RubyGems - tarantula - Versions diffs - 0.0.5 - Mend

tarantula 0.0.5

Files changed (118) hide show

data/CHANGELOG +2 -0
data/MIT-LICENSE +20 -0
data/README.rdoc +106 -0
data/Rakefile +80 -0
data/init.rb +1 -0
data/install.rb +1 -0
data/laf/images/background.jpg +0 -0
data/laf/images/relevance-os-logo.gif +0 -0
data/laf/images/tab.png +0 -0
data/laf/images/table-sort.gif +0 -0
data/laf/images/tarantula-sprites.png +0 -0
data/laf/javascripts/jquery-1.2.3.js +3408 -0
data/laf/javascripts/jquery-ui-tabs.js +890 -0
data/laf/javascripts/jquery.tablesorter.js +861 -0
data/laf/javascripts/tarantula.js +10 -0
data/laf/stylesheets/tarantula.css +638 -0
data/laf/stylesheets/ui.tabs.css +113 -0
data/lib/relevance/core_extensions/ellipsize.rb +34 -0
data/lib/relevance/core_extensions/file.rb +9 -0
data/lib/relevance/core_extensions/response.rb +9 -0
data/lib/relevance/core_extensions/test_case.rb +12 -0
data/lib/relevance/tarantula.rb +63 -0
data/lib/relevance/tarantula/attack.rb +15 -0
data/lib/relevance/tarantula/attack_form_submission.rb +75 -0
data/lib/relevance/tarantula/attack_handler.rb +37 -0
data/lib/relevance/tarantula/crawler.rb +240 -0
data/lib/relevance/tarantula/detail.html.erb +77 -0
data/lib/relevance/tarantula/form.rb +21 -0
data/lib/relevance/tarantula/form_submission.rb +70 -0
data/lib/relevance/tarantula/html_document_handler.rb +36 -0
data/lib/relevance/tarantula/html_report_helper.rb +56 -0
data/lib/relevance/tarantula/html_reporter.rb +105 -0
data/lib/relevance/tarantula/index.html.erb +48 -0
data/lib/relevance/tarantula/invalid_html_handler.rb +18 -0
data/lib/relevance/tarantula/io_reporter.rb +34 -0
data/lib/relevance/tarantula/link.rb +56 -0
data/lib/relevance/tarantula/log_grabber.rb +16 -0
data/lib/relevance/tarantula/rails_integration_proxy.rb +70 -0
data/lib/relevance/tarantula/recording.rb +12 -0
data/lib/relevance/tarantula/response.rb +13 -0
data/lib/relevance/tarantula/result.rb +66 -0
data/lib/relevance/tarantula/test_report.html.erb +34 -0
data/lib/relevance/tarantula/tidy_handler.rb +32 -0
data/lib/relevance/tarantula/transform.rb +17 -0
data/manifest.txt +117 -0
data/rails/init.rb +1 -0
data/tarantula.gemspec +48 -0
data/tasks/tarantula_tasks.rake +34 -0
data/template/tarantula_test.rb +12 -0
data/test/relevance/core_extensions/ellipsize_test.rb +19 -0
data/test/relevance/core_extensions/file_test.rb +8 -0
data/test/relevance/core_extensions/response_test.rb +29 -0
data/test/relevance/core_extensions/test_case_test.rb +16 -0
data/test/relevance/tarantula/attack_form_submission_test.rb +79 -0
data/test/relevance/tarantula/attack_handler_test.rb +29 -0
data/test/relevance/tarantula/crawler_test.rb +296 -0
data/test/relevance/tarantula/form_submission_test.rb +71 -0
data/test/relevance/tarantula/form_test.rb +50 -0
data/test/relevance/tarantula/html_document_handler_test.rb +43 -0
data/test/relevance/tarantula/html_report_helper_test.rb +47 -0
data/test/relevance/tarantula/html_reporter_test.rb +82 -0
data/test/relevance/tarantula/invalid_html_handler_test.rb +33 -0
data/test/relevance/tarantula/io_reporter_test.rb +11 -0
data/test/relevance/tarantula/link_test.rb +61 -0
data/test/relevance/tarantula/log_grabber_test.rb +26 -0
data/test/relevance/tarantula/rails_integration_proxy_test.rb +94 -0
data/test/relevance/tarantula/result_test.rb +85 -0
data/test/relevance/tarantula/tidy_handler_test.rb +58 -0
data/test/relevance/tarantula/transform_test.rb +21 -0
data/test/relevance/tarantula_test.rb +23 -0
data/test/test_helper.rb +34 -0
data/tmp/test_output/images/background.jpg +0 -0
data/tmp/test_output/images/relevance-os-logo.gif +0 -0
data/tmp/test_output/images/tab.png +0 -0
data/tmp/test_output/images/table-sort.gif +0 -0
data/tmp/test_output/images/tarantula-sprites.png +0 -0
data/tmp/test_output/index.html +255 -0
data/tmp/test_output/javascripts/jquery-1.2.3.js +3408 -0
data/tmp/test_output/javascripts/jquery-ui-tabs.js +890 -0
data/tmp/test_output/javascripts/jquery.tablesorter.js +861 -0
data/tmp/test_output/javascripts/tarantula.js +10 -0
data/tmp/test_output/stylesheets/tarantula.css +638 -0
data/tmp/test_output/stylesheets/ui.tabs.css +113 -0
data/tmp/test_output/test_user_pages/1.html +71 -0
data/tmp/test_output/test_user_pages/10.html +71 -0
data/tmp/test_output/test_user_pages/11.html +71 -0
data/tmp/test_output/test_user_pages/12.html +71 -0
data/tmp/test_output/test_user_pages/13.html +71 -0
data/tmp/test_output/test_user_pages/14.html +71 -0
data/tmp/test_output/test_user_pages/15.html +71 -0
data/tmp/test_output/test_user_pages/16.html +71 -0
data/tmp/test_output/test_user_pages/17.html +71 -0
data/tmp/test_output/test_user_pages/18.html +71 -0
data/tmp/test_output/test_user_pages/19.html +71 -0
data/tmp/test_output/test_user_pages/2.html +71 -0
data/tmp/test_output/test_user_pages/20.html +71 -0
data/tmp/test_output/test_user_pages/3.html +71 -0
data/tmp/test_output/test_user_pages/4.html +71 -0
data/tmp/test_output/test_user_pages/5.html +71 -0
data/tmp/test_output/test_user_pages/6.html +71 -0
data/tmp/test_output/test_user_pages/7.html +71 -0
data/tmp/test_output/test_user_pages/8.html +71 -0
data/tmp/test_output/test_user_pages/9.html +71 -0
data/uninstall.rb +1 -0
data/vendor/xss-shield/MIT-LICENSE +20 -0
data/vendor/xss-shield/README +76 -0
data/vendor/xss-shield/init.rb +16 -0
data/vendor/xss-shield/lib/xss_shield.rb +6 -0
data/vendor/xss-shield/lib/xss_shield/erb_hacks.rb +111 -0
data/vendor/xss-shield/lib/xss_shield/haml_hacks.rb +42 -0
data/vendor/xss-shield/lib/xss_shield/safe_string.rb +47 -0
data/vendor/xss-shield/lib/xss_shield/secure_helpers.rb +40 -0
data/vendor/xss-shield/test/test_actionview_integration.rb +40 -0
data/vendor/xss-shield/test/test_erb.rb +44 -0
data/vendor/xss-shield/test/test_haml.rb +43 -0
data/vendor/xss-shield/test/test_helpers.rb +25 -0
data/vendor/xss-shield/test/test_safe_string.rb +55 -0
metadata +283 -0

data/lib/relevance/tarantula/detail.html.erb ADDED Viewed

@@ -0,0 +1,77 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+  <head>
+    <meta http-equiv="Content-type" content="text/html; charset=utf-8"/>
+    <title>Tarantula report detail <%= short_description %></title>
+    <script type="text/javascript" src="../javascripts/jquery-1.2.3.js"></script>
+    <script type="text/javascript" src="../javascripts/jquery.tablesorter.js"></script>
+    <script type="text/javascript" src="../javascripts/jquery-ui-tabs.js"></script>
+    <script type="text/javascript" src="../javascripts/tarantula.js"></script>
+    <link type="text/css" media="screen" rel="stylesheet" href="../stylesheets/tarantula.css"/>
+    <link type="text/css" media="screen" rel="stylesheet" href="../stylesheets/ui.tabs.css"/>
+  <!--[if lte IE 7]>
+    <link rel="stylesheet" href="jqeury.tabs-ie.css" type="text/css" media="projection, screen" />
+  <![endif]-->
+  </head>
+  <body id="top">
+    <div id="container">
+      <div id="header">
+        <hr class="top"/>
+        <h1><span>Tarantula : Eight Legs, Two Fangs, and an Attitude</span></h1>
+      </div>
+      <div id="page-container">
+        <hr class="top"/>
+        <div id="page">
+          <h1>Tarantula report detail <%= short_description %></h1>
+          <p>Generated on <%= Time.now %> (<a href="../index.html">Back</a>)</p>
+          <p>Visit <a href="<%= full_url %>"><%= full_url %></a></p>
+          <p>Response: <%= code %></p>
+          <p>Referrer: <%= referrer || "" %></p>
+          <div id="tabs-container">
+            <ul>
+              <li><a href="#fragment-1"><span>Data</span></a></li>
+              <li><a href="#fragment-2"><span>Body</span></a></li>
+              <li><a href="#fragment-3"><span>Log</span></a></li>
+            </ul>
+            <div id="fragment-1">
+              <% if data %>
+                <%= wrap_in_line_number_table(data) %>
+              <% else %>
+                <p>No Data</p>
+              <% end %>
+            </div>
+            <div id="fragment-2">
+              <% if body %>
+                <%= wrap_in_line_number_table(body) %>
+              <% else %>
+                <p>No Body</p>
+              <% end %>
+            </div>
+            <div id="fragment-3">
+              <% if log %>
+                <%= wrap_in_line_number_table(log) {|line| wrap_stack_trace_line(line)} %>
+              <% else %>
+                <p>No Log</p>
+              <% end %>
+            </div>
+          </div>
+        </div>
+      </div>
+      <div id="sidebar">
+        <h3><span>Tarantula</span></h3>
+        <p>Tarantula is an open-source tool for testing Rails web applications. Tarantula is developed by <a href="http://thinkrelevance.com">Relevance, Inc.</a> and lives at <a href="http://opensource.thinkrelevance.com">http://opensource.thinkrelevance.com</a>.</p>
+      </div>
+    </div>
+  </body>
+</html>

data/lib/relevance/tarantula/form.rb ADDED Viewed

@@ -0,0 +1,21 @@
+class Relevance::Tarantula::Form
+  extend Forwardable
+  def_delegators("@tag", :search)
+  def initialize(tag)
+    @tag = tag
+  end
+  def action
+    @tag['action'].downcase
+  end
+  def method
+    (rails_method_hack or @tag['method'] or 'get').downcase
+  end
+  def rails_method_hack
+    (tag = @tag.at('input[@name="_method"]')) && tag["value"]
+  end
+end

data/lib/relevance/tarantula/form_submission.rb ADDED Viewed

@@ -0,0 +1,70 @@
+class Relevance::Tarantula::FormSubmission
+  attr_accessor :method, :action, :data
+  def initialize(form)
+    @method = form.method
+    @action = form.action
+    @data = mutate_selects(form).merge(mutate_text_areas(form)).merge(mutate_inputs(form))
+  end
+  def self.mutate(form)
+    [self.new(form)]
+  end
+  def to_s
+    "#{action} #{method} #{data.inspect}"
+  end
+  # a form's signature is what makes it unique (e.g. action + fields)
+  # used to keep track of which forms we have submitted already
+  def signature
+    [action, data.keys.sort]
+  end
+  def create_random_data_for(form, tag_selector)
+    form.search(tag_selector).inject({}) do |form_args, input|
+      # TODO: test
+      form_args[input['name']] = random_data(input) if input['name']
+      form_args
+    end
+  end
+  def mutate_inputs(form)
+    create_random_data_for(form, 'input')
+  end
+  def mutate_text_areas(form)
+    create_random_data_for(form, 'textarea')
+  end
+  def mutate_selects(form)
+    form.search('select').inject({}) do |form_args, select|
+      options = select.search('option')
+      option = options.rand
+      form_args[select['name']] = option['value']
+      form_args
+    end
+  end
+  def random_data(input)
+    case input['name']
+      when /amount/         : random_int
+      when /_id$/           : random_whole_number
+      when /uploaded_data/  : nil
+      when /^_method$/      : input['value']
+      when nil              : input['value']
+      else                    random_int
+    end
+  end
+  def big_number
+    10000   # arbitrary
+  end
+  def random_int
+    rand(big_number) - (big_number/2)
+  end
+  def random_whole_number
+    rand(big_number)
+  end
+end

data/lib/relevance/tarantula/html_document_handler.rb ADDED Viewed

@@ -0,0 +1,36 @@
+require 'hpricot'
+class Relevance::Tarantula::HtmlDocumentHandler
+  extend Forwardable
+  def_delegators("@crawler", :queue_link, :queue_form)
+  def initialize(crawler)
+    @crawler = crawler
+  end
+  # HTML::Document shouts to stderr when it sees ugly HTML
+  # We don't want this -- the InvalidHtmlHandler will deal with it
+  def html_doc_without_stderr_noise(html)
+    body = nil
+    Recording.stderr do
+      body = Hpricot html
+    end
+    body
+  end
+  def handle(result)
+    response = result.response
+    url = result.url
+    return unless response.html?
+    body = html_doc_without_stderr_noise(response.body)
+    body.search('a').each do |tag|
+      queue_link(tag, url)
+    end
+    body.search('link').each do |tag|
+      queue_link(tag, url)
+    end
+    body.search('form').each do |form|
+      form['action'] = url unless form['action']
+      queue_form(form, url)
+    end
+    nil
+  end
+end

data/lib/relevance/tarantula/html_report_helper.rb ADDED Viewed

@@ -0,0 +1,56 @@
+require "erb"
+module Relevance::Tarantula::HtmlReportHelper
+  include ERB::Util
+  include Relevance::Tarantula
+  def wrap_in_line_number_table(text, &blk)
+    x = Builder::XmlMarkup.new
+    x.table(:class => "grid tablesorter") do
+      x.thead do
+        x.tr do
+          x.th(:class => "sort asc") do
+            x.span("Line \#")
+            x.span(:class => "sort") do
+              x.em do
+                x << '&#8613;'
+              end
+            end
+          end
+          x.th(:class => "sort left") do
+            x.span("Line")
+            x.span(:class => "sort") do
+              x.em do
+                x << '&#8613;'
+              end
+            end
+          end
+        end
+      end
+      text.split("\n").each_with_index do |line, index|
+        x.tr do
+          x.td(index+1)
+          if block_given?
+            x.td {x << yield(line)}
+          else
+            x.td(line)
+          end
+        end
+      end
+    end
+    x.target!
+  end
+  def textmate_url(file, line_no)
+    "txmt://open?url=file://#{File.expand_path(File.join(rails_root,file))}&line_no=#{line_no}"
+  end
+  def wrap_stack_trace_line(text)
+    if text =~ %r{^\s*(/[^:]+):(\d+):([^:]+)$}
+      file = h($1) # .to_s_xss_protected
+      line_number = $2
+      message = h($3) # .to_s_xss_protected
+      "<a href='#{textmate_url(file, line_number)}'>#{file}:#{line_number}</a>:#{message}" # .mark_as_xss_protected
+    else
+      h(text) # .to_s_xss_protected
+    end
+  end
+end

data/lib/relevance/tarantula/html_reporter.rb ADDED Viewed

@@ -0,0 +1,105 @@
+class Relevance::Tarantula::HtmlReporter
+  include Relevance::Tarantula
+  attr_accessor :basedir, :results
+  delegate :successes, :failures, :to => :results
+  HtmlResultOverview = Struct.new(:code, :url, :description, :method, :referrer, :file_name)
+  def initialize(basedir)
+    @basedir = basedir
+    @results = Struct.new(:successes, :failures).new([], [])
+    FileUtils.mkdir_p(@basedir)
+  end
+  def report(result)
+    return if result.nil?
+    create_detail_report(result)
+    collection = result.success ? results.successes : results.failures
+    collection << HtmlResultOverview.new(
+      result.code, result.url, result.description, result.method, result.referrer, result.file_name
+    )
+  end
+  def finish_report(test_name)
+    puts "Writing results to #{basedir}"
+    copy_styles  unless styles_exist?
+    create_index unless index_exists?
+    update_index(test_name)
+  end
+  def create_detail_report(result)
+    template = ERB.new(template("detail.html.erb"))
+    output(result.file_name, template.result(result.send(:binding)), result.test_name)
+  end
+  def copy_styles
+    # not using cp_r because it picks up .svn crap
+    FileUtils.mkdir_p(File.join(basedir, "stylesheets"))
+    Dir.glob("#{tarantula_home}/laf/stylesheets/*.css").each do |file|
+      FileUtils.cp(file, File.join(basedir, "stylesheets"))
+    end
+    FileUtils.mkdir_p(File.join(basedir, "images"))
+    Dir.glob("#{tarantula_home}/laf/images/*.{jpg,gif,png}").each do |file|
+      FileUtils.cp(file, File.join(basedir, "images"))
+    end
+    FileUtils.mkdir_p(File.join(basedir, "javascripts"))
+    Dir.glob("#{tarantula_home}/laf/javascripts/*.js").each do |file|
+      FileUtils.cp(file, File.join(basedir, "javascripts"))
+    end
+  end
+  def create_index
+    template = ERB.new(template("index.html.erb"))
+    output("index.html", template.result(binding))
+  end
+  def update_index(test_name)
+    File.open(File.join(basedir, "index.html"), "r+") do |file|
+      doc = Hpricot file.read
+      tabs_container = doc.search "#tabs-container ul"
+      results_container = doc.search "#tabs-container"
+      tabs_container.append tab_html(test_name)
+      results_container.append results_html(test_name)
+      file.rewind
+      file.write doc.to_s
+    end
+  end
+  def index_exists?
+    File.exists?(File.join(basedir, "index.html"))
+  end
+  def styles_exist?
+    File.exists?(File.join(basedir, "stylesheets", "tarantula.css"))
+  end
+  def tab_html(test_name)
+    "<li><a href='##{test_name}'><span>#{test_name}</span></a></li>"
+  end
+  def results_html(test_name)
+    template = ERB.new(template("test_report.html.erb"))
+    template.result(binding)
+  end
+  def template(name)
+    File.read(File.join(File.dirname(__FILE__), name))
+  end
+  def output(name, body, subdir = '')
+    FileUtils.mkdir_p(File.join(basedir, subdir)) unless subdir.empty?
+    File.open(File.join(basedir, subdir, name), "w") do |file|
+      file.write body
+    end
+  end
+  # CSS class for HTML status codes
+  def class_for_code(code)
+    "r#{Integer(code)/100}"
+  end
+end

data/lib/relevance/tarantula/index.html.erb ADDED Viewed

@@ -0,0 +1,48 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+  <head>
+    <meta http-equiv="Content-type" content="text/html; charset=utf-8"/>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+    <meta name="Author" content="Erik Yowell; erik[at]thinkrelevance.com"/>
+    <title>Tarantula report</title>
+    <script type="text/javascript" src="javascripts/jquery-1.2.3.js"></script>
+    <script type="text/javascript" src="javascripts/jquery.tablesorter.js"></script>
+    <script type="text/javascript" src="javascripts/jquery-ui-tabs.js"></script>
+    <script type="text/javascript" src="javascripts/tarantula.js"></script>
+    <link type="text/css" media="screen" rel="stylesheet" href="stylesheets/tarantula.css"/>
+    <link type="text/css" media="screen" rel="stylesheet" href="stylesheets/ui.tabs.css"/>
+  </head>
+  <body id="top">
+    <div id="container">
+      <div id="header">
+        <hr class="top"/>
+        <h1><span>Tarantula : Eight Legs, Two Fangs, and an Attitude</span></h1>
+        <ul class="navigation">
+          <li><a href="#" class="result-all"><span>All</span> <em><%= successes.size + failures.size %></em></a></li>
+          <li><a href="#" class="result-failure"><span>Failures</span> <em><%= failures.size %></em></a></li>
+          <li><a href="#" class="result-success"><span>Successful</span> <em><%= successes.size %></em></a></li>
+        </ul>
+      </div>
+    </div>
+    <div id="page-container">
+      <hr class="top"/>
+      <div id="page">
+        <p>Generated on <%= Time.now %></p>
+        <div id="tabs-container">
+          <ul>
+          </ul>
+        </div>
+      </div>
+      <div id="sidebar">
+        <h3><span>Tarantula</span></h3>
+        <p>Tarantula is an open-source tool for testing Rails web applications. Tarantula is developed by <a href="http://thinkrelevance.com">Relevance, Inc.</a> and lives at <a href="http://opensource.thinkrelevance.com">http://opensource.thinkrelevance.com</a>.</p>
+      </div>
+    </div>
+  </body>
+</html>

data/lib/relevance/tarantula/invalid_html_handler.rb ADDED Viewed

@@ -0,0 +1,18 @@
+class Relevance::Tarantula::InvalidHtmlHandler
+  include Relevance::Tarantula
+  def handle(result)
+    response = result.response
+    return unless response.html?
+    begin
+      body = HTML::Document.new(response.body, true)
+    rescue Exception => e
+      error_result = result.dup
+      error_result.success = false
+      error_result.description = "Bad HTML (Scanner)"
+      error_result.data = e.message
+      error_result
+    else
+      nil
+    end
+  end
+end

data/lib/relevance/tarantula/io_reporter.rb ADDED Viewed

@@ -0,0 +1,34 @@
+class Relevance::Tarantula::IOReporter
+  include Relevance::Tarantula
+  attr_accessor :io, :results
+  delegate :successes, :failures, :to => :results
+  IOResultOverview = Struct.new(:code, :url)
+  def initialize(io)
+    @io = io
+    @results = Struct.new(:successes, :failures).new([], [])
+  end
+  def report(result)
+    return if result.nil?
+    unless result.success # collection = result.success ? results.successes : results.failures
+      results.failures << IOResultOverview.new(
+        result.code, result.url
+      )
+    end
+  end
+  def finish_report(test_name)
+    unless (failures).empty?
+      io.puts "****** FAILURES"
+      failures.each do |failure|
+        io.puts "#{failure.code}: #{failure.url}"
+      end
+      raise "#{failures.size} failures"
+    end
+  end
+end