arachni 1.5 → 1.6.1

data/lib/arachni/element/nested_cookie.rb

@@ -0,0 +1,370 @@
+=begin
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
+
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
+=end
+
+require_relative 'cookie'
+
+module Arachni::Element
+
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class NestedCookie < Base
+
+    # Load and include all cookie-specific capability overrides.
+    lib = "#{File.dirname( __FILE__ )}/#{File.basename(__FILE__, '.rb')}/capabilities/**/*.rb"
+    Dir.glob( lib ).each { |f| require f }
+
+    include Arachni::Element::Capabilities::Inputtable
+    include Arachni::Element::Capabilities::Mutable
+    include Arachni::Element::Capabilities::Auditable
+    include Arachni::Element::Capabilities::Auditable::Buffered
+    include Arachni::Element::Capabilities::Auditable::LineBuffered
+    include Arachni::Element::Capabilities::Analyzable
+    include Arachni::Element::Capabilities::WithSource
+
+    include Capabilities::Submittable
+
+    # Default cookie values
+    DEFAULT = Cookie::DEFAULT
+
+    attr_reader :data
+
+    # @param    [Hash]  options
+    #   For options see {DEFAULT}, with the following extras:
+    # @option   options [String]    :url
+    #   URL of the page which created the cookie -- **required**.
+    # @option   options [String]     :action
+    #   URL of the page to submit the cookie -- defaults to `:url`.
+    # @option   options [Hash]     :inputs
+    #   Allows you to pass cookie data as a `name => value` pair instead of the
+    #   more complex {DEFAULT} structure.
+    def initialize( options )
+        @data = {}
+        super( options )
+
+        if options[:name] && options[:value]
+            options[:name]  = options[:name].to_s.recode
+            options[:value] = options[:value].to_s.recode
+
+            self.inputs = self.class.parse_inputs( options[:value] )
+            @data.merge!( options )
+        else
+            self.inputs = (options[:inputs] || {}).dup
+        end
+
+        @data.merge!( DEFAULT.merge( @data ) )
+        @data[:value] = decode( @data[:value].to_s ) rescue @data[:value].to_s
+
+        parsed_uri = uri_parse( action )
+        if !@data[:path]
+            path = parsed_uri.path
+            path = !path.empty? ? path : '/'
+            @data[:path] = path
+        end
+
+        if @data[:expires] && !@data[:expires].is_a?( Time )
+            @data[:expires] = Time.parse( @data[:expires].to_s ) rescue nil
+        end
+
+        @data[:domain] ||= parsed_uri.host
+
+        @default_inputs = self.inputs.dup.freeze
+    end
+
+    # Indicates whether the cookie must be only sent over an encrypted channel.
+    #
+    # @return   [Bool]
+    def secure?
+        @data[:secure] == true
+    end
+
+    # Indicates whether the cookie is safe from modification from client-side code.
+    #
+    # @return   [Bool]
+    def http_only?
+        @data[:httponly] == true
+    end
+
+    # Indicates whether the cookie is to be discarded at the end of the session.
+    #
+    # Doesn't play a role during the scan but it can provide useful info to checks and such.
+    #
+    # @return   [Bool]
+    def session?
+        @data[:expires].nil?
+    end
+
+    # @return   [Time, NilClass]
+    #   Expiration `Time` of the cookie or `nil` if it doesn't have one
+    #   (i.e. is a session cookie).
+    def expires_at
+        @data[:expires]
+    end
+
+    # Indicates whether or not the cookie has expired.
+    #
+    # @param    [Time]    time
+    #   To compare against.
+    #
+    # @return [Boolean]
+    def expired?( time = Time.now )
+        expires_at != nil && time > expires_at
+    end
+
+    # @return   [Hash]
+    #   Simple representation of the cookie as a hash -- with the cookie name as
+    #   `key` and the cookie value as `value`.
+    def simple
+        self.inputs.dup
+    end
+
+    # Uses the method name as a key to cookie attributes in {DEFAULT}.
+    def method_missing( sym, *args, &block )
+        return @data[sym] if @data.include? sym
+        super( sym, *args, &block )
+    end
+
+    # Used by {#method_missing} to determine if it should process the call.
+    #
+    # @return   [Bool]
+    #
+    def respond_to?( *args )
+        (@data && @data.include?( args.first )) || super
+    end
+
+    def value
+        self.inputs.map { |n, v| "#{encode( n )}=#{encode( v )}" }.join( '&' )
+    end
+
+    # @return   [String]
+    #   To be used in a `Cookie` HTTP request header.
+    def to_s
+        # Only do encoding if we're dealing with updated inputs, otherwise pass
+        # along the raw data as set in order to deal with server-side decoding
+        # quirks.
+        if updated? || !(raw_name || raw_value )
+            "#{encode( name )}=#{value}"
+        else
+            "#{raw_name}=#{raw_value}"
+        end
+    end
+
+    # @return   [String]
+    #   Converts self to a `Set-Cookie` string.
+    def to_set_cookie
+        set_cookie = "#{self.to_s}"
+
+        @data.each do |k, v|
+            next if !v || !Cookie.keep_for_set_cookie.include?( k )
+
+            set_cookie << "; #{k.capitalize}=#{v}"
+        end
+
+        set_cookie << '; Secure'   if secure?
+        set_cookie << '; HttpOnly' if http_only?
+
+        # If we want to set a cookie for only the domain that responded to the
+        # request, Set-Cookie should not specify a domain.
+        #
+        # If we want the cookie to apply to all subdomains, we need to either
+        # specify a dot-prefixed domain or a domain, the browser client will
+        # prefix the dot anyways.
+        #
+        # http://stackoverflow.com/questions/1062963/how-do-browser-cookie-domains-work/1063760#1063760
+        set_cookie << "; Domain=#{domain}" if domain.start_with?( '.' )
+
+        set_cookie
+    end
+
+    # @see .encode
+    def encode( *args )
+        self.class.encode( *args )
+    end
+
+    # @see .decode
+    def decode( str )
+        self.class.decode( str )
+    end
+
+    def to_rpc_data
+        h = super
+
+        if h['initialization_options']['expires']
+            h['initialization_options']['expires'] =
+                h['initialization_options']['expires'].to_s
+        end
+
+        h['data'] = h['data'].my_stringify_keys(false)
+        if h['data']['expires']
+            h['data']['expires'] = h['data']['expires'].to_s
+        end
+
+        h
+    end
+
+    class <<self
+
+        def type
+            :nested_cookie
+        end
+
+        def from_rpc_data( data )
+            if data['initialization_options']['expires']
+                data['initialization_options']['expires'] =
+                    Time.parse( data['initialization_options']['expires'] )
+            end
+
+            if data['data']['expires']
+                data['data']['expires'] = Time.parse( data['data']['expires'] )
+            end
+
+            data['data'] = data['data'].my_symbolize_keys(false)
+
+            super data
+        end
+
+        # Parses a Netscape Cookie-jar into an Array of {Cookie}.
+        #
+        # @param   [String]    url
+        #   {HTTP::Request} URL.
+        # @param   [String]    filepath
+        #   Netscape HTTP cookiejar file.
+        #
+        # @return   [Array<NestedCookie>]
+        #
+        # @see http://curl.haxx.se/rfc/cookie_spec.html
+        def from_file( url, filepath )
+            from_cookies( Cookie.from_file( url, filepath ) )
+        end
+
+        # Extracts cookies from an HTTP {Arachni::HTTP::Response response}.
+        #
+        # @param   [Arachni::HTTP::Response]    response
+        #
+        # @return   [Array<NestedCookie>]
+        #
+        # @see .from_parser
+        # @see .from_headers
+        def from_response( response )
+            from_parser( Arachni::Parser.new( response ) ) +
+                from_headers( response.url, response.headers )
+        end
+
+        # Extracts cookies from a document based on `Set-Cookie` `http-equiv`
+        # meta tags.
+        #
+        # @param    [Arachni::Parser]    parser
+        #
+        # @return   [Array<NestedCookie>]
+        #
+        # @see .parse_set_cookie
+        def from_parser( parser )
+            from_cookies( Cookie.from_parser( parser ) )
+        end
+
+        def in_html?( html )
+            html =~ /set-cookie.*&/i
+        end
+
+        # Extracts cookies from the `Set-Cookie` HTTP response header field.
+        #
+        # @param    [String]    url
+        #   {HTTP::Request} URL.
+        # @param    [Hash]      headers
+        #
+        # @return   [Array<NestedCookie>]
+        #
+        # @see .forms_set_cookie
+        def from_headers( url, headers )
+            from_cookies( Cookie.from_headers( url, headers ) )
+        end
+
+        # Parses the `Set-Cookie` header value into cookie elements.
+        #
+        # @param    [String]    url
+        #   {HTTP::Request} URL.
+        # @param    [Hash]      str
+        #   `Set-Cookie` string
+        #
+        # @return   [Array<NestedCookie>]
+        def from_set_cookie( url, str )
+            from_cookies( Cookie.from_set_cookie( url, str ) )
+        end
+        alias :parse_set_cookie :from_set_cookie
+
+        # Parses a string formatted for the `Cookie` HTTP request header field
+        # into cookie elements.
+        #
+        # @param    [String]    url
+        #   {HTTP::Request} URL.
+        # @param    [Hash]      string
+        #   `Cookie` string.
+        #
+        # @return   [Array<NestedCookie>]
+        def from_string( url, string )
+            from_cookies( Cookie.from_string( url, string ) )
+        end
+
+        def from_cookies( cookies )
+            [cookies].flatten.compact.map do |cookie|
+                next if !cookie.value.include?( '=' )
+
+                inputs = parse_inputs( cookie.value )
+                next if inputs.empty?
+
+                new({
+                    url:    cookie.url,
+                    action: cookie.action,
+                    method: cookie.method,
+                    inputs: inputs,
+                    source: cookie.source
+                }.merge( cookie.data ))
+            end.compact
+        end
+
+        def parse_inputs( value )
+            value.to_s.split( '&' ).inject( {} ) do |h, pair|
+                name, value = pair.split( '=', 2 )
+                h[decode( name.to_s )] = decode( value.to_s )
+                h
+            end
+        end
+
+        # Encodes a {String}'s reserved characters in order to prepare it for
+        # the `Cookie` header field.
+        #
+        # @param    [String]    str
+        #
+        # @return   [String]
+        def encode( str )
+            Cookie.encode( str )
+        end
+
+        # Decodes a {String} encoded for the `Cookie` header field.
+        #
+        # @param    [String]    str
+        #
+        # @return   [String]
+        def decode( str )
+            Cookie.decode( str )
+        end
+
+    end
+
+    private
+
+    def http_request( opts = {}, &block )
+        opts[:cookies] = opts.delete( :parameters )
+
+        self.method == :get ?
+            http.get( self.action, opts, &block ) :
+            http.post( self.action, opts, &block )
+    end
+
+end
+end
+
+Arachni::NestedCookie = Arachni::Element::NestedCookie

data/lib/arachni/element/path.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/server.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/ui_form/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/ui_form.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/ui_input/dom.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/ui_input.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/xml/capabilities/inputtable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/xml/capabilities/mutable.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element/xml.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/element_filter.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/error.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/ethon/easy.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/audit.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/browser.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/check.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/data.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/platform.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/plugin.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/report.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -79,7 +79,7 @@ module Report
                      "Reporter '#{name}' cannot format the audit results as a String."
             end
 
-            outfile = "#{Arachni.tmpdir}/#{generate_token}"
+            outfile = "#{Options.paths.tmpdir}/#{generate_token}"
             @reporters.run( name, external_report, outfile: outfile )
 
             IO.binread( outfile )

data/lib/arachni/framework/parts/scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework/parts/state.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/framework.rb

@@ -1,7 +1,7 @@
 # encoding: utf-8
 
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/client/dynamic_404_handler.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/client.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -361,14 +361,16 @@ class Client
         fail ArgumentError, 'URL cannot be empty.' if !url
 
         options     = options.dup
-        cookies     = options.delete( :cookies ) || {}
-        raw_cookies = []
+        cookies     = options.delete( :cookies )     || {}
+        raw_cookies = options.delete( :raw_cookies ) || []
+        raw_cookie_names = Set.new( raw_cookies.map(&:name) )
 
         exception_jail false do
             if !options.delete( :no_cookie_jar )
-                raw_cookies = begin
+                raw_cookies |= begin
                     cookie_jar.for_url( url ).reject do |c|
-                        cookies.include? c.name
+                        cookies.include?( c.name ) ||
+                            raw_cookie_names.include?( c.name )
                     end
                 rescue => e
                     print_error "Could not get cookies for URL '#{url}' from Cookiejar (#{e})."

data/lib/arachni/http/cookie_jar.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/headers.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/message/scope.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework

data/lib/arachni/http/message.rb

@@ -1,5 +1,5 @@
 =begin
-    Copyright 2010-2017 Sarosys LLC <http://www.sarosys.com>
+    Copyright 2010-2022 Ecsypno <http://www.ecsypno.com>
 
     This file is part of the Arachni Framework project and is subject to
     redistribution and commercial restrictions. Please see the Arachni Framework
@@ -73,7 +73,7 @@ class Message
 
     def url=( url )
         if @normalize_url || @normalize_url.nil?
-            @url = URI.normalize_url( url ).to_s.freeze
+            @url = URI.normalize( url ).to_s.freeze
         else
             @url = url.to_s.freeze
         end