metasploit-model 3.0.0 → 3.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a5f988847549534fae7fffc226d076ba4bd61664ec29df83d88bd063841d7a4
-  data.tar.gz: c9e43a7f1669acf013d92202396df2e37a2225a9ddebd0d868d448891015d0d3
+  metadata.gz: 9735bf99e2c7ca26ac1b2e41075a5d8895f4ea952a0641e1cb3189468086cf66
+  data.tar.gz: c4659546c247eb29d7c06a4af9ef765eda2606df5876f4405f6e45430ce143ff
 SHA512:
-  metadata.gz: b3382aedd7f694cb1d1087d524763f00d0c01f505cd530cb5acf708681a78c6e94ef8725bbd07e1174d107eba468a5c4ec905c6dc30c22825afbfba74ba6fdec
-  data.tar.gz: b86c773e1eb4789c7b32660f24bceb4a7746f0d148ef57a668ab1fd6e55eb1337a12d498414dc9e17255328e3d6efba2ab5acf4b627ca595f8eccf30805d4769
+  metadata.gz: 7909c402f1aca1f347e6f20a4d8062607c59c871178a1b20aacc45af5e781426363527cf77b200a4a24d252d5bbd0d477c16b8cea0e185edcb765095377c7d9c
+  data.tar.gz: a81b3d657573da78157a54bfa78bea6083e6490ea1f164ce7be83332816c95cc49796bc4a715fcec5b08603cd1e221231439795fb1037171e76a840dc54b64cf

data/.github/workflows/verify.yml

@@ -0,0 +1,83 @@
+name: Verify
+
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
+
+jobs:
+  test:
+    runs-on: ubuntu-16.04
+    timeout-minutes: 40
+
+    services:
+      postgres:
+        image: postgres:9.6
+        ports: [ "5432:5432" ]
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    strategy:
+      fail-fast: true
+      matrix:
+        ruby:
+          - 2.5
+          - 2.6
+          - 2.7
+
+    env:
+      RAILS_ENV: test
+
+    name: Ruby ${{ matrix.ruby }}
+    steps:
+      - name: Install system dependencies
+        run: sudo apt-get install graphviz
+
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - uses: actions/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+
+      - name: Setup bundler
+        run: |
+          gem install bundler
+      - uses: actions/cache@v2
+        with:
+          path: vendor/bundle
+          key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-gems-
+      - name: Bundle install
+        run: |
+          bundle config path vendor/bundle
+          bundle install --jobs 4 --retry 3
+
+      - name: Test
+        run: |
+          gem install bundler
+          cp spec/dummy/config/database.yml.github_actions spec/dummy/config/database.yml
+          bundle install
+          bundle exec rake --version
+          bundle exec rake db:test:prepare
+
+          bundle exec rake spec
+          bundle exec rake yard
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v2
+        with:
+          name: coverage-${{ matrix.ruby }}
+          path: |
+            coverage/
+          retention-days: 1

data/Gemfile

@@ -18,8 +18,6 @@ group :test do
 
   # Dummy app uses actionpack for ActionController, but not rails since it doesn't use activerecord.
   gem 'actionpack'
-  # Uploads simplecov reports to coveralls.io
-  gem 'coveralls', require: false
   # Engine tasks are loaded using railtie
   gem 'railties'
   gem 'rspec-rails'

data/README.md

@@ -1,4 +1,4 @@
-# Metasploit::Model [![Build Status](https://travis-ci.org/rapid7/metasploit-model.png)](https://travis-ci.org/rapid7/metasploit-model)[![Code Climate](https://codeclimate.com/github/rapid7/metasploit-model.png)](https://codeclimate.com/github/rapid7/metasploit-model)[![Coverage Status](https://coveralls.io/repos/rapid7/metasploit-model/badge.png?branch=feature%2Fexploit)](https://coveralls.io/r/rapid7/metasploit-model)[![Dependency Status](https://gemnasium.com/rapid7/metasploit-model.svg)](https://gemnasium.com/rapid7/metasploit-model)[![Gem Version](https://badge.fury.io/rb/metasploit-model.svg)](http://badge.fury.io/rb/metasploit-model)[![Inline docs](http://inch-ci.org/github/rapid7/metasploit-model.svg?branch=master)](http://inch-ci.org/github/rapid7/metasploit-model)[![PullReview stats](https://www.pullreview.com/github/rapid7/metasploit-model/badges/master.svg)](https://www.pullreview.com/github/rapid7/metasploit-model/reviews/master)
+# Metasploit::Model [![Build Status](https://github.com/rapid7/metasploit-model/actions/workflows/verify.yml/badge.svg)](https://github.com/rapid7/metasploit-model/actions/workflows/verify.yml)[![Code Climate](https://codeclimate.com/github/rapid7/metasploit-model.png)](https://codeclimate.com/github/rapid7/metasploit-model)[![Dependency Status](https://gemnasium.com/rapid7/metasploit-model.svg)](https://gemnasium.com/rapid7/metasploit-model)[![Gem Version](https://badge.fury.io/rb/metasploit-model.svg)](http://badge.fury.io/rb/metasploit-model)[![Inline docs](http://inch-ci.org/github/rapid7/metasploit-model.svg?branch=master)](http://inch-ci.org/github/rapid7/metasploit-model)[![PullReview stats](https://www.pullreview.com/github/rapid7/metasploit-model/badges/master.svg)](https://www.pullreview.com/github/rapid7/metasploit-model/reviews/master)
 
 ## Versioning
 

data/app/validators/address_format_validator.rb

@@ -0,0 +1,26 @@
+require 'ipaddr'
+
+# Validates that attribute is a valid address.
+class AddressFormatValidator < ActiveModel::EachValidator
+  # Validates that `attribute`'s `value` on `object` is a valid address.
+  #
+  # @param record [#errors, ApplicationRecord] ActiveModel or ActiveRecord
+  # @param attribute [Symbol] name of address attribute.
+  # @param value [String, nil] address.
+  # @return [void]
+  def validate_each(object, attribute, value)
+    error_message_block = lambda{ object.errors.add attribute, "must be a valid (IP or hostname) address" }
+    begin
+      # Checks for valid IP addresses
+      if value.is_a? IPAddr
+        potential_ip = value.dup
+      else
+        potential_ip = IPAddr.new(value)
+      end
+      error_message_block.call unless potential_ip.ipv4? || potential_ip.ipv6?
+    rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError, ArgumentError
+      # IP address resolution failed, checks for valid hostname
+      error_message_block.call unless (value && value.match?(/\A#{URI::PATTERN::HOSTNAME}\z/))
+    end
+  end
+end

data/app/validators/ip_format_validator.rb

@@ -1,31 +1,25 @@
 require 'ipaddr'
 
-# Validates that value is an IPv4 or IPv6 address.
+# Validates that value is a valid IPv4 or IPv6 address.
 class IpFormatValidator < ActiveModel::EachValidator
-  # Validates that `value` is an IPv4 or IPv4 address.  Ranges in CIDR or netmask notation are not allowed.
+  # Validates that `attribute`'s `value` on `object` is a valid IPv4 or IPv6 address.
   #
   # @param record [#errors, ApplicationRecord] ActiveModel or ActiveRecord
   # @param attribute [Symbol] name of IP address attribute.
   # @param value [String, nil] IP address.
   # @return [void]
-  # @see IPAddr#ipv4?
-  # @see IPAddr#ipv6?
-  def validate_each(record, attribute, value)
+  def validate_each(object, attribute, value)
+    error_message_block = lambda{ object.errors.add attribute, "must be a valid IPv4 or IPv6 address" }
     begin
-      potential_ip = IPAddr.new(value)
-    rescue ArgumentError
-      record.errors[attribute] << 'must be a valid IPv4 or IPv6 address'
-    else
-      # if it includes a netmask, then it's not an IP address, but an IP range.
-      if potential_ip.ipv4?
-        if potential_ip.instance_variable_get(:@mask_addr) != IPAddr::IN4MASK
-          record.errors[attribute] << 'must be a valid IPv4 or IPv6 address and not an IPv4 address range in CIDR or netmask notation'
-        end
-      elsif potential_ip.ipv6?
-        if potential_ip.instance_variable_get(:@mask_addr) != IPAddr::IN6MASK
-          record.errors[attribute] << 'must be a valid IPv4 or IPv6 address and not an IPv6 address range in CIDR or netmask notation'
-        end
+      if value.is_a? IPAddr
+        potential_ip = value.dup
+      else
+        potential_ip = IPAddr.new(value)
       end
+
+      error_message_block.call unless potential_ip.ipv4? || potential_ip.ipv6?
+    rescue ArgumentError
+      error_message_block.call
     end
   end
 end

data/app/validators/nil_validator.rb

@@ -10,7 +10,7 @@ class NilValidator < ActiveModel::EachValidator
   # @return [void]
   def validate_each(record, attribute, value)
     unless value.nil?
-      record.errors[attribute] << 'must be nil'
+      record.errors.add attribute, 'must be nil'
     end
   end
 end

data/app/validators/parameters_validator.rb

@@ -1,11 +1,19 @@
 # Validates that attribute's value is Array<Array(String, String)> which is the only valid type signature for serialized
 # parameters.
 class ParametersValidator < ActiveModel::EachValidator
+  #
+  # CONSTANTS
+  #
+
   # Sentence explaining the valid type signature for parameters.
   TYPE_SIGNATURE_SENTENCE = 'Valid parameters are an Array<Array(String, String)>.'
 
-  # Validates that attribute's value is Array<Array(String, String)> which is the only valid type signature for
-  # serialized parameters.  Errors are specific to the how different `value` is compared to correct format.
+  #
+  # Instance Methods
+  #
+
+  # Validates that `attribute`'s `value` on `record` is `Array<Array(String, String)>` which is the only valid type
+  # signature for serialized parameters.
   #
   # @param record [#errors, ApplicationRecord] ActiveModel or ActiveRecord
   # @param attribute [Symbol] serialized parameters attribute name.
@@ -28,7 +36,7 @@ class ParametersValidator < ActiveModel::EachValidator
                 :index => index
             )
 
-            record.errors[attribute] << length_error
+            record.errors.add attribute, length_error
           else
             parameter_name = element.first
 
@@ -39,7 +47,7 @@ class ParametersValidator < ActiveModel::EachValidator
                     :index => index,
                     :prefix => "has blank parameter name"
                 )
-                record.errors[attribute] << error
+                record.errors.add attribute, error
               end
             else
               error = error_at(
@@ -47,7 +55,7 @@ class ParametersValidator < ActiveModel::EachValidator
                   :index => index,
                   :prefix => "has non-String parameter name (#{parameter_name.inspect})"
               )
-              record.errors[attribute] << error
+              record.errors.add attribute, error
             end
 
             parameter_value = element.second
@@ -58,7 +66,7 @@ class ParametersValidator < ActiveModel::EachValidator
                   :index => index,
                   :prefix => "has non-String parameter value (#{parameter_value.inspect})"
               )
-              record.errors[attribute] << error
+              record.errors.add attribute, error
             end
           end
         else
@@ -67,11 +75,11 @@ class ParametersValidator < ActiveModel::EachValidator
               :index => index,
               :prefix => 'has non-Array'
           )
-          record.errors[attribute] << error
+          record.errors.add attribute, error
         end
       end
     else
-      record.errors[attribute] << "is not an Array.  #{TYPE_SIGNATURE_SENTENCE}"
+      record.errors.add attribute, "is not an Array.  #{TYPE_SIGNATURE_SENTENCE}"
     end
   end
 

data/app/validators/password_is_strong_validator.rb

@@ -4,20 +4,18 @@ class PasswordIsStrongValidator < ActiveModel::EachValidator
   # CONSTANTS
   #
 
-  # Password that are used too often and will be easily guessed.
+  # Known passwords that should NOT be allowed and should be considered weak.
   COMMON_PASSWORDS = %w{
-			password pass root admin metasploit
-			msf 123456 qwerty abc123 letmein monkey link182 demo
-			changeme test1234 rapid7
-		}
-
-  # Validates that `value` is a strong password.  A password is strong if it meets the following rules:
-  # * SHOULD contain at least one letter.
-  # * SHOULD contain at least one digit.
-  # * SHOULD contain at least one special character.
-  # * SHOULD NOT contain `record.username` (case-insensitive).
-  # * SHOULD NOT be in {COMMON_PASSWORDS}.
-  # * SHOULD NOT repetitions.
+      password pass root admin metasploit
+      msf 123456 qwerty abc123 letmein monkey link182 demo
+      changeme test1234 rapid7
+    }
+
+  # Special characters that are considered to strength passwords and are required once in a strong password.
+  SPECIAL_CHARS = %q{!@"#$%&'()*+,-./:;<=>?[\\]^_`{|}~ }
+
+  # Validates that the `attribute`'s `value` on `record` contains letters, numbers, and at least one special character
+  # without containing the `record.username`, any {COMMON_PASSWORDS} or repetition.
   #
   # @param record [#errors, #username, ApplicationRecord] ActiveModel or ActiveRecord that supports #username method.
   # @param attribute [Symbol] password attribute name.
@@ -27,30 +25,101 @@ class PasswordIsStrongValidator < ActiveModel::EachValidator
     return if value.blank?
 
     if is_simple?(value)
-      record.errors[attribute] << 'must contain letters, numbers, and at least one special character'
+      record.errors.add attribute, 'must contain letters, numbers, and at least one special character'
     end
 
-    if contains_username?(record.username, value)
-      record.errors[attribute] << 'must not contain the username'
+    if !record.username.blank? && contains_username?(record.username, value)
+      record.errors.add attribute, 'must not contain the username'
     end
 
     if is_common_password?(value)
-      record.errors[attribute] << 'must not be a common password'
+      record.errors.add attribute, 'must not be a common password'
     end
 
-    if contains_repetition?(value)
-      record.errors[attribute] << 'must not be a predictable sequence of characters'
+    if is_only_repetition?(value)
+      record.errors.add attribute, 'must not be a predictable sequence of characters'
     end
   end
 
   private
 
-  # Password repetition (quite basic) -- no "aaaaaa" or "ababab" or "abcabc" or
-  # "abcdabcd" (but note that the user can use "aaaaaab" or something).
+  # Returns whether the password is simple.
+  #
+  # @return [false] if password contains a letter, digit and special character.
+  # @return [true] otherwise
+  def is_simple?(password)
+    not (password =~ /[A-Za-z]/ and password =~ /[0-9]/ and password =~ /[#{Regexp.escape(SPECIAL_CHARS)}]/)
+  end
+
+  # Returns whether username is in password (case-insensitively).
+  #
+  # @return [true] if `username` is in `password`.
+  # @return [false] unless `username` is in `password`.
+  def contains_username?(username, password)
+    !!(password =~ /#{username}/i)
+  end
+
+  # Returns whether `password` is in {COMMON_PASSWORDS} or a simple variation of a password in {COMMON_PASSWORDS}.
+  #
+  # @param password [String]
+  # @return [Boolean]
+  def is_common_password?(password)
+    COMMON_PASSWORDS.each do |pw|
+      common_pw = [pw] # pw + "!", pw + "1", pw + "12", pw + "123", pw + "1234"]
+      common_pw += mutate_pass(pw)
+      common_pw.each do |common_pass|
+        if password.downcase =~ /#{common_pass}[\d!]*/
+          return true
+        end
+      end
+    end
+    false
+  end
+
+  # Returns a leet mutated variant of the original password
+  #
+  # @param password [String]
+  # @return [String] containing the password with leet mutations
+  def mutate_pass(password)
+    mutations = {
+        'a' => '@',
+        'o' => '0',
+        'e' => '3',
+        's' => '$',
+        't' => '7',
+        'l' => '1'
+    }
+
+    iterations = mutations.keys.dup
+    results = []
+
+    # Find PowerSet of all possible mutation combinations
+    iterations = iterations.inject([[]]){|c,y|r=[];c.each{|i|r<<i;r<<i+[y]};r}
+
+    # Iterate through combinations to create each possible mutation
+    iterations.each do |iteration|
+      next if iteration.flatten.empty?
+      first = iteration.shift
+      intermediate = password.gsub(/#{first}/i, mutations[first])
+      iteration.each do |mutator|
+        next unless mutator.kind_of? String
+        intermediate.gsub!(/#{mutator}/i, mutations[mutator])
+      end
+      results << intermediate
+    end
+
+    return results
+  end
+
+
+  # Returns whether `password` is only composed of repetitions
   #
   # @param password [String]
   # @return [Boolean]
-  def contains_repetition?(password)
+  def is_only_repetition?(password)
+    # Password repetition (quite basic) -- no "aaaaaa" or "ababab" or "abcabc" or
+    # "abcdabcd" (but note that the user can use "aaaaaab" or something).
+
     if password.scan(/./).uniq.size < 2
       return true
     end
@@ -69,47 +138,4 @@ class PasswordIsStrongValidator < ActiveModel::EachValidator
 
     false
   end
-
-  # Whether username is in password (case-insensitively).
-  #
-  # @return [false] if `password` is blank.
-  # @return [false] if `username` is blank.
-  # @return [false] unless `username` is in `password`.
-  # @return [true] if `username` is in `password`.
-  def contains_username?(username, password)
-    contains = false
-
-    unless password.blank? or username.blank?
-      escaped_username = Regexp.escape(username)
-      username_regexp = Regexp.new(escaped_username, Regexp::IGNORECASE)
-
-      if username_regexp.match(password)
-        contains = true
-      end
-    end
-
-    contains
-  end
-
-  # Whether `password` is in {COMMON_PASSWORDS} or a simple variation of a password in {COMMON_PASSWORDS}.
-  #
-  # @param password [String]
-  # @return [Boolean]
-  def is_common_password?(password)
-    COMMON_PASSWORDS.each do |pw|
-      common_pw = [pw, pw + "!", pw + "1", pw + "12", pw + "123", pw + "1234"]
-      if common_pw.include?(password.downcase)
-        return true
-      end
-    end
-    false
-  end
-
-  # Returns whether the password is simple.
-  #
-  # @return [false] if password contains a letter, digit and special character.
-  # @return [true] otherwise
-  def is_simple?(password)
-    not (password =~ /[A-Za-z]/ and password =~ /[0-9]/ and password =~ /[\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x3a\x3b\x3c\x3d\x3e\x3f\x5b\x5c\x5d\x5e\x5f\x60\x7b\x7c\x7d\x7e]/)
-  end
 end

data/lib/metasploit/model.rb

@@ -9,6 +9,7 @@
 require 'active_model'
 require 'active_support'
 
+autoload :AddressFormatValidator, 'address_format_validator'
 autoload :IpFormatValidator, 'ip_format_validator'
 autoload :NilValidator, 'nil_validator'
 autoload :ParametersValidator, 'parameters_validator'

data/lib/metasploit/model/file.rb

@@ -41,5 +41,6 @@ if RUBY_PLATFORM =~ /java/ && Gem::Version.new(JRUBY_VERSION) < Gem::Version.new
     end
   end
 else
+  # Alias for ::File when not in jruby.
   Metasploit::Model::File = ::File
 end

data/lib/metasploit/model/search/operator/help.rb

@@ -72,6 +72,6 @@ module Metasploit::Model::Search::Operator::Help
         name: name
     }
 
-    ::I18n.translate(key, options)
+    ::I18n.translate(key, **options)
   end
 end

data/lib/metasploit/model/version.rb

@@ -1,7 +1,7 @@
 module Metasploit
   module Model
     # VERSION is managed by GemRelease
-    VERSION = '3.0.0'
+    VERSION = '3.1.4'
   
     # @return [String]
     #

data/metasploit-model.gemspec

@@ -6,24 +6,24 @@ require 'metasploit/model/version'
 Gem::Specification.new do |spec|
   spec.name          = 'metasploit-model'
   spec.version       = Metasploit::Model::VERSION
-  spec.authors       = ['Luke Imhoff']
-  spec.email         = ['luke_imhoff@rapid7.com']
+  spec.authors       = ['Metasploit Hackers']
+  spec.email         = ['msfdev@metasploit.com']
   spec.description   = %q{Common code, such as validators and mixins, that are shared between ActiveModels in metasploit-framework and ActiveRecords in metasploit_data_models.}
   spec.summary       = %q{Metasploit Model Mixins and Validators}
 
-  spec.files         = `git ls-files`.split($/)
+  spec.files         = `git ls-files`.split($/).reject { |file|
+    file =~ /^bin/
+  }
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = %w{app/models app/validators lib}
 
-  spec.required_ruby_version = '>= 2.2.0'
+  spec.required_ruby_version = '>= 2.4.0'
 
   spec.add_development_dependency 'metasploit-yard'
   spec.add_development_dependency 'metasploit-erd'
   spec.add_development_dependency 'rake'
-
-  # documentation
-  # 0.8.7.4 has a bug where attribute setters show up as undocumented
-  spec.add_development_dependency 'yard', '< 0.8.7.4'
+  spec.add_development_dependency 'yard'
+  spec.add_development_dependency 'e2mmap'
 
   # Dependency loading
 

data/spec/app/validators/address_format_validator_spec.rb

@@ -0,0 +1,136 @@
+RSpec.describe AddressFormatValidator do
+  subject(:address_format_validator) do
+    described_class.new(
+        :attributes => attributes
+    )
+  end
+
+  let(:attribute) do
+    :address
+  end
+
+  let(:attributes) do
+    [
+        attribute
+    ]
+  end
+
+  context '#validate_each' do
+    subject(:validate_each) do
+      address_format_validator.validate_each(record, attribute, value)
+    end
+
+    let(:error) do
+      'must be a valid (IP or hostname) address'
+    end
+
+    let(:record) do
+      record_class.new
+    end
+
+    let(:record_class) do
+      # capture for Class.new scope
+      attribute = self.attribute
+
+      Class.new do
+        include ActiveModel::Validations
+
+        #
+        # Validations
+        #
+
+        validates attribute,
+                  :address_format => true
+      end
+    end
+
+    context 'address' do
+      context 'in IPv4 format' do
+        let(:value) do
+          '192.168.0.1'
+        end
+
+        it 'should not record any errors' do
+          validate_each
+
+          expect(record.errors).to be_empty
+        end
+      end
+
+      context 'in IPv6 format' do
+        let(:value) do
+          '::1'
+        end
+
+        it 'should not record any errors' do
+          validate_each
+
+          expect(record.errors).to be_empty
+        end
+      end
+
+      context 'with a valid hostname' do
+        let(:value) do
+          'testvalue.test.com'
+        end
+
+        it 'should not record any errors' do
+          validate_each
+
+          expect(record.errors).to be_empty
+        end
+      end
+
+      context 'with localhost' do
+        let(:value) do
+          'localhost'
+        end
+
+        it 'should not record any errors' do
+          validate_each
+
+          expect(record.errors).to be_empty
+        end
+      end
+
+      context 'with blank address' do
+        let(:value) do
+          ''
+        end
+
+        it 'should record error' do
+          validate_each
+
+          expect(record.errors[attribute]).to include(error)
+        end
+      end
+
+      context 'with nil value' do
+        let(:value) do
+          nil
+        end
+
+        it 'should record error on attribute' do
+          validate_each
+
+          expect(record.errors[attribute]).to include(error)
+        end
+      end
+
+      context 'with a malformed hostname should record an error' do
+        invalid_hostnames = ['testvalue.test.com:', 'testvalue-.test.com', '[testvalue.test.com]']
+        invalid_hostnames.each do | entry |
+          let(:value) do
+            entry
+          end
+
+          it 'should record an error on attribute' do
+            validate_each
+            expect(record.errors[attribute]).to include(error)
+          end
+        end
+
+      end
+    end
+  end
+end

data/spec/app/validators/ip_format_validator_spec.rb

@@ -69,30 +69,6 @@ RSpec.describe IpFormatValidator do
         end
       end
 
-      context 'with IPv4 range' do
-        let(:value) do
-          '127.0.0.1/8'
-        end
-
-        it 'should record error' do
-          validate_each
-
-          expect(record.errors[attribute]).to include("#{error} and not an IPv4 address range in CIDR or netmask notation")
-        end
-      end
-
-      context 'with IPv6 range' do
-        let(:value) do
-          '3ffe:505:2::1/48'
-        end
-
-        it 'should record error' do
-          validate_each
-
-          expect(record.errors[attribute]).to include("#{error} and not an IPv6 address range in CIDR or netmask notation")
-        end
-      end
-
       context 'without IPv4 or IPv6 address' do
         let(:value) do
           'localhost'

data/spec/app/validators/password_is_strong_validator_spec.rb

@@ -15,9 +15,9 @@ RSpec.describe PasswordIsStrongValidator do
     ]
   end
 
-  context '#contains_repetition' do
-    subject(:contains_repetition?) do
-      password_is_strong_validator.send(:contains_repetition?, password)
+  context '#is_only_repetition' do
+    subject(:is_only_repetition?) do
+      password_is_strong_validator.send(:is_only_repetition?, password)
     end
 
     context 'with all the same character' do
@@ -56,8 +56,8 @@ RSpec.describe PasswordIsStrongValidator do
       let(:password) do
         'abcdefgh'
       end
-
       it { is_expected.to eq(false) }
+
     end
   end
 
@@ -66,59 +66,48 @@ RSpec.describe PasswordIsStrongValidator do
       password_is_strong_validator.send(:contains_username?, username, password)
     end
 
-    let(:username) do
-      ''
-    end
-
-    context 'with blank password' do
-      let(:password) do
-        ''
-      end
-
-      it { is_expected.to eq(false) }
-    end
-
-    context 'without blank password' do
-      let(:password) do
-        'password'
+    context 'without blank username' do
+      let(:username) do
+        'username'
       end
 
-      context 'with blank username' do
-        let(:username) do
+      context 'with blank password' do
+        let(:password) do
           ''
         end
-
         it { is_expected.to eq(false) }
       end
 
-      context 'without blank username' do
+      context 'with reserved regex characters in username' do
         let(:username) do
-          'username'
+          "user(with)regex"
         end
 
-        it 'should escape username' do
-          expect(Regexp).to receive(:escape).with(username).and_call_original
-
-          contains_username?
+        context 'with username in password' do
+          let(:password) do
+            "myPassworduser(with)regexValue"
+          end
+          it { is_expected.to eq(false)}
         end
+      end
 
-        context 'with matching password' do
-          context 'of different case' do
-            let(:password) do
-              username.titleize
-            end
-
-            it { is_expected.to eq(true) }
+      context 'with matching password' do
+        context 'of different case' do
+          let(:password) do
+            username.titleize
           end
 
-          context 'of same case' do
-            let(:password) do
-              username
-            end
+          it { is_expected.to eq(true) }
+        end
 
-            it { is_expected.to eq(true) }
+        context 'of same case' do
+          let(:password) do
+            username
           end
+
+          it { is_expected.to eq(true) }
         end
+
       end
     end
   end
@@ -231,7 +220,7 @@ RSpec.describe PasswordIsStrongValidator do
 
             context 'without repetition' do
               let(:value) do
-                'A$uperg00dp@ssw0rd'
+                'A$uperg00dp@sw0rd'
               end
 
               it 'should not record any errors' do
@@ -245,4 +234,4 @@ RSpec.describe PasswordIsStrongValidator do
       end
     end
   end
-end
+end

data/spec/dummy/config/{database.yml.travis → database.yml.github_actions}

@@ -1,17 +1,16 @@
-# @note This file is only for use in travis-ci.  If you need to make a `spec/dummy/config/database.yml` for running
+# @note This file is only for use in github actions.  If you need to make a `spec/dummy/config/database.yml` for running
 # rake, rake spec, or rspec locally, please customize `spec/dummy/config/database.yml.example`.
 #
 # @example Customizing config/database.yml.example
 #   cp spec/dummy/config/database.yml.example spec/dummy/config/database.yml
 #   # update password fields for each environment's user
 
-# Using the postgres user locally without a host and port is the supported configuration from Travis-CI
-#
-# @see http://about.travis-ci.org/docs/user/database-setup/#PostgreSQL
 development: &pgsql
   adapter: postgresql
   database: metasploit_model_development
+  host: localhost
   username: postgres
+  password: postgres
   pool: 5
   timeout: 5
 
@@ -19,4 +18,4 @@ development: &pgsql
 # `rake`.  Do not set this db to the same as development or production.
 test:
   <<: *pgsql
-  database: metasploit_model_test
+  database: metasploit_model_test

data/spec/spec_helper.rb

@@ -8,9 +8,8 @@ Bundler.setup(:default, :test)
 # Require simplecov before loading ..dummy/config/environment.rb because it will cause metasploit_data_models/lib to
 # be loaded, which would result in Coverage not recording hits for any of the files.
 require 'simplecov'
-require 'coveralls'
 
-SimpleCov.formatter = Coveralls::SimpleCov::Formatter
+SimpleCov.formatter = SimpleCov::Formatter::HTMLFormatter
 
 require File.expand_path('../dummy/config/environment.rb',  __FILE__)
 require 'rspec/rails'

metadata

@@ -1,10 +1,10 @@
 --- !ruby/object:Gem::Specification
 name: metasploit-model
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.4
 platform: ruby
 authors:
-- Luke Imhoff
+- Metasploit Hackers
 autorequire: 
 bindir: bin
 cert_chain:
@@ -64,20 +64,20 @@ cert_chain:
   -----END CERTIFICATE-----
 - |
   -----BEGIN CERTIFICATE-----
-  MIIFIzCCBAugAwIBAgIQDX9ZkVJ2eNVTlibR5ALyJTANBgkqhkiG9w0BAQsFADBy
+  MIIFIzCCBAugAwIBAgIQCMePMbkSxvnPeJhYXIfaxzANBgkqhkiG9w0BAQsFADBy
   MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
   d3cuZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFzc3VyZWQg
-  SUQgQ29kZSBTaWduaW5nIENBMB4XDTE5MTAxNjAwMDAwMFoXDTIwMTAxOTEyMDAw
+  SUQgQ29kZSBTaWduaW5nIENBMB4XDTIwMTAwNzAwMDAwMFoXDTIzMTEwNjEyMDAw
   MFowYDELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxDzANBgNV
   BAcTBkJvc3RvbjETMBEGA1UEChMKUmFwaWQ3IExMQzETMBEGA1UEAxMKUmFwaWQ3
-  IExMQzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANHnKegPAghKuZk4
-  Gy1jKaZEXbWc4fxioTemv/F1yIYzAjCWP65qjKtyeeFDe4/kJzG9nseF9oa93YBf
-  1nyEqxNSZMw/sCAZ87lOl713dRi73uxOoszy2PT5xEB+Q5R6cbzExkWG2zrLdXDr
-  so0Bd6VHw+IsAoBBkAq5FrZOJQYGn5VY20xw/2DqtCeoW4QDWyqTnbJmwO9tZrfr
-  3Le2crfk2eOgafaPNhLon5uuIKCZsk2YkUSNURSS3M7gosMwU9Gg4JTBi7X5+oww
-  rY43dJT28YklxmNVu8o5kJxW4dqLKJLOIgSXZ63nceT/EaCSg7DcofHNcUzejFwb
-  M7Zbb2kCAwEAAaOCAcUwggHBMB8GA1UdIwQYMBaAFFrEuXsqCqOl6nEDwGD5LfZl
-  dQ5YMB0GA1UdDgQWBBR18CAeMsIEU+0pXal/XXw9LCtMADAOBgNVHQ8BAf8EBAMC
+  IExMQzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALNTz4zvAy7h/vQp
+  4dr1txXHlABAagkwYYwTMCtHs5PXsJITx/5SAjx5swuaLfze5kPBNF2YImvFlOXY
+  WaB+0PsOnXnaARsDZU683xFlj8izU6IN6VrAHzDLKFBzruJENrOJD/ikbEtbjO/q
+  gFbmS9J9v5ohG/pcRSS0t4ZPAwymf8eCp6QsvOKK/Aymp1RhlRaP8N6N5CIpkhz1
+  9p968iCE+DjOXVYxcWE+jE/7uB1dbgrXykNBujMSS3GULOvVEY28n6NCmrPlo23g
+  yRjYVJ2Vy14nBqnxDZ/yRIfWRVjWoT9TsAEbe9gY29oDpSCSs4wSmLQd5zGCpZ9h
+  r0HDFB8CAwEAAaOCAcUwggHBMB8GA1UdIwQYMBaAFFrEuXsqCqOl6nEDwGD5LfZl
+  dQ5YMB0GA1UdDgQWBBTLBL7DTwumVEKtdCdpHVYMXOFeDzAOBgNVHQ8BAf8EBAMC
   B4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwdwYDVR0fBHAwbjA1oDOgMYYvaHR0cDov
   L2NybDMuZGlnaWNlcnQuY29tL3NoYTItYXNzdXJlZC1jcy1nMS5jcmwwNaAzoDGG
   L2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWFzc3VyZWQtY3MtZzEuY3Js
@@ -86,14 +86,14 @@ cert_chain:
   JAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBOBggrBgEFBQcw
   AoZCaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3Vy
   ZWRJRENvZGVTaWduaW5nQ0EuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEL
-  BQADggEBAFpzR9s7lcYKDzSJucOHztEPj+iSIeCzxEw34NTE9M2AfkYIu82c4r2a
-  bzIGmzZWiCGufjOp0gF5xW6sSSJ9n0TqH0nhHhvjtZQkmkGtOBbN1zeYDFS2ozAp
-  sljF/g68Y1eYs3NaFf7kQUa6vb6RdjW3J8M9AQ8gthBt7gr/guVxd/gJUYbdDdBX
-  cWfJJi/X7GVBOBmmvA43qoKideuhOBrVGBHvIF/yO9p23dIiUrGmW9kxXCSxgute
-  JI/W23RbIRksG2pioMhd4dCXq3FLLlkOV1YfCwWixNB+iIhQPPZVaPNfgPhCn4Dt
-  DeGjje/qA4fkLtRmOtb9PUBq3ToRDE4=
+  BQADggEBAN+GL5/myPWg7oH4mVrG7/OhXF1MoYQF0ddaNiqaweEHMuKJBQCVZRbL
+  37HojoKXXv2yyRJBCeTB+ojrxX+5PdLVZa0ss7toWzJ2A1poPXZ1eZvm5xeFD32z
+  YQaTmmNWNI3PCDTyJ2PXUc+bDiNNwcZ7yc5o78UNRvp9Jxghya17Q76c9Ov9wvnv
+  dxxQKWGOQy0m4fBrkyjAyH9Djjn81RbQrqYgPuhd5nD0HjN3VUQLhQbIJrk9TVs0
+  EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
+  9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2020-02-01 00:00:00.000000000 Z
+date: 2021-04-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: metasploit-yard
@@ -141,16 +141,30 @@ dependencies:
   name: yard
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.8.7.4
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: e2mmap
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 0.8.7.4
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
@@ -210,16 +224,15 @@ dependencies:
 description: Common code, such as validators and mixins, that are shared between ActiveModels
   in metasploit-framework and ActiveRecords in metasploit_data_models.
 email:
-- luke_imhoff@rapid7.com
+- msfdev@metasploit.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".coveralls.yml"
+- ".github/workflows/verify.yml"
 - ".gitignore"
 - ".rspec"
 - ".simplecov"
-- ".travis.yml"
 - ".yardopts"
 - CHANGELOG.md
 - CONTRIBUTING.md
@@ -263,11 +276,11 @@ files:
 - app/models/metasploit/model/search/operator/single.rb
 - app/models/metasploit/model/search/query.rb
 - app/models/metasploit/model/visitation/visitor.rb
+- app/validators/address_format_validator.rb
 - app/validators/ip_format_validator.rb
 - app/validators/nil_validator.rb
 - app/validators/parameters_validator.rb
 - app/validators/password_is_strong_validator.rb
-- bin/rails
 - config/locales/en.yml
 - lib/metasploit/model.rb
 - lib/metasploit/model/association.rb
@@ -337,6 +350,7 @@ files:
 - spec/app/models/metasploit/model/search/operator/single_spec.rb
 - spec/app/models/metasploit/model/search/query_spec.rb
 - spec/app/models/metasploit/model/visitation/visitor_spec.rb
+- spec/app/validators/address_format_validator_spec.rb
 - spec/app/validators/ip_format_validator_spec.rb
 - spec/app/validators/nil_validator_spec.rb
 - spec/app/validators/parameters_validator_spec.rb
@@ -356,7 +370,7 @@ files:
 - spec/dummy/config/application.rb
 - spec/dummy/config/boot.rb
 - spec/dummy/config/database.yml.example
-- spec/dummy/config/database.yml.travis
+- spec/dummy/config/database.yml.github_actions
 - spec/dummy/config/environment.rb
 - spec/dummy/config/environments/development.rb
 - spec/dummy/config/environments/production.rb
@@ -435,7 +449,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.2.0
+      version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -476,6 +490,7 @@ test_files:
 - spec/app/models/metasploit/model/search/operator/single_spec.rb
 - spec/app/models/metasploit/model/search/query_spec.rb
 - spec/app/models/metasploit/model/visitation/visitor_spec.rb
+- spec/app/validators/address_format_validator_spec.rb
 - spec/app/validators/ip_format_validator_spec.rb
 - spec/app/validators/nil_validator_spec.rb
 - spec/app/validators/parameters_validator_spec.rb
@@ -495,7 +510,7 @@ test_files:
 - spec/dummy/config/application.rb
 - spec/dummy/config/boot.rb
 - spec/dummy/config/database.yml.example
-- spec/dummy/config/database.yml.travis
+- spec/dummy/config/database.yml.github_actions
 - spec/dummy/config/environment.rb
 - spec/dummy/config/environments/development.rb
 - spec/dummy/config/environments/production.rb

data/.coveralls.yml

@@ -1 +0,0 @@
-service_name: travis-ci

data/.travis.yml

@@ -1,21 +0,0 @@
-dist: trusty
-group: stable
-sudo: false
-cache: bundler
-language: ruby
-addons:
-  postgresql: '9.6'
-  apt:
-    packages:
-      - graphviz
-rvm:
-  - 2.6.5
-before_install:
-  - gem install bundler
-  - cp spec/dummy/config/database.yml.travis spec/dummy/config/database.yml
-  - bundle install
-  - bundle exec rake --version
-  - bundle exec rake db:test:prepare
-script:
-  - bundle exec rake spec
-  - bundle exec rake yard

data/bin/rails

@@ -1,14 +0,0 @@
-#!/usr/bin/env ruby
-# This command will automatically be run when you run "rails" with Rails gems
-# installed from the root of your application.
-
-ENGINE_ROOT = File.expand_path('..', __dir__)
-ENGINE_PATH = File.expand_path('../lib/metasploit/model/engine', __dir__)
-APP_PATH = File.expand_path('../test/dummy/config/application', __dir__)
-
-# Set up gems listed in the Gemfile.
-ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
-require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
-
-require 'rails/all'
-require 'rails/engine/commands'