dawnscanner 1.6.8 → 2.0.0.rc4

data/spec/lib/kb/cve_2011_2930_spec.rb

@@ -1,31 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2011-2930 vulnerability" do
-  before(:all) do
-    @check = Dawn::Kb::CVE_2011_2930.new
-    # @check.debug = true
-  end
-  it "fires when vulnerable rails version is used (2.3.12)" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.12'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version is used (3.0.9)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.9'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version is used (3.1.0)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.1.0'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "doesn't fire when safe rails version is used (2.3.14)" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.14'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version is used (3.0.10)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.10'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version is used (3.1.1)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.1.1'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-end

data/spec/lib/kb/cve_2011_3009_spec.rb

@@ -1,25 +0,0 @@
-require 'spec_helper'
-
-describe "The CVE-2011-3009 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2011_3009.new
-		# @check.debug = true
-	end
-  it "fires if ruby version is vulnerable (1.8.6-p111)" do
-    @check.detected_ruby = {:engine=>'ruby', :version=>"1.8.6", :patchlevel=>"p111"}
-    expect(@check.vuln?).to    eq(true)
-  end
-  it "fires if ruby version is vulnerable (1.8.5-p111)" do
-    @check.detected_ruby = {:engine=>'ruby', :version=>"1.8.5", :patchlevel=>"p111"}
-    expect(@check.vuln?).to    eq(true)
-  end
-  it "doesn't fire if ruby version is not vulnerable (1.8.6-p112)" do
-    @check.detected_ruby = {:engine=>'ruby', :version=>"1.8.6", :patchlevel=>"p112"}
-    expect(@check.vuln?).to    eq(false)
-  end
-  it "doesn't fire if ruby version is not vulnerable (1.9.2-p112)" do
-    @check.detected_ruby = {:engine=>'ruby', :version=>"1.9.2", :patchlevel=>"p112"}
-    expect(@check.vuln?).to    eq(false)
-  end
-
-end

data/spec/lib/kb/cve_2011_3187_spec.rb

@@ -1,24 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2011-3187 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2011_3187.new
-		# @check.debug = true
-	end
-  it "fires when vulnerable rails version it has been found (3.0.5)" do
-    @check.dependencies = [{:name=>'rails', :version=>'3.0.5'}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "doesn't fire when safe rails version it has been found (3.0.6)" do
-    @check.dependencies = [{:name=>'rails', :version=>'3.0.6'}]
-    expect(@check.vuln?).to eq(false)
-  end
-  it "doesn't fire when safe rails version it has been found (3.1.6)" do
-    @check.dependencies = [{:name=>'rails', :version=>'3.1.6'}]
-    expect(@check.vuln?).to eq(false)
-  end
-  it "doesn't fire when safe rails version it has been found (2.3.16)" do
-    @check.dependencies = [{:name=>'rails', :version=>'2.3.16'}]
-    expect(@check.vuln?).to eq(false)
-  end
-          # self.safe_dependencies = [{:name=>"rails", :version=>['3.0.6']}]
-end

data/spec/lib/kb/cve_2011_4319_spec.rb

@@ -1,44 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2011-4319 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2011_4319.new
-		# @check.debug = true
-	end
-  it "fires when vulnerable rails version it has been found (2.3.12)" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.12'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version it has been found (3.0.10)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.10'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version it has been found (3.1.1)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.10'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "doesn't fire when safe rails version it has been found (2.3.13)" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.13'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version it has been found (2.3.14)" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.14'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version it has been found (3.0.11)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.11'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version it has been found (3.0.12)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.12'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version it has been found (3.1.2)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.1.2'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version it has been found (3.2.0)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.2.0'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-          # self.safe_dependencies = [{:name=>"rails", :version=>['2.3.13', '3.0.11', '3.1.2']}]
-end

data/spec/lib/kb/cve_2011_5036_spec.rb

@@ -1,95 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2011-5036 vulnerability" do
-  before(:all) do
-    @check = Dawn::Kb::CVE_2011_5036.new
-    # @check.debug = true
-  end
-  it "is reported when the vulnerable gem is detected - 1.0.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.0.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-
-  it "is reported when the vulnerable gem is detected - 0.9.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.9.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.9" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.9"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.4" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.4"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.3" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.3"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.0.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.0.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.1.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.1.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.1.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.1.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-
-  it "is reported when the vulnerable gem is detected - 1.2.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.3" do
-
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.3"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.4" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.4"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-
-  it "is reported when the vulnerable gem is detected - 1.3.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.3" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.3"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.4" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.4"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.5" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.5"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-end

data/spec/lib/kb/cve_2012_1098_spec.rb

@@ -1,36 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2012-1098 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2012_1098.new
-		# @check.debug = true
-	end
-  it "fires when vulnerable rails version it has been found (3.0.11)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.11'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version it has been found (3.1.3)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.1.3'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version it has been found (3.2.1)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.2.1'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "doesn't fire when non vulnerable rails version it has been found (3.2.2)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.2.2'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when non vulnerable rails version it has been found (3.2.4)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.2.4'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when non vulnerable rails version it has been found (3.1.4)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.1.4'}]
-    # @check.debug = true
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when rails version older than 3.x.y it has been found" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.12'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-end

data/spec/lib/kb/cve_2012_2139_spec.rb

@@ -1,20 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2012-2139 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2012_2139.new
-		# @check.debug = true
-	end
-  it "is reported when mail_gem version 2.4.3 is used" do
-    @check.dependencies = [{:name=>"mail_gem", :version=>"2.4.3"}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "is reported when mail_gem version 2.3.3 is used" do
-    @check.dependencies = [{:name=>"mail_gem", :version=>"2.3.3"}]
-    expect(@check.vuln?).to eq(true)
-  end
-
-  it "is not reported when mail_gem version 2.4.4 is used" do
-    @check.dependencies = [{:name=>"mail_gem", :version=>"2.4.4"}]
-    expect(@check.vuln?).to eq(false)
-  end
-end

data/spec/lib/kb/cve_2012_2671_spec.rb

@@ -1,23 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2012-2671 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2012_2671.new
-		# @check.debug = true
-	end
-  it "is reported when ruby-cache version 0.5 is used" do
-    @check.dependencies = [{:name=>"rack-cache", :version=>'0.5'}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "is reported when ruby-cache version 0.8 is used" do
-    @check.dependencies = [{:name=>"rack-cache", :version=>'0.8'}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "is reported when ruby-cache version 1.1.1 is used" do
-    @check.dependencies = [{:name=>"rack-cache", :version=>'1.1.1'}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "is not reported when ruby-cache version 1.1.2 is used" do
-    @check.dependencies = [{:name=>"rack-cache", :version=>'1.1.2'}]
-    expect(@check.vuln?).to eq(false)
-  end
-end

data/spec/lib/kb/cve_2012_6109_spec.rb

@@ -1,112 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2012-6109 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2012_6109.new
-		# @check.debug = true
-	end
-  it "is reported when the vulnerable gem is detected - 1.0.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.0.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-
-  it "is reported when the vulnerable gem is detected - 0.9.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.9.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.9" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.9"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.4" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.4"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.3" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.3"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 0.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"0.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.0.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.0.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.1.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.1.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.1.3" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.1.3"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.1.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.1.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-
-  it "is reported when the vulnerable gem is detected - 1.2.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.3" do
-
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.3"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.2.4" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.2.4"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-
-  it "is reported when the vulnerable gem is detected - 1.3.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.2" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.2"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.3" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.3"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.4" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.4"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.5" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.5"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.3.6" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.3.6"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-
-  it "is reported when the vulnerable gem is detected - 1.4.0" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.4.0"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is reported when the vulnerable gem is detected - 1.4.1" do
-    @check.dependencies = [{:name=>"rack", :version=>"1.4.1"}]
-    expect(@check.vuln?).to   eq(true)
-  end
-end

data/spec/lib/kb/cve_2012_6684_spec.rb

@@ -1,16 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2012-6684 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2012_6684.new
-		# @check.debug = true
-	end
-  it "is reported when vulnerable raven-ruby gem is used (4.2.9)" do
-    @check.dependencies = [{:name=>"RedCloth", :version=>'4.2.9'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "is not reported when safe raven-ruby gem is used (4.2.10)" do
-    @check.dependencies = [{:name=>"RedCloth", :version=>'4.2.10'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-
-end

data/spec/lib/kb/cve_2013_0162_spec.rb

@@ -1,23 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2013-0162 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2013_0162.new
-		# @check.debug = true
-	end
-  it "is reported when ruby_parser version 1.x is used" do
-    @check.dependencies = [{:name=>"ruby_parser", :version=>'1.4.5'}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "is reported when ruby_parser version 2.x is used" do
-    @check.dependencies = [{:name=>"ruby_parser", :version=>'2.4.5'}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "is reported when ruby_parser version 3.0.x is used" do
-    @check.dependencies = [{:name=>"ruby_parser", :version=>'3.0.5'}]
-    expect(@check.vuln?).to eq(true)
-  end
-  it "is not reported when ruby_parser version 3.1.1 is used" do
-    @check.dependencies = [{:name=>"ruby_parser", :version=>'3.1.1'}]
-    expect(@check.vuln?).to eq(false)
-  end
-end