cms_scanner 0.13.5 → 0.13.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7cac4c9125791a009eef019b5ef6ccb107ecad9123813925ac8bd42f07d4fd4
-  data.tar.gz: b15f005bad40382d40ef86e065da7ec0be65df295ab8e2cb9cffcf364c9e990c
+  metadata.gz: c30dcbc053e4087d1f308d8390d026a028ddb2ca7c8f5f01108e72beed649e76
+  data.tar.gz: fdd30f85d4a8847da231678c1a785002421f322d65623a9ad66168a007cba420
 SHA512:
-  metadata.gz: b77289442e06fafc7510db531c1b8e3288370aed6d605b3851105800c770ae1fb8bbbaf172cf5b99f413537bf5f71a18fe9f431740a7066929dd2dc778114291
-  data.tar.gz: 4472f7df03531464cbed7d4f14b48d769735eb3deb2a56fcb6386f0001d61dbac08375a3e4cb78c205eeb9cf7fd0eb37250ae0e0364595a628ff83b2adf4787e
+  metadata.gz: a63a0447cc9f8dcc69974e6b82e93db96d534006e5a5a35b5de56a2374d8a28750034b3490e6180e8d1706a01132eb90ca49e6dc8060c4c625b704a93a76e862
+  data.tar.gz: 9b5e1f8fa8cbee20c75b163814196cc08292fbff28a6feb6d5f52f58cf36ecd9bbbd161b8c38abf3476fb7a87e564fcdb5bbb554c0611d4ba0a146dc083cb3e2

data/app/controllers/core/cli_options.rb

@@ -55,7 +55,7 @@ module CMSScanner
           OptPositiveInteger.new(['-t', '--max-threads VALUE', 'The max threads to use'],
                                  default: 5),
           OptPositiveInteger.new(['--throttle MilliSeconds', 'Milliseconds to wait before doing another web request. ' \
-                                  'If used, the max threads will be set to 1.']),
+                                                             'If used, the max threads will be set to 1.']),
           OptPositiveInteger.new(['--request-timeout SECONDS', 'The request timeout in seconds'],
                                  default: 60),
           OptPositiveInteger.new(['--connect-timeout SECONDS', 'The connection timeout in seconds'],

data/app/controllers/core.rb

@@ -48,14 +48,28 @@ module CMSScanner
           raise Error::ProxyAuthRequired
         end
 
-        # Checks for redirects
-        # An out of scope redirect will raise an Error::HTTPRedirect
-        effective_url = target.homepage_res.effective_url
+        handle_redirection(res)
+      end
+
+      # Checks for redirects, an out of scope redirect will raise an Error::HTTPRedirect
+      #
+      # @param [ Typhoeus::Response ] res
+      def handle_redirection(res)
+        effective_url = target.homepage_res.effective_url # Basically get and follow location of target.url
+        effective_uri = Addressable::URI.parse(effective_url)
+
+        # Case of http://a.com => https://a.com (or the opposite)
+        if !NS::ParsedCli.ignore_main_redirect && target.uri.domain == effective_uri.domain &&
+           target.uri.path == effective_uri.path && target.uri.scheme != effective_uri.scheme
+
+          target.url = effective_url
+        end
 
         return if target.in_scope?(effective_url)
 
         raise Error::HTTPRedirect, effective_url unless NS::ParsedCli.ignore_main_redirect
 
+        # Sets back homepage_res to unfollowed location in case of ignore_main_redirect used
         target.homepage_res = res
       end
 

data/lib/cms_scanner/errors/http.rb

@@ -64,7 +64,8 @@ module CMSScanner
 
       def to_s
         "The URL supplied redirects to #{redirect_uri}. Use the --ignore-main-redirect "\
-        'option to ignore the redirection and scan the target, or change the --url option value to the redirected URL.'
+          'option to ignore the redirection and scan the target, or change the --url option ' \
+          'value to the redirected URL.'
       end
     end
   end

data/lib/cms_scanner/finders/finder/enumerator.rb

@@ -62,7 +62,7 @@ module CMSScanner
           return unless valid_response_codes.include?(full_res.code)
 
           return if target.homepage_or_404?(full_res) ||
-                    opts[:exclude_content] && full_res.body&.match(opts[:exclude_content])
+                    (opts[:exclude_content] && full_res.body&.match(opts[:exclude_content]))
 
           full_res
         end

data/lib/cms_scanner/formatter.rb

@@ -84,6 +84,8 @@ module CMSScanner
         puts render(tpl, vars, controller_name)
       end
 
+      ERB_SUPPORTS_KVARGS = ::ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+
+
       # @param [ String ] tpl
       # @param [ Hash ] vars
       # @param [ String ] controller_name
@@ -93,7 +95,12 @@ module CMSScanner
 
         # '-' is used to disable new lines when -%> is used
         # See http://www.ruby-doc.org/stdlib-2.1.1/libdoc/erb/rdoc/ERB.html
-        ERB.new(File.read(view_path(tpl)), nil, '-').result(binding)
+        # Since ruby 2.6, KVARGS are supported and passing argument is deprecated in ruby 3+
+        if ERB_SUPPORTS_KVARGS
+          ERB.new(File.read(view_path(tpl)), trim_mode: '-').result(binding)
+        else
+          ERB.new(File.read(view_path(tpl)), nil, '-').result(binding)
+        end
       end
 
       # @param [ Hash ] vars

data/lib/cms_scanner/numeric.rb

@@ -6,7 +6,7 @@ class Numeric
   def bytes_to_human
     units = %w[B KB MB GB TB]
     e     = abs.zero? ? abs : (Math.log(abs) / Math.log(1024)).floor
-    s     = format('%<s>.3f', s: (abs.to_f / 1024**e))
+    s     = format('%<s>.3f', s: (abs.to_f / (1024**e)))
 
     s.sub(/\.?0*$/, " #{units[e]}")
   end

data/lib/cms_scanner/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module CMSScanner
-  VERSION = '0.13.5'
+  VERSION = '0.13.8'
 end

data/lib/cms_scanner/web_site.rb

@@ -115,7 +115,7 @@ module CMSScanner
 
     # @return [ Hash ] The Typhoeus params to use to perform head requests
     def head_or_get_params
-      @head_or_get_params ||= if NS::Browser.head(homepage_url).code == 405
+      @head_or_get_params ||= if [0, 405, 501].include?(NS::Browser.head(homepage_url).code)
                                 { method: :get, maxfilesize: 1 }
                               else
                                 { method: :head }

metadata

@@ -1,15 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: cms_scanner
 version: !ruby/object:Gem::Version
-  version: 0.13.5
+  version: 0.13.8
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-08 00:00:00.000000000 Z
+date: 2022-04-04 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: ethon
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.14'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '0.16'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.14'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '0.16'
 - !ruby/object:Gem::Dependency
   name: get_process_mem
   requirement: !ruby/object:Gem::Requirement
@@ -28,30 +48,36 @@ dependencies:
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.11.4
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 1.14.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.11.4
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 1.14.0
 - !ruby/object:Gem::Dependency
   name: opt_parse_validator
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.4
+        version: 1.9.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.4
+        version: 1.9.5
 - !ruby/object:Gem::Dependency
   name: public_suffix
   requirement: !ruby/object:Gem::Requirement
@@ -106,20 +132,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '1.5'
-- !ruby/object:Gem::Dependency
-  name: ethon
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.14.0
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.14.0
 - !ruby/object:Gem::Dependency
   name: xmlrpc
   requirement: !ruby/object:Gem::Requirement
@@ -196,14 +208,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.0
+        version: 3.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.0
+        version: 3.11.0
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
@@ -224,28 +236,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.26.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.26.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.13.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -280,14 +292,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.13.0
+        version: 3.14.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.13.0
+        version: 3.14.0
 description: Framework to provide an easy way to implement CMS Scanners
 email:
 - contact@wpscan.com