stratagem 0.1.7

data/lib/stratagem/auto_mock/value_generator.rb

@@ -0,0 +1,174 @@
+module Stratagem::AutoMock
+  module ValueGenerator
+    ADDRESSES = [
+      {:street => "1600 Pennsylvania Avenue, NW", :city => "Washington", :state => "DC", :zip_code => '20500', :phone => "(202) 395-2020", :fax => "(202) 395-2020"},
+      {:street => "525 8th Ave", :city => "New York", :state => "NY", :zip_code => '10018', :phone => "(212) 869-6427", :fax => "(202) 395-2020" }
+    ]
+    USERS = [
+      {:email => "wchurchill@stratagemapp.com", :first => "winston", :last => "churchill", :login => "wchurchill#{rand 1000}", :password => 'P7D8y5fycaaaa00pa' },
+      {:email => "bwalsh@stratagemapp.com", :first => "brenda", :last => "walsh", :login => "bwalsh#{rand 1000}", :password => '@.04@49\PFtB00a0d' },
+      {:email => "hiro@stratagemapp.com", :first => "hiro", :last => "protagonist", :login => "bigtimehiro#{rand 1000}", :password => '4Kq651p0A534p7T01klj' }
+    ]
+    GENERIC_NAMES = [
+      'supercalifragilisticexpialidocious',
+      'hippopotomonstrosesquipedalian',
+      'honorificabilitudinitatibus',
+      'otorhinolaryngological',
+      'tom'
+    ]
+    GENERIC_URLS = [
+      'http://www.thewebsiteisdown.com',
+      'http://www.failblog.org',
+      'http://www.xkcd.org'
+    ]
+
+    NUMERIC_TYPES = [
+      :decimal, :float, :integer
+    ]
+
+    def generate_value(attribute_name, attribute_type)
+      @address ||= ADDRESSES[rand ADDRESSES.size]
+      @user ||= USERS[rand USERS.size]
+      value = case attribute_type
+        when :string
+          generate_string(attribute_name)
+        when :integer
+          generate_int(attribute_name)
+        when :datetime
+          generate_datetime(attribute_name)
+        when :date
+          generate_datetime(attribute_name)
+        when :text
+          generate_text(attribute_name)
+        when :boolean
+          generate_boolean(attribute_name)
+        when :decimal
+          generate_float(attribute_name)
+        when :float
+          generate_float(attribute_name)
+        when :symbol
+          generate_string(attribute_name).to_sym
+        else
+          raise Stratagem::AutoMock::UnsupportedColumnTypeError.new("Attribute #{attribute_name} of type #{attribute_type} is not supported")
+      end
+      value = nil if (rand(20) == 1) && !NUMERIC_TYPES.include?(attribute_type)
+      value
+    end
+
+    def generate_string(attribute_name)
+      attribute_name = attribute_name.to_s
+      if (attribute_name.stratagem_contains_token?('email') || attribute_name.stratagem_contains_token?('e-mail'))
+        (random_noise(4,false) || '') + @user[:email]
+      elsif (attribute_name.stratagem_contains_token?('login') || attribute_name.stratagem_contains_token?('username') || attribute_name.stratagem_contains_token?('user_name'))
+        @user[:login] + (random_noise(4, false) || '')
+      elsif (attribute_name.stratagem_contains_token?('first') && attribute_name.stratagem_contains_token?('name'))
+        (random_noise(2, false) || '') + @user[:first]
+      elsif (attribute_name.stratagem_contains_token?('last') && attribute_name.stratagem_contains_token?('name'))
+        (random_noise(2, false) || '') + @user[:last]
+      elsif (attribute_name.stratagem_contains_token?('password'))
+        @user[:password]
+      elsif (attribute_name.stratagem_contains_token?('zip_code') || attribute_name.stratagem_contains_token?('zipcode'))
+        @address[:zip_code]
+      elsif (attribute_name.stratagem_contains_token?('phone'))
+        @address[:phone]
+      elsif (attribute_name.stratagem_contains_token?('fax'))
+        @address[:fax]
+      elsif (attribute_name.stratagem_contains_token?('address'))
+        @address[:street]
+      elsif (attribute_name.stratagem_contains_token?('city'))
+        @address[:city]
+      elsif (attribute_name.stratagem_contains_token?('state'))
+        @address[:state]
+      elsif (attribute_name.stratagem_contains_token?('name'))
+        value = GENERIC_NAMES[rand GENERIC_NAMES.size]
+        noise = random_noise(4)
+        value += noise unless value.nil? || noise.nil?
+      elsif (attribute_name.stratagem_contains_token?('url'))
+        GENERIC_URLS[rand GENERIC_URLS.size]
+      elsif (attribute_name.stratagem_contains_token?('ip'))
+        "#{rand(156)+100}.#{rand(156)+100}.#{rand(156)+100}.#{rand(156)+100}"
+      else
+        random_noise
+      end
+    end
+
+    def generate_float(attribute_name)
+      if (attribute_name.to_s.stratagem_contains_token?('price'))
+        ((rand + rand(10)) * 100).round.to_f / 100
+      else
+        rand
+      end
+    end
+
+    def generate_boolean(attribute_name)
+      case rand(4)
+        when 0
+          false
+        when 1
+          true
+        when 2
+          '0'
+        when 3
+          '1'
+      end
+    end
+
+    def generate_int(attribute_name)
+      rand(1000)+1
+    end
+
+    def generate_datetime(attribute_name)
+      Time.now+rand(10.days)
+    end
+
+    def generate_text(attribute_name)
+      random_noise(200)
+    end
+
+    private
+
+    def random_noise(size=nil, use_non_alpha_numeric=true)
+      size ||= rand(20)
+      options = {
+        :ssn => [
+                Proc.new { "#{rand(800)+100}-#{rand(80)+10}-#{rand(9000)+1000}" },
+                Proc.new { "#{rand(800)+100}#{rand(80)+10}#{rand(9000)+1000}" },
+                Proc.new { "#{rand(800)+100} #{rand(80)+10} #{rand(9000)+1000}" }
+        ],
+        :phone => [
+                Proc.new { "#{rand(800)+100}-#{rand(800)+100}-#{rand(9000)+1000}" },
+                Proc.new { "(#{rand(800)+100}) #{rand(800)+100}-#{rand(9000)+1000}" },
+                Proc.new { "(#{rand(800)+100})#{rand(800)+100}-#{rand(9000)+1000}" },
+        ],
+        :zip_code => [
+                Proc.new { "#{rand(90000)+10000}" },
+                Proc.new { "#{rand(90000)+10000}-#{rand(900)+100}" },
+                Proc.new { "#{rand(90000)+10000} #{rand(900)+100}" }
+        ],
+        :credit_card => [
+                Proc.new { "#{rand(900)+100} #{rand(900)+100} #{rand(900)+100} #{rand(900)+100}" },
+                Proc.new { "#{rand(900)+100}-#{rand(900)+100}-#{rand(900)+100}-#{rand(900)+100}" },
+                Proc.new { "#{rand(900)+100}-#{rand(900)+100}-#{rand(900)+100}-#{rand(900)+100}" }
+        ],
+        :date => [
+                Proc.new { "#{rand(9)+1}/#{rand(90)+10}" },
+                Proc.new { "#{rand(9)+1}/#{rand(100)+1990}" }
+        ],
+        :random => [
+          Proc.new {
+            c = 'abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNOPQRSTUVWXYZ0123456789-_@.        '
+            s = ''
+            size.times { |i| s << c[rand(c.length)] }
+            s
+          }
+        ],
+        :nil => [Proc.new { nil }]
+      }
+      procs = options.values[rand(options.values.size)]
+      proc = procs[rand(procs.size)]
+      result = proc.call
+      result.gsub!(/[^A-Za-z0-9]/, '') unless use_non_alpha_numeric || result.nil?
+      result
+    end
+  end
+end

data/lib/stratagem/auto_mock.rb

@@ -0,0 +1,6 @@
+module Stratagem::AutoMock
+end
+
+require 'stratagem/auto_mock/value_generator'
+require 'stratagem/auto_mock/factory'
+require 'stratagem/auto_mock/aquifer'

data/lib/stratagem/blocker.rb

@@ -0,0 +1,16 @@
+require 'thread'
+
+class Blocker
+  def initialize
+    @mutex = Mutex.new
+    @cv = ConditionVariable.new
+  end
+  
+  def wait
+    @mutex.synchronize { @cv.wait(@mutex) }
+  end
+  
+  def notify
+    @mutex.synchronize { @cv.signal }
+  end
+end

data/lib/stratagem/client.rb

@@ -0,0 +1,32 @@
+require 'uri'
+
+module Stratagem
+  class Client
+    def initialize(authentication)
+      @authentication = authentication
+    end
+    
+    def send(snapshot)
+      Stratagem.logger.debug "Sending report to server"
+      url = URI.parse("#{@authentication.base_url}/snapshots")
+      req = Net::HTTP::Post.new(url.path)
+      req.set_form_data({
+        'api_key' => @authentication.credentials[:token],
+        'project_id' => @authentication.credentials[:project],
+        'timestamp' => snapshot.timestamp.to_i,
+        'model' => snapshot.model.export.to_json
+      }, ';')
+      res = Net::HTTP.new(url.host, url.port).start {|http| http.request(req) }
+      puts "response:"
+      case res
+      when Net::HTTPSuccess, Net::HTTPRedirection
+        puts "Visit #{@authentication.base_url} for your security posture."
+        # OK
+      else
+        res.error!
+      end
+
+      Stratagem.logger.phase('complete')
+    end
+  end
+end

data/lib/stratagem/command.rb

@@ -0,0 +1,13 @@
+module Stratagem::Command
+  class << self
+    def run(command)
+      klass = load_command_class(command)
+      klass.new.run
+    end
+    
+    def load_command_class(command)
+      module_eval("Stratagem::Command::#{command.camelize}")
+    end
+
+  end
+end

data/lib/stratagem/commands/analyze.rb

@@ -0,0 +1,22 @@
+module Stratagem::Command
+  class Analyze < Base
+    def run
+      require './config/environment'
+      require 'stratagem/interface/browser'
+
+      authentication = Stratagem::Authentication.instance
+
+      while !Sinatra::Application.running
+        puts "Waiting for Sinatra to launch"
+        sleep 0.5
+      end
+      
+      puts "Launching your web browser"
+      Launchy::Browser.run(authentication.url)
+      Stratagem.wait_for_completion
+
+      log "" # ensure logger sends final message
+      puts "analysis complete. exiting."
+    end
+  end
+end

data/lib/stratagem/commands/base.rb

@@ -0,0 +1,11 @@
+module Stratagem::Command
+  class Base
+    def logger
+      Stratagem.logger
+    end
+    
+    def log(msg)
+      logger.debug(msg)
+    end
+  end
+end

data/lib/stratagem/commands/devel_crawl.rb

@@ -0,0 +1,27 @@
+module Stratagem::Command
+  class DevelCrawl < Base
+    include Stratagem::Crawler::Session
+    
+    def run
+      require './config/environment'
+
+      crawler_session do
+        phase(:unauthenticated)
+        crawl
+        display
+        authenticated = authenticate(true)
+
+        if (authenticated)
+          phase(:authenticated)
+          crawl
+          display
+        end
+      end
+      
+      puts "SSL? #{authentication.ssl}"
+      puts "AUTHENTICATED? #{authentication.success}"
+
+      
+    end
+  end
+end

data/lib/stratagem/commands/devel_mock.rb

@@ -0,0 +1,10 @@
+module Stratagem::Command
+  class DevelMock < Base
+    def run
+      require 'config/environment'
+      require 'stratagem/labs/auto_mock'
+
+      Stratagem::Labs::AutoMock.new.run
+    end
+  end
+end

data/lib/stratagem/commands.rb

@@ -0,0 +1,7 @@
+module Stratagem::Commands
+end
+
+require 'stratagem/commands/base'
+require 'stratagem/commands/analyze'
+require 'stratagem/commands/devel_crawl'
+require 'stratagem/commands/devel_mock'

data/lib/stratagem/crawler/authentication.rb

@@ -0,0 +1,109 @@
+module Stratagem::Crawler
+  class AuthenticationData
+    attr_accessor :success, :login_page, :form, :response_page, :ssl
+  end
+
+
+  module Authentication
+    include Stratagem::Crawler::TraceUtils
+
+    def authentication
+      @authentication_data ||= AuthenticationData.new()
+    end
+
+    def authenticate
+      page, form = find_login_form
+      if (page && form)
+        authentication.login_page = page
+        login(form)
+        form.submit {|action,params| 
+          post(action, params)
+          response
+        }
+
+        route = application_model.routes.recognize(response.request.path, :post)
+        page = site_model.add(route, response) {|response| }
+        authentication.response_page = page
+
+        begin
+          authentication.success = authentication.response_page.login_form.nil?
+        rescue
+          puts $!.message
+          puts $!.backtrace
+        end
+        puts "authenticated? #{authentication.success}"
+      else
+        puts "Authentication Error: Unable to locate sign in form"
+      end
+
+      if (response)
+        authentication.ssl = response.request.ssl?
+        authentication.success
+      else
+        false
+      end
+    end
+
+    def find_login_form
+      site_model.pages.sort {|a,b| b.inbound_edges(:redirect).size <=> a.inbound_edges(:redirect).size }.each do |page|
+        puts "Testing page #{page.url} for sign in form"
+        page.reload {|url| get url; response }
+        form = page.login_form
+        return [page, form] if (form)
+      end
+      []
+    end
+
+    def login(form)
+      attr_names = form.inputs.map {|input| input.guess_attribute.to_sym }
+      model = guess_login_model(attr_names)
+
+      if model
+        record = Stratagem::AutoMock::Aquifer.instance.random_instance(model.klass)
+
+        if (record)
+          puts "populating login form"
+          populate_login_form(model, form, record)
+        else
+          log "ERROR: Unable to find suitable model to populate authentication form with."
+        end
+      else
+        raise "Unable to infer model from inputs"
+      end
+    end
+
+    def guess_login_model(attr_names)
+      selections = application_model.models.select {|model|
+        intersect = (model.model_attributes.keys & attr_names)
+        intersect.size > 0
+      }.sort {|a,b|
+        a_intersect = (a.model_attributes.keys & attr_names)
+        b_intersect = (b.model_attributes.keys & attr_names)
+        b_intersect.size <=> a_intersect.size
+      }
+      puts "selecting model #{selections.first.klass.name} for authentication"
+      selections.first
+    end
+
+  
+    def populate_login_form(model, form, record)
+      form.inputs.each do |input|
+        attribute_name = input.guess_attribute.to_sym
+        attribute_value = record.stratagem.read_mock_attribute(attribute_name)
+
+        puts "authentication field: #{attribute_name} -> #{attribute_value}"
+
+        if (input.kind_of? Stratagem::Crawler::Toggle)
+          input.check
+        elsif (record.stratagem.mock_attributes.keys.include?(attribute_name))
+          input.value = record.stratagem.read_mock_attribute(attribute_name) unless input.hidden?
+        else
+          puts record.stratagem.mock_attributes.inspect
+          puts "ERROR: Cannot find attribute #{attribute_name} in model #{record.class.name}"
+        end
+      end
+      form.generate_parameters
+    end
+  
+  end
+end

data/lib/stratagem/crawler/form.rb

@@ -0,0 +1,101 @@
+# Primarily used to fill out login forms rather than trying to fudge the before_filters
+module Stratagem::Crawler
+  class Form
+    attr_accessor :action, :method, :fields, :buttons
+    attr_reader :inputs, :buttons
+
+    def initialize
+      @inputs = []
+      @buttons = []
+    end
+
+    def << (input)
+      if (input.kind_of?(Button))
+        @buttons << input
+      else
+        @inputs << input
+      end
+    end
+
+    def password?
+      !(inputs.find {|i| i.type == 'password' }.nil?)
+    end
+
+    def submit(&block)
+      response = block.call(action, generate_parameters)
+    end
+
+    def generate_parameters
+      params = {}
+      inputs.each do |input|
+        params[input.name] = input.value 
+      end
+      params
+    end
+  end
+
+  class Input
+    attr_accessor :name, :id
+    attr_reader :type, :value
+
+    def type=(type)
+      @type = type.downcase.strip                 
+    end
+
+    def value=(value)
+      if (value.kind_of?(String))
+        @value = value.nil? ? nil : value.strip
+      else
+        @value = value
+      end
+    end
+
+    def guess_attribute
+      if (name =~ /.*\[(.*)\]/)
+        $1.to_sym
+      else
+        name.to_sym
+      end
+    end
+
+    def guess_model
+      return $1.camelize if (name =~ /(.*)?\[/)
+      return nil
+    end
+
+    def hidden?
+      self.type == 'hidden'
+    end
+  end
+
+  class Button < Input
+  end
+
+  class Toggle < Input
+    def check
+      @value = '1'
+    end
+
+    def uncheck
+      @value = '0'
+    end
+
+    def checked?
+      @value == '1'
+    end
+  end
+
+  class Select < Input
+    def initialize
+      @options = []
+    end
+
+    def choose(value)
+      @value = value 
+    end
+
+    def <<(value)
+      @options << value
+    end
+  end
+end

data/lib/stratagem/crawler/html_utils.rb

@@ -0,0 +1,92 @@
+module Stratagem::Crawler
+  class CrawlError < StratagemError; attr_accessor :html, :route; end
+  class FormParseError < CrawlError; end
+
+  module HtmlUtils
+    INPUT_TEXT = ['text', 'password', 'hidden']
+    INPUT_BUTTON = ['button', 'submit', 'reset', 'image', 'src']
+    INPUT_TOGGLE = ['checkbox']
+
+    def find_login_form(document)
+      possibilities = parse_forms(document).select {|form|
+        # this maps to the form action, not the controller action
+        form.action =~ /log[-]*in/ ||
+        form.action =~ /sign[-]*in/ ||
+        !form.inputs.find {|input| input.type == 'password' }.nil?
+      }.sort {|a,b| a.inputs.size <=> b.inputs.size }
+      possibilities.first
+    end
+
+    def parse_forms(document)
+      document.xpath('//form').map do |form_tag|
+        form = Form.new()
+        form.action = form_load_attribute(form_tag, 'action')
+        form.method = form_load_attribute(form_tag, 'method', false)  || 'post'
+        (form_tag/'input').each do |input_tag|
+          form_add_input(form, input_tag)
+        end
+        (form_tag/'textarea').each do |input_tag|
+          form_add_input(form, input_tag)
+        end
+        (form_tag/'select').each do |select_tag|
+          form_add_select(form, select_tag)
+        end
+
+        form
+      end
+    end
+
+    private
+
+    def form_add_select(form, select_tag)
+      input = Select.new()
+      input.id = form_load_attribute(select_tag, 'id', false)
+      input.name = form_load_attribute(select_tag, 'name')
+
+      (select_tag/'option').each do |option_tag|
+        value = option_tag.attributes['value']
+        value = (value ? value.value : option_tag.inner_html).strip
+        input << value unless value.empty?
+      end
+    end
+
+    def form_add_input(form, input_tag)
+      type = form_load_attribute(input_tag, 'type', false)
+
+      input = nil
+
+      if ((type.nil?) || INPUT_TEXT.include?(type))
+        if (input_tag.attributes['src'])
+          input = Button.new()
+        else
+          input = Input.new()
+        end
+      elsif (INPUT_BUTTON.include?(type))
+        input = Button.new()
+      elsif (INPUT_TOGGLE.include?(type))
+        input = Toggle.new()
+      else
+        raise FormParseError.new("Unsupported <input> type: '#{type}'", :html => input_tag.to_html)
+      end
+
+      input.id = form_load_attribute(input_tag, 'id', false)
+      input.type = form_load_attribute(input_tag, 'type', false) || 'text'
+      input.name = form_load_attribute(input_tag, 'name', false)
+      input.value = form_load_attribute(input_tag, 'value', false)
+
+      form << input
+    end
+
+    def form_load_attribute(node, attribute_name, raise_error = true)
+      # determine action
+      attr = node.attributes[attribute_name]
+      value = nil
+      if (attr)
+        value = attr.value.strip.downcase
+      elsif (raise_error)
+        raise FormParseError.new("#{attribute_name} attribute not found in tag - #{node.to_html}")
+      end
+      value
+    end
+  end
+end