RubyGems - tarantula - Versions diffs - 0.0.5 - Mend

tarantula 0.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (118) hide show

data/CHANGELOG +2 -0
data/MIT-LICENSE +20 -0
data/README.rdoc +106 -0
data/Rakefile +80 -0
data/init.rb +1 -0
data/install.rb +1 -0
data/laf/images/background.jpg +0 -0
data/laf/images/relevance-os-logo.gif +0 -0
data/laf/images/tab.png +0 -0
data/laf/images/table-sort.gif +0 -0
data/laf/images/tarantula-sprites.png +0 -0
data/laf/javascripts/jquery-1.2.3.js +3408 -0
data/laf/javascripts/jquery-ui-tabs.js +890 -0
data/laf/javascripts/jquery.tablesorter.js +861 -0
data/laf/javascripts/tarantula.js +10 -0
data/laf/stylesheets/tarantula.css +638 -0
data/laf/stylesheets/ui.tabs.css +113 -0
data/lib/relevance/core_extensions/ellipsize.rb +34 -0
data/lib/relevance/core_extensions/file.rb +9 -0
data/lib/relevance/core_extensions/response.rb +9 -0
data/lib/relevance/core_extensions/test_case.rb +12 -0
data/lib/relevance/tarantula.rb +63 -0
data/lib/relevance/tarantula/attack.rb +15 -0
data/lib/relevance/tarantula/attack_form_submission.rb +75 -0
data/lib/relevance/tarantula/attack_handler.rb +37 -0
data/lib/relevance/tarantula/crawler.rb +240 -0
data/lib/relevance/tarantula/detail.html.erb +77 -0
data/lib/relevance/tarantula/form.rb +21 -0
data/lib/relevance/tarantula/form_submission.rb +70 -0
data/lib/relevance/tarantula/html_document_handler.rb +36 -0
data/lib/relevance/tarantula/html_report_helper.rb +56 -0
data/lib/relevance/tarantula/html_reporter.rb +105 -0
data/lib/relevance/tarantula/index.html.erb +48 -0
data/lib/relevance/tarantula/invalid_html_handler.rb +18 -0
data/lib/relevance/tarantula/io_reporter.rb +34 -0
data/lib/relevance/tarantula/link.rb +56 -0
data/lib/relevance/tarantula/log_grabber.rb +16 -0
data/lib/relevance/tarantula/rails_integration_proxy.rb +70 -0
data/lib/relevance/tarantula/recording.rb +12 -0
data/lib/relevance/tarantula/response.rb +13 -0
data/lib/relevance/tarantula/result.rb +66 -0
data/lib/relevance/tarantula/test_report.html.erb +34 -0
data/lib/relevance/tarantula/tidy_handler.rb +32 -0
data/lib/relevance/tarantula/transform.rb +17 -0
data/manifest.txt +117 -0
data/rails/init.rb +1 -0
data/tarantula.gemspec +48 -0
data/tasks/tarantula_tasks.rake +34 -0
data/template/tarantula_test.rb +12 -0
data/test/relevance/core_extensions/ellipsize_test.rb +19 -0
data/test/relevance/core_extensions/file_test.rb +8 -0
data/test/relevance/core_extensions/response_test.rb +29 -0
data/test/relevance/core_extensions/test_case_test.rb +16 -0
data/test/relevance/tarantula/attack_form_submission_test.rb +79 -0
data/test/relevance/tarantula/attack_handler_test.rb +29 -0
data/test/relevance/tarantula/crawler_test.rb +296 -0
data/test/relevance/tarantula/form_submission_test.rb +71 -0
data/test/relevance/tarantula/form_test.rb +50 -0
data/test/relevance/tarantula/html_document_handler_test.rb +43 -0
data/test/relevance/tarantula/html_report_helper_test.rb +47 -0
data/test/relevance/tarantula/html_reporter_test.rb +82 -0
data/test/relevance/tarantula/invalid_html_handler_test.rb +33 -0
data/test/relevance/tarantula/io_reporter_test.rb +11 -0
data/test/relevance/tarantula/link_test.rb +61 -0
data/test/relevance/tarantula/log_grabber_test.rb +26 -0
data/test/relevance/tarantula/rails_integration_proxy_test.rb +94 -0
data/test/relevance/tarantula/result_test.rb +85 -0
data/test/relevance/tarantula/tidy_handler_test.rb +58 -0
data/test/relevance/tarantula/transform_test.rb +21 -0
data/test/relevance/tarantula_test.rb +23 -0
data/test/test_helper.rb +34 -0
data/tmp/test_output/images/background.jpg +0 -0
data/tmp/test_output/images/relevance-os-logo.gif +0 -0
data/tmp/test_output/images/tab.png +0 -0
data/tmp/test_output/images/table-sort.gif +0 -0
data/tmp/test_output/images/tarantula-sprites.png +0 -0
data/tmp/test_output/index.html +255 -0
data/tmp/test_output/javascripts/jquery-1.2.3.js +3408 -0
data/tmp/test_output/javascripts/jquery-ui-tabs.js +890 -0
data/tmp/test_output/javascripts/jquery.tablesorter.js +861 -0
data/tmp/test_output/javascripts/tarantula.js +10 -0
data/tmp/test_output/stylesheets/tarantula.css +638 -0
data/tmp/test_output/stylesheets/ui.tabs.css +113 -0
data/tmp/test_output/test_user_pages/1.html +71 -0
data/tmp/test_output/test_user_pages/10.html +71 -0
data/tmp/test_output/test_user_pages/11.html +71 -0
data/tmp/test_output/test_user_pages/12.html +71 -0
data/tmp/test_output/test_user_pages/13.html +71 -0
data/tmp/test_output/test_user_pages/14.html +71 -0
data/tmp/test_output/test_user_pages/15.html +71 -0
data/tmp/test_output/test_user_pages/16.html +71 -0
data/tmp/test_output/test_user_pages/17.html +71 -0
data/tmp/test_output/test_user_pages/18.html +71 -0
data/tmp/test_output/test_user_pages/19.html +71 -0
data/tmp/test_output/test_user_pages/2.html +71 -0
data/tmp/test_output/test_user_pages/20.html +71 -0
data/tmp/test_output/test_user_pages/3.html +71 -0
data/tmp/test_output/test_user_pages/4.html +71 -0
data/tmp/test_output/test_user_pages/5.html +71 -0
data/tmp/test_output/test_user_pages/6.html +71 -0
data/tmp/test_output/test_user_pages/7.html +71 -0
data/tmp/test_output/test_user_pages/8.html +71 -0
data/tmp/test_output/test_user_pages/9.html +71 -0
data/uninstall.rb +1 -0
data/vendor/xss-shield/MIT-LICENSE +20 -0
data/vendor/xss-shield/README +76 -0
data/vendor/xss-shield/init.rb +16 -0
data/vendor/xss-shield/lib/xss_shield.rb +6 -0
data/vendor/xss-shield/lib/xss_shield/erb_hacks.rb +111 -0
data/vendor/xss-shield/lib/xss_shield/haml_hacks.rb +42 -0
data/vendor/xss-shield/lib/xss_shield/safe_string.rb +47 -0
data/vendor/xss-shield/lib/xss_shield/secure_helpers.rb +40 -0
data/vendor/xss-shield/test/test_actionview_integration.rb +40 -0
data/vendor/xss-shield/test/test_erb.rb +44 -0
data/vendor/xss-shield/test/test_haml.rb +43 -0
data/vendor/xss-shield/test/test_helpers.rb +25 -0
data/vendor/xss-shield/test/test_safe_string.rb +55 -0
metadata +283 -0

data/lib/relevance/tarantula/detail.html.erb ADDED Viewed

@@ -0,0 +1,77 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+  <head>
+    <meta http-equiv="Content-type" content="text/html; charset=utf-8"/>
+    <title>Tarantula report detail <%= short_description %></title>
+    <script type="text/javascript" src="../javascripts/jquery-1.2.3.js"></script>
+    <script type="text/javascript" src="../javascripts/jquery.tablesorter.js"></script>
+    <script type="text/javascript" src="../javascripts/jquery-ui-tabs.js"></script>
+    <script type="text/javascript" src="../javascripts/tarantula.js"></script>
+    <link type="text/css" media="screen" rel="stylesheet" href="../stylesheets/tarantula.css"/>
+    <link type="text/css" media="screen" rel="stylesheet" href="../stylesheets/ui.tabs.css"/>
+  <!--[if lte IE 7]>
+    <link rel="stylesheet" href="jqeury.tabs-ie.css" type="text/css" media="projection, screen" />
+  <![endif]-->
+  </head>
+  <body id="top">
+    <div id="container">
+      <div id="header">
+        <hr class="top"/>
+        <h1><span>Tarantula : Eight Legs, Two Fangs, and an Attitude</span></h1>
+      </div>
+      <div id="page-container">
+        <hr class="top"/>
+        <div id="page">
+          <h1>Tarantula report detail <%= short_description %></h1>
+          <p>Generated on <%= Time.now %> (<a href="../index.html">Back</a>)</p>
+          <p>Visit <a href="<%= full_url %>"><%= full_url %></a></p>
+          <p>Response: <%= code %></p>
+          <p>Referrer: <%= referrer || "" %></p>
+          <div id="tabs-container">
+            <ul>
+              <li><a href="#fragment-1"><span>Data</span></a></li>
+              <li><a href="#fragment-2"><span>Body</span></a></li>
+              <li><a href="#fragment-3"><span>Log</span></a></li>
+            </ul>
+            <div id="fragment-1">
+              <% if data %>
+                <%= wrap_in_line_number_table(data) %>
+              <% else %>
+                <p>No Data</p>
+              <% end %>
+            </div>
+            <div id="fragment-2">
+              <% if body %>
+                <%= wrap_in_line_number_table(body) %>
+              <% else %>
+                <p>No Body</p>
+              <% end %>
+            </div>
+            <div id="fragment-3">
+              <% if log %>
+                <%= wrap_in_line_number_table(log) {|line| wrap_stack_trace_line(line)} %>
+              <% else %>
+                <p>No Log</p>
+              <% end %>
+            </div>
+          </div>
+        </div>
+      </div>
+      <div id="sidebar">
+        <h3><span>Tarantula</span></h3>
+        <p>Tarantula is an open-source tool for testing Rails web applications. Tarantula is developed by <a href="http://thinkrelevance.com">Relevance, Inc.</a> and lives at <a href="http://opensource.thinkrelevance.com">http://opensource.thinkrelevance.com</a>.</p>
+      </div>
+    </div>
+  </body>
+</html>

data/lib/relevance/tarantula/form.rb ADDED Viewed

@@ -0,0 +1,21 @@
+class Relevance::Tarantula::Form
+  extend Forwardable
+  def_delegators("@tag", :search)
+  def initialize(tag)
+    @tag = tag
+  end
+  def action
+    @tag['action'].downcase
+  end
+  def method
+    (rails_method_hack or @tag['method'] or 'get').downcase
+  end
+  def rails_method_hack
+    (tag = @tag.at('input[@name="_method"]')) && tag["value"]
+  end
+end

data/lib/relevance/tarantula/form_submission.rb ADDED Viewed

@@ -0,0 +1,70 @@
+class Relevance::Tarantula::FormSubmission
+  attr_accessor :method, :action, :data
+  def initialize(form)
+    @method = form.method
+    @action = form.action
+    @data = mutate_selects(form).merge(mutate_text_areas(form)).merge(mutate_inputs(form))
+  end
+  def self.mutate(form)
+    [self.new(form)]
+  end
+  def to_s
+    "#{action} #{method} #{data.inspect}"
+  end
+  # a form's signature is what makes it unique (e.g. action + fields)
+  # used to keep track of which forms we have submitted already
+  def signature
+    [action, data.keys.sort]
+  end
+  def create_random_data_for(form, tag_selector)
+    form.search(tag_selector).inject({}) do |form_args, input|
+      # TODO: test
+      form_args[input['name']] = random_data(input) if input['name']
+      form_args
+    end
+  end
+  def mutate_inputs(form)
+    create_random_data_for(form, 'input')
+  end
+  def mutate_text_areas(form)
+    create_random_data_for(form, 'textarea')
+  end
+  def mutate_selects(form)
+    form.search('select').inject({}) do |form_args, select|
+      options = select.search('option')
+      option = options.rand
+      form_args[select['name']] = option['value']
+      form_args
+    end
+  end
+  def random_data(input)
+    case input['name']
+      when /amount/         : random_int
+      when /_id$/           : random_whole_number
+      when /uploaded_data/  : nil
+      when /^_method$/      : input['value']
+      when nil              : input['value']
+      else                    random_int
+    end
+  end
+  def big_number
+    10000   # arbitrary
+  end
+  def random_int
+    rand(big_number) - (big_number/2)
+  end
+  def random_whole_number
+    rand(big_number)
+  end
+end

data/lib/relevance/tarantula/html_document_handler.rb ADDED Viewed

@@ -0,0 +1,36 @@
+require 'hpricot'
+class Relevance::Tarantula::HtmlDocumentHandler
+  extend Forwardable
+  def_delegators("@crawler", :queue_link, :queue_form)
+  def initialize(crawler)
+    @crawler = crawler
+  end
+  # HTML::Document shouts to stderr when it sees ugly HTML
+  # We don't want this -- the InvalidHtmlHandler will deal with it
+  def html_doc_without_stderr_noise(html)
+    body = nil
+    Recording.stderr do
+      body = Hpricot html
+    end
+    body
+  end
+  def handle(result)
+    response = result.response
+    url = result.url
+    return unless response.html?
+    body = html_doc_without_stderr_noise(response.body)
+    body.search('a').each do |tag|
+      queue_link(tag, url)
+    end
+    body.search('link').each do |tag|
+      queue_link(tag, url)
+    end
+    body.search('form').each do |form|
+      form['action'] = url unless form['action']
+      queue_form(form, url)
+    end
+    nil
+  end
+end

data/lib/relevance/tarantula/html_report_helper.rb ADDED Viewed

@@ -0,0 +1,56 @@
+require "erb"
+module Relevance::Tarantula::HtmlReportHelper
+  include ERB::Util
+  include Relevance::Tarantula
+  def wrap_in_line_number_table(text, &blk)
+    x = Builder::XmlMarkup.new
+    x.table(:class => "grid tablesorter") do
+      x.thead do
+        x.tr do
+          x.th(:class => "sort asc") do
+            x.span("Line \#")
+            x.span(:class => "sort") do
+              x.em do
+                x << '&#8613;'
+              end
+            end
+          end
+          x.th(:class => "sort left") do
+            x.span("Line")
+            x.span(:class => "sort") do
+              x.em do
+                x << '&#8613;'
+              end
+            end
+          end
+        end
+      end
+      text.split("\n").each_with_index do |line, index|
+        x.tr do
+          x.td(index+1)
+          if block_given?
+            x.td {x << yield(line)}
+          else
+            x.td(line)
+          end
+        end
+      end
+    end
+    x.target!
+  end
+  def textmate_url(file, line_no)
+    "txmt://open?url=file://#{File.expand_path(File.join(rails_root,file))}&line_no=#{line_no}"
+  end
+  def wrap_stack_trace_line(text)
+    if text =~ %r{^\s*(/[^:]+):(\d+):([^:]+)$}
+      file = h($1) # .to_s_xss_protected
+      line_number = $2
+      message = h($3) # .to_s_xss_protected
+      "<a href='#{textmate_url(file, line_number)}'>#{file}:#{line_number}</a>:#{message}" # .mark_as_xss_protected
+    else
+      h(text) # .to_s_xss_protected
+    end
+  end
+end

data/lib/relevance/tarantula/html_reporter.rb ADDED Viewed

@@ -0,0 +1,105 @@
+class Relevance::Tarantula::HtmlReporter
+  include Relevance::Tarantula
+  attr_accessor :basedir, :results
+  delegate :successes, :failures, :to => :results
+  HtmlResultOverview = Struct.new(:code, :url, :description, :method, :referrer, :file_name)
+  def initialize(basedir)
+    @basedir = basedir
+    @results = Struct.new(:successes, :failures).new([], [])
+    FileUtils.mkdir_p(@basedir)
+  end
+  def report(result)
+    return if result.nil?
+    create_detail_report(result)
+    collection = result.success ? results.successes : results.failures
+    collection << HtmlResultOverview.new(
+      result.code, result.url, result.description, result.method, result.referrer, result.file_name
+    )
+  end
+  def finish_report(test_name)
+    puts "Writing results to #{basedir}"
+    copy_styles  unless styles_exist?
+    create_index unless index_exists?
+    update_index(test_name)
+  end
+  def create_detail_report(result)
+    template = ERB.new(template("detail.html.erb"))
+    output(result.file_name, template.result(result.send(:binding)), result.test_name)
+  end
+  def copy_styles
+    # not using cp_r because it picks up .svn crap
+    FileUtils.mkdir_p(File.join(basedir, "stylesheets"))
+    Dir.glob("#{tarantula_home}/laf/stylesheets/*.css").each do |file|
+      FileUtils.cp(file, File.join(basedir, "stylesheets"))
+    end
+    FileUtils.mkdir_p(File.join(basedir, "images"))
+    Dir.glob("#{tarantula_home}/laf/images/*.{jpg,gif,png}").each do |file|
+      FileUtils.cp(file, File.join(basedir, "images"))
+    end
+    FileUtils.mkdir_p(File.join(basedir, "javascripts"))
+    Dir.glob("#{tarantula_home}/laf/javascripts/*.js").each do |file|
+      FileUtils.cp(file, File.join(basedir, "javascripts"))
+    end
+  end
+  def create_index
+    template = ERB.new(template("index.html.erb"))
+    output("index.html", template.result(binding))
+  end
+  def update_index(test_name)
+    File.open(File.join(basedir, "index.html"), "r+") do |file|
+      doc = Hpricot file.read
+      tabs_container = doc.search "#tabs-container ul"
+      results_container = doc.search "#tabs-container"
+      tabs_container.append tab_html(test_name)
+      results_container.append results_html(test_name)
+      file.rewind
+      file.write doc.to_s
+    end
+  end
+  def index_exists?
+    File.exists?(File.join(basedir, "index.html"))
+  end
+  def styles_exist?
+    File.exists?(File.join(basedir, "stylesheets", "tarantula.css"))
+  end
+  def tab_html(test_name)
+    "<li><a href='##{test_name}'><span>#{test_name}</span></a></li>"
+  end
+  def results_html(test_name)
+    template = ERB.new(template("test_report.html.erb"))
+    template.result(binding)
+  end
+  def template(name)
+    File.read(File.join(File.dirname(__FILE__), name))
+  end
+  def output(name, body, subdir = '')
+    FileUtils.mkdir_p(File.join(basedir, subdir)) unless subdir.empty?
+    File.open(File.join(basedir, subdir, name), "w") do |file|
+      file.write body
+    end
+  end
+  # CSS class for HTML status codes
+  def class_for_code(code)
+    "r#{Integer(code)/100}"
+  end
+end

data/lib/relevance/tarantula/index.html.erb ADDED Viewed

@@ -0,0 +1,48 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+  <head>
+    <meta http-equiv="Content-type" content="text/html; charset=utf-8"/>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+    <meta name="Author" content="Erik Yowell; erik[at]thinkrelevance.com"/>
+    <title>Tarantula report</title>
+    <script type="text/javascript" src="javascripts/jquery-1.2.3.js"></script>
+    <script type="text/javascript" src="javascripts/jquery.tablesorter.js"></script>
+    <script type="text/javascript" src="javascripts/jquery-ui-tabs.js"></script>
+    <script type="text/javascript" src="javascripts/tarantula.js"></script>
+    <link type="text/css" media="screen" rel="stylesheet" href="stylesheets/tarantula.css"/>
+    <link type="text/css" media="screen" rel="stylesheet" href="stylesheets/ui.tabs.css"/>
+  </head>
+  <body id="top">
+    <div id="container">
+      <div id="header">
+        <hr class="top"/>
+        <h1><span>Tarantula : Eight Legs, Two Fangs, and an Attitude</span></h1>
+        <ul class="navigation">
+          <li><a href="#" class="result-all"><span>All</span> <em><%= successes.size + failures.size %></em></a></li>
+          <li><a href="#" class="result-failure"><span>Failures</span> <em><%= failures.size %></em></a></li>
+          <li><a href="#" class="result-success"><span>Successful</span> <em><%= successes.size %></em></a></li>
+        </ul>
+      </div>
+    </div>
+    <div id="page-container">
+      <hr class="top"/>
+      <div id="page">
+        <p>Generated on <%= Time.now %></p>
+        <div id="tabs-container">
+          <ul>
+          </ul>
+        </div>
+      </div>
+      <div id="sidebar">
+        <h3><span>Tarantula</span></h3>
+        <p>Tarantula is an open-source tool for testing Rails web applications. Tarantula is developed by <a href="http://thinkrelevance.com">Relevance, Inc.</a> and lives at <a href="http://opensource.thinkrelevance.com">http://opensource.thinkrelevance.com</a>.</p>
+      </div>
+    </div>
+  </body>
+</html>

data/lib/relevance/tarantula/invalid_html_handler.rb ADDED Viewed

@@ -0,0 +1,18 @@
+class Relevance::Tarantula::InvalidHtmlHandler
+  include Relevance::Tarantula
+  def handle(result)
+    response = result.response
+    return unless response.html?
+    begin
+      body = HTML::Document.new(response.body, true)
+    rescue Exception => e
+      error_result = result.dup
+      error_result.success = false
+      error_result.description = "Bad HTML (Scanner)"
+      error_result.data = e.message
+      error_result
+    else
+      nil
+    end
+  end
+end

data/lib/relevance/tarantula/io_reporter.rb ADDED Viewed

@@ -0,0 +1,34 @@
+class Relevance::Tarantula::IOReporter
+  include Relevance::Tarantula
+  attr_accessor :io, :results
+  delegate :successes, :failures, :to => :results
+  IOResultOverview = Struct.new(:code, :url)
+  def initialize(io)
+    @io = io
+    @results = Struct.new(:successes, :failures).new([], [])
+  end
+  def report(result)
+    return if result.nil?
+    unless result.success # collection = result.success ? results.successes : results.failures
+      results.failures << IOResultOverview.new(
+        result.code, result.url
+      )
+    end
+  end
+  def finish_report(test_name)
+    unless (failures).empty?
+      io.puts "****** FAILURES"
+      failures.each do |failure|
+        io.puts "#{failure.code}: #{failure.url}"
+      end
+      raise "#{failures.size} failures"
+    end
+  end
+end