RubyGems - codez-tarantula - Versions diffs - 0.5.0 - Mend

codez-tarantula 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (88) hide show

data/.autotest +14 -0
data/.gitignore +12 -0
data/.travis.yml +7 -0
data/CHANGELOG +64 -0
data/DSL_EXAMPLES.md +120 -0
data/Gemfile +2 -0
data/LICENSE +20 -0
data/README.rdoc +136 -0
data/Rakefile +36 -0
data/ci/rails2.gemfile +4 -0
data/ci/rails3.gemfile +4 -0
data/laf/images/header_bg.jpg +0 -0
data/laf/images/logo.png +0 -0
data/laf/images/tagline.png +0 -0
data/laf/javascripts/jquery-1.2.3.js +3408 -0
data/laf/javascripts/jquery-ui-tabs.js +890 -0
data/laf/javascripts/jquery.tablesorter.js +861 -0
data/laf/javascripts/tarantula.js +10 -0
data/laf/stylesheets/tarantula.css +346 -0
data/lib/relevance/core_extensions/ellipsize.rb +38 -0
data/lib/relevance/core_extensions/file.rb +15 -0
data/lib/relevance/core_extensions/metaclass.rb +78 -0
data/lib/relevance/core_extensions/response.rb +14 -0
data/lib/relevance/core_extensions/test_case.rb +21 -0
data/lib/relevance/tarantula.rb +55 -0
data/lib/relevance/tarantula/attack.rb +22 -0
data/lib/relevance/tarantula/attack_handler.rb +43 -0
data/lib/relevance/tarantula/basic_attack.rb +44 -0
data/lib/relevance/tarantula/crawler.rb +271 -0
data/lib/relevance/tarantula/detail.html.erb +81 -0
data/lib/relevance/tarantula/form.rb +29 -0
data/lib/relevance/tarantula/form_submission.rb +98 -0
data/lib/relevance/tarantula/html_document_handler.rb +42 -0
data/lib/relevance/tarantula/html_report_helper.rb +46 -0
data/lib/relevance/tarantula/html_reporter.rb +111 -0
data/lib/relevance/tarantula/index.html.erb +37 -0
data/lib/relevance/tarantula/invalid_html_handler.rb +27 -0
data/lib/relevance/tarantula/io_reporter.rb +40 -0
data/lib/relevance/tarantula/link.rb +105 -0
data/lib/relevance/tarantula/log_grabber.rb +22 -0
data/lib/relevance/tarantula/rails_integration_proxy.rb +90 -0
data/lib/relevance/tarantula/recording.rb +12 -0
data/lib/relevance/tarantula/response.rb +19 -0
data/lib/relevance/tarantula/result.rb +83 -0
data/lib/relevance/tarantula/test_report.html.erb +32 -0
data/lib/relevance/tarantula/tidy_handler.rb +35 -0
data/lib/relevance/tarantula/transform.rb +21 -0
data/lib/relevance/tarantula/version.rb +5 -0
data/lib/relevance/tasks/tarantula_tasks.rake +42 -0
data/lib/tarantula-rails3.rb +9 -0
data/spec/relevance/core_extensions/ellipsize_spec.rb +19 -0
data/spec/relevance/core_extensions/file_spec.rb +7 -0
data/spec/relevance/core_extensions/response_spec.rb +48 -0
data/spec/relevance/core_extensions/test_case_spec.rb +19 -0
data/spec/relevance/tarantula/attack_handler_spec.rb +29 -0
data/spec/relevance/tarantula/basic_attack_spec.rb +12 -0
data/spec/relevance/tarantula/crawler_spec.rb +409 -0
data/spec/relevance/tarantula/form_spec.rb +50 -0
data/spec/relevance/tarantula/form_submission_spec.rb +171 -0
data/spec/relevance/tarantula/html_document_handler_spec.rb +43 -0
data/spec/relevance/tarantula/html_report_helper_spec.rb +46 -0
data/spec/relevance/tarantula/html_reporter_spec.rb +82 -0
data/spec/relevance/tarantula/invalid_html_handler_spec.rb +33 -0
data/spec/relevance/tarantula/io_reporter_spec.rb +11 -0
data/spec/relevance/tarantula/link_spec.rb +132 -0
data/spec/relevance/tarantula/log_grabber_spec.rb +26 -0
data/spec/relevance/tarantula/rails_integration_proxy_spec.rb +100 -0
data/spec/relevance/tarantula/result_spec.rb +85 -0
data/spec/relevance/tarantula/tidy_handler_spec.rb +58 -0
data/spec/relevance/tarantula/transform_spec.rb +20 -0
data/spec/relevance/tarantula_spec.rb +23 -0
data/spec/spec_helper.rb +43 -0
data/tarantula.gemspec +25 -0
data/template/tarantula_test.rb +22 -0
data/vendor/xss-shield/MIT-LICENSE +20 -0
data/vendor/xss-shield/README +76 -0
data/vendor/xss-shield/init.rb +16 -0
data/vendor/xss-shield/lib/xss_shield.rb +6 -0
data/vendor/xss-shield/lib/xss_shield/erb_hacks.rb +111 -0
data/vendor/xss-shield/lib/xss_shield/haml_hacks.rb +42 -0
data/vendor/xss-shield/lib/xss_shield/safe_string.rb +47 -0
data/vendor/xss-shield/lib/xss_shield/secure_helpers.rb +40 -0
data/vendor/xss-shield/test/test_actionview_integration.rb +40 -0
data/vendor/xss-shield/test/test_erb.rb +44 -0
data/vendor/xss-shield/test/test_haml.rb +43 -0
data/vendor/xss-shield/test/test_helpers.rb +25 -0
data/vendor/xss-shield/test/test_safe_string.rb +55 -0
metadata +247 -0

data/lib/relevance/tarantula/detail.html.erb ADDED

@@ -0,0 +1,81 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+	"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+	<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+  <link rel="stylesheet" href="../stylesheets/tarantula.css" type="text/css" media="screen" title="no title" charset="utf-8" />
+	<title>Detail</title>
+</head>
+<body>
+  <div id="container">
+    <div id="header">
+      <h1>Tarantula by Relevance</h1>
+      <h2>Eight legs, two fangs ... and an attitude</h2>
+      <p>Tarantula is an open source tool for testing Rails web
+      applications. Tarantula is developed by <a href="http://thinkrelevance.com">Relevance, Inc.</a>
+      and lives at <a href="http://github.com/relevance/tarantula">http://github.com/relevance/tarantula</a>.</p>
+      <hr/>
+    </div>
+    <div id="page">
+      <ul class="tabs">
+        <li><a href="../index.html">&laquo; Back</a></li>
+        <li><a href="#fragment-1" class="active">Body</a></li>
+        <li><a href="#fragment-2" class="active">Log</a></li>
+      </ul>
+      <div id="report">
+        <h3>Detail of <%= result.short_description %> <em>Generated on <%= Time.now %></em></h3>
+        <p><b>Resource</b> <a href="<%= result.full_url %>"><%= result.full_url %></a></p>
+        <p><b>Response</b> <span class="r<%= result.code.first %>"><%= result.code %></span></p>
+        <p><b>Referrer</b> <%= result.referrer || "" %></p>
+        <table class="output">
+        <tbody>
+          <tr>
+            <th colspan="2">#&nbsp;&nbsp;Data</th>
+          </tr>
+          <% if result.data %>
+            <%= result.wrap_in_line_number_table_row(result.data) %>
+          <% else %>
+            <tr>
+              <td colspan="2">No Data</td>
+            </tr>
+          <% end %>
+          </tbody>
+        </table>
+        <table class="output" id="fragment-1">
+          <tbody>
+          <tr>
+            <th colspan="2">#&nbsp;&nbsp;Body</th>
+          </tr>
+          <% if result.body %>
+            <%= result.wrap_in_line_number_table_row(result.body) %>
+          <% else %>
+            <tr>
+              <td colspan="2">No Body</td>
+            </tr>
+          <% end %>
+          </tbody>
+        </table>
+        <table class="output" id="fragment-2">
+          <tbody>
+            <tr>
+              <th colspan="2">#&nbsp;&nbsp;Log</th>
+            </tr>
+            <% if result.log %>
+              <%= result.wrap_in_line_number_table_row(result.log) {|line| wrap_stack_trace_line(line)} %>
+            <% else %>
+              <tr>
+                <td colspan="2">No Log</td>
+              </tr>
+            <% end %>
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </div>
+</body>
+</html>

data/lib/relevance/tarantula/form.rb ADDED

@@ -0,0 +1,29 @@
+module Relevance
+  module Tarantula
+    class Form
+      extend Forwardable
+      def_delegators("@tag", :search)
+      attr_accessor :crawler, :referrer
+      def initialize(tag, crawler, referrer)
+        @tag, @crawler, @referrer = tag, crawler, referrer
+      end
+      def action
+        @tag['action']
+      end
+      def meth
+        (rails_method_hack or @tag['method'] or 'get').downcase
+      end
+      def rails_method_hack
+        (tag = @tag.at('input[@name="_method"]')) && tag["value"]
+      end
+    end
+  end
+end

data/lib/relevance/tarantula/form_submission.rb ADDED

@@ -0,0 +1,98 @@
+module Relevance
+  module Tarantula
+    class FormSubmission
+      include Relevance::Tarantula
+      attr_accessor :meth, :action, :data, :attack, :form
+      class << self
+        def attacks
+          # normalize from hash input to Attack
+          @attacks = @attacks.map do |val|
+            Hash === val ? Relevance::Tarantula::Attack.new(val) : val
+          end
+          @attacks
+        end
+        def attacks=(atts)
+          # normalize from hash input to Attack
+          @attacks = atts.map do |val|
+            Hash === val ? Relevance::Tarantula::Attack.new(val) : val
+          end
+        end
+      end
+      @attacks = [Relevance::Tarantula::BasicAttack.new]
+      def initialize(form, attack = Relevance::Tarantula::BasicAttack.new)
+        @form = form
+        @meth = form.meth
+        @action = form.action
+        @attack = attack
+        @data = mutate_selects(form).merge(mutate_text_areas(form)).merge(mutate_inputs(form))
+      end
+      def crawl
+        begin
+          response = form.crawler.submit(meth, action, data)
+          log "Response #{response.code} for #{self}"
+        rescue ActiveRecord::RecordNotFound => e
+          log "Skipping #{action}, presumed ok that record is missing"
+          response = Relevance::Tarantula::Response.new(:code => "404", :body => e.message, :content_type => "text/plain")
+        end
+        form.crawler.handle_form_results(self, response)
+        response
+      end
+      def self.mutate(form)
+        attacks.map{|attack| new(form, attack)} if attacks
+      end
+      def url
+        action
+      end
+      def to_s
+        "#{action} #{meth} #{data.inspect} #{attack.inspect}"
+      end
+      # a form's signature is what makes it unique (e.g. action + fields)
+      # used to keep track of which forms we have submitted already
+      def signature
+        [action, data.keys.sort, attack.name]
+      end
+      def create_random_data_for(form, tag_selector)
+        form.search(tag_selector).inject({}) do |form_args, input|
+          # TODO: test
+          form_args[input['name']] = random_data(input) if input['name']
+          form_args
+        end
+      end
+      def mutate_inputs(form)
+        create_random_data_for(form, 'input')
+      end
+      def mutate_text_areas(form)
+        create_random_data_for(form, 'textarea')
+      end
+      def mutate_selects(form)
+        form.search('select').inject({}) do |form_args, select|
+          options = select.search('option')
+          option = options.sample
+          form_args[select['name']] = option && option['value']
+          form_args
+        end
+      end
+      def random_data(input)
+        case input['name']
+        when /^_method$/      then input['value']
+        else
+          attack.input(input)
+        end
+      end
+    end
+  end
+end

data/lib/relevance/tarantula/html_document_handler.rb ADDED

@@ -0,0 +1,42 @@
+require 'hpricot'
+module Relevance
+  module Tarantula
+    class HtmlDocumentHandler
+      extend Forwardable
+      def_delegators("@crawler", :queue_link, :queue_form)
+      def initialize(crawler)
+        @crawler = crawler
+      end
+      # HTML::Document shouts to stderr when it sees ugly HTML
+      # We don't want this -- the InvalidHtmlHandler will deal with it
+      def html_doc_without_stderr_noise(html)
+        body = nil
+        Recording.stderr do
+          body = Hpricot html
+        end
+        body
+      end
+      def handle(result)
+        response = result.response
+        url = result.url
+        return unless response.html?
+        body = html_doc_without_stderr_noise(response.body)
+        body.search('a').each do |tag|
+          queue_link(tag, url)
+        end
+        body.search('link').each do |tag|
+          queue_link(tag, url)
+        end
+        body.search('form').each do |form|
+          form['action'] = url unless form['action']
+          queue_form(form, url)
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/relevance/tarantula/html_report_helper.rb ADDED

@@ -0,0 +1,46 @@
+require "erb"
+require "active_support/builder" unless defined?(Builder)
+module Relevance
+  module Tarantula
+    module HtmlReportHelper
+      include ERB::Util
+      include Relevance::Tarantula
+      def wrap_in_line_number_table_row(text, &blk)
+        x = Builder::XmlMarkup.new
+        x.tr do
+          lines = text.split("\n")
+          x.td(:class => "numbers") do
+            lines.size.times do |index|
+              x.span(index+1, :class => "line number")
+            end
+          end
+          x.td(:class => "lines") do
+            lines.each do |line|
+              x.span(line, :class => "line")
+            end
+          end
+        end
+        x.target!
+      end
+      def textmate_url(file, line_no)
+        "txmt://open?url=file://#{File.expand_path(File.join(rails_root,file))}&line_no=#{line_no}"
+      end
+      def wrap_stack_trace_line(text)
+        if text =~ %r{^\s*(/[^:]+):(\d+):([^:]+)$}
+          file = h($1) # .to_s_xss_protected
+          line_number = $2
+          message = h($3) # .to_s_xss_protected
+          "<a href='#{textmate_url(file, line_number)}'>#{file}:#{line_number}</a>:#{message}" # .mark_as_xss_protected
+        else
+          h(text) # .to_s_xss_protected
+        end
+      end
+    end
+  end
+end

data/lib/relevance/tarantula/html_reporter.rb ADDED

@@ -0,0 +1,111 @@
+module Relevance
+  module Tarantula
+    class HtmlReporter
+      include Relevance::Tarantula
+      attr_accessor :basedir, :results
+      delegate :successes, :failures, :to => :results
+      HtmlResultOverview = Struct.new(:code, :url, :description, :method, :referrer, :file_name)
+      def initialize(basedir)
+        @basedir = basedir
+        @results = Struct.new(:successes, :failures).new([], [])
+        FileUtils.mkdir_p(@basedir)
+      end
+      def report(result)
+        return if result.nil?
+        create_detail_report(result)
+        collection = result.success ? results.successes : results.failures
+        collection << HtmlResultOverview.new(
+          result.code, result.url, result.description, result.method, result.referrer, result.file_name
+        )
+      end
+      def finish_report(test_name)
+        puts "Writing results to #{basedir}"
+        copy_styles  unless styles_exist?
+        create_index unless index_exists?
+        update_index(test_name)
+      end
+      def create_detail_report(result)
+        template = ERB.new(template("detail.html.erb"))
+        output(result.file_name, template.result(result.send(:binding)), result.test_name)
+      end
+      def copy_styles
+        # not using cp_r because it picks up .svn crap
+        FileUtils.mkdir_p(File.join(basedir, "stylesheets"))
+        Dir.glob("#{tarantula_home}/laf/stylesheets/*.css").each do |file|
+          FileUtils.cp(file, File.join(basedir, "stylesheets"))
+        end
+        FileUtils.mkdir_p(File.join(basedir, "images"))
+        Dir.glob("#{tarantula_home}/laf/images/*.{jpg,gif,png}").each do |file|
+          FileUtils.cp(file, File.join(basedir, "images"))
+        end
+        FileUtils.mkdir_p(File.join(basedir, "javascripts"))
+        Dir.glob("#{tarantula_home}/laf/javascripts/*.js").each do |file|
+          FileUtils.cp(file, File.join(basedir, "javascripts"))
+        end
+      end
+      def create_index
+        template = ERB.new(template("index.html.erb"))
+        output("index.html", template.result(binding))
+      end
+      def update_index(test_name)
+        File.open(File.join(basedir, "index.html"), "r+") do |file|
+          doc = Hpricot file.read
+          tabs_container = doc.search "#tabs-container ul"
+          results_container = doc.search "#results-container"
+          tabs_container.append tab_html(test_name)
+          results_container.append results_html(test_name)
+          file.rewind
+          file.write doc.to_s
+        end
+      end
+      def index_exists?
+        File.exists?(File.join(basedir, "index.html"))
+      end
+      def styles_exist?
+        File.exists?(File.join(basedir, "stylesheets", "tarantula.css"))
+      end
+      def tab_html(test_name)
+        "<li><a href='##{test_name}'><span>#{test_name}</span></a></li>"
+      end
+      def results_html(test_name)
+        template = ERB.new(template("test_report.html.erb"))
+        template.result(binding)
+      end
+      def template(name)
+        File.read(File.join(File.dirname(__FILE__), name))
+      end
+      def output(name, body, subdir = '')
+        FileUtils.mkdir_p(File.join(basedir, subdir)) unless subdir.empty?
+        File.open(File.join(basedir, subdir, name), "w") do |file|
+          file.write body
+        end
+      end
+      # CSS class for HTML status codes
+      def class_for_code(code)
+        "r#{Integer(code)/100}"
+      end
+    end
+  end
+end

data/lib/relevance/tarantula/index.html.erb ADDED

@@ -0,0 +1,37 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+	"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+	<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+  <link rel="stylesheet" href="stylesheets/tarantula.css" type="text/css" media="screen" title="no title" charset="utf-8">
+	<script type="text/javascript" src="javascripts/jquery-1.2.3.js"></script>
+  <script type="text/javascript" src="javascripts/jquery.tablesorter.js"></script>
+  <script type="text/javascript" src="javascripts/jquery-ui-tabs.js"></script>
+  <script type="text/javascript" src="javascripts/tarantula.js"></script>
+	<title>Tarantula</title>
+</head>
+<body>
+  <div id="container">
+    <div id="header">
+      <h1>Tarantula by Relevance</h1>
+      <h2>Eight legs, two fangs ... and an attitude</h2>
+      <p>Tarantula is an open source tool for testing Rails web
+      applications. Tarantula is developed by <a href="http://thinkrelevance.com">Relevance, Inc.</a>
+      and lives at <a href="http://github.com/relevance/tarantula">http://github.com/relevance/tarantula</a>.</p>
+      <hr/>
+    </div>
+    <div id="page">
+      <div id="tabs-container">
+        <ul class="tabs"> </ul>
+    	</div>
+      <div id="results-container">
+      </div>
+    </div>
+  </div>
+</body>
+</html>