [Arachni::Link, Arachni::Form]
+
+        context 'and no types are specified by the check' do
+            it 'provides all types of elements but :inputs and :ui_forms'do
+                auditor.class.info[:elements].clear
+
+                expected_elements = Arachni::Page::ELEMENTS
+                expected_elements.delete :ui_inputs
+                expected_elements.delete :ui_forms
 
                 elements = []
                 auditor.each_candidate_element do |element|
                     elements << element
                 end
 
-                expect(auditor.class.elements).to eq([Arachni::Link, Arachni::Form])
-                expect(elements).to eq((auditor.page.links | auditor.page.forms).
+                expect(elements.map { |e| "#{e.type}s".to_sym }.uniq).to eq(Arachni::Page::ELEMENTS)
+                expect(elements).to eq((auditor.page.elements).
                     select { |e| e.inputs.any? })
             end
-
-            context 'and no types are specified by the check' do
-                it 'provides all types of elements but :inputs and :ui_forms'do
-                    auditor.class.info[:elements].clear
-
-                    expected_elements = Arachni::Page::ELEMENTS
-                    expected_elements.delete :ui_inputs
-                    expected_elements.delete :ui_forms
-
-                    elements = []
-                    auditor.each_candidate_element do |element|
-                        elements << element
-                    end
-
-                    expect(elements.map { |e| "#{e.type}s".to_sym }.uniq).to eq(Arachni::Page::ELEMENTS)
-                    expect(elements).to eq((auditor.page.elements).
-                        select { |e| e.inputs.any? })
-                end
-            end
         end
     end
 
@@ -504,54 +483,33 @@ describe Arachni::Check::Auditor do
             end
         end
 
-        context 'when types have been provided' do
-            it 'provides those types of elements' do
-                elements = []
-                auditor.each_candidate_dom_element [ Arachni::Link::DOM ] do |element|
-                    elements << element
-                end
+        it 'provides the types of elements specified by the check' do
+            auditor.class.info[:elements] = [Arachni::Form::DOM]
+            expect(auditor.class.elements).to eq([Arachni::Form::DOM])
 
-                expect(elements).to be_any
-                expect(elements).to eq(auditor.page.links.select { |l| l.dom }.map(&:dom))
+            elements = []
+            auditor.each_candidate_dom_element do |element|
+                elements << element
             end
 
-            context 'and are not supported' do
-                it 'raises ArgumentError' do
-                    expect {
-                        auditor.each_candidate_dom_element [Arachni::Link]
-                    }.to raise_error ArgumentError
-                end
-            end
+            expect(elements).to eq(auditor.page.forms.map(&:dom))
         end
-        context 'when types have not been provided' do
-            it 'provides the types of elements specified by the check' do
-                auditor.class.info[:elements] = [Arachni::Form::DOM]
-                expect(auditor.class.elements).to eq([Arachni::Form::DOM])
+
+        context 'and no types are specified by the check' do
+            it 'provides all types of elements'do
+                auditor.class.info[:elements].clear
 
                 elements = []
                 auditor.each_candidate_dom_element do |element|
                     elements << element
                 end
 
-                expect(elements).to eq(auditor.page.forms.map(&:dom))
-            end
-
-            context 'and no types are specified by the check' do
-                it 'provides all types of elements'do
-                    auditor.class.info[:elements].clear
-
-                    elements = []
-                    auditor.each_candidate_dom_element do |element|
-                        elements << element
-                    end
-
-                    expect(elements).to eq(
-                        (auditor.page.links.select { |l| l.dom } |
-                            auditor.page.forms | auditor.page.cookies |
-                            auditor.page.link_templates | auditor.page.ui_inputs |
-                            auditor.page.ui_forms).map(&:dom)
-                    )
-                end
+                expect(elements).to eq(
+                    (auditor.page.links.select { |l| l.dom } |
+                        auditor.page.forms | auditor.page.cookies |
+                        auditor.page.link_templates | auditor.page.ui_inputs |
+                        auditor.page.ui_forms).map(&:dom)
+                )
             end
         end
     end
@@ -874,99 +832,20 @@ describe Arachni::Check::Auditor do
                 end
 
                 auditor.audit( @seed ){}
-                expect($audit_called).to eq(auditor.page.elements.map(&:class))
+                expect($audit_called).to eq(auditor.class.elements)
             end
         end
 
         context 'when called without a block' do
             it 'delegates to #audit_signature' do
-                expect(auditor).to receive(:audit_signature).with( @seed, described_class::OPTIONS )
-                auditor.audit( @seed )
+                opts = { stuff: :here }
+
+                expect(auditor).to receive(:audit_signature).with( @seed, opts )
+                auditor.audit( @seed, opts )
             end
         end
 
         context 'when called with options' do
-            describe ':elements' do
-
-                before { auditor.load_page_from( @url + '/elem_combo' ) }
-
-                describe 'Arachni::Element::Link' do
-                    it 'audits links' do
-                        auditor.audit( @seed,
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
-                            elements: [ Arachni::Element::Link ]
-                         )
-                        @framework.http.run
-                        expect(Arachni::Data.issues.size).to eq(1)
-                        issue = Arachni::Data.issues.first
-                        expect(issue.vector.class).to eq(Arachni::Element::Link)
-                        expect(issue.vector.affected_input_name).to eq('link_input')
-                    end
-                end
-                describe 'Arachni::Element::Form' do
-                    it 'audits forms' do
-                        auditor.audit( @seed,
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
-                            elements: [ Arachni::Element::Form ]
-                         )
-                        @framework.http.run
-                        expect(Arachni::Data.issues.size).to eq(1)
-                        issue = Arachni::Data.issues.first
-                        expect(issue.vector.class).to eq(Arachni::Element::Form)
-                        expect(issue.vector.affected_input_name).to eq('form_input')
-                    end
-                end
-                describe 'Arachni::Element::Cookie' do
-                    it 'audits cookies' do
-                        auditor.audit( @seed,
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
-                            elements: [ Arachni::Element::Cookie ]
-                         )
-                        @framework.http.run
-                        expect(Arachni::Data.issues.size).to eq(1)
-                        issue = Arachni::Data.issues.first
-                        expect(issue.vector.class).to eq(Arachni::Element::Cookie)
-                        expect(issue.vector.affected_input_name).to eq('cookie_input')
-                    end
-                    it 'maintains the session while auditing cookies' do
-                        auditor.load_page_from( @url + '/session' )
-                        auditor.audit( @seed,
-                                        format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
-                                        elements: [ Arachni::Element::Cookie ]
-                        )
-                        @framework.http.run
-                        expect(Arachni::Data.issues.size).to eq(1)
-                        issue = Arachni::Data.issues.first
-                        expect(issue.vector.class).to eq(Arachni::Element::Cookie)
-                        expect(issue.vector.affected_input_name).to eq('vulnerable')
-                    end
-
-                end
-                describe 'Arachni::Element::Header' do
-                    it 'audits headers' do
-                        auditor.audit( @seed,
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ],
-                            elements: [ Arachni::Element::Header ]
-                         )
-                        @framework.http.run
-                        expect(Arachni::Data.issues.size).to eq(1)
-                        issue = Arachni::Data.issues.first
-                        expect(issue.vector.class).to eq(Arachni::Element::Header)
-                        expect(issue.vector.affected_input_name).to eq('Referer')
-                    end
-                end
-
-                context 'when using default options' do
-                    it 'audits all element types' do
-                        auditor.audit( @seed,
-                            format: [ Arachni::Check::Auditor::Format::STRAIGHT ]
-                         )
-                        @framework.http.run
-                        expect(Arachni::Data.issues.size).to eq(4)
-                    end
-                end
-            end
-
             describe ':train' do
                 context 'default' do
                     it 'parses the responses of forms submitted with their default values and feed any new elements back to the framework to be audited' do
@@ -1061,7 +940,7 @@ describe Arachni::Check::Auditor do
             end
 
             auditor.audit_signature( 'seed' )
-            expect($audit_signature_called).to eq(auditor.page.elements.map(&:class))
+            expect($audit_signature_called).to eq(auditor.class.elements)
         end
     end
 
@@ -1080,7 +959,7 @@ describe Arachni::Check::Auditor do
             end
 
             auditor.audit_differential( { false: '0', pairs: { '1' => '2' } } )
-            expect($audit_differential_called).to eq(auditor.page.elements.map(&:class))
+            expect($audit_differential_called).to eq(auditor.class.elements)
         end
     end
 
@@ -1099,7 +978,7 @@ describe Arachni::Check::Auditor do
             end
 
             auditor.audit_timeout( 'seed', timeout: 1 )
-            expect($audit_timeout_called).to eq(auditor.page.elements.map(&:class))
+            expect($audit_timeout_called).to eq(auditor.class.elements)
         end
     end