dradis-acunetix 4.12.0 → 4.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f524ed0cb7e422e55d6a417c7f44ffcc75062ad8fd270c3974b5d4df36296cb7
-  data.tar.gz: 3c76fdd522b2471213d32b88e5fe83675b22fd5cf542f3b560cf589169656fac
+  metadata.gz: 70ada77a2b5ccc95dea1ee7de02fb8ff3dc64b53b4083cd6a6bbc5ef0ef2436a
+  data.tar.gz: ea41c007052e86cc1911e6c14869207bf8826b2498088fcd2f0a9d884dbd3972
 SHA512:
-  metadata.gz: 1cd647ad42044b3e6eaed0bdd803cbac50e64f82d2bff5d8849b631409e64a41d4f280a4ee045286b5618e6bf587d8860786e65eb8dcb8e1f72e8b835c739b4b
-  data.tar.gz: b6d4cf1be6d5fd42cad884af20b045551c2390f6c18bae467aaecfd03e289e49c29c903e5440c8ca495c87cce6e6d6839c93e92a6d110ad173dcbb7984edd192
+  metadata.gz: b440d35fc20eee027b5cc8c959ba16e7d646d725c1e6db537740b2b8c2b24c20671a136b31d66f9b632f976d98ea514b5d4b8ffbb8c18723a8579645bf712e1d
+  data.tar.gz: abb9e364750381d45c33ba282cd47811c05a4e4fb51a7f9d89d348fc9f48d6cd55ff1712fac2673865139c5b8ec9a5dcebefbd3b57e1d623622ac862869aeda9

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+v4.14.0 (October 2024)
+  - Separate general importer into Acunetix360 & Standard importers
+
+v4.13.0 (July 2024)
+  - No changes
+
 v4.12.0 (May 2024)
   - Migrate integration to use Mappings Manager
   - Update Dradis links in README

data/dradis-acunetix.gemspec

@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'dradis-plugins', '~> 4.0'
   spec.add_dependency 'nokogiri', '~> 1.3'
 
-  spec.add_development_dependency 'bundler', '~> 1.6'
+  spec.add_development_dependency 'bundler', '~> 2'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'rspec-rails'
   spec.add_development_dependency 'combustion', '~> 0.5.2'

data/lib/dradis/plugins/acunetix/acunetix360/importer.rb

@@ -0,0 +1,95 @@
+module Dradis::Plugins::Acunetix
+  module Acunetix360
+    def self.meta
+      package = Dradis::Plugins::Acunetix
+      {
+        name: package::Engine::plugin_name,
+        description: 'Upload Acunetix360 output file (.xml)',
+        version: package.version
+      }
+    end
+
+    class Importer < Dradis::Plugins::Upload::Importer
+      attr_accessor :scan_node, :xml
+
+      def self.templates
+        { evidence: 'evidence_360', issue: 'vulnerability_360' }
+      end
+
+      def initialize(args = {})
+        args[:plugin] = Dradis::Plugins::Acunetix
+        super(args)
+      end
+
+      # The framework will call this function if the user selects this plugin from
+      # the dropdown list and uploads a file.
+      # @returns true if the operation was successful, false otherwise
+      def import(params = {})
+        file_content = File.read(params.fetch(:file))
+
+        logger.info { 'Parsing Acunetix360 output file...' }
+        @xml = Nokogiri::XML( file_content )
+        logger.info { 'Done.' }
+
+        unless xml.xpath('//acunetix-360').present?
+          error = 'No Acunetix360 results were detected in the uploaded file. Ensure you uploaded an Acunetix360 XML report.'
+          logger.fatal { error }
+          content_service.create_note text: error
+          return false
+        end
+
+        process_acunetix360
+
+        logger.info { 'Acunetix360 file successfully imported' }
+        true
+      end
+
+      private
+
+      def process_acunetix360
+        process_target_node
+        process_acunetix360_vulnerabilities
+      end
+
+      def process_target_node
+        target_xml = xml.at_xpath('//acunetix-360/target')
+        @scan_node = content_service.create_node(
+          label: target_xml.at_xpath('url').text,
+          type: :host
+        )
+
+        logger.info { "Creating target node: #{scan_node.label}" }
+
+        if scan_node.respond_to?(:properties)
+          scan_node.set_property(:scan_id, target_xml.at_xpath('scan-id').text)
+          scan_node.set_property(:initiated, target_xml.at_xpath('initiated').text)
+          scan_node.set_property(:duration, target_xml.at_xpath('duration').text)
+        end
+      end
+
+      def process_acunetix360_vulnerabilities
+        logger.info { 'Creating issues from Acunetix360 vulnerabilities.' }
+
+        xml.xpath('//acunetix-360/vulnerabilities/vulnerability').each do |vuln_xml|
+          issue_text = mapping_service.apply_mapping(
+            source: 'vulnerability_360',
+            data: vuln_xml
+          )
+
+          type = vuln_xml.at_xpath('type').text
+
+          logger.info { "\t\t => Creating new issue: #{type}" }
+          issue = content_service.create_issue(text: issue_text, id: type)
+
+          evidence_text = mapping_service.apply_mapping(
+            source: 'evidence_360',
+            data: vuln_xml
+          )
+
+          logger.info { "\t\t => Creating new evidence" }
+          content_service.create_evidence(issue: issue, node: scan_node, content: evidence_text)
+        end
+      end
+    end
+  end
+end

data/lib/dradis/plugins/acunetix/engine.rb

@@ -5,5 +5,17 @@ module Dradis::Plugins::Acunetix
     include ::Dradis::Plugins::Base
     description 'Processes Acunetix XML format'
     provides :upload
+
+    # Because this plugin provides two export modules, we have to overwrite
+    # the default .uploaders() method.
+    #
+    # See:
+    #  Dradis::Plugins::Upload::Base in dradis-plugins
+    def self.uploaders
+      [
+        Dradis::Plugins::Acunetix::Standard,
+        Dradis::Plugins::Acunetix::Acunetix360
+      ]
+    end
   end
 end

data/lib/dradis/plugins/acunetix/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 4
-        MINOR = 12
+        MINOR = 14
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/acunetix/mapping.rb

@@ -73,81 +73,81 @@ module Dradis::Plugins::Acunetix
         'evidence_360.http_response_duration'
       ],
       evidence: [
-        'evidence.details',
         'evidence.affects',
-        'evidence.parameter',
+        'evidence.aop_additional',
         'evidence.aop_source_file',
         'evidence.aop_source_line',
-        'evidence.aop_additional',
+        'evidence.details',
         'evidence.is_false_positive',
+        'evidence.parameter',
         'evidence.request',
         'evidence.response'
       ],
       report_item: [
-        'report_item.name',
-        'report_item.module_name',
-        'report_item.severity',
-        'report_item.type',
-        'report_item.impact',
-        'report_item.description',
-        'report_item.detailed_information',
-        'report_item.recommendation',
-        'report_item.request',
-        'report_item.response',
+        'report_item.cve_list',
         'report_item.cvss_descriptor',
         'report_item.cvss_score',
         'report_item.cvss3_descriptor',
         'report_item.cvss3_score',
         'report_item.cvss3_tempscore',
         'report_item.cvss3_envscore',
-        'report_item.cve_list',
-        'report_item.references'
+        'report_item.description',
+        'report_item.detailed_information',
+        'report_item.impact',
+        'report_item.module_name',
+        'report_item.name',
+        'report_item.recommendation',
+        'report_item.references',
+        'report_item.request',
+        'report_item.response',
+        'report_item.severity',
+        'report_item.type'
       ],
       scan: [
-        'scan.name',
-        'scan.short_name',
-        'scan.start_url',
-        'scan.start_time',
-        'scan.finish_time',
-        'scan.scan_time',
         'scan.aborted',
-        'scan.responsive',
         'scan.banner',
+        'scan.name',
         'scan.os',
-        'scan.web_server',
-        'scan.technologies'
+        'scan.finish_time',
+        'scan.responsive',
+        'scan.scan_time',
+        'scan.short_name',
+        'scan.start_time',
+        'scan.start_url',
+        'scan.technologies',
+        'scan.web_server'
       ],
       vulnerability_360: [
-        'vulnerability_360.name',
-        'vulnerability_360.type',
-        'vulnerability_360.url',
+        'vulnerability_360.capec',
+        'vulnerability_360.certainty',
+        'vulnerability_360.confirmed',
+        'vulnerability_360.cvss_base',
+        'vulnerability_360.cvss_environmental',
+        'vulnerability_360.cvss_temporal',
+        'vulnerability_360.cvss_vector',
+        'vulnerability_360.cvss31_base',
+        'vulnerability_360.cvss31_environmental',
+        'vulnerability_360.cvss31_temporal',
+        'vulnerability_360.cvss31_vector',
+        'vulnerability_360.cwe',
         'vulnerability_360.description',
+        'vulnerability_360.exploitation_skills',
+        'vulnerability_360.external_references',
+        'vulnerability_360.hipaa',
         'vulnerability_360.impact',
+        'vulnerability_360.iso27001',
+        'vulnerability_360.name',
+        'vulnerability_360.owasp',
+        'vulnerability_360.owasppc',
+        'vulnerability_360.pci32',
         'vulnerability_360.remedial_actions',
-        'vulnerability_360.exploitation_skills',
         'vulnerability_360.remedial_procedure',
         'vulnerability_360.remedy_references',
-        'vulnerability_360.external_references',
         'vulnerability_360.severity',
-        'vulnerability_360.certainty',
-        'vulnerability_360.confirmed',
         'vulnerability_360.state',
-        'vulnerability_360.owasp',
+        'vulnerability_360.type',
+        'vulnerability_360.url',
         'vulnerability_360.wasc',
-        'vulnerability_360.cwe',
-        'vulnerability_360.capec',
-        'vulnerability_360.pci32',
-        'vulnerability_360.hipaa',
-        'vulnerability_360.owasppc',
-        'vulnerability_360.iso27001',
-        'vulnerability_360.cvss_vector',
-        'vulnerability_360.cvss_base',
-        'vulnerability_360.cvss_temporal',
-        'vulnerability_360.cvss_environmental',
-        'vulnerability_360.cvss31_vector',
-        'vulnerability_360.cvss31_base',
-        'vulnerability_360.cvss31_temporal',
-        'vulnerability_360.cvss31_environmental'
       ]
     }.freeze
   end

data/lib/dradis/plugins/acunetix/standard/importer.rb

@@ -0,0 +1,102 @@
+module Dradis::Plugins::Acunetix
+  module Standard
+    def self.meta
+      package = Dradis::Plugins::Acunetix
+      {
+        name: package::Engine::plugin_name,
+        description: 'Upload Standard Acunetix output file (.xml)',
+        version: package.version
+      }
+    end
+
+    class Importer < Dradis::Plugins::Upload::Importer
+      attr_accessor :scan_node, :xml
+
+      def self.templates
+        { evidence: 'evidence', issue: 'report_item' }
+      end
+
+      def initialize(args = {})
+        args[:plugin] = Dradis::Plugins::Acunetix
+        super(args)
+      end
+
+      # The framework will call this function if the user selects this plugin from
+      # the dropdown list and uploads a file.
+      # @returns true if the operation was successful, false otherwise
+      def import(params = {})
+        file_content = File.read(params.fetch(:file))
+
+        logger.info { 'Parsing Standard Acunetix output file...' }
+        @xml = Nokogiri::XML(file_content)
+        logger.info { 'Done.' }
+
+        unless xml.xpath('/ScanGroup/Scan').present?
+          error = 'No scan results were detected in the uploaded file (/ScanGroup/Scan). Ensure you uploaded an Acunetix XML report.'
+          logger.fatal { error }
+          content_service.create_note text: error
+          return false
+        end
+
+        process_standard
+
+        logger.info { 'Standard Acunetix file successfully imported' }
+        true
+      end
+
+      private
+
+      def process_standard
+        xml.xpath('/ScanGroup/Scan').each do |xml_scan|
+          process_scan(xml_scan)
+        end
+      end
+
+      def process_scan(xml_scan)
+        url = xml_scan.at_xpath('./StartURL').text()
+        start_url = URI::parse(url).host || url # urls wo/ protocol returned nil
+
+        self.scan_node = content_service.create_node(label: start_url, type: :host)
+        logger.info{ "\tScan start URL: #{start_url}" }
+
+        # Define Node properties
+        if scan_node.respond_to?(:properties)
+          scan_node.set_property(:short_name, xml_scan.at_xpath('./ShortName').text() )
+          scan_node.set_property(:start_url, start_url)
+          scan_node.set_property(:start_time, xml_scan.at_xpath('./StartTime').text() )
+          scan_node.set_property(:finish_time, xml_scan.at_xpath('./FinishTime').text() )
+          scan_node.set_property(:scan_time, xml_scan.at_xpath('./ScanTime').text() )
+          scan_node.set_property(:aborted, xml_scan.at_xpath('./Aborted').text() )
+          scan_node.set_property(:responsive, xml_scan.at_xpath('./Responsive').text() )
+          scan_node.set_property(:banner, xml_scan.at_xpath('./Banner').text() )
+          scan_node.set_property(:os, xml_scan.at_xpath('./Os').text() )
+          scan_node.set_property(:web_server, xml_scan.at_xpath('./WebServer').text() )
+          scan_node.set_property(:technologies, xml_scan.at_xpath('./Technologies').text() )
+          scan_node.save
+        end
+
+        scan_note = mapping_service.apply_mapping(source: 'scan', data: xml_scan)
+        content_service.create_note text: scan_note, node: scan_node
+
+        xml_scan.xpath('./ReportItems/ReportItem').each do |xml_report_item|
+          process_report_item(xml_report_item)
+        end
+      end
+
+      def process_report_item(xml_report_item)
+        plugin_id = "%s/%s" % [
+                                xml_report_item.at_xpath('./ModuleName').text(),
+                                xml_report_item.at_xpath('./Name').text()
+                              ]
+        logger.info { "\t\t => Creating new issue (plugin_id: #{plugin_id})" }
+
+        issue_text = mapping_service.apply_mapping(source: 'report_item', data: xml_report_item)
+        issue = content_service.create_issue(text: issue_text, id: plugin_id)
+
+        logger.info { "\t\t => Creating new evidence" }
+        evidence_content = mapping_service.apply_mapping(source: 'evidence', data: xml_report_item)
+        content_service.create_evidence(issue: issue, node: scan_node, content: evidence_content)
+      end
+    end
+  end
+end

data/lib/dradis/plugins/acunetix.rb

@@ -5,9 +5,10 @@ module Dradis
   end
 end
 
+require 'dradis/plugins/acunetix/acunetix360/importer'
 require 'dradis/plugins/acunetix/engine'
 require 'dradis/plugins/acunetix/field_processor'
-require 'dradis/plugins/acunetix/importer'
 require 'dradis/plugins/acunetix/mapping'
+require 'dradis/plugins/acunetix/standard/importer'
 require 'dradis/plugins/acunetix/version'
 

data/lib/tasks/thorfile.rb

@@ -1,10 +1,27 @@
 class AcunetixTasks < Thor
   include Rails.application.config.dradis.thor_helper_module
-  
-  namespace "dradis:plugins:acunetix"
 
-  desc "upload FILE", "upload Acunetix XML results"
-  def upload(file_path)
+  namespace 'dradis:plugins:acunetix:upload'
+
+  desc 'standard FILE', 'upload Standard Acunetix XML results'
+  def standard(file_path)
+    detect_and_set_project_scope
+    importer = Dradis::Plugins::Acunetix::Standard::Importer.new(task_options)
+
+    process_upload(importer, file_path)
+  end
+
+  desc 'acunetix_360 FILE', 'upload Acunetix360 XML results'
+  def acunetix_360(file_path)
+    detect_and_set_project_scope
+    importer = Dradis::Plugins::Acunetix::Acunetix360::Importer.new(task_options)
+
+    process_upload(importer, file_path)
+  end
+
+  private
+
+  def process_upload(importer, file_path)
     require 'config/environment'
 
     unless File.exists?(file_path)
@@ -12,9 +29,6 @@ class AcunetixTasks < Thor
       exit -1
     end
 
-    detect_and_set_project_scope
-    importer = Dradis::Plugins::Acunetix::Importer.new(task_options)
     importer.import(file: file_path)
   end
-
 end

data/spec/acunetix/acunetix360/importer_spec.rb

@@ -0,0 +1,61 @@
+# To run, execute from Dradis main app folder:
+# bin/rspec [dradis-acunetix path]/spec/acunetix/acunetix360/importer_spec.rb
+require 'rails_helper'
+require 'ostruct'
+require File.expand_path('../../../../../dradis-plugins/spec/support/spec_macros.rb', __FILE__)
+
+include Dradis::Plugins::SpecMacros
+
+module Dradis::Plugins
+  describe Acunetix::Acunetix360::Importer do
+    before do
+      @fixtures_dir = File.expand_path('../../../fixtures/files/', __FILE__)
+    end
+
+    before(:each) do
+      stub_content_service
+
+      @importer = described_class.new(content_service: @content_service)
+    end
+
+    def run_import!
+      @importer.import(file: @fixtures_dir + '/acunetix360.xml')
+    end
+
+    it 'creates nodes as needed' do
+      expect(@content_service).to receive(:create_node).with(hash_including label: 'http://aspnet.testsparker.com/', type: :host).once
+
+      run_import!
+    end
+
+    it 'creates issues from vulnerability elements' do
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include("#[Title]#\nBlind SQL Injection")
+        expect(args[:id]).to eq('ConfirmedBlindSqlInjection')
+      end.once
+
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include("#[Title]#\nCross-site Scripting")
+        expect(args[:id]).to eq('Xss')
+      end.once
+
+      run_import!
+    end
+
+    it 'creates evidence from vulnerability elements' do
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include('POST /blog/%27))%20WAITFOR%20DELAY%20%270%3a0%3a25%27')
+        expect(args[:issue].id).to eq('ConfirmedBlindSqlInjection')
+        expect(args[:node].label).to eq('http://aspnet.testsparker.com/')
+      end.once
+
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include('GET /About.aspx HTTP/1.1')
+        expect(args[:issue].id).to eq('Xss')
+        expect(args[:node].label).to eq('http://aspnet.testsparker.com/')
+      end
+
+      run_import!
+    end
+  end
+end

data/spec/acunetix/standard/importer_spec.rb

@@ -0,0 +1,100 @@
+# To run, execute from Dradis main app folder:
+# bin/rspec [dradis-acunetix path]/spec/acunetix/standard/importer_spec.rb
+require 'rails_helper'
+require 'ostruct'
+require File.expand_path('../../../../../dradis-plugins/spec/support/spec_macros.rb', __FILE__)
+
+include Dradis::Plugins::SpecMacros
+
+module Dradis::Plugins
+  describe Acunetix::Standard::Importer do
+    before do
+      @fixtures_dir = File.expand_path('../../../fixtures/files/', __FILE__)
+    end
+
+    before(:each) do
+      stub_content_service
+
+      @importer = described_class.new(content_service: @content_service)
+    end
+
+    def run_import!
+      @importer.import(file: @fixtures_dir + '/simple.acunetix.xml')
+    end
+
+    it 'creates nodes as needed' do
+      expect(@content_service).to receive(:create_node).with(hash_including label: 'testphp.vulnweb.com', type: :host).once
+
+      run_import!
+    end
+
+    it 'creates notes as needed' do
+      expect(@content_service).to receive(:create_note) do |args|
+        expect(args[:text]).to include('Scan Thread 1')
+        expect(args[:node].label).to eq('testphp.vulnweb.com')
+      end.once
+
+      run_import!
+    end
+
+    it 'creates issues from report_item elements' do
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include('HTML form without CSRF protection')
+        expect(args[:id]).to eq('Crawler/HTML form without CSRF protection')
+      end.once
+
+      expect(@content_service).to receive(:create_issue) do |args|
+        expect(args[:text]).to include('Clickjacking: X-Frame-Options header missing')
+        expect(args[:id]).to eq('Scripting (Clickjacking_X_Frame_Options.script)/Clickjacking: X-Frame-Options header missing')
+      end.once
+
+      run_import!
+    end
+
+    it 'creates evidence from report_item elements' do
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include('Form name:')
+        expect(args[:issue].id).to eq('Crawler/HTML form without CSRF protection')
+        expect(args[:node].label).to eq('testphp.vulnweb.com')
+      end.once
+
+      expect(@content_service).to receive(:create_evidence) do |args|
+        expect(args[:content]).to include('Web Server')
+        expect(args[:issue].id).to eq('Scripting (Clickjacking_X_Frame_Options.script)/Clickjacking: X-Frame-Options header missing')
+        expect(args[:node].label).to eq('testphp.vulnweb.com')
+      end
+
+      run_import!
+    end
+
+    describe 'Regression tests' do
+      # Regression test for github.com/dradis/dradis-nexpose/issues/1
+      describe 'Source HTML parsing' do
+        it 'identifies code/pre blocks and replaces them with the Textile equivalent' do
+
+          expect(@content_service).to receive(:create_issue) do |args|
+            expect(args[:text]).to include('SQL injection (verified)')
+            expect(args[:text]).not_to include('<code>')
+            expect(args[:text]).not_to include('<pre')
+            expect(args[:id]).to eq('Scripting (Sql_Injection.script)/SQL injection (verified)')
+          end.once
+
+          @importer.import(file: @fixtures_dir + '/code-pre.acunetix.xml')
+        end
+      end
+
+      # Regression test to make sure that commas are replaced with decimals in the CVSSv3 scores
+      describe 'CVSS clean up decimals' do
+        it 'identifies commas used as decimals in CVSSv3 scores and replaces them with periods' do
+
+          expect(@content_service).to receive(:create_issue) do |args|
+            expect(args[:text]).to include('5.3')
+          end
+
+          @importer.import(file: @fixtures_dir + '/commas-format.acunetix.xml')
+        end
+      end
+
+    end
+  end
+end

data/spec/fixtures/files/acunetix360.xml

@@ -0,0 +1,280 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<acunetix-360 generated="16/06/2020 10:42 AM">
+	<target>
+		<scan-id>1234</scan-id>
+		<url>http://aspnet.testsparker.com/</url>
+		<initiated>16/06/2020 09:47 AM</initiated>
+		<duration>00:51:11.4005587</duration>
+	</target>
+	<vulnerabilities>
+		<vulnerability>
+      <LookupId>a000a00a-0000-000a-000-abcd00a0000a</LookupId>
+      <url>
+        http://aspnet.testsparker.com/blog/
+      </url>
+      <type>ConfirmedBlindSqlInjection</type>
+      <name>Blind SQL Injection</name>
+      <severity>Critical</severity>
+      <certainty>100</certainty>
+      <confirmed>True</confirmed>
+      <state>Present</state>
+      <FirstSeenDate>6/16/2020 1:41:23 PM +00:00</FirstSeenDate>
+      <LastSeenDate>6/16/2020 1:41:23 PM +00:00</LastSeenDate>
+      <classification>
+        <owasp>A1</owasp>
+        <wasc>19</wasc>
+        <cwe>89</cwe>
+        <capec>66</capec>
+        <pci32>6.5.1</pci32>
+        <hipaa>164.306(a), 164.308(a)</hipaa>
+        <owasppc></owasppc>
+        <iso27001>A.14.2.5</iso27001>
+          <cvss>
+            <vector>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N</vector>
+            <score>
+              <type>Base</type>
+              <value>8.6</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Temporal</type>
+              <value>8.6</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Environmental</type>
+              <value>8.6</value>
+              <severity>High</severity>
+            </score>
+          </cvss>
+          <cvss31>
+            <vector>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N</vector>
+            <score>
+              <type>Base</type>
+              <value>8.6</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Temporal</type>
+              <value>8.6</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Environmental</type>
+              <value>8.6</value>
+              <severity>High</severity>
+            </score>
+          </cvss31>
+      </classification>
+      <http-request>
+        <method>POST</method>
+          <parameters>
+            <parameter name="__VIEWSTATE" type="Post" value="/wEPDwUJLTIzMTExOTgyZGSsxJXO6Juz0H9WnmLaZ/ANH9shOpBmzSi1EHH6egImZA==" />
+            <parameter name="__VIEWSTATEGENERATOR" type="Post" value="5C9CE5AE" />
+            <parameter name="param1" type="UrlRewrite" value="&amp;apos;))&amp;#32;WAITFOR&amp;#32;DELAY&amp;#32;&amp;apos;0:0:25&amp;apos;--" vulnerable="vulnerable" />
+          </parameters>
+        <content>
+          <![CDATA[POST /blog/%27))%20WAITFOR%20DELAY%20%270%3a0%3a25%27--/HTTP1.1
+          Host: aspnet.testsparker.com
+          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+          Accept-Encoding: gzip, deflate
+          Accept-Language: en-us,en;q=0.5
+          Cache-Control: no-cache
+          Content-Length: 118
+          Content-Type: application/x-www-form-urlencoded
+          Cookie: ASP.NET_SessionId=44lomqqluxhcl2e4yxvrmxsq; TestCookie=Hello
+          Referer: http://aspnet.testsparker.com/blog/is-bitcoin-anonymous-95/
+          User-Agent: Chrome/70.0.3538.77
+          X-Scanner: Acunetix 360]]>
+        </content>
+      </http-request>
+        <http-response>
+          <status-code>404</status-code>
+          <duration>25053.3534</duration>
+          <content>
+            <![CDATA[HTTP/1.1 404 Not Found
+            Server: Microsoft-IIS/8.5
+            X-Powered-By: ASP.NET
+            X-AspNet-Version: 4.0.30319
+            Content-Length: 3084
+            Content-Type: text/html; charset=utf-8
+            Date: Tue, 16 Jun 2020 13:23:36 GMT
+            Cache-Control: private
+            <!DOCTYPE html>
+            <html xmlns="http://www.w3.org/1999/xhtml">
+            <head><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta charset="utf-8" /><title>
+              Bitcoin Web Site
+              </title><meta name="generator" content="Bootply" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /><link href="//maxcdn.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css" rel="stylesheet" /><link href="/statics/style.css" rel="stylesheet" />
+            </head>
+            <body>
+              <div id="resetbar">
+                This website is automatically reset at every midnight (00:00 - UTC).
+              </div>
+            </body>
+            </html>
+            ]]>
+          </content>
+        </http-response>
+      <description>
+        <![CDATA[<p>Acunetix 360 identified a Blind SQL Injection</p>]]>
+      </description>
+          <impact>
+            <![CDATA[<div>Depending on the backend database, the database connection settings, and the operating system, an attacker can mount one or more of the following attacks successfully:
+            <ul>
+            <li>Reading, updating and deleting arbitrary data or tables from the database</li>
+            <li>Executing commands on the underlying operating system</li>
+            </ul>
+            </div>]]>
+          </impact>
+          <remedial-actions>
+            <![CDATA[<div>
+            <ol>
+              <li>See the remedy for solution.</li>
+            </ol>
+            </div>]]>
+          </remedial-actions>
+          <exploitation-skills>
+            <![CDATA[<div>There are numerous freely available tools to exploit SQL injection vulnerabilities.</div>]]>
+          </exploitation-skills>
+          <remedial-procedure>
+            <![CDATA[<div>A robust method for mitigating the threat of SQL injection-based vulnerabilities is to use parameterized queries (<em>prepared statements</em>). Almost all modern languages provide built-in libraries for this. Wherever possible, do not create dynamic SQL queries or SQL queries with string concatenation.</div>]]>
+          </remedial-procedure>
+          <remedy-references>
+            <![CDATA[<div><ul><li><a target='_blank' href='https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet'><i class='icon-external-link'></i>SQL injection Prevention Cheat Sheet</a></li><li><a target='_blank' href='http://bobby-tables.com'><i class='icon-external-link'></i>A guide to preventing SQL injection</a></li></ul></div>]]>
+          </remedy-references>
+          <external-references>
+            <![CDATA[<div><ul><li><a target='_blank' href='https://www.owasp.org/index.php/Blind_SQL_Injection'><i class='icon-external-link'></i>Blind SQL Injection</a></li><li><a target='_blank' href='https://www.acunetix.com/blog/web-security/sql-injection-cheat-sheet/#BlindSQLInjections'><i class='icon-external-link'></i>SQL Injection Cheat Sheet[#Blind]</a></li></ul></div>]]>
+          </external-references>
+          <proof-of-concept></proof-of-concept>
+		</vulnerability>
+    <vulnerability>
+      <LookupId>a11a1a-11-11a-11-abcd1a111a</LookupId>
+      <url>http://aspnet.testsparker.com/About.aspx</url>
+      <type>Xss</type>
+      <name>Cross-site Scripting</name>
+      <severity>High</severity>
+      <certainty>100</certainty>
+      <confirmed>True</confirmed>
+      <state>Present</state>
+      <classification>
+        <owasp>A3</owasp>
+        <wasc>8</wasc>
+        <cwe>79</cwe>
+        <capec>19</capec>
+        <pci32>6.5.7</pci32>
+        <hipaa>164.308(a)</hipaa>
+        <owasppc></owasppc>
+        <iso27001>A.14.2.5</iso27001>
+          <cvss>
+            <vector>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N</vector>
+            <score>
+              <type>Base</type>
+              <value>7.4</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Temporal</type>
+              <value>7.4</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Environmental</type>
+              <value>7.4</value>
+              <severity>High</severity>
+            </score>
+          </cvss>
+          <cvss31>
+            <vector>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N</vector>
+            <score>
+              <type>Base</type>
+              <value>7.4</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Temporal</type>
+              <value>7.4</value>
+              <severity>High</severity>
+            </score>
+            <score>
+              <type>Environmental</type>
+              <value>7.4</value>
+              <severity>High</severity>
+            </score>
+          </cvss31>
+      </classification>
+        <http-request>
+          <method>GET</method>
+            <parameters>
+                <parameter name="hello" type="Querystring" value="&amp;lt;scRipt&amp;gt;netsparker(0x0234AA)&amp;lt;/scRipt&amp;gt;" vulnerable="vulnerable" />
+            </parameters>
+              <content>
+                <![CDATA[GET /About.aspx HTTP/1.1
+                Host: aspnet.testsparker.com
+                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
+                Accept-Encoding: gzip, deflate
+                Accept-Language: en-us,en;q=0.5
+                Cache-Control: no-cache
+                Cookie: ASP.NET_SessionId=aaaa; TestCookie=Hello
+                Referer: http://aspnet.testsparker.com/Guestbook.aspx
+                User-Agent: Chrome/70.0.3538.77
+                X-Scanner: Acunetix 360]]>
+              </content>
+                </http-request>
+                  <http-response>
+                    <status-code>200</status-code>
+                    <duration>160.6656</duration>
+                    <content>
+                      <![CDATA[HTTP/1.1 200 OK
+                        Server: Microsoft-IIS/8.5
+                        X-Powered-By: ASP.NET
+                        Vary: Accept-Encoding
+                        X-AspNet-Version: 4.0.30319
+                        Content-Length: 3267
+                        Content-Type: text/html; charset=utf-8
+                        Content-Encoding: 
+                        Date: Tue, 16 Jun 2020 12:54:25 GMT
+                        Cache-Control: private
+                        <!DOCTYPE html>
+
+                        <html xmlns="http://www.w3.org/1999/xhtml">
+                        <head><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta charset="utf-8" /><title>
+                          Bitcoin Web Site
+                        </title><meta name="generator" content="Bootply" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /><link href="//maxcdn.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css" rel="stylesheet" /><link href="/statics/style.css" rel="stylesheet" />
+                            <!--[if lt IE 9]>
+                                <script src="//html5shim.googlecode.com/svn/trunk/html5.js"></script>
+                            <![endif]-->
+                        </head>
+                        <body>
+                          <div id="resetbar">This website is automatically reset at every midnight (00:00 - UTC).</div>
+                        </body>
+                        </html>]]>
+                    </content>
+                  </http-response>
+      <description>
+        <![CDATA[<p>Acunetix 360 detected Cross-site Scripting, which allows an attacker to execute a dynamic script (<em>JavaScript, VBScript</em>) in the context of the application.</p>]]>
+      </description>
+        <impact>
+          <![CDATA[<div>There are many different attacks that can be leveraged through the use of cross-site scripting, including:
+            <ul>
+            <li>Hijacking user's active session.</li>
+            <li>Mounting phishing attacks.</li>
+            <li>Intercepting data and performing man-in-the-middle attacks.</li>
+            </ul>
+            </div>]]>
+        </impact>
+        <remedial-actions></remedial-actions>
+        <exploitation-skills></exploitation-skills>
+        <remedial-procedure>
+          <![CDATA[<div><p><span style="font-weight: 400;">The issue occurs because the browser interprets the input as active HTML, JavaScript or VBScript. To avoid this, output should be encoded according to the output location and context.</span></p></div>]]>
+        </remedial-procedure>
+        <remedy-references>
+          <![CDATA[<div><ul><li><a target='_blank' href='https://www.microsoft.com/en-us/download/details.aspx?id=28589'><i class='icon-external-link'></i>Microsoft Anti-XSS Library</a></li><li><a target='_blank' href='https://www.acunetix.com/blog/web-security/negative-impact-incorrect-csp-implementations/'><i class='icon-external-link'></i>Negative Impact of Incorrect CSP Implementations</a></li></ul></div>]]>
+        </remedy-references>
+        <external-references>
+          <![CDATA[<div><ul><li><a target='_blank' href='https://www.owasp.org/index.php/Cross_site_scripting'><i class='icon-external-link'></i>OWASP - Cross-site Scripting</a></li><li><a target='_blank' href='https://www.acunetix.com/blog/web-security/cross-site-scripting-xss/'><i class='icon-external-link'></i>Cross-site Scripting Web Application Vulnerability</a></li></ul></div>]]>
+        </external-references>
+        <proof-of-concept></proof-of-concept>
+			</vulnerability>
+    </vulnerability>
+  </vulnerabilities>
+</acunetix-360>

data/spec/models/acunetix/scan_spec.rb

@@ -19,7 +19,7 @@ describe Acunetix::Scan do
 
   describe "creating a Scan object with the wrong XML element" do
     it "raises an error" do
-      expect{ described_class.new(@xml) }.to raise_error
+      expect{ described_class.new(@xml) }.to raise_error(RuntimeError, /Invalid XML/)
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-acunetix
 version: !ruby/object:Gem::Version
-  version: 4.12.0
+  version: 4.14.0
 platform: ruby
 authors:
 - Daniel Martin
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-05-07 00:00:00.000000000 Z
+date: 2024-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '2'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -96,7 +96,7 @@ dependencies:
         version: 0.5.2
 description: This add-on allows you to upload and parse output produced from Acunetix
   Web Vulnerability Scanner into Dradis.
-email: 
+email:
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -119,16 +119,17 @@ files:
 - lib/acunetix/vulnerability.rb
 - lib/dradis-acunetix.rb
 - lib/dradis/plugins/acunetix.rb
+- lib/dradis/plugins/acunetix/acunetix360/importer.rb
 - lib/dradis/plugins/acunetix/engine.rb
 - lib/dradis/plugins/acunetix/field_processor.rb
-- lib/dradis/plugins/acunetix/formats/acunetix360.rb
-- lib/dradis/plugins/acunetix/formats/standard.rb
 - lib/dradis/plugins/acunetix/gem_version.rb
-- lib/dradis/plugins/acunetix/importer.rb
 - lib/dradis/plugins/acunetix/mapping.rb
+- lib/dradis/plugins/acunetix/standard/importer.rb
 - lib/dradis/plugins/acunetix/version.rb
 - lib/tasks/thorfile.rb
-- spec/dradis-acunetix_spec.rb
+- spec/acunetix/acunetix360/importer_spec.rb
+- spec/acunetix/standard/importer_spec.rb
+- spec/fixtures/files/acunetix360.xml
 - spec/fixtures/files/code-pre.acunetix.xml
 - spec/fixtures/files/commas-format.acunetix.xml
 - spec/fixtures/files/simple.acunetix.xml
@@ -144,7 +145,7 @@ homepage: https://dradis.com/integrations/acunetix.html
 licenses:
 - GPL-2
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -159,12 +160,14 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.5.6
+signing_key:
 specification_version: 4
 summary: Acunetix add-on for the Dradis Framework.
 test_files:
-- spec/dradis-acunetix_spec.rb
+- spec/acunetix/acunetix360/importer_spec.rb
+- spec/acunetix/standard/importer_spec.rb
+- spec/fixtures/files/acunetix360.xml
 - spec/fixtures/files/code-pre.acunetix.xml
 - spec/fixtures/files/commas-format.acunetix.xml
 - spec/fixtures/files/simple.acunetix.xml

data/lib/dradis/plugins/acunetix/formats/acunetix360.rb

@@ -1,51 +0,0 @@
-module Dradis::Plugins::Acunetix::Formats
-  module Acunetix360
-
-    private
-
-    def process_acunetix360
-      process_target_node
-      process_acunetix360_vulnerabilities
-    end
-
-    def process_target_node
-      target_xml = xml.at_xpath('//acunetix-360/target')
-      @scan_node = content_service.create_node(
-        label: target_xml.at_xpath('url').text,
-        type: :host
-      )
-
-      logger.info { "Creating target node: #{scan_node.label}" }
-
-      if scan_node.respond_to?(:properties)
-        scan_node.set_property(:scan_id, target_xml.at_xpath('scan-id').text)
-        scan_node.set_property(:initiated, target_xml.at_xpath('initiated').text)
-        scan_node.set_property(:duration, target_xml.at_xpath('duration').text)
-      end
-    end
-
-    def process_acunetix360_vulnerabilities
-      logger.info { 'Creating issues from Acunetix360 vulnerabilities.' }
-
-      xml.xpath('//acunetix-360/vulnerabilities/vulnerability').each do |vuln_xml|
-        issue_text = mapping_service.apply_mapping(
-          source: 'vulnerability_360',
-          data: vuln_xml
-        )
-
-        type = vuln_xml.at_xpath('type').text
-
-        logger.info { "\t\t => Creating new issue: #{type}" }
-        issue = content_service.create_issue(text: issue_text, id: type)
-
-        evidence_text = mapping_service.apply_mapping(
-          source: 'evidence_360',
-          data: vuln_xml
-        )
-
-        logger.info { "\t\t => Creating new evidence" }
-        content_service.create_evidence(issue: issue, node: scan_node, content: evidence_text)
-      end
-    end
-  end
-end

data/lib/dradis/plugins/acunetix/formats/standard.rb

@@ -1,58 +0,0 @@
-module Dradis::Plugins::Acunetix::Formats
-  module Standard
-
-    private
-
-    def process_standard
-      xml.xpath('/ScanGroup/Scan').each do |xml_scan|
-        process_scan(xml_scan)
-      end
-    end
-
-    def process_scan(xml_scan)
-      url = xml_scan.at_xpath('./StartURL').text()
-      start_url = URI::parse(url).host || url # urls wo/ protocol returned nil
-
-      self.scan_node = content_service.create_node(label: start_url, type: :host)
-      logger.info{ "\tScan start URL: #{start_url}" }
-
-      # Define Node properties
-      if scan_node.respond_to?(:properties)
-        scan_node.set_property(:short_name, xml_scan.at_xpath('./ShortName').text() )
-        scan_node.set_property(:start_url, start_url)
-        scan_node.set_property(:start_time, xml_scan.at_xpath('./StartTime').text() )
-        scan_node.set_property(:finish_time, xml_scan.at_xpath('./FinishTime').text() )
-        scan_node.set_property(:scan_time, xml_scan.at_xpath('./ScanTime').text() )
-        scan_node.set_property(:aborted, xml_scan.at_xpath('./Aborted').text() )
-        scan_node.set_property(:responsive, xml_scan.at_xpath('./Responsive').text() )
-        scan_node.set_property(:banner, xml_scan.at_xpath('./Banner').text() )
-        scan_node.set_property(:os, xml_scan.at_xpath('./Os').text() )
-        scan_node.set_property(:web_server, xml_scan.at_xpath('./WebServer').text() )
-        scan_node.set_property(:technologies, xml_scan.at_xpath('./Technologies').text() )
-        scan_node.save
-      end
-
-      scan_note = mapping_service.apply_mapping(source: 'scan', data: xml_scan)
-      content_service.create_note text: scan_note, node: scan_node
-
-      xml_scan.xpath('./ReportItems/ReportItem').each do |xml_report_item|
-        process_report_item(xml_report_item)
-      end
-    end
-
-    def process_report_item(xml_report_item)
-      plugin_id = "%s/%s" % [
-                              xml_report_item.at_xpath('./ModuleName').text(),
-                              xml_report_item.at_xpath('./Name').text()
-                            ]
-      logger.info { "\t\t => Creating new issue (plugin_id: #{plugin_id})" }
-
-      issue_text = mapping_service.apply_mapping(source: 'report_item', data: xml_report_item)
-      issue = content_service.create_issue(text: issue_text, id: plugin_id)
-
-      logger.info { "\t\t => Creating new evidence" }
-      evidence_content = mapping_service.apply_mapping(source: 'evidence', data: xml_report_item)
-      content_service.create_evidence(issue: issue, node: scan_node, content: evidence_content)
-    end
-  end
-end

data/lib/dradis/plugins/acunetix/importer.rb

@@ -1,43 +0,0 @@
-require 'dradis/plugins/acunetix/formats/standard'
-require 'dradis/plugins/acunetix/formats/acunetix360'
-
-module Dradis::Plugins::Acunetix
-  class Importer < Dradis::Plugins::Upload::Importer
-    include Dradis::Plugins::Acunetix::Formats::Standard
-    include Dradis::Plugins::Acunetix::Formats::Acunetix360
-
-    attr_accessor :scan_node, :xml
-
-    def self.templates
-      { evidence: 'evidence', issue: 'report_item' }
-    end
-
-    # The framework will call this function if the user selects this plugin from
-    # the dropdown list and uploads a file.
-    # @returns true if the operation was successful, false otherwise
-    def import(params={})
-      file_content    = File.read( params.fetch(:file) )
-
-      logger.info{'Parsing Acunetix output file...'}
-      @xml = Nokogiri::XML( file_content )
-      logger.info{'Done.'}
-
-      if xml.xpath('/ScanGroup/Scan').present?
-        logger.info { 'Standard Acunetix import detected.' }
-        process_standard
-
-        return true
-      elsif xml.xpath('//acunetix-360').present?
-        logger.info { 'Acunetix360 import detected.' }
-        process_acunetix360
-
-        return true
-      else
-        error = "No scan results were detected in the uploaded file (/ScanGroup/Scan). Ensure you uploaded an Acunetix XML report."
-        logger.fatal{ error }
-        content_service.create_note text: error
-        return false
-      end
-    end # /import
-  end
-end

data/spec/dradis-acunetix_spec.rb

@@ -1,109 +0,0 @@
-require 'spec_helper'
-require 'ostruct'
-
-module Dradis::Plugins
-  describe 'Acunetix upload plugin' do
-    before(:each) do
-      # Stub template service
-      templates_dir = File.expand_path('../../templates', __FILE__)
-      allow_any_instance_of(TemplateService).to \
-        receive(:default_templates_dir).and_return(templates_dir)
-
-      @content_service = ContentService.new(plugin: Acunetix)
-      template_service = TemplateService.new(plugin: Acunetix)
-
-      @importer = Acunetix::Importer.new(
-        content_service: @content_service,
-        template_service: template_service
-      )
-
-      # Stub dradis-plugins methods
-      #
-      # They return their argument hashes as objects mimicking
-      # Nodes, Issues, etc
-      allow(@content_service).to receive(:create_node) do |args|
-        OpenStruct.new(args)
-      end
-      allow(@content_service).to receive(:create_note) do |args|
-        OpenStruct.new(args)
-      end
-      allow(@content_service).to receive(:create_issue) do |args|
-        OpenStruct.new(args)
-      end
-      allow(@content_service).to receive(:create_evidence) do |args|
-        OpenStruct.new(args)
-      end
-    end
-
-    it "creates nodes, issues, notes and an evidences as needed" do
-
-      expect(@content_service).to receive(:create_node).with(hash_including label: "testphp.vulnweb.com", type: :host).once
-      expect(@content_service).to receive(:create_note) do |args|
-        expect(args[:text]).to include("#[Title]#\nAcunetix scanner notes (7/10/2014, 11:56:03)")
-        expect(args[:node].label).to eq("testphp.vulnweb.com")
-      end.once
-
-      expect(@content_service).to receive(:create_issue) do |args|
-        expect(args[:text]).to include("#[Title]#\nHTML form without CSRF protection")
-        expect(args[:id]).to eq("Crawler/HTML form without CSRF protection")
-        OpenStruct.new(args)
-      end.once
-
-      expect(@content_service).to receive(:create_issue) do |args|
-        expect(args[:text]).to include("#[Title]#\nClickjacking: X-Frame-Options header missing")
-        expect(args[:id]).to eq("Scripting (Clickjacking_X_Frame_Options.script)/Clickjacking: X-Frame-Options header missing")
-        OpenStruct.new(args)
-      end.once
-
-      expect(@content_service).to receive(:create_evidence) do |args|
-        expect(args[:content]).to include("/")
-        expect(args[:issue].id).to eq("Crawler/HTML form without CSRF protection")
-        expect(args[:node].label).to eq("testphp.vulnweb.com")
-      end.once
-
-      expect(@content_service).to receive(:create_evidence) do |args|
-        expect(args[:content]).to include("Web Server")
-        expect(args[:issue].id).to eq("Scripting (Clickjacking_X_Frame_Options.script)/Clickjacking: X-Frame-Options header missing")
-        expect(args[:node].label).to eq("testphp.vulnweb.com")
-      end.once
-
-      @importer.import(file: 'spec/fixtures/files/simple.acunetix.xml')
-    end
-
-    # Regression test for github.com/dradis/dradis-nexpose/issues/1
-    describe "Source HTML parsing" do
-      it "identifies code/pre blocks and replaces them with the Textile equivalent" do
-
-        expect(@content_service).to receive(:create_issue) do |args|
-          expect(args[:text]).to     include("#[Title]#\nSQL injection (verified)")
-          expect(args[:text]).not_to include("<code>")
-          expect(args[:text]).not_to include("<pre")
-          expect(args[:id]).to        eq("Scripting (Sql_Injection.script)/SQL injection (verified)")
-          OpenStruct.new(args)
-        end.once
-
-        # expect(@content_service).to receive(:create_evidence) do |args|
-        #   expect(args[:content]).to include("Web Server")
-        #   expect(args[:issue].id).to eq("Scripting (Clickjacking_X_Frame_Options.script)")
-        #   expect(args[:node].label).to eq("testphp.vulnweb.com")
-        # end.once
-
-        @importer.import(file: 'spec/fixtures/files/code-pre.acunetix.xml')
-      end
-    end
-
-    # Regression test to make sure that commas are replaced with decimals in the CVSSv3 scores
-    describe "CVSS clean up decimals" do
-      it "identifies commas used as decimals in CVSSv3 scores and replaces them with periods" do
-
-        expect(@content_service).to receive(:create_issue) do |args|
-          expect(args[:text]).to include("#[CVSS3Score]#\n5.3")
-          OpenStruct.new(args)
-        end
-        
-        @importer.import(file: 'spec/fixtures/files/commas-format.acunetix.xml')
-      end
-    end
-
-  end
-end