pwn 0.5.739 → 0.5.741

data/spec/lib/pwn/plugins/repl_mesh_channel_route_spec.rb

@@ -3,7 +3,7 @@
 require 'spec_helper'
 require 'meshtastic'
 
-describe PWN::Plugins::REPL, 'mesh packet channel routing' do
+RSpec.shared_context 'mesh packet channel fixture' do
   let(:mesh_env) do
     {
       transport: 'serial',
@@ -42,6 +42,112 @@ describe PWN::Plugins::REPL, 'mesh packet channel routing' do
       PWN.send(:remove_const, c) if PWN.const_defined?(c)
     end
   end
+end
+
+describe PWN::Plugins::REPL, 'mesh packet channel routing' do
+  include_context 'mesh packet channel fixture'
+
+  [false, true].each do |local|
+    it "paints absolute source and destination paths for #{local ? 'TX' : 'RX'}" do
+      mesh_env[:mqtt] = { region: 'US/CA' }
+      win = double('rx', maxx: 200)
+      %i[attron attroff addstr refresh].each { |method| allow(win).to receive(method) }
+      allow(Curses).to receive(:color_pair) { |color| color }
+      PWN.const_set(:MeshRxBodyWin, win)
+      PWN.const_set(:MeshMutex, Mutex.new)
+      allow(described_class).to receive(:mesh_maybe_dispatch_to_pwn_ai)
+      described_class.send(:mesh_handle_rx, local: local, msg: { packet: {
+                             channel: 1, from: 0xb0b, to: 0xffffffff,
+                             decoded: { portnum: 1, payload: 'Absolute paths' }
+                           } })
+      expect(win).to have_received(:addstr).with(a_string_including('US/CA/2/e/LongFast/!00000b0b (ME)', 'US/CA/2/e/LongFast/#'))
+      expect(win).to have_received(:attron).with((local ? 23 : 21) | Curses::A_BOLD)
+    end
+    it "includes the original sender and message in a #{local ? 'sent' : 'received'} reaction without changing header colors" do
+      win = double('rx', maxx: 200)
+      %i[attron attroff addstr refresh].each { |method| allow(win).to receive(method) }
+      allow(Curses).to receive(:color_pair) { |color| color }
+      PWN.const_set(:MeshRxBodyWin, win)
+      PWN.const_set(:MeshMutex, Mutex.new)
+      PWN.const_set(:MeshRxState, {})
+      allow(described_class).to receive(:mesh_maybe_dispatch_to_pwn_ai)
+      original = Meshtastic::MeshPacket.new(id: 123, from: 0xaabbccdd, to: 0xffffffff, channel: 1,
+                                            decoded: { portnum: :TEXT_MESSAGE_APP, payload: 'Meet at noon' }).to_h
+      described_class.send(:mesh_handle_rx, msg: { packet: original })
+      reaction = Meshtastic::MeshPacket.new(id: 124, from: 0xb0b, to: 0xffffffff, channel: 1,
+                                            decoded: { portnum: :TEXT_MESSAGE_APP, payload: '👍'.b, emoji: 1, reply_id: 123 }).to_h
+      described_class.send(:mesh_handle_rx, local: local, msg: { packet: reaction })
+      expect(win).to have_received(:addstr).with(" Reacted to: \"!aabbccdd >> Meet at noon\" with: 👍.\n")
+      expect(win).to have_received(:attron).with((local ? 23 : 21) | Curses::A_BOLD).at_least(:once)
+      expect(described_class).to have_received(:mesh_maybe_dispatch_to_pwn_ai).once
+      reply = Meshtastic::MeshPacket.new(id: 125, from: 0xb0b, to: 0xffffffff, channel: 1,
+                                         decoded: { portnum: :TEXT_MESSAGE_APP, payload: 'See you there!', reply_id: 123 }).to_h
+      described_class.send(:mesh_handle_rx, local: local, msg: { packet: reply })
+      expect(win).to have_received(:addstr).with(" Replied to: \"!aabbccdd >> Meet at noon\" with: See you there!\n")
+    end
+  end
+
+  it 'uses the received topic region for both endpoints of a DM' do
+    mesh_env[:mqtt] = { region: 'US' }
+    win = double('rx', maxx: 200)
+    %i[attron attroff addstr refresh].each { |method| allow(win).to receive(method) }
+    allow(Curses).to receive(:color_pair).and_return(0)
+    PWN.const_set(:MeshRxBodyWin, win)
+    PWN.const_set(:MeshMutex, Mutex.new)
+    allow(described_class).to receive(:mesh_maybe_dispatch_to_pwn_ai)
+    described_class.send(:mesh_handle_rx, msg: {
+                           topic: 'msh/US/CA/2/e/LongFast/!aabbccdd',
+                           packet: { channel: 1, from: 0xaabbccdd, to: 0xb0b, decoded: { portnum: 1, payload: 'DM' } }
+                         })
+    expect(win).to have_received(:addstr).with(a_string_including('US/CA/2/e/LongFast/!aabbccdd', 'US/CA/2/e/LongFast/!00000b0b (ME)'))
+  end
+
+  it 'preserves a configured channel topic without a wildcard suffix' do
+    mesh_env[:channel][:LongFast][:topic] = '2/e/LongFast'
+    expect(described_class.send(:mesh_conversation_path, env: mesh_env, channel_name: 'LongFast')).to eq('US/2/e/LongFast')
+  end
+
+  it 'remembers the actual transmitted packet ID for reactions to locally sent messages' do
+    sent = nil
+    allow(Meshtastic::Serial).to receive(:send_to_radio) do |args|
+      sent = Meshtastic::ToRadio.decode(args[:to_radio]).packet
+    end
+    allow(described_class).to receive(:mesh_maybe_dispatch_to_pwn_ai)
+    described_class.send(:mesh_send_text, env: mesh_env, obj: radio, text: 'Local message', channel_name: 'LongFast')
+    expect(sent.decoded.payload).to eq('Local message')
+    packet = { decoded: { emoji: 1, reply_id: sent.id } }
+    text = described_class.send(:mesh_reaction_text, packet: packet, text: '👍', channel: 'LongFast', index: 1)
+    expect(text).to eq('Reacted to: "!00000b0b >> Local message" with: 👍.')
+  end
+
+  it 'recovers a reaction target from transport history when the display cache is empty' do
+    radio[:proto_data] << Meshtastic::FromRadio.new(packet: {
+                                                      id: 123, from: 0xaabbccdd, to: 0xffffffff, channel: 1,
+                                                      decoded: { portnum: :TEXT_MESSAGE_APP, payload: 'Earlier message' }
+                                                    }).to_h
+    packet = { channel: 1, decoded: { emoji: 1, reply_id: 123 } }
+    text = described_class.send(:mesh_reaction_text, packet: packet, text: '👍', channel: 'LongFast', index: 1)
+    expect(text).to eq('Reacted to: "!aabbccdd >> Earlier message" with: 👍.')
+  end
+
+  it 'resolves the same radio slot after its channel name becomes known' do
+    described_class.send(:mesh_reaction_text, packet: { id: 123, decoded: {} }, text: 'Before channel listing', from: '!aabbccdd', channel: '', index: 1)
+    packet = { decoded: { emoji: 1, reply_id: 123 } }
+    text = described_class.send(:mesh_reaction_text, packet: packet, text: '👍', channel: 'LongFast', index: 1)
+    expect(text).to eq('Reacted to: "!aabbccdd >> Before channel listing" with: 👍.')
+    other = described_class.send(:mesh_reaction_text, packet: packet, text: '👍', channel: 'LongFast', index: 2)
+    expect(other).to include('original message unavailable')
+  end
+
+  it 'labels unavailable reaction targets rather than inventing their sender or text' do
+    packet = { decoded: { emoji: 1, reply_id: 999 } }
+    text = described_class.send(:mesh_reaction_text, packet: packet, text: '👍', channel: 'LongFast', index: 1)
+    expect(text).to eq('Reacted to: "original message unavailable (packet 999)" with: 👍.')
+    packet[:decoded][:emoji] = 0
+    expect(described_class.send(:mesh_reaction_text, packet: packet, text: 'Reply')).to eq('Replied to: "original message unavailable (packet 999)" with: Reply')
+    packet[:decoded].delete(:reply_id)
+    expect(described_class.send(:mesh_reaction_text, packet: packet, text: '👍')).to eq('👍')
+  end
 
   it 'does not route LongFast to disabled protobuf slots with omitted roles' do
     mesh_env[:channel][:LongFast].delete(:radio_index)

data/spec/lib/pwn/plugins/repl_mesh_history_spec.rb

@@ -1,8 +1,130 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'meshtastic'
 
 describe PWN::Plugins::REPL, 'mesh compose history' do
+  it 'does not warn when the real subscriber sees an empty protobuf Data message' do
+    stub_const('PWN::MeshTransport', :serial)
+    queue = Queue.new
+    encoded = Meshtastic::FromRadio.new(packet: { decoded: Meshtastic::Data.new }).to_proto
+    queue << Meshtastic::FromRadio.decode(encoded)
+    queue << Meshtastic::FromRadio.new(queueStatus: { free: 1 })
+    queue.close
+    received = []
+    output = StringIO.new
+    old = $stdout
+    $stdout = output
+    described_class.send(:mesh_subscribe, obj: { from_radio_queue: queue }, psks: {}, on_message: proc { |message| received << message })
+    expect(received.size).to eq(2)
+    expect(output.string).not_to include("Can't decode")
+    Meshtastic::MeshInterface.new.decode_payload(payload: 'unsupported', msg_type: :PRIVATE_APP)
+    expect(output.string).to include("Can't decode", 'unsupported')
+  ensure
+    $stdout = old
+  end
+
+  it 'queues warnings for acknowledgement instead of writing through the TUI' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    expect(described_class).not_to receive(:puts)
+    described_class.send(:mesh_ui_puts, text: 'WARNING: fixture warning')
+    expect(events.pop(true)).to eq(notice: 'WARNING: fixture warning')
+  end
+
+  it 'displays queued diagnostics on the UI thread' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    events << { notice: 'RX failed: fixture' }
+    expect(described_class).to receive(:mesh_notice).with(text: 'RX failed: fixture')
+    described_class.send(:mesh_drain_events)
+  end
+
+  it 'captures dependency stdout and stderr and restores both streams on failure' do
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    original = [$stdout, $stderr]
+    expect do
+      described_class.send(:mesh_capture_output, run: proc {
+        puts 'WARNING: decoder fixture'
+        warn 'ERROR: transport fixture'
+        raise IOError, 'fixture'
+      })
+    end.to raise_error(IOError, 'fixture')
+    expect([$stdout, $stderr]).to eq(original)
+    output = []
+    output << events.pop(true)[:notice] until events.empty?
+    expect(output.join).to include('WARNING: decoder fixture', 'ERROR: transport fixture')
+  end
+
+  it 'centers a reverse-colored Ok button and repaints the underlying panes' do
+    win = double('notice', maxx: 78, maxy: 6)
+    %i[keypad erase setpos addstr refresh close attron attroff].each { |method| allow(win).to receive(method) }
+    allow(Curses).to receive(:color_pair).with(20).and_return(5120)
+    allow(Curses).to receive(:cols).and_return(80)
+    allow(Curses).to receive(:lines).and_return(24)
+    allow(Curses::Window).to receive(:new).and_return(win)
+    pane = double('pane', touch: nil, refresh: nil)
+    stub_const('PWN::MeshTxWin', pane)
+    keys = ["\e", 'q', "\n"]
+    described_class.send(:mesh_notice, text: 'Decoder warning', getch: proc { keys.shift })
+    expect(keys).to be_empty
+    expect(win).to have_received(:addstr).with('Ok').exactly(3).times
+    expect(win).not_to have_received(:addstr).with(a_string_matching(/Acknowledged|Enter/))
+    expect(win).to have_received(:setpos).with(4, 38).exactly(3).times
+    expect(win).to have_received(:attron).with(5120 | Curses::A_BOLD | Curses::A_REVERSE).exactly(3).times
+    expect(win).to have_received(:attroff).with(5120 | Curses::A_BOLD | Curses::A_REVERSE).exactly(3).times
+    expect(win).to have_received(:close)
+    expect(pane).to have_received(:touch)
+  end
+
+  it 'keeps an idle PhoneAPI session alive and stops its heartbeat with the subscriber' do
+    events = Queue.new
+    beats = Queue.new
+    release = Queue.new
+    obj = {}
+    stub_const('PWN::MeshEvents', events)
+    stub_const('PWN::MeshObj', obj)
+    stub_const('PWN::MeshTransport', :serial)
+    allow(Meshtastic::Serial).to receive(:send_to_radio) do |args|
+      beats << [Thread.current, Meshtastic::ToRadio.decode(args[:to_radio])]
+    end
+    allow(described_class).to receive(:mesh_subscribe) do |args|
+      release.pop
+      args[:on_message].call(packet: { decoded: { portnum: 1, payload: 'after idle' } })
+    end
+    thread = described_class.send(:mesh_start_rx!, env: { channel: {} }, obj: obj, heartbeat_interval: 0.01)
+    first = beats.pop(timeout: 1)
+    second = beats.pop(timeout: 1)
+    expect(first).not_to be_nil
+    expect(second).not_to be_nil
+    expect(second.last.payload_variant).to eq(:heartbeat)
+    expect(second.last.heartbeat.nonce).to eq(0)
+    release << true
+    expect(thread.join(1)).to eq(thread)
+    expect(first.first).not_to be_alive
+    expect(events.pop[:msg].dig(:packet, :decoded, :payload)).to eq('after idle')
+  ensure
+    thread&.kill
+    thread&.join(1)
+  end
+
+  it 'drains incoming messages during idle input polls without a keypress' do
+    pi = double('pry', config: double('config', pwn_mesh: true))
+    events = Queue.new
+    stub_const('PWN::MeshEvents', events)
+    message = { packet: { decoded: { portnum: 1, payload: 'idle RX' } } }
+    polls = 0
+    allow(described_class).to receive(:mesh_draw_input)
+    expect(described_class).to receive(:mesh_handle_rx).with(msg: message)
+    reader = proc do
+      polls += 1
+      events << { msg: message } if polls == 20
+      polls > 20 ? "\u0004" : nil
+    end
+    described_class.send(:mesh_console_loop, pry: pi, getch: reader)
+  end
+
   it 'recalls submissions with Up/Down and restores the unfinished draft and cursor' do
     config = double('config', pwn_mesh: true)
     pry = double('pry', config: config)

data/spec/lib/pwn/plugins/rop_spec.rb

@@ -11,4 +11,23 @@ describe 'ROP normalized adapter' do
     expect(result[:gadgets]).to all(include(:gadget, :address, :regs_clobbered))
     expect(result[:gadgets].all? { |row| row[:gadget].split(';').length <= 2 }).to eq(true)
   end
+
+  it 'parses ropper and rp listings into queryable gadget records' do
+    ropper = <<~TXT
+      [INFO] Load gadgets from cache
+      0x000000000040101a: pop rdi; ret
+      0x000000000040101b: pop rsi; pop r15; ret
+    TXT
+    rp = <<~TXT
+      0x0000000000401020: pop rdx ; ret
+      0x401021: ret
+    TXT
+    a = PWN::Plugins::ROP.parse(text: ropper, backend: 'ropper')
+    b = PWN::Plugins::ROP.parse(text: rp, backend: 'rp')
+    expect(a.map { |row| row[:gadget] }).to include('pop rdi; ret')
+    expect(a.first).to include(:address, :gadget)
+    expect(b.map { |row| format('%#x', row[:address]) }).to include('0x401020')
+    hits = PWN::Plugins::ROP.filter(gadgets: a + b, constraints: { contains: 'pop rdx' })
+    expect(hits.length).to eq(1)
+  end
 end

data/spec/lib/pwn/plugins/transparent_browser_spec.rb

@@ -2,6 +2,7 @@
 
 require 'spec_helper'
 require 'tmpdir'
+require 'json'
 
 describe PWN::Plugins::TransparentBrowser do
   it 'should display information for authors' do
@@ -53,6 +54,7 @@ describe PWN::Plugins::TransparentBrowser do
   it 'evidence! writes screenshot, dom, and har files' do
     Dir.mktmpdir do |dir|
       allow(Dir).to receive(:home).and_return(dir)
+      stub_const('PWN::Plugins::ArtifactRegistry::ROOT', File.join(dir, 'artifacts'))
       browser = Object.new
       def browser.html
         '<html/>'
@@ -63,4 +65,73 @@ describe PWN::Plugins::TransparentBrowser do
       expect(File.file?(out[:har])).to be true
     end
   end
+
+  it 'goto optionally spills screenshot, DOM, and HAR into the artifact store' do
+    Dir.mktmpdir('pwn-tb-cap-') do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      stub_const('PWN::Plugins::ArtifactRegistry::ROOT', File.join(dir, 'artifacts'))
+      browser = Object.new
+      def browser.html
+        '<html><body>admin</body></html>'
+      end
+
+      def browser.goto(url)
+        @url = url
+      end
+
+      def browser.url
+        @url.to_s
+      end
+      out = described_class.goto(
+        browser_obj: { browser: browser },
+        url: 'https://app.example.test/admin',
+        capture: true,
+        session_id: 'web'
+      )
+      expect(out[:url]).to include('/admin')
+      expect(File.binread(out[:evidence][:screenshot]).b.start_with?("\x89PNG".b)).to be true
+      har = JSON.parse(File.read(out[:evidence][:har]))
+      expect(har.dig('log', 'entries').to_s).to include('/admin')
+      expect(out[:evidence][:screenshot_handle].to_s).not_to be_empty
+      expect(out[:evidence][:har_handle].to_s).not_to be_empty
+    end
+  end
+
+  it 'records an auth-bypass finding with pixel and HAR proof in one goto' do
+    Dir.mktmpdir('pwn-tb-find-') do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      stub_const('PWN::Plugins::ArtifactRegistry::ROOT', File.join(dir, 'artifacts'))
+      stub_const('PWN::Plugins::Findings::FILE', File.join(dir, 'findings.jsonl'))
+      browser = Object.new
+      def browser.html
+        '<html><h1>Dashboard</h1></html>'
+      end
+
+      def browser.goto(url)
+        @url = url
+      end
+
+      def browser.url
+        @url.to_s
+      end
+      out = described_class.goto(
+        browser_obj: { browser: browser },
+        url: 'https://app.example.test/admin',
+        title: 'Auth bypass',
+        severity: 'high',
+        session_id: 'web'
+      )
+      row = out[:finding]
+      expect(row[:title]).to match(/auth bypass/i)
+      arts = Array(row[:poc_artifacts]) + Array(row[:evidence_artifacts]).flat_map { |item| [item[:path], item[:stored]] }
+      shot = arts.find { |path| path.to_s.end_with?('.png') || (File.file?(path.to_s) && File.binread(path).b.start_with?("\x89PNG".b)) }
+      har = arts.find { |path| path.to_s.include?('har') || (File.file?(path.to_s) && File.read(path).include?('"log"')) }
+      expect(shot).not_to be_nil
+      expect(har).not_to be_nil
+      expect(File.binread(shot).b.start_with?("\x89PNG".b)).to be true
+      expect(JSON.parse(File.read(har)).dig('log', 'entries').to_s).to include('/admin')
+      stored = PWN::Plugins::Findings.report
+      expect(stored.first[:title]).to match(/auth bypass/i)
+    end
+  end
 end

data/spec/lib/pwn/plugins/vault_spec.rb

@@ -23,4 +23,45 @@ describe PWN::Plugins::Vault do
       expect(described_class.redact(text: 'tok=s3cret-value')).to include('{{vault:api}}')
     end
   end
+
+  it 'stores engagement-scoped creds with provenance and offers them for auth' do
+    Dir.mktmpdir('pwn-loot-') do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      row = described_class.store(
+        secret: 'hunter2',
+        username: 'admin',
+        host: 'app.example.test',
+        service: 'http',
+        kind: 'password',
+        source: 'recon',
+        where: 'https://app.example.test/.env',
+        finding_id: 'f00bar',
+        engagement: 'lab'
+      )
+      expect(row[:engagement]).to eq('lab')
+      expect(row[:finding_id]).to eq('f00bar')
+      expect(row[:where]).to include('.env')
+      hits = described_class.query(host: 'app.example.test', engagement: 'lab')
+      expect(hits.first[:username]).to eq('admin')
+      expect(hits.first[:finding_id]).to eq('f00bar')
+      offered = described_class.offer(host: 'app.example.test', service: 'http', engagement: 'lab')
+      expect(offered.first[:username]).to eq('admin')
+      expect(offered.first[:secret]).to eq('hunter2')
+    end
+  end
+
+  it 'ingests recon banner creds into the loot store' do
+    Dir.mktmpdir('pwn-loot-ingest-') do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      described_class.ingest(
+        text: "username=admin\npassword=hunter2\n",
+        host: 'app.example.test',
+        source: 'recon',
+        where: 'banner:22',
+        engagement: 'lab'
+      )
+      offered = described_class.offer(host: 'app.example.test', engagement: 'lab')
+      expect(offered.first[:secret]).to eq('hunter2')
+    end
+  end
 end

data/spec/lib/pwn/reports/engagement_spec.rb

@@ -12,6 +12,57 @@ describe PWN::Reports::Engagement do
     expect(described_class).to respond_to :help
   end
 
+  it 'isolates default findings from named engagements with symbol and string keys' do
+    rows = [{ title: 'legacy' }, { 'title' => 'default row', 'engagement_id' => 'default' },
+            { title: 'private alpha', engagement_id: 'alpha' }, { 'title' => 'private beta', 'engagement_id' => 'beta' }]
+    allow(PWN::Plugins::Findings).to receive(:report).and_return(rows)
+    Dir.mktmpdir do |dir|
+      out = described_class.generate(dir_path: dir)
+      data = JSON.parse(File.read(out[:json]))
+      expect(data['findings'].map { |row| row['title'] }).to eq(['legacy', 'default row'])
+      out = described_class.generate(engagement: 'beta', dir_path: dir)
+      expect(JSON.parse(File.read(out[:json]))['findings'].map { |row| row['title'] }).to eq(['private beta'])
+    end
+  end
+
+  it 'excludes explicitly supplied findings belonging to other engagements' do
+    Dir.mktmpdir do |dir|
+      out = described_class.generate(engagement: 'alpha', dir_path: dir, findings: [
+                                       { title: 'implicit' }, { 'title' => 'selected', 'engagement_id' => 'alpha' },
+                                       { title: 'other', engagement_id: 'beta' }
+                                     ])
+      expect(JSON.parse(File.read(out[:json]))['findings'].map { |row| row['title'] }).to eq(%w[implicit selected])
+    end
+  end
+
+  it 'keeps finding evidence portable after moving the generated report bundle' do
+    Dir.mktmpdir do |dir|
+      stored = File.join(dir, 'stored')
+      bytes = "raise 'Do not execute this fixture'"
+      File.write(stored, bytes)
+      evidence = { kind: 'poc', handle: 'artifact:fixture', label: '../fixture.rb', stored: stored,
+                   sha256: Digest::SHA256.hexdigest(bytes), size: bytes.bytesize, finding_id: 'f1', ts: 'fixture-time' }
+      bundle = File.join(dir, 'bundle')
+      out = described_class.generate(engagement: 'lab', dir_path: bundle, findings: [
+                                       { id: 'f1', engagement_id: 'lab', title: 'fixture', poc: bytes,
+                                         reproduction_steps: ['Run fixture in lab', 'Observe output'], severity_justification: 'Fixture only',
+                                         evidence_artifacts: [evidence], legacy_field: 'preserved' }
+                                     ])
+      moved = File.join(dir, 'moved')
+      FileUtils.mv(bundle, moved)
+      File.unlink(stored)
+      row = JSON.parse(File.read(File.join(moved, File.basename(out[:json]))))['findings'].first
+      exported = row['evidence_artifacts'].first
+      expect(exported).to include('handle' => 'artifact:fixture', 'finding_id' => 'f1', 'ts' => 'fixture-time')
+      expect(row['legacy_field']).to eq('preserved')
+      expect(File.binread(File.join(moved, exported['attachment']))).to eq(bytes)
+      %i[html markdown].each do |format|
+        text = File.read(File.join(moved, File.basename(out[format])))
+        expect(text).to include(exported['attachment'], evidence[:sha256], 'Fixture only', 'Observe output')
+      end
+    end
+  end
+
   it 'writes html for two findings with poc paths' do
     Dir.mktmpdir do |dir|
       poc = File.join(dir, 'poc.rb')