tarantula 0.0.5 → 0.0.8.1

data/CHANGELOG

@@ -1,2 +1,13 @@
+v0.0.8.1
+* Fix numerous installation and initial setup issues
+* Enhance rake tasks to support use of Tarantula in a continuous integration environment
+** Use "rake tarantula:test" to run headless with build-friendly exit codes
+** Use "rake tarantula:report" to open the Tarantula report in your browser
+* Update README
+** Provide better installation and setup documentation
+** Include example of adding a custom attack handler
+* Simplify design to address concerns about hard-to-read fonts
+
 v0.0.5 Make sure we don't include Relevance::Tarantula into Object - will cause issues Rails dependencies and is a bad idea in general; update Rakefile for dev dependencies; another small clean up tasks
+
 v0.0.1 Tarantula becomes a gem. (Aaron Bedra)

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2008 Relevance, Inc.
+Copyright (c) 2008-2009 Relevance, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.rdoc

@@ -4,14 +4,6 @@
 
 Tarantula is a big fuzzy spider. It crawls your Rails application, fuzzing data to see what breaks.
 
-== Dependencies
-
-htmlentities
-hpricot
-facets >= 2.4.3
-actionpack
-activesupport
-
 == Usage
 
    #!sh
@@ -24,8 +16,6 @@ Creates a Rails integration test that looks like this, filling in your own auth
    # in your test
    def test_with_login
        post '/sessions/create', :password => 'your-pass'
-       assert_response :redirect
-       assert_redirected_to '/'
        follow_redirect!
        tarantula_crawl(self)
    end
@@ -44,9 +34,9 @@ If you want to set custom options, you can get access to the crawler and set pro
 
 Assuming your project is at /work/project/:
 
-         #!sh
-         cd /work/project
-         rake tarantula:test
+   #!sh
+   cd /work/project
+   rake tarantula:test
 
 == Verbose Mode
 
@@ -62,45 +52,65 @@ tell Tarantula to allow 404s for URLs matching a regexp:
      t = tarantula_crawler(self)
      t.allow_404_for %r{/users/\d+/}
 
+== Custom Attack Handlers
+
+You can specify the attack strings that Tarantula throws at your application.
+
+    def test_tarantula
+      t = tarantula_crawler(self)
+
+      Relevance::Tarantula::AttackFormSubmission.attacks << { 
+        :name => :xss,
+        :input => "<script>gotcha!</script>",
+        :output => "<script>gotcha!</script>",
+      }
+
+      Relevance::Tarantula::AttackFormSubmission.attacks << { 
+        :name => :sql_injection,
+        :input => "a'; DROP TABLE posts;",
+      }
+
+      t.handlers << Relevance::Tarantula::AttackHandler.new
+      t.fuzzers << Relevance::Tarantula::AttackFormSubmission
+      t.times_to_crawl = 2
+      t.crawl "/posts"
+    end
+
+This example adds custom attacks for both SQL injection and XSS.  It also tells tarantula to crawl the app 2 times.  This
+is important for XSS attacks because the results won't appear until the second time tarantula performs the crawl.
+
 == Install
 
+See the rakefile for dependencies, or just let Rubygems handle it.
+
 The latest and greatest gem will always be available from Github:
 
     gem install relevance-tarantula --source http://gems.github.com
 
-You can also grab it from Rubyforge, where we will push stable releases but may not be as bleeding edge as the Github gem.
+To setup tarantula in your application add the following line into either config/environment.rb or config/environments/test.rb (preferred).
+This assumes that you have Rails 2.1 or higher installed.
 
-		gem install tarantula
+    config.gem 'relevance-tarantula', :source => "http://gems.github.com", :lib => 'relevance/tarantula'
 
-== Bugs/Requests
+Since rails doesn't (yet) support loading rake tasks that live inside gems you will need to update your Rakefile.  This assumes that you have vendored tarantula.  Simply run
+	
+	cd vendor/gems
+    gem unpack relevance-tarantula
 
-Please submit your bug reports, patches or feature requests as a ticket under the component "tarantula" on our Trac instance here: 
+You can then add the following line into your Rakefile, substituting the proper version of relevance-tarantula in the path.
 
-http://opensource.thinkrelevance.com/
+    load File.join(RAILS_ROOT, "vendor/gems/relevance-tarantula-0.0.8.1/tasks/tarantula_tasks.rake")
 
-You'll have to create an account (Sorry!  Otherwise we'd get way too much spam).
+You can also grab it from Rubyforge, where we will push stable releases but may not be as bleeding edge as the Github gem.
 
-== License and Copyright
+    gem install tarantula
 
-(The MIT License)
+== Bugs/Requests
 
-Copyright (c) 2008 Relevance, Inc. - http://thinkrelevance.com
+Please submit your bug reports, patches or feature requests at Lighthouse:
 
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
+http://relevance.lighthouseapp.com/projects/17868-tarantula/overview
 
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
+== License
 
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+Tarantula is released under the MIT license.

data/Rakefile

@@ -3,13 +3,7 @@ require 'rake/testtask'
 require 'rake/rdoctask'
 require 'rubygems'
 
-begin
-  gem 'technicalpickles-echoe'
-rescue LoadError => e
-  puts "Couldn't find the correct version of echoe - please install from forked version on github: http://github.com/technicalpickles/echoe/ ->"
-  puts "sudo gem install technicalpickles-echoe --source http://gems.github.com"
-end
-
+gem 'echoe', '~> 3.0.1'
 require 'echoe'
 require 'lib/relevance/tarantula.rb'
 
@@ -20,26 +14,16 @@ echoe = Echoe.new('tarantula') do |p|
   p.version = Relevance::Tarantula::VERSION
   p.summary = "A big hairy fuzzy spider that crawls your site, wreaking havoc"
   p.description = "A big hairy fuzzy spider that crawls your site, wreaking havoc"
-  p.url = "http://opensource.thinkrelevance.com/wiki/tarantula"
+  p.url = "http://github.com/relevance/tarantula"
   p.rdoc_pattern = /^(lib|bin)|txt|rdoc|CHANGELOG|MIT-LICENSE$/
   rdoc_template = `allison --path`.strip << ".rb"
   p.rdoc_template = rdoc_template
   p.test_pattern = 'test/**/*_test.rb'
   p.manifest_name = 'manifest.txt'
-  p.dependencies = ['htmlentities', 'hpricot', 'facets >=2.4.3']
+  p.dependencies = ['htmlentities', 'hpricot', 'facets >=2.4.3', 'actionpack', 'activesupport']
   p.development_dependencies = ['ruby-debug', 'test-spec', 'mocha']
 end
 
-desc 'Default: run unit tests.'
-task :default => :test
-
-desc 'Test the tarantula plugin.'
-Rake::TestTask.new(:test) do |t|
-  t.libs << 'lib'
-  t.pattern = 'test/**/*_test.rb'
-  t.verbose = true
-end
-
 desc 'Generate documentation for the tarantula plugin.'
 Rake::RDocTask.new(:rdoc) do |rdoc|
   rdoc.rdoc_dir = 'rdoc'

data/laf/javascripts/niftyLayout.js

@@ -0,0 +1,11 @@
+/*nifty corners layout*/
+
+window.onload=function(){
+Nifty("div#menu a","small transparent top");
+Nifty("ul#intro li","same-height");
+Nifty("div.date");
+Nifty("div#content,div#side","same-height");
+Nifty("div.comments div");
+Nifty("div#footer");
+Nifty("div#container","bottom");
+}

data/laf/javascripts/niftycube-details.js

@@ -0,0 +1,298 @@
+/* Nifty Corners Cube - rounded corners with CSS and Javascript
+Copyright 2006 Alessandro Fulciniti (a.fulciniti@html.it)
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+var niftyOk=(document.getElementById && document.createElement && Array.prototype.push);
+var niftyCss=false;
+
+String.prototype.find=function(what){
+return(this.indexOf(what)>=0 ? true : false);
+}
+
+var oldonload=window.onload;
+if(typeof(NiftyLoad)!='function') NiftyLoad=function(){};
+if(typeof(oldonload)=='function')
+    window.onload=function(){oldonload();AddCss();NiftyLoad()};
+else window.onload=function(){AddCss();NiftyLoad()};
+
+function AddCss(){
+niftyCss=true;
+var l=CreateEl("link");
+l.setAttribute("type","text/css");
+l.setAttribute("rel","stylesheet");
+l.setAttribute("href","../stylesheets/niftyCorners.css");
+l.setAttribute("media","screen");
+document.getElementsByTagName("head")[0].appendChild(l);
+}
+
+function Nifty(selector,options){
+if(niftyOk==false) return;
+if(niftyCss==false) AddCss();
+var i,v=selector.split(","),h=0;
+if(options==null) options="";
+if(options.find("fixed-height"))
+    h=getElementsBySelector(v[0])[0].offsetHeight;
+for(i=0;i<v.length;i++)
+    Rounded(v[i],options);
+if(options.find("height")) SameHeight(selector,h);
+}
+
+function Rounded(selector,options){
+var i,top="",bottom="",v=new Array();
+if(options!=""){
+    options=options.replace("left","tl bl");
+    options=options.replace("right","tr br");
+    options=options.replace("top","tr tl");
+    options=options.replace("bottom","br bl");
+    options=options.replace("transparent","alias");
+    if(options.find("tl")){
+        top="both";
+        if(!options.find("tr")) top="left";
+        }
+    else if(options.find("tr")) top="right";
+    if(options.find("bl")){
+        bottom="both";
+        if(!options.find("br")) bottom="left";
+        }
+    else if(options.find("br")) bottom="right";
+    }
+if(top=="" && bottom=="" && !options.find("none")){top="both";bottom="both";}
+v=getElementsBySelector(selector);
+for(i=0;i<v.length;i++){
+    FixIE(v[i]);
+    if(top!="") AddTop(v[i],top,options);
+    if(bottom!="") AddBottom(v[i],bottom,options);
+    }
+}
+
+function AddTop(el,side,options){
+var d=CreateEl("b"),lim=4,border="",p,i,btype="r",bk,color;
+d.style.marginLeft="-"+getPadding(el,"Left")+"px";
+d.style.marginRight="-"+getPadding(el,"Right")+"px";
+if(options.find("alias") || (color=getBk(el))=="transparent"){
+    color="transparent";bk="transparent"; border=getParentBk(el);btype="t";
+    }
+else{
+    bk=getParentBk(el); border=Mix(color,bk);
+    }
+d.style.background=bk;
+d.className="niftycorners";
+p=getPadding(el,"Top");
+if(options.find("small")){
+    d.style.marginBottom=(p-2)+"px";
+    btype+="s"; lim=2;
+    }
+else if(options.find("big")){
+    d.style.marginBottom=(p-10)+"px";
+    btype+="b"; lim=8;
+    }
+else d.style.marginBottom=(p-5)+"px";
+for(i=1;i<=lim;i++)
+    d.appendChild(CreateStrip(i,side,color,border,btype));
+el.style.paddingTop="0";
+el.insertBefore(d,el.firstChild);
+}
+
+function AddBottom(el,side,options){
+var d=CreateEl("b"),lim=4,border="",p,i,btype="r",bk,color;
+d.style.marginLeft="-"+getPadding(el,"Left")+"px";
+d.style.marginRight="-"+getPadding(el,"Right")+"px";
+if(options.find("alias") || (color=getBk(el))=="transparent"){
+    color="transparent";bk="transparent"; border=getParentBk(el);btype="t";
+    }
+else{
+    bk=getParentBk(el); border=Mix(color,bk);
+    }
+d.style.background=bk;
+d.className="niftycorners";
+p=getPadding(el,"Bottom");
+if(options.find("small")){
+    d.style.marginTop=(p-2)+"px";
+    btype+="s"; lim=2;
+    }
+else if(options.find("big")){
+    d.style.marginTop=(p-10)+"px";
+    btype+="b"; lim=8;
+    }
+else d.style.marginTop=(p-5)+"px";
+for(i=lim;i>0;i--)
+    d.appendChild(CreateStrip(i,side,color,border,btype));
+el.style.paddingBottom=0;
+el.appendChild(d);
+}
+
+function CreateStrip(index,side,color,border,btype){
+var x=CreateEl("b");
+x.className=btype+index;
+x.style.backgroundColor=color;
+x.style.borderColor=border;
+if(side=="left"){
+    x.style.borderRightWidth="0";
+    x.style.marginRight="0";
+    }
+else if(side=="right"){
+    x.style.borderLeftWidth="0";
+    x.style.marginLeft="0";
+    }
+return(x);
+}
+
+function CreateEl(x){
+return(document.createElement(x));
+}
+
+function FixIE(el){
+if(el.currentStyle!=null && el.currentStyle.hasLayout!=null && el.currentStyle.hasLayout==false)
+    el.style.display="inline-block";
+}
+
+function SameHeight(selector,maxh){
+var i,v=selector.split(","),t,j,els=[],gap;
+for(i=0;i<v.length;i++){
+    t=getElementsBySelector(v[i]);
+    els=els.concat(t);
+    }
+for(i=0;i<els.length;i++){
+    if(els[i].offsetHeight>maxh) maxh=els[i].offsetHeight;
+    els[i].style.height="auto";
+    }
+for(i=0;i<els.length;i++){
+    gap=maxh-els[i].offsetHeight;
+    if(gap>0){
+        t=CreateEl("b");t.className="niftyfill";t.style.height=gap+"px";
+        nc=els[i].lastChild;
+        if(nc.className=="niftycorners")
+            els[i].insertBefore(t,nc);
+        else els[i].appendChild(t);
+        }
+    }
+}
+
+function getElementsBySelector(selector){
+var i,j,selid="",selclass="",tag=selector,tag2="",v2,k,f,a,s=[],objlist=[],c;
+if(selector.find("#")){ //id selector like "tag#id"
+    if(selector.find(" ")){  //descendant selector like "tag#id tag"
+        s=selector.split(" ");
+        var fs=s[0].split("#");
+        if(fs.length==1) return(objlist);
+        f=document.getElementById(fs[1]);
+        if(f){
+            v=f.getElementsByTagName(s[1]);
+            for(i=0;i<v.length;i++) objlist.push(v[i]);
+            }
+        return(objlist);
+        }
+    else{
+        s=selector.split("#");
+        tag=s[0];
+        selid=s[1];
+        if(selid!=""){
+            f=document.getElementById(selid);
+            if(f) objlist.push(f);
+            return(objlist);
+            }
+        }
+    }
+if(selector.find(".")){      //class selector like "tag.class"
+    s=selector.split(".");
+    tag=s[0];
+    selclass=s[1];
+    if(selclass.find(" ")){   //descendant selector like tag1.classname tag2
+        s=selclass.split(" ");
+        selclass=s[0];
+        tag2=s[1];
+        }
+    }
+var v=document.getElementsByTagName(tag);  // tag selector like "tag"
+if(selclass==""){
+    for(i=0;i<v.length;i++) objlist.push(v[i]);
+    return(objlist);
+    }
+for(i=0;i<v.length;i++){
+    c=v[i].className.split(" ");
+    for(j=0;j<c.length;j++){
+        if(c[j]==selclass){
+            if(tag2=="") objlist.push(v[i]);
+            else{
+                v2=v[i].getElementsByTagName(tag2);
+                for(k=0;k<v2.length;k++) objlist.push(v2[k]);
+                }
+            }
+        }
+    }
+return(objlist);
+}
+
+function getParentBk(x){
+var el=x.parentNode,c;
+while(el.tagName.toUpperCase()!="HTML" && (c=getBk(el))=="transparent")
+    el=el.parentNode;
+if(c=="transparent") c="#FFFFFF";
+return(c);
+}
+
+function getBk(x){
+var c=getStyleProp(x,"backgroundColor");
+if(c==null || c=="transparent" || c.find("rgba(0, 0, 0, 0)"))
+    return("transparent");
+if(c.find("rgb")) c=rgb2hex(c);
+return(c);
+}
+
+function getPadding(x,side){
+var p=getStyleProp(x,"padding"+side);
+if(p==null || !p.find("px")) return(0);
+return(parseInt(p));
+}
+
+function getStyleProp(x,prop){
+if(x.currentStyle)
+    return(x.currentStyle[prop]);
+if(document.defaultView.getComputedStyle)
+    return(document.defaultView.getComputedStyle(x,'')[prop]);
+return(null);
+}
+
+function rgb2hex(value){
+var hex="",v,h,i;
+var regexp=/([0-9]+)[, ]+([0-9]+)[, ]+([0-9]+)/;
+var h=regexp.exec(value);
+for(i=1;i<4;i++){
+    v=parseInt(h[i]).toString(16);
+    if(v.length==1) hex+="0"+v;
+    else hex+=v;
+    }
+return("#"+hex);
+}
+
+function Mix(c1,c2){
+var i,step1,step2,x,y,r=new Array(3);
+if(c1.length==4)step1=1;
+else step1=2;
+if(c2.length==4) step2=1;
+else step2=2;
+for(i=0;i<3;i++){
+    x=parseInt(c1.substr(1+step1*i,step1),16);
+    if(step1==1) x=16*x+x;
+    y=parseInt(c2.substr(1+step2*i,step2),16);
+    if(step2==1) y=16*y+y;
+    r[i]=Math.floor((x*50+y*50)/100);
+    r[i]=r[i].toString(16);
+    if(r[i].length==1) r[i]="0"+r[i];
+    }
+return("#"+r[0]+r[1]+r[2]);
+}