metasploit-model 0.24.1.pre.semantic.pre.versioning.pre.2.pre.0

data/spec/app/validators/password_is_strong_validator_spec.rb

@@ -0,0 +1,250 @@
+require 'spec_helper'
+
+describe PasswordIsStrongValidator do
+  subject(:password_is_strong_validator) do
+    described_class.new(
+        :attributes => attributes
+    )
+  end
+
+  let(:attribute) do
+    :password
+  end
+
+  let(:attributes) do
+    [
+        attribute
+    ]
+  end
+
+  context '#contains_repetition' do
+    subject(:contains_repetition?) do
+      password_is_strong_validator.send(:contains_repetition?, password)
+    end
+
+    context 'with all the same character' do
+      let(:password) do
+        'aaaaa'
+      end
+
+      it { should be_true }
+    end
+
+    context 'with repeats of 2 characters' do
+      let(:password) do
+        'abab'
+      end
+
+      it { should be_true }
+    end
+
+    context 'with repeats of 3 characters' do
+      let(:password) do
+        'abcabc'
+      end
+
+      it { should be_true }
+    end
+
+    context 'with repeats of 4 characters' do
+      let(:password) do
+        'abcdabcd'
+      end
+
+      it { should be_true }
+    end
+
+    context 'without any repeats' do
+      let(:password) do
+        'abcdefgh'
+      end
+
+      it { should be_false }
+    end
+  end
+
+  context '#contains_username?' do
+    subject(:contains_username?) do
+      password_is_strong_validator.send(:contains_username?, username, password)
+    end
+
+    let(:username) do
+      ''
+    end
+
+    context 'with blank password' do
+      let(:password) do
+        ''
+      end
+
+      it { should be_false }
+    end
+
+    context 'without blank password' do
+      let(:password) do
+        'password'
+      end
+
+      context 'with blank username' do
+        let(:username) do
+          ''
+        end
+
+        it { should be_false }
+      end
+
+      context 'without blank username' do
+        let(:username) do
+          'username'
+        end
+
+        it 'should escape username' do
+          Regexp.should_receive(:escape).with(username).and_call_original
+
+          contains_username?
+        end
+
+        context 'with matching password' do
+          context 'of different case' do
+            let(:password) do
+              username.titleize
+            end
+
+            it { should be_true }
+          end
+
+          context 'of same case' do
+            let(:password) do
+              username
+            end
+
+            it { should be_true }
+          end
+        end
+      end
+    end
+  end
+
+  context '#validate_each' do
+    subject(:validate_each) do
+      password_is_strong_validator.validate_each(record, attribute, value)
+    end
+
+    let(:record) do
+      record_class.new
+    end
+
+    let(:record_class) do
+      attribute = self.attribute
+
+      Class.new do
+        include ActiveModel::Validations
+
+        #
+        # Attributes
+        #
+
+        # @!attribute [rw] username
+        #   User name
+        #
+        #   @return [String]
+        attr_accessor :username
+
+        #
+        # Validations
+        #
+
+        validates attribute,
+                  :password_is_strong => true
+      end
+    end
+
+    context 'with blank' do
+      let(:value) do
+        ''
+      end
+
+      it 'should not record any error' do
+        validate_each
+
+        record.errors.should be_empty
+      end
+    end
+
+    context 'without blank' do
+      context 'with simple' do
+        let(:value) do
+          'a'
+        end
+
+        it 'should record error on attributes' do
+          validate_each
+
+          record.errors[attribute].should include('must contain letters, numbers, and at least one special character')
+        end
+      end
+
+      context 'without simple' do
+        context 'contains username' do
+          let(:username) do
+            'root'
+          end
+
+          let(:value) do
+            username
+          end
+
+          before(:each) do
+            record.username = username
+          end
+
+          it 'should record error on attribute' do
+            validate_each
+
+            record.errors[attribute].should include('must not contain the username')
+          end
+        end
+
+        context 'does not contain username' do
+          context 'with password in COMMON_PASSWORDS' do
+            let(:value) do
+              described_class::COMMON_PASSWORDS.sample
+            end
+
+            it 'should record error on attribute' do
+              validate_each
+
+              record.errors[attribute].should include('must not be a common password')
+            end
+          end
+
+          context 'without password in COMMON_PASSWORDS' do
+            context 'with repetition' do
+              let(:value) do
+                'aaaaa'
+              end
+
+              it 'should record error on attribute' do
+                validate_each
+
+                record.errors[attribute].should include('must not be a predictable sequence of characters')
+              end
+            end
+
+            context 'without repetition' do
+              let(:value) do
+                'A$uperg00dp@ssw0rd'
+              end
+
+              it 'should not record any errors' do
+                validate_each
+
+                record.errors.should be_empty
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/spec/dummy/Rakefile

@@ -0,0 +1,7 @@
+#!/usr/bin/env rake
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require File.expand_path('../config/application', __FILE__)
+
+Dummy::Application.load_tasks

data/spec/dummy/app/assets/javascripts/application.js

@@ -0,0 +1,15 @@
+// This is a manifest file that'll be compiled into application.js, which will include all the files
+// listed below.
+//
+// Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts,
+// or vendor/assets/javascripts of plugins, if any, can be referenced here using a relative path.
+//
+// It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
+// the compiled file.
+//
+// WARNING: THE FIRST BLANK LINE MARKS THE END OF WHAT'S TO BE PROCESSED, ANY BLANK LINE SHOULD
+// GO AFTER THE REQUIRES BELOW.
+//
+//= require jquery
+//= require jquery_ujs
+//= require_tree .

data/spec/dummy/app/assets/stylesheets/application.css

@@ -0,0 +1,13 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ *
+ * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
+ * or vendor/assets/stylesheets of plugins, if any, can be referenced here using a relative path.
+ *
+ * You're free to add application-wide styles to this file and they'll appear at the top of the
+ * compiled file, but it's generally better to create a new file per style scope.
+ *
+ *= require_self
+ *= require_tree .
+ */

data/spec/dummy/app/controllers/application_controller.rb

@@ -0,0 +1,3 @@
+class ApplicationController < ActionController::Base
+  protect_from_forgery
+end

data/spec/dummy/app/helpers/application_helper.rb

@@ -0,0 +1,2 @@
+module ApplicationHelper
+end

data/spec/dummy/app/models/dummy/architecture.rb

@@ -0,0 +1,92 @@
+# Implementation of {Metasploit::Model::Architecture} to allow testing of {Metasploit::Model::Architecture} using an
+# in-memory ActiveModel and use of factories.
+class Dummy::Architecture < Metasploit::Model::Base
+  include Metasploit::Model::Architecture
+
+  #
+  # Associations
+  #
+
+  # @!attribute [r] module_instances
+  #   {Dummy::Module::Instance Modules} that have this {Metasploit::Model::Module::Architecture} as a
+  #   {Dummy::Module::Instance#architectures support architecture}.
+  #
+  #   @return [Array<Metasploit::Model::Module::Instance>]
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] abbreviation
+  #   Abbreviation used for the architecture.  Will match ARCH constants in metasploit-framework.
+  #
+  #   @return [String]
+  attr_accessor :abbreviation
+
+  # @!attribute [rw] bits
+  #   Number of bits supported by this architecture.
+  #
+  #   @return [32] if 32-bit
+  #   @return [64] if 64-bit
+  #   @return [nil] if bits aren't applicable, such as for non-CPU architectures like ruby, etc.
+  attr_accessor :bits
+
+  # @!attribute [rw] endianness
+  #   The endianness of the architecture.
+  #
+  #   @return ['big'] if big endian
+  #   @return ['little'] if little endian
+  #   @return [nil] if endianness is not applicable, such as for software architectures like tty.
+  attr_accessor :endianness
+
+  # @!attribute [rw] family
+  #   The CPU architecture family.
+  #
+  #   @return [String] if a CPU architecture.
+  #   @return [nil] if not a CPU architecture.
+  attr_accessor :family
+
+  # @!attribute [rw] summary
+  #   Sentence length summary of architecture.  Usually an expansion of the abbreviation or initialism in the
+  #   {#abbreviation} and the {#bits} and {#endianness} in prose.
+  #
+  #   @return [String]
+  attr_accessor :summary
+
+  #
+  # Methods
+  #
+
+  def self.all
+    instance_by_abbreviation.values
+  end
+
+  def self.instance_by_abbreviation
+    unless instance_variable_defined? :@instance_by_abbreviation
+      @instance_by_abbreviation = {}
+
+      SEED_ATTRIBUTES.each do |attributes|
+        instance = new(attributes)
+
+        unless instance.valid?
+          raise Metasploit::Model::Invalid.new(instance)
+        end
+
+        # freeze object to prevent specs from modifying them and interfering with other specs.
+        instance.freeze
+
+        @instance_by_abbreviation[instance.abbreviation] = instance
+      end
+    end
+
+    @instance_by_abbreviation
+  end
+
+  # Keep single instance for each set of attributes in {SEED_ATTRIBUTES} to emulate unique database seeds in-memory.
+  #
+  # @param abbreviation [String] {#abbreviation}
+  # @return [Dummy::Architecture]
+  def self.with_abbreviation(abbreviation)
+    instance_by_abbreviation.fetch(abbreviation)
+  end
+end

data/spec/dummy/app/models/dummy/author.rb

@@ -0,0 +1,15 @@
+# Implementation of {Metasploit::Model::Author} to allow testing of {Metasploit::Model::Author} using an in-memory
+# ActiveModel and use of factories.
+class Dummy::Author < Metasploit::Model::Base
+  include Metasploit::Model::Author
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] name
+  #   Full name (First + Last name) or handle of author.
+  #
+  #   @return [String]
+  attr_accessor :name
+end

data/spec/dummy/app/models/dummy/authority.rb

@@ -0,0 +1,130 @@
+# Implementation of {Metasploit::Model::Authority} to allow testing of {Metasploit::Model::Authority} using an in-memory
+# ActiveModel and use of factories.
+class Dummy::Authority < Metasploit::Model::Base
+  include Metasploit::Model::Authority
+
+  #
+  # CONSTANTS
+  #
+
+  SEED_ATTRIBUTES = [
+      {
+          :abbreviation => 'BID',
+          :obsolete => false,
+          :summary => 'BuqTraq ID',
+          :url => 'http://www.securityfocus.com/bid'
+      },
+      {
+          :abbreviation => 'CVE',
+          :obsolete => false,
+          :summary => 'Common Vulnerabilities and Exposures',
+          :url => 'http://cvedetails.com'
+      },
+      {
+          :abbreviation => 'MIL',
+          :obsolete => true,
+          :summary => 'milw0rm',
+          :url => 'https://en.wikipedia.org/wiki/Milw0rm'
+      },
+      {
+          :abbreviation => 'MSB',
+          :obsolete => false,
+          :summary => 'Microsoft Security Bulletin',
+          :url => 'http://www.microsoft.com/technet/security/bulletin'
+      },
+      {
+          :abbreviation => 'OSVDB',
+          :obsolete => false,
+          :summary => 'Open Sourced Vulnerability Database',
+          :url => 'http://osvdb.org'
+      },
+      {
+          :abbreviation => 'PMASA',
+          :obsolete => false,
+          :summary => 'phpMyAdmin Security Announcement',
+          :url => 'http://www.phpmyadmin.net/home_page/security/'
+      },
+      {
+          :abbreviation => 'SECUNIA',
+          :obsolete => false,
+          :summary => 'Secunia',
+          :url => 'https://secunia.com/advisories'
+      },
+      {
+          :abbreviation => 'US-CERT-VU',
+          :obsolete => false,
+          :summary => 'United States Computer Emergency Readiness Team Vulnerability Notes Database',
+          :url => 'http://www.kb.cert.org/vuls'
+      },
+      {
+          :abbreviation => 'waraxe',
+          :obsolete => false,
+          :summary => 'Waraxe Advisories',
+          :url => 'http://www.waraxe.us/content-cat-1.html'
+      },
+      {
+          abbreviation: 'ZDI',
+          obsolete: false,
+          summary: 'Zero Day Initiative',
+          url: 'http://www.zerodayinitiative.com/advisories'
+      }
+  ]
+
+  #
+  # Attributes
+  #
+
+  # @!attribute [rw] abbreviation
+  #   Abbreviation or initialism for authority, such as CVE for 'Common Vulnerability and Exposures'.
+  #
+  #   @return [String]
+  attr_accessor :abbreviation
+
+  # @!attribute [rw] obsolete
+  #   Whether this authority is obsolete and no longer exists on the internet.
+  #
+  #   @return [false]
+  #   @return [true] {#url} may be `nil` because authory no longer has a web site.
+  attr_accessor :obsolete
+
+  # @!attribute [rw] summary
+  #   An expansion of the {#abbreviation}.
+  #
+  #   @return [String, nil]
+  attr_accessor :summary
+
+  # @!attribute [rw] url
+  #   URL to the authority's home page or root URL for their {#references} database.
+  #
+  #   @return [String, nil]
+  attr_accessor :url
+
+  #
+  # Methods
+  #
+
+  # Keep single instance of each set of attributes in {SEED_ATTRIBUTES} to emulate unique database seeds in-memory.
+  #
+  # @param abbreviation [String] {#abbreviation}
+  # @return [Dummy::Authority]
+  def self.with_abbreviation(abbreviation)
+    unless instance_variable_defined? :@instance_by_abbreviation
+      @instance_by_abbreviation = {}
+
+      SEED_ATTRIBUTES.each do |attributes|
+        instance = new(attributes)
+
+        unless instance.valid?
+          raise Metasploit::Model::Invalid.new(instance)
+        end
+
+        # freeze object to prevent specs from modifying them and interfering with other specs.
+        instance.freeze
+
+        @instance_by_abbreviation[instance.abbreviation] = instance
+      end
+    end
+
+    @instance_by_abbreviation.fetch(abbreviation)
+  end
+end