arachni 1.5 → 1.6.1

data/spec/components/checks/active/ldap_injection_spec.rb

@@ -4,8 +4,8 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -14,11 +14,12 @@ describe name_from_filename do
         {
             Element::Form         => i,
             Element::Link         => i,
-            Element::Cookie       => i,
+            Element::Cookie       => i * 2,
             Element::Header       => i,
             Element::LinkTemplate => i * 2,
             Element::JSON         => i,
-            Element::XML          => i * 2
+            Element::XML          => i * 2,
+            Element::NestedCookie => i * 2
         }
     end
     easy_test

data/spec/components/checks/active/no_sql_injection_differential_spec.rb

@@ -8,7 +8,7 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie ]
     end
 
     def issue_count

data/spec/components/checks/active/no_sql_injection_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -17,11 +17,12 @@ describe name_from_filename do
             mongodb: {
                 Element::Form         => 2,
                 Element::Link         => 2,
-                Element::Cookie       => 2,
+                Element::Cookie       => 4,
                 Element::Header       => 1,
                 Element::LinkTemplate => 2,
                 Element::JSON         => 2,
-                Element::XML          => 2
+                Element::XML          => 2,
+                Element::NestedCookie => 3
             }
         }
     end

data/spec/components/checks/active/os_cmd_injection_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -22,7 +22,8 @@ describe name_from_filename do
                 Element::Header       => 8,
                 Element::LinkTemplate => 20,
                 Element::JSON         => 11,
-                Element::XML          => 22
+                Element::XML          => 22,
+                Element::NestedCookie => 16
             }
         end
 
@@ -33,7 +34,8 @@ describe name_from_filename do
             Element::Header       => 16,
             Element::LinkTemplate => 44,
             Element::JSON         => 22,
-            Element::XML          => 44
+            Element::XML          => 44,
+            Element::NestedCookie => 32
         }
 
         h

data/spec/components/checks/active/os_cmd_injection_timing_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
@@ -20,7 +20,8 @@ describe name_from_filename do
             Element::Header       => 14,
             Element::LinkTemplate => 14,
             Element::JSON         => 14,
-            Element::XML          => 28
+            Element::XML          => 28,
+            Element::NestedCookie => 8
         }
     end
 

data/spec/components/checks/active/path_traversal_spec.rb

@@ -8,29 +8,31 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
         {
             unix:    {
                 Element::Form         => 288,
-                Element::Link         => 288,
+                Element::Link         => 286,
                 Element::Cookie       => 144,
                 Element::Header       => 72,
                 Element::LinkTemplate => 16,
                 Element::JSON         => 216,
-                Element::XML          => 144
+                Element::XML          => 144,
+                Element::NestedCookie => 288
             },
             windows: {
                 Element::Form         => 864,
-                Element::Link         => 864,
+                Element::Link         => 856,
                 Element::Cookie       => 432,
                 Element::Header       => 216,
                 Element::LinkTemplate => 48,
                 Element::JSON         => 648,
-                Element::XML          => 432
+                Element::XML          => 432,
+                Element::NestedCookie => 864
             },
             java:    {
                 Element::Form         => 16,
@@ -39,7 +41,8 @@ describe name_from_filename do
                 Element::Header       => 4,
                 Element::LinkTemplate => 0,
                 Element::JSON         => 12,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 16
             }
         }
     end

data/spec/components/checks/active/response_splitting_spec.rb

@@ -4,19 +4,20 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
         {
             Element::Form         => 4,
             Element::Link         => 4,
-            Element::Cookie       => 4,
+            Element::Cookie       => 6,
             Element::Header       => 2,
             Element::LinkTemplate => 8,
             Element::JSON         => 4,
-            Element::XML          => 4
+            Element::XML          => 4,
+            Element::NestedCookie => 8
         }
     end
 

data/spec/components/checks/active/rfi_spec.rb

@@ -4,18 +4,19 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
         {
-            Element::Form   => 24,
-            Element::Link   => 24,
-            Element::Cookie => 12,
-            Element::Header => 6,
-            Element::JSON   => 12,
-            Element::XML    => 12
+            Element::Form         => 24,
+            Element::Link         => 24,
+            Element::Cookie       => 18,
+            Element::Header       => 6,
+            Element::JSON         => 12,
+            Element::XML          => 12,
+            Element::NestedCookie => 24
         }
     end
 

data/spec/components/checks/active/source_code_disclosure_spec.rb

@@ -8,19 +8,42 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
-    def issue_count_per_element
+    def issue_count_per_element_per_platform
         {
-            Element::Form         => 12,
-            Element::Link         => 12,
-            Element::Cookie       => 4,
-            Element::Header       => 4,
-            Element::LinkTemplate => 10,
-            Element::JSON         => 6,
-            Element::XML          => 8
+            php:    {
+                Element::Form         => 12,
+                Element::Link         => 12,
+                Element::Cookie       => 3,
+                Element::Header       => 4,
+                Element::LinkTemplate => 10,
+                Element::JSON         => 6,
+                Element::XML          => 8,
+                Element::NestedCookie => 8
+            },
+            asp: {
+                Element::Form         => 12,
+                Element::Link         => 12,
+                Element::Cookie       => 3,
+                Element::Header       => 4,
+                Element::LinkTemplate => 10,
+                Element::JSON         => 6,
+                Element::XML          => 8,
+                Element::NestedCookie => 8
+            },
+            java:    {
+                Element::Form         => 12,
+                Element::Link         => 12,
+                Element::Cookie       => 4,
+                Element::Header       => 4,
+                Element::LinkTemplate => 10,
+                Element::JSON         => 6,
+                Element::XML          => 8,
+                Element::NestedCookie => 8
+            }
         }
     end
 

data/spec/components/checks/active/sql_injection_differential_spec.rb

@@ -8,7 +8,7 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie ]
     end
 
     def issue_count

data/spec/components/checks/active/sql_injection_spec.rb

@@ -9,8 +9,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -18,155 +18,172 @@ describe name_from_filename do
             access:     {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             db2:        {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             emc:        {
                 Element::Form         => 10,
                 Element::Link         => 10,
-                Element::Cookie       => 8,
+                Element::Cookie       => 16,
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 8,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 12
             },
             firebird:   {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             frontbase:  {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             hsqldb:     {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             informix:   {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             ingres:     {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             interbase:  {
                 Element::Form         => 10,
                 Element::Link         => 10,
-                Element::Cookie       => 8,
+                Element::Cookie       => 16,
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 8,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 12
             },
             maxdb:      {
                 Element::Form         => 5,
                 Element::Link         => 5,
-                Element::Cookie       => 4,
+                Element::Cookie       => 8,
                 Element::Header       => 2,
                 Element::LinkTemplate => 4,
                 Element::JSON         => 4,
-                Element::XML          => 4
+                Element::XML          => 4,
+                Element::NestedCookie => 6
             },
             mssql:      {
                 Element::Form         => 97,
                 Element::Link         => 97,
-                Element::Cookie       => 78,
+                Element::Cookie       => 156,
                 Element::Header       => 38,
                 Element::LinkTemplate => 76,
                 Element::JSON         => 78,
-                Element::XML          => 76
+                Element::XML          => 76,
+                Element::NestedCookie => 116
             },
             mysql:      {
                 Element::Form         => 65,
                 Element::Link         => 65,
-                Element::Cookie       => 52,
+                Element::Cookie       => 104,
                 Element::Header       => 26,
                 Element::LinkTemplate => 52,
                 Element::JSON         => 52,
-                Element::XML          => 52
+                Element::XML          => 52,
+                Element::NestedCookie => 78
             },
             oracle:     {
                 Element::Form         => 25,
                 Element::Link         => 25,
-                Element::Cookie       => 20,
+                Element::Cookie       => 40,
                 Element::Header       => 10,
                 Element::LinkTemplate => 20,
                 Element::JSON         => 20,
-                Element::XML          => 20
+                Element::XML          => 20,
+                Element::NestedCookie => 30
             },
             pgsql:      {
                 Element::Form         => 45,
                 Element::Link         => 45,
-                Element::Cookie       => 36,
+                Element::Cookie       => 72,
                 Element::Header       => 18,
                 Element::LinkTemplate => 36,
                 Element::JSON         => 36,
-                Element::XML          => 36
+                Element::XML          => 36,
+                Element::NestedCookie => 54
             },
             sqlite:     {
                 Element::Form         => 20,
                 Element::Link         => 20,
-                Element::Cookie       => 16,
+                Element::Cookie       => 32,
                 Element::Header       => 8,
                 Element::LinkTemplate => 16,
                 Element::JSON         => 16,
-                Element::XML          => 16
+                Element::XML          => 16,
+                Element::NestedCookie => 24
             },
             sybase:     {
                 Element::Form         => 15,
                 Element::Link         => 15,
-                Element::Cookie       => 12,
+                Element::Cookie       => 24,
                 Element::Header       => 6,
                 Element::LinkTemplate => 12,
                 Element::JSON         => 12,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 18
             },
             java:       {
                 Element::Form         => 10,
                 Element::Link         => 10,
-                Element::Cookie       => 8,
+                Element::Cookie       => 16,
                 Element::Header       => 4,
                 Element::LinkTemplate => 8,
                 Element::JSON         => 8,
-                Element::XML          => 8
+                Element::XML          => 8,
+                Element::NestedCookie => 12
             }
         }
     end

data/spec/components/checks/active/sql_injection_timing_spec.rb

@@ -8,8 +8,8 @@ describe name_from_filename do
     end
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element_per_platform
@@ -17,29 +17,32 @@ describe name_from_filename do
             mysql: {
                 Element::Form         => 16,
                 Element::Link         => 16,
-                Element::Cookie       => 16,
+                Element::Cookie       => 32,
                 Element::Header       => 16,
                 Element::LinkTemplate => 16,
                 Element::JSON         => 16,
-                Element::XML          => 32
+                Element::XML          => 32,
+                Element::NestedCookie => 16
             },
             pgsql: {
                 Element::Form         => 6,
                 Element::Link         => 6,
-                Element::Cookie       => 6,
+                Element::Cookie       => 12,
                 Element::Header       => 6,
                 Element::LinkTemplate => 6,
                 Element::JSON         => 6,
-                Element::XML          => 12
+                Element::XML          => 12,
+                Element::NestedCookie => 6
             },
             mssql: {
                 Element::Form         => 9,
                 Element::Link         => 9,
-                Element::Cookie       => 9,
+                Element::Cookie       => 18,
                 Element::Header       => 9,
                 Element::LinkTemplate => 9,
                 Element::JSON         => 9,
-                Element::XML          => 18
+                Element::XML          => 18,
+                Element::NestedCookie => 9
             }
         }
     end

data/spec/components/checks/active/unvalidated_redirect_spec.rb

@@ -4,18 +4,19 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
         {
-            Element::Form   => 26,
-            Element::Link   => 22,
-            Element::Cookie => 11,
-            Element::Header => 11,
-            Element::JSON   => 9,
-            Element::XML    => 18
+            Element::Form         => 26,
+            Element::Link         => 22,
+            Element::Cookie       => 11,
+            Element::Header       => 11,
+            Element::JSON         => 9,
+            Element::XML          => 18,
+            Element::NestedCookie => 16
         }
     end
 

data/spec/components/checks/active/xpath_injection_spec.rb

@@ -4,19 +4,20 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header,
-          Element::LinkTemplate, Element::JSON, Element::XML ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header, Element::LinkTemplate, Element::JSON, Element::XML ]
     end
 
     def issue_count_per_element
         {
             Element::Form         => 150,
             Element::Link         => 150,
-            Element::Cookie       => 150,
+            Element::Cookie       => 300,
             Element::Header       => 75,
             Element::LinkTemplate => 150,
             Element::JSON         => 75,
-            Element::XML          => 150
+            Element::XML          => 150,
+            Element::NestedCookie => 225
         }
     end
 

data/spec/components/checks/active/xss_dom_script_context_spec.rb

@@ -56,11 +56,11 @@ describe name_from_filename do
                     expect(trace.first.function.source).to start_with 'function handleSubmit()'
                     expect(trace.first.function.name).to start_with 'handleSubmit'
 
-                when Element::LinkTemplate::DOM
-                    expect(trace.first.url).to eq issue.page.dom.url
-
-                when Element::Link::DOM
-                    expect(trace.first.url).to eq issue.page.dom.url
+                # when Element::LinkTemplate::DOM
+                #     expect(trace.first.url).to eq issue.page.dom.url
+                #
+                # when Element::Link::DOM
+                #     expect(trace.first.url).to eq issue.page.dom.url
 
                 when Element::Cookie::DOM
                     expect(trace.first.url).to eq issue.page.dom.url

data/spec/components/checks/active/xss_event_spec.rb

@@ -4,16 +4,18 @@ describe name_from_filename do
     include_examples 'check'
 
     def self.elements
-        [ Element::Form, Element::Link, Element::Cookie, Element::Header ]
+        [ Element::Form, Element::Link, Element::Cookie, Element::NestedCookie,
+          Element::Header ]
     end
 
     def issue_count_per_element
         {
             Element::Form         => 210,
             Element::Link         => 114,
-            Element::Cookie       => 114,
+            Element::Cookie       => 228,
             Element::Header       => 114,
-            Element::LinkTemplate => 114
+            Element::LinkTemplate => 114,
+            Element::NestedCookie => 228
         }
     end