dawnscanner 1.6.1 → 1.6.2

data/spec/lib/kb/osvdb_105971_spec.rb

@@ -6,10 +6,10 @@ describe "The OSVDB_105971 vulnerability" do
 	end
   it "is reported when a vulnerable version it has been found (0.4.14)" do
     @check.dependencies = [{:name=>"sfpagent", :version=>"0.4.14"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe version it has been found (0.4.15)" do
     @check.dependencies = [{:name=>"sfpagent", :version=>"0.4.15"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 end

data/spec/lib/kb/osvdb_108530_spec.rb

@@ -6,15 +6,15 @@ describe "The OSVDB-108530 vulnerability" do
 	end
   it "is reported when a vulnerable version it has been found (1.0.3.rc2)" do
     @check.dependencies = [{:name=>"kajam", :version=>"1.0.3.rc2"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe version it has been found (1.0.3)" do
     @check.dependencies = [{:name=>"kajam", :version=>"1.0.3"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a safe version it has been found (1.0.4)" do
     @check.dependencies = [{:name=>"kajam", :version=>"1.0.4"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 
   it "must be filled with CVE identifier"

data/spec/lib/kb/osvdb_108563_spec.rb

@@ -7,11 +7,11 @@ describe "The OSVDB-108563 vulnerability" do
 
   it "is reported when a vulnerable version it has been found (1.0.0)" do
     @check.dependencies = [{:name=>"gyazo", :version=>"1.0.0"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe version it has been found (0.4.15)" do
     @check.dependencies = [{:name=>"gyazo", :version=>"1.0.1"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "must be filled with CVE identifier"
   it "must be filled with CVSS information"

data/spec/lib/kb/osvdb_108569_spec.rb

@@ -6,11 +6,11 @@ describe "The OSVDB-108569 vulnerability" do
 	end
   it "is reported when a vulnerable backup_checksum gem version it has been found (3.0.23)" do
     @check.dependencies = [{:name=>"backup_checksum", :version=>"3.0.23"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe backup_checksum gem version it has been found (3.0.24)" do
     @check.dependencies = [{:name=>"backup_checksum", :version=>"3.0.24"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "must be filled with CVE identifier"
   it "must be filled with CVSS information"

data/spec/lib/kb/osvdb_108570_spec.rb

@@ -6,11 +6,11 @@ describe "The OSVDB-108570 vulnerability" do
 	end
   it "is reported when a vulnerable version it has been found (3.0.23)" do
     @check.dependencies = [{:name=>"backup_checksum", :version=>"3.0.23"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe version it has been found (0.4.15)" do
     @check.dependencies = [{:name=>"backup_checksum", :version=>"3.0.24"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "must be filled with CVE identifier"
   it "must be filled with CVSS information"

data/spec/lib/kb/osvdb_115654_spec.rb

@@ -6,10 +6,10 @@ describe "The OSVDB_115654 vulnerability" do
 	end
 	it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"raven-ruby", :version=>"0.12.1"}]
-		@check.vuln?.should   == true
+		expect(@check.vuln?).to   eq(true)
 	end
 	it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"raven-ruby", :version=>"0.12.2"}]
-		@check.vuln?.should   == false
+		expect(@check.vuln?).to   eq(false)
 	end
 end

data/spec/lib/kb/osvdb_116010_spec.rb

@@ -6,10 +6,10 @@ describe "The OSVDB_116010 vulnerability" do
 	end
 	it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"doorkeeper", :version=>"1.4.0"}]
-		@check.vuln?.should   == true
+		expect(@check.vuln?).to   eq(true)
 	end
 	it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"doorkeeper", :version=>"1.4.1"}]
-		@check.vuln?.should   == false
+		expect(@check.vuln?).to   eq(false)
 	end
 end

data/spec/lib/kb/osvdb_117903_spec.rb

@@ -6,18 +6,18 @@ describe "The OSVDB_117903 vulnerability" do
 	end
   it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"ruby-saml", :version=>"0.7.2"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"ruby-saml", :version=>"0.8.1"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"ruby-saml", :version=>"0.7.3"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"ruby-saml", :version=>"0.8.2"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 end

data/spec/lib/kb/osvdb_118830_spec.rb

@@ -6,11 +6,11 @@ describe "The OSVDB_118830 vulnerability" do
 	end
   it "is reported when a vulnerable version it has been found (2.1.1)" do
     @check.dependencies = [{:name=>"doorkeeper", :version=>"2.1.1"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe version it has been found (2.1.2)" do
     @check.dependencies = [{:name=>"doorkeepr", :version=>"2.1.2"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 
 end

data/spec/lib/kb/osvdb_118954_spec.rb

@@ -6,15 +6,15 @@ describe "The OSVDB_118954 vulnerability" do
 	end
   it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"rails", :version=>"4.2.0"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"rails", :version=>"4.2.1.rc3"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"rails", :version=>"4.0.3"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 
 end

data/spec/lib/kb/osvdb_119878_spec.rb

@@ -6,87 +6,87 @@ describe "The OSVDB_119878 vulnerability" do
 	end
   it "is reported when a vulnerable version it has been found (1.6.1.a)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.1.a"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.1)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.1"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.2" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.2"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.2.a" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.2.a"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.3)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.3"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.4)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.4"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.5)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.5"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.6)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.6"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.7)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.7"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.8)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.8"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.8.rc1)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.8.rc1"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.6.9)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.6.9"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.7.0.rc1)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.7.0.rc1"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.7.0)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.7.0"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.7.1)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.7.1"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.7.2)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.7.2"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.7.2.rc1)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.7.2.rc1"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is reported when a vulnerable version it has been found (1.7.3)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.7.3"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe version it has been found (1.8.0)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"1.8.0"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a safe version it has been found (2.0.0.rc1)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"2.0.0.rc1"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a safe version it has been found (2.0.0.rc2)" do
     @check.dependencies = [{:name=>"rest-client", :version=>"2.0.0.rc2"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 
 end

data/spec/lib/kb/osvdb_119927_spec.rb

@@ -6,11 +6,11 @@ describe "The OSVDB_119927 vulnerability" do
 	end
   it "is reported when a vulnerable version it has been found (0.7.3)" do
     @check.dependencies = [{:name=>"http", :version=>"0.7.3"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a safe version it has been found (0.8.0)" do
     @check.dependencies = [{:name=>"http", :version=>"0.8.0"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 
 end

data/spec/lib/kb/osvdb_120415_spec.rb

@@ -6,11 +6,11 @@ describe "The OSVDB_120415 vulnerability" do
 	end
   it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"redcarpet", :version=>"3.2.2"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"redcarpet", :version=>"3.2.3"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 
 end

data/spec/lib/kb/osvdb_120857_spec.rb

@@ -6,27 +6,27 @@ describe "The OSVDB_120857 vulnerability" do
 	end
   it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"refile", :version=>"0.5.2"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"refile", :version=>"0.5.4"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"refile", :version=>"0.4.4"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"refile", :version=>"0.3.4"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"refile", :version=>"0.2.4"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"refile", :version=>"0.1.4"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 
 end

data/spec/lib/kb/osvdb_121701_spec.rb

@@ -6,10 +6,10 @@ describe "The OSVDB_121701 vulnerability" do
 	end
 	it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"open-uri-cached", :version=>"0.0.4"}]
-    @check.vuln?.should   == true
+    expect(@check.vuln?).to   eq(true)
   end
   it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"open-uri-cached", :version=>"0.0.5"}]
-    @check.vuln?.should   == false
+    expect(@check.vuln?).to   eq(false)
   end
 end

data/spec/lib/kb/owasp_ror_cheatsheet_disabled.rb

@@ -11,43 +11,43 @@ describe "The OWASP Ruby on Rails cheatsheet" do
   end 
 
   it "is correctly applied" do
-    @applied.should == true
+    expect(@applied).to eq(true)
   end
 
   it "fires up vulnerabilities" do
-    @engine.is_vulnerable_to?("Owasp Ror Cheatsheet").should == true
+    expect(@engine.is_vulnerable_to?("Owasp Ror Cheatsheet")).to eq(true)
   end
 
   it "says that running operating system commands from a ruby app can be dangerous" do
     ev = @engine.vulnerabilities[0][:vulnerable_checks][0].evidences
-    @engine.vulnerabilities[0][:vulnerable_checks][0].should be_an_instance_of(Dawn::Kb::OwaspRorCheatSheet::CommandInjection)
-    ev[0][:filename].should == "./spec/support/hello_world_3.2.13/app/helpers/application_helper.rb"
-    ev[0][:matches].count.should == 4
-    ev[0][:matches].should =~ [{:match=>"    eval(command)\n", :line=>4}, {:match=>"    System(command)\n", :line=>5}, {:match=>"    `\#{command}`\n", :line=>6}, {:match=>"    Kernel.exec(command)\n", :line=>7}]
+    expect(@engine.vulnerabilities[0][:vulnerable_checks][0]).to be_an_instance_of(Dawn::Kb::OwaspRorCheatSheet::CommandInjection)
+    expect(ev[0][:filename]).to eq("./spec/support/hello_world_3.2.13/app/helpers/application_helper.rb")
+    expect(ev[0][:matches].count).to eq(4)
+    expect(ev[0][:matches]).to match_array([{:match=>"    eval(command)\n", :line=>4}, {:match=>"    System(command)\n", :line=>5}, {:match=>"    `\#{command}`\n", :line=>6}, {:match=>"    Kernel.exec(command)\n", :line=>7}])
   end
 
   it "says that methods fetching data must validate parameters form request"
   it "says that applications must filter data to avoid XSS"
   it "says that applications must tune session cookies to have them to expire or to store them in a database" do
     sessions = Dawn::Kb::ComboCheck.find_vulnerable_checks_by_class(@vc, Dawn::Kb::OwaspRorCheatSheet::SessionStoredInDatabase)
-    sessions.should  be_nil
+    expect(sessions).to  be_nil
   end
   it "says that applications must tune devise parameters"
   it "says that you have to implement some access control to your REST code (e.g. using cancan)"
   it "says that protect_from_forgery must be enabled" do 
     forgery = Dawn::Kb::ComboCheck.find_vulnerable_checks_by_class(@vc, Dawn::Kb::OwaspRorCheatSheet::Csrf)
-    forgery.should  be_nil
+    expect(forgery).to  be_nil
   end
   it "says that your models must take care about not declaring attr_accessor fields to avoid mass assignements" do
     mass_assignment = Dawn::Kb::ComboCheck.find_vulnerable_checks_by_class(@vc, Dawn::Kb::OwaspRorCheatSheet::MassAssignmentInModel)
-    mass_assignment.should_not be_nil
+    expect(mass_assignment).not_to be_nil
   end
   it "says redirect_to calls in your code must use only_path=true param that lets your code to be safe against forceful browsing"
   it "says that pages passed to render call must not under the user control"
   it "says that applications must implement the same-origin control when handling data"
   it "says that applications must use HTTP headers designed for security" do
     headers = Dawn::Kb::ComboCheck.find_vulnerable_checks_by_class(@vc, Dawn::Kb::OwaspRorCheatSheet::SecurityRelatedHeaders)
-    headers.should_not be_nil
+    expect(headers).not_to be_nil
   end
   it "says that you have to perform code reviews to avoid business logic faults. Using codesake dawn is great :-)"
   it "says that you have to manually check your routes to avoid a widespread attack surface."

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dawnscanner
 version: !ruby/object:Gem::Version
-  version: 1.6.1
+  version: 1.6.2
 platform: ruby
 authors:
 - Paolo Perego
@@ -30,7 +30,7 @@ cert_chain:
   jm6Bw8fGx65GCWIdgMhH/P0icixcnyrnotnnOrEcmPudIlgEN9qaUYcguOfFBhTH
   1sGpM7KzrYHU8qJJPrdaX0ezIDL4cN/kA/DxYTfUiMw=
   -----END CERTIFICATE-----
-date: 2016-02-24 00:00:00.000000000 Z
+date: 2016-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cvss
@@ -315,6 +315,7 @@ files:
 - checksum/dawnscanner-1.5.1.gem.sha1
 - checksum/dawnscanner-1.5.2.gem.sha1
 - checksum/dawnscanner-1.6.0.gem.sha1
+- checksum/dawnscanner-1.6.1.gem.sha1
 - dawnscanner.gemspec
 - doc/dawn_1_0_announcement.md
 - doc/dawn_1_1_announcement.md
@@ -534,6 +535,8 @@ files:
 - lib/dawn/kb/cve_2016_0751.rb
 - lib/dawn/kb/cve_2016_0752.rb
 - lib/dawn/kb/cve_2016_0753.rb
+- lib/dawn/kb/cve_2016_2097.rb
+- lib/dawn/kb/cve_2016_2098.rb
 - lib/dawn/kb/dependency_check.rb
 - lib/dawn/kb/deprecation_check.rb
 - lib/dawn/kb/gem_check.rb
@@ -670,6 +673,8 @@ files:
 - spec/lib/kb/cve_2016_0751_spec.rb
 - spec/lib/kb/cve_2016_0752_spec.rb
 - spec/lib/kb/cve_2016_0753_spec.rb
+- spec/lib/kb/cve_2016_2097_spec.rb
+- spec/lib/kb/cve_2016_2098_spec.rb
 - spec/lib/kb/osvdb_105971_spec.rb
 - spec/lib/kb/osvdb_108530_spec.rb
 - spec/lib/kb/osvdb_108563_spec.rb
@@ -812,6 +817,8 @@ test_files:
 - spec/lib/kb/cve_2016_0751_spec.rb
 - spec/lib/kb/cve_2016_0752_spec.rb
 - spec/lib/kb/cve_2016_0753_spec.rb
+- spec/lib/kb/cve_2016_2097_spec.rb
+- spec/lib/kb/cve_2016_2098_spec.rb
 - spec/lib/kb/osvdb_105971_spec.rb
 - spec/lib/kb/osvdb_108530_spec.rb
 - spec/lib/kb/osvdb_108563_spec.rb