dradis-burp 3.12.0 → 3.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 4b47e6172ec23713350dd1f19ac3881833a7b8c6
-  data.tar.gz: 8823c7a403ed67a43e92f0a2fcff544ec059ebfc
+SHA256:
+  metadata.gz: d11d73abaa8f4ff6693de7df049a1e0ec6301ecb91f535728b683c9e493fbf08
+  data.tar.gz: 790c924c63008c2afefacc270c8afe174254dbd353b8b9881e054025ec676b1e
 SHA512:
-  metadata.gz: 2b383351569604421cbbda13575bf89b8b005955cc23ca4335529aff8dc917a78212b5f3bb8b15c18f5cb8d546ee5556f339e77f8ec3cbd3137101ab8570afbd
-  data.tar.gz: e366429358af292c92675d8bda229e6e8ce1592bd8f37219d2e48eee359ba5ddd701f6ff4a55f4677c9de08f2093d7e6d60db8c6751a1c21949b52233159129c
+  metadata.gz: 19c4ee6c62c14272432688d87142a037db20f59d346835387c406d4d1036293fce093d81337a63f5ba8a0565117ace9d70c48a3b43d120d3ce919a125226fb7c
+  data.tar.gz: f05a95f9515215245f1a0674bed64748b3e85684ee79dbdf4ebc5bfba21ec075d1d519181554fcc4d23b4eac10a53a006aa6e8a1e8b962e6a4e4cb57d9b2a15e

data/.github/issue_template.md

@@ -0,0 +1,16 @@
+### Steps to reproduce
+
+Help us help you, how can we reproduce the problem?
+
+### Expected behavior
+Tell us what should happen
+
+### Actual behavior
+Tell us what happens instead
+
+### System configuration
+**Dradis version**:
+
+**Ruby version**:
+
+**OS version**:

data/.github/pull_request_template.md

@@ -0,0 +1,36 @@
+### Summary
+
+Provide a general description of the code changes in your pull
+request... were there any bugs you had fixed? If so, mention them. If
+these bugs have open GitHub issues, be sure to tag them here as well,
+to keep the conversation linked together.
+
+
+### Other Information
+
+If there's anything else that's important and relevant to your pull
+request, mention that information here. This could include
+benchmarks, or other information.
+
+Thanks for contributing to Dradis!
+
+
+### Copyright assignment
+
+Collaboration is difficult with commercial closed source but we want
+to keep as much of the OSS ethos as possible available to users
+who want to fix it themselves.
+
+In order to unambiguously own and sell Dradis Framework commercial
+products, we must have the copyright associated with the entire
+codebase. Any code you create which is merged must be owned by us.
+That's not us trying to be a jerks, that's just the way it works.
+
+Please review the [CONTRIBUTING.md](https://github.com/dradis/dradis-ce/blob/master/CONTRIBUTING.md)
+file for the details.
+
+You can delete this section, but the following sentence needs to
+remain in the PR's description:
+
+> I assign all rights, including copyright, to any future Dradis
+> work by myself to Security Roots.

data/CHANGELOG.md

@@ -1,6 +1,26 @@
-## Dradis Framework 3.12 (XXXX, 2019) ##
+## Dradis Framework 3.17 (May, 2020) ##
 
-*   Make `issue.detail` available at the Evidence level
+*   No changes.
+
+## Dradis Framework 3.16 (February, 2020) ##
+
+*   Update severity fixture for specs.
+
+## Dradis Framework 3.15 (November, 2019) ##
+
+*   Make `issue.severity` available at the Issue level.
+
+## Dradis Framework 3.14 (August, 2019) ##
+
+*   No changes.
+
+## Dradis Framework 3.13 (June, 2019) ##
+
+*   Include parsing Burp Html output.
+
+## Dradis Framework 3.12 (March, 2019) ##
+
+*   Make `issue.detail` available at the Evidence level.
 
 ## Dradis Framework 3.11 (November, 2018) ##
 
@@ -8,17 +28,17 @@
 
 ## Dradis Framework 3.10 (August, 2018) ##
 
-*   Adds `references` and `vulnerability_classifications` as available fields
+*   Adds `references` and `vulnerability_classifications` as available fields.
 
-*   Adds `hostname` as a Node property
+*   Adds `hostname` as a Node property.
 
-*   Fixes formatting errors including `<p>`, `<a href="">`, and `<table>` tags
+*   Fixes formatting errors including `<p>`, `<a href="">`, and `<table>` tags.
 
-*   Findings with <type>134217728</type> are not bundled together into one Issue
+*   Findings with <type>134217728</type> are not bundled together into one Issue.
 
 ## Dradis Framework 3.9 (January, 2018) ##
 
-*   Encode content with UTF-8 to avoid incompatible db errors (v3.8.1)
+*   Encode content with UTF-8 to avoid incompatible db errors (v3.8.1).
 
 ## Dradis Framework 3.8 (September, 2017) ##
 

data/dradis-burp.gemspec

@@ -27,7 +27,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'dradis-plugins', '~> 3.6'
   spec.add_dependency 'nokogiri', '~> 1.3'
 
-  spec.add_development_dependency 'bundler', '~> 1.6'
+  spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'rspec-rails'
   spec.add_development_dependency 'combustion', '~> 0.5.2'

data/lib/burp/html/issue.rb

@@ -0,0 +1,157 @@
+module Burp
+  module Html
+  # This class represents each of the issue elements in the Burp
+  # Scanner HTML document: all elemennts from a span.BODH0 until the next
+  # span.BODH0 (the next one excluded).
+  #
+  # It provides a convenient way to access the information scattered all over
+  # the HTML.
+  class Issue < ::Burp::Issue
+    # Accepts a Nokogiri::XML::NodeSet
+    def initialize(html)
+      @html = Nokogiri::HTML(html.to_s)
+    end
+
+    # List of supported tags
+    def supported_tags
+      [
+        # tags with contents retrieved from inside the span header
+        :name, :type,
+
+        # tags with contents retrieved following the span header
+        :background, :detail,
+        :references, :remediation_background, :remediation_detail,
+        :request, :request_1, :request_2, :request_3,
+        :response, :response_1, :response_2, :response_3,
+        :vulnerability_classifications
+      ] + summary_table_tags
+    end
+
+    def header
+      @header ||= @html.at_css('span')
+    end
+
+    def name
+      @name ||= header.text.gsub(/^\d+\.\S/, '')
+    end
+
+    # Link looks like: https://portswigger.net/kb/issues/00200400_flash-cross-domain-policy
+    # We use that 00200400 as type since in that page it calls it 'Type index'
+    def type
+      @type ||=
+        if header_link = header.at_css('a')
+          header_link.attr('href').to_s[/\/([0-9a-f]+)_.*/, 1].to_i(16)
+        else
+          nil
+        end
+    end
+
+    # This method is invoked by Ruby when a method that is not defined in this
+    # instance is called.
+    #
+    # In our case we inspect the @method@ parameter and try to find the
+    # corresponding header in our HTML, then return the following text.
+    def method_missing(method, *args)
+      # We could remove this check and return nil for any non-recognized tag.
+      # The problem would be that it would make tricky to debug problems with
+      # typos. For instance: <>.potr would return nil instead of raising an
+      # exception
+      unless supported_tags.include?(method)
+        super
+        return
+      end
+
+      # First we try the h2 headers.
+      translations_table = {
+        background: ['Issue background', 'Issue description'],
+        detail: 'Issue detail',
+        references: 'References',
+        remediation_background: ['Remediation background', 'Issue remediation'],
+        remediation_detail: 'Remediation detail',
+        request: 'Request',
+        request_1: 'Request 1',
+        request_2: 'Request 2',
+        request_3: 'Request 3',
+        response: 'Response',
+        response_1: 'Response 1',
+        response_2: 'Response 2',
+        response_3: 'Response 3',
+        serial_number: 'Serial number',
+        vulnerability_classifications: 'Vulnerability classifications'
+      }
+
+      # look for the h2 headers in the html fragment
+      method_names = translations_table.fetch(method, method.to_s)
+      method_names = [method_names].flatten
+
+      h2 = nil
+      method_names.each do |method_name|
+        h2 = @html.xpath("//h2[text()='#{method_name}']").first
+        break if h2
+      end
+
+      if h2
+        content =
+          if h2.text =~ /^(Request|Response)/
+            cleanup_request_response_html(h2.next_element.inner_html)
+          else
+            cleanup_html(h2.next_element.inner_html)
+          end
+
+        return content
+      end
+
+      # look inside the summary table in the html fragment
+      summary[method]
+    end
+
+    private
+
+    # In Request/Response html snippets we don't want to cleanup the whole
+    # html as we ususally do. The snippets may contain html code to be displayed,
+    # and we don't want to convert that to textile.
+    def cleanup_request_response_html(source)
+      result = source.dup
+
+      result.gsub!(/<b>(.*?)<\/b>/, '\1')
+      result.gsub!(/<br>|<\/br>/){"\n"}
+      result.gsub!(/<span.*?>/, '')
+      result.gsub!(/<\/span>/, '')
+
+      result.gsub!(/&quot;/, '"')
+      result.gsub!(/&amp;/, '&')
+      result.gsub!(/&lt;/, '<')
+      result.gsub!(/&gt;/, '>')
+      result.gsub!(/&nbsp;/, ' ')
+
+      result
+    end
+
+    # Returns the summary table in the HTML fragment as a Hash
+    def summary
+      @summary ||= begin
+        @summary = {}
+        h2 = @html.search("h2[text()='Summary']").first
+        return @summary if h2.nil?
+
+        table = h2.next_element
+
+        summary_table_tags.each do |tag|
+          td = table.search("td:starts-with('#{tag.to_s.capitalize}:')").first
+          @summary[tag] = td.next_element.text
+        end
+
+        @summary
+      end
+    end
+
+    # List of supported tags to obtain from the summary html table
+    def summary_table_tags
+      [
+        :confidence, :host, :path, :severity
+      ]
+    end
+
+  end
+  end
+end

data/lib/burp/issue.rb

@@ -2,37 +2,8 @@ module Burp
   # We use this string to replace invalid UTF-8 bytes with.
   INVALID_UTF_REPLACE = '<?>'
 
-  # This class represents each of the /issues/issue elements in the Burp
-  # Scanner XML document.
-  #
-  # It provides a convenient way to access the information scattered all over
-  # the XML in attributes and nested tags.
-  #
-  # Instead of providing separate methods for each supported property we rely
-  # on Ruby's #method_missing to do most of the work.
   class Issue
 
-    # Accepts an XML node from Nokogiri::XML.
-    def initialize(xml_node)
-      @xml = xml_node
-    end
-
-    # List of supported tags. They can be attributes, simple descendants or
-    # collections (e.g. <references/>, <tags/>)
-    def supported_tags
-      [
-        # attributes
-
-        # simple tags
-        :serial_number, :type, :name, :host, :path, :location, :severity,
-        :confidence, :background, :remediation_background, :detail,
-        :remediation_detail, :references, :vulnerability_classifications,
-
-        # nested tags
-        :request, :response
-      ]
-    end
-
     # This allows external callers (and specs) to check for implemented
     # properties
     def respond_to?(method, include_private=false)
@@ -40,57 +11,6 @@ module Burp
       super
     end
 
-    # This method is invoked by Ruby when a method that is not defined in this
-    # instance is called.
-    #
-    # In our case we inspect the @method@ parameter and try to find the
-    # attribute, simple descendent or collection that it maps to in the XML
-    # tree.
-    def method_missing(method, *args)
-
-      # We could remove this check and return nil for any non-recognized tag.
-      # The problem would be that it would make tricky to debug problems with
-      # typos. For instance: <>.potr would return nil instead of raising an
-      # exception
-      unless supported_tags.include?(method)
-        super
-        return
-      end
-
-      # First we try the attributes. In Ruby we use snake_case, but in XML
-      # CamelCase is used for some attributes
-      translations_table = {
-        :background => 'issueBackground',
-        :detail => 'issueDetail',
-        :remediation_background => 'remediationBackground',
-        :remediation_detail => 'remediationDetail',
-        :vulnerability_classifications => 'vulnerabilityClassifications',
-        :serial_number => 'serialNumber'
-      }
-
-      method_name = translations_table.fetch(method, method.to_s)
-
-      # no attributes in the <issue> node
-      # return @xml.attributes[method_name].value if @xml.attributes.key?(method_name)
-
-      # Then we try simple children tags: name, type, ...
-      tag = @xml.xpath("./#{method_name}").first
-      if tag && !tag.text.blank?
-        if tags_with_html_content.include?(method)
-          return cleanup_html(tag.text)
-        else
-          return tag.text
-        end
-      end
-
-      if (['request', 'response'].include?(method_name))
-        requestresponse_child(method_name)
-      else
-        # nothing found, the tag is valid but not present in this ReportItem
-        return nil
-      end
-    end
-
     private
 
     def cleanup_html(source)
@@ -111,7 +31,7 @@ module Burp
 
       result.gsub!(/<ul>(.*?)<\/ul>/m){|m| "#{ $1 }\n"}
       result.gsub!(/<li>(.*?)<\/li>/m){|m| "\n* #{ $1 }"}
-      result.gsub!(/<a href=\"(.*?)\">(.*?)<\/a>/i) { "\"#{$2.strip}\":#{$1.strip}" }
+      result.gsub!(/<a href=\"(.*?)\">(.*?)<\/a>/im) { "\"#{$2.strip}\":#{$1.strip}" }
 
       result.gsub!(/<table>(.*?)<\/table>/m){|m| "\n\n#{ $1 }\n\n" }
       result.gsub!(/<tr>(.*?)<\/tr>/m){|m| "|#{ $1 }\n" }
@@ -119,42 +39,5 @@ module Burp
 
       result
     end
-
-    # Some of the values have embedded HTML content that we need to strip
-    def tags_with_html_content
-      [:background, :detail, :remediation_background, :remediation_detail, :references, :vulnerability_classifications]
-    end
-
-    def requestresponse_child(field)
-      return 'n/a' unless @xml.at('requestresponse') && @xml.at("requestresponse/#{field}")
-
-      xml_node = @xml.at("requestresponse/#{field}")
-      result = "[unprocessable #{field}]"
-
-      if xml_node['base64'] == 'true'
-        result = Base64::strict_decode64(xml_node.text)
-
-        # don't pass binary data to the DB.
-        if result =~ /\0/
-          header, _ = result.split("\r\n\r\n")
-          result = header << "\r\n\r\n" << '[Binary Data Not Displayed]'
-        end
-      else
-        result = xml_node.text
-      end
-
-      # Just in case a null byte was left by Burp
-      result.gsub!(/\0/,'&#00;')
-
-      # We truncate the request/response because it can be pretty big.
-      # If it is > 1M MySQL will die when trying to INSERT
-      #
-      # TODO: maybe add a reference to this node's XPATH so the user can go
-      # back to the burp scanner file and look up the original request/response
-      result.truncate(50000, omission: '... (truncated)')
-
-      # Encode the string to UTF-8 to catch invalid bytes.
-      result.encode('utf-8', invalid: :replace, undef: :replace, replace: ::Burp::INVALID_UTF_REPLACE)
-    end
   end
 end

data/lib/burp/xml/issue.rb

@@ -0,0 +1,127 @@
+module Burp
+  module Xml
+
+  # This class represents each of the /issues/issue elements in the Burp
+  # Scanner XML document.
+  #
+  # It provides a convenient way to access the information scattered all over
+  # the XML in attributes and nested tags.
+  #
+  # Instead of providing separate methods for each supported property we rely
+  # on Ruby's #method_missing to do most of the work.
+  class Issue < ::Burp::Issue
+
+    # Accepts an XML node from Nokogiri::XML.
+    def initialize(xml_node)
+      @xml = xml_node
+    end
+
+    # List of supported tags. They can be attributes, simple descendants or
+    # collections (e.g. <references/>, <tags/>)
+    def supported_tags
+      [
+        # attributes
+
+        # simple tags
+        :background, :confidence, :detail, :host, :location, :name, :path,
+        :references, :remediation_background, :remediation_detail,
+        :serial_number, :severity, :type,
+        :vulnerability_classifications,
+
+        # nested tags
+        :request, :response
+      ]
+    end
+
+    # This method is invoked by Ruby when a method that is not defined in this
+    # instance is called.
+    #
+    # In our case we inspect the @method@ parameter and try to find the
+    # attribute, simple descendent or collection that it maps to in the XML
+    # tree.
+    def method_missing(method, *args)
+
+      # We could remove this check and return nil for any non-recognized tag.
+      # The problem would be that it would make tricky to debug problems with
+      # typos. For instance: <>.potr would return nil instead of raising an
+      # exception
+      unless supported_tags.include?(method)
+        super
+        return
+      end
+
+      # First we try the attributes. In Ruby we use snake_case, but in XML
+      # CamelCase is used for some attributes
+      translations_table = {
+        background: 'issueBackground',
+        detail: 'issueDetail',
+        remediation_background: 'remediationBackground',
+        remediation_detail: 'remediationDetail',
+        vulnerability_classifications: 'vulnerabilityClassifications',
+        serial_number: 'serialNumber'
+      }
+
+      method_name = translations_table.fetch(method, method.to_s)
+
+      # no attributes in the <issue> node
+      # return @xml.attributes[method_name].value if @xml.attributes.key?(method_name)
+
+      # Then we try simple children tags: name, type, ...
+      tag = @xml.xpath("./#{method_name}").first
+      if tag && !tag.text.blank?
+        if tags_with_html_content.include?(method)
+          return cleanup_html(tag.text)
+        else
+          return tag.text
+        end
+      end
+
+      if (['request', 'response'].include?(method_name))
+        requestresponse_child(method_name)
+      else
+        # nothing found, the tag is valid but not present in this ReportItem
+        return nil
+      end
+    end
+
+    private
+
+    # Some of the values have embedded HTML content that we need to strip
+    def tags_with_html_content
+      [:background, :detail, :remediation_background, :remediation_detail, :references, :vulnerability_classifications]
+    end
+
+    def requestresponse_child(field)
+      return 'n/a' unless @xml.at('requestresponse') && @xml.at("requestresponse/#{field}")
+
+      xml_node = @xml.at("requestresponse/#{field}")
+      result = "[unprocessable #{field}]"
+
+      if xml_node['base64'] == 'true'
+        result = Base64::strict_decode64(xml_node.text)
+
+        # don't pass binary data to the DB.
+        if result =~ /\0/
+          header, _ = result.split("\r\n\r\n")
+          result = header << "\r\n\r\n" << '[Binary Data Not Displayed]'
+        end
+      else
+        result = xml_node.text
+      end
+
+      # Just in case a null byte was left by Burp
+      result.gsub!(/\0/,'&#00;')
+
+      # We truncate the request/response because it can be pretty big.
+      # If it is > 1M MySQL will die when trying to INSERT
+      #
+      # TODO: maybe add a reference to this node's XPATH so the user can go
+      # back to the burp scanner file and look up the original request/response
+      result.truncate(50000, omission: '... (truncated)')
+
+      # Encode the string to UTF-8 to catch invalid bytes.
+      result.encode('utf-8', invalid: :replace, undef: :replace, replace: ::Burp::INVALID_UTF_REPLACE)
+    end
+  end
+end
+end