cms_scanner 0.0.44.2 → 0.0.44.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/cms_scanner/errors/http.rb +1 -1
- data/lib/cms_scanner/target.rb +3 -2
- data/lib/cms_scanner/target/scope.rb +4 -3
- data/lib/cms_scanner/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 4a69d69efdd838ceece417f3417b454795d9fd9d1a682e0216dda9589f39a27e
|
4
|
+
data.tar.gz: affd1105e6d9589166e8448a2b43f48781ea0e882475aea7a305f16ad1d6fa9e
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: fc2252487b5e24d9dc78186ca68f4df618e43d19f62cb89872897099735f114468fcba740e99b7e6d809e9fd5f9e9f3e516aa0bc9376382f5034cb1f4b406036
|
7
|
+
data.tar.gz: ab0385847b1becef1a0d8c062cf5491bf62c10ca2118ef32db38dccef84fbb10ab314f790939852bfc331806c97a7f3dc64a2af4aa84e1c49db7f14252a21233
|
@@ -64,7 +64,7 @@ module CMSScanner
|
|
64
64
|
|
65
65
|
def to_s
|
66
66
|
"The URL supplied redirects to #{redirect_uri}. Use the --ignore-main-redirect "\
|
67
|
-
'option to ignore the redirection and scan the target.'
|
67
|
+
'option to ignore the redirection and scan the target, or change the --url option value to the redirected URL.'
|
68
68
|
end
|
69
69
|
end
|
70
70
|
end
|
data/lib/cms_scanner/target.rb
CHANGED
@@ -37,9 +37,10 @@ module CMSScanner
|
|
37
37
|
raise NotImplementedError
|
38
38
|
end
|
39
39
|
|
40
|
-
# @return [ Regexp ]
|
40
|
+
# @return [ Regexp ] The pattern related to the target url, also matches escaped /, such as
|
41
|
+
# in JSON JS data: http:\/\/t.com\/
|
41
42
|
def url_pattern
|
42
|
-
@url_pattern ||= Regexp.new(Regexp.escape(url).gsub(/https?/i, 'https?'), Regexp::IGNORECASE)
|
43
|
+
@url_pattern ||= Regexp.new(Regexp.escape(url).gsub(/https?/i, 'https?').gsub('/', '\\\\\?/'), Regexp::IGNORECASE)
|
43
44
|
end
|
44
45
|
|
45
46
|
# @param [ String ] xpath
|
@@ -39,15 +39,16 @@ module CMSScanner
|
|
39
39
|
|
40
40
|
# Similar to Target#url_pattern but considering the in scope domains as well
|
41
41
|
#
|
42
|
-
# @return [ Regexp ]
|
42
|
+
# @return [ Regexp ] The pattern related to the target url and in scope domains,
|
43
|
+
# it also matches escaped /, such as in JSON JS data: http:\/\/t.com\/
|
43
44
|
def scope_url_pattern
|
44
45
|
return @scope_url_pattern if @scope_url_pattern
|
45
46
|
|
46
47
|
domains = [uri.host + uri.path] + scope.domains[1..-1]&.map(&:to_s) + scope.invalid_domains
|
47
48
|
|
48
|
-
domains.map! { |d| Regexp.escape(d.gsub(%r{/$}, '')).
|
49
|
+
domains.map! { |d| Regexp.escape(d.gsub(%r{/$}, '')).gsub('\*', '.*').gsub('/', '\\\\\?/') }
|
49
50
|
|
50
|
-
@scope_url_pattern = %r{https
|
51
|
+
@scope_url_pattern = %r{https?:\\?/\\?/(?:#{domains.join('|')})\\?/?}i
|
51
52
|
end
|
52
53
|
|
53
54
|
# Scope Implementation
|
data/lib/cms_scanner/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: cms_scanner
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.44.
|
4
|
+
version: 0.0.44.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- WPScanTeam
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2019-04-
|
11
|
+
date: 2019-04-18 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: nokogiri
|