cms_scanner 0.0.44.2 → 0.0.44.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '09dd0821b75168298578cb5c85a22365f04cf20e6e1ebd5b8d8596c1a254d030'
-  data.tar.gz: fad0cc718b8357a3fdb36a554a988ad785953dcc31928695e0f79fc4ced98280
+  metadata.gz: 4a69d69efdd838ceece417f3417b454795d9fd9d1a682e0216dda9589f39a27e
+  data.tar.gz: affd1105e6d9589166e8448a2b43f48781ea0e882475aea7a305f16ad1d6fa9e
 SHA512:
-  metadata.gz: 562b4365b26263a79bb4efeeabf29ad5d43354909409260727bfe72e04c43193fd3bd96615cc2b46ac0b35f0c692711c40dd31762e1d714b1aa775baeb090c44
-  data.tar.gz: 37f9846fb92cfe73ee786d3a8d93a535a67d38008632b5b0c994499719d92a8161a118ac3c5a7b610968f6a444e5b6db017e20b1719f31f08c0adf6a9a5a6a44
+  metadata.gz: fc2252487b5e24d9dc78186ca68f4df618e43d19f62cb89872897099735f114468fcba740e99b7e6d809e9fd5f9e9f3e516aa0bc9376382f5034cb1f4b406036
+  data.tar.gz: ab0385847b1becef1a0d8c062cf5491bf62c10ca2118ef32db38dccef84fbb10ab314f790939852bfc331806c97a7f3dc64a2af4aa84e1c49db7f14252a21233

data/lib/cms_scanner/errors/http.rb

@@ -64,7 +64,7 @@ module CMSScanner
 
       def to_s
         "The URL supplied redirects to #{redirect_uri}. Use the --ignore-main-redirect "\
-        'option to ignore the redirection and scan the target.'
+        'option to ignore the redirection and scan the target, or change the --url option value to the redirected URL.'
       end
     end
   end

data/lib/cms_scanner/target.rb

@@ -37,9 +37,10 @@ module CMSScanner
       raise NotImplementedError
     end
 
-    # @return [ Regexp ]
+    # @return [ Regexp ] The pattern related to the target url, also matches escaped /, such as
+    #                    in JSON JS data: http:\/\/t.com\/
     def url_pattern
-      @url_pattern ||= Regexp.new(Regexp.escape(url).gsub(/https?/i, 'https?'), Regexp::IGNORECASE)
+      @url_pattern ||= Regexp.new(Regexp.escape(url).gsub(/https?/i, 'https?').gsub('/', '\\\\\?/'), Regexp::IGNORECASE)
     end
 
     # @param [ String ] xpath

data/lib/cms_scanner/target/scope.rb

@@ -39,15 +39,16 @@ module CMSScanner
 
     # Similar to Target#url_pattern but considering the in scope domains as well
     #
-    # @return [ Regexp ]
+    # @return [ Regexp ] The pattern related to the target url and in scope domains,
+    #                    it also matches escaped /, such as in JSON JS data: http:\/\/t.com\/
     def scope_url_pattern
       return @scope_url_pattern if @scope_url_pattern
 
       domains = [uri.host + uri.path] + scope.domains[1..-1]&.map(&:to_s) + scope.invalid_domains
 
-      domains.map! { |d| Regexp.escape(d.gsub(%r{/$}, '')).sub('\*', '.*') }
+      domains.map! { |d| Regexp.escape(d.gsub(%r{/$}, '')).gsub('\*', '.*').gsub('/', '\\\\\?/') }
 
-      @scope_url_pattern = %r{https?://(?:#{domains.join('|')})/?}i
+      @scope_url_pattern = %r{https?:\\?/\\?/(?:#{domains.join('|')})\\?/?}i
     end
 
     # Scope Implementation

data/lib/cms_scanner/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module CMSScanner
-  VERSION = '0.0.44.2'
+  VERSION = '0.0.44.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.0.44.2
+  version: 0.0.44.3
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-17 00:00:00.000000000 Z
+date: 2019-04-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri