tarantula 0.0.5

data/lib/relevance/tarantula/link.rb

@@ -0,0 +1,56 @@
+class Relevance::Tarantula::Link
+  
+  class << self
+    include ActionView::Helpers::UrlHelper
+    # method_javascript_function needs this method
+    def protect_against_forgery?
+      false
+    end
+  end
+  
+  METHOD_REGEXPS = {}
+  [:put, :delete, :post].each do |m|
+    # remove submit from the end so we'll match with or without forgery protection
+    s = method_javascript_function(m).gsub( /f.submit();/, "" )
+    # don't just match this.href in case a different url was passed originally
+    s = Regexp.escape(s).gsub( /this.href/, ".*" )
+    METHOD_REGEXPS[m] = /#{s}/
+  end
+  
+  attr_accessor :href
+  
+  def initialize(link)
+    if String === link || link.nil?
+      @href = link
+      @method = :get
+    else # should be a tag
+      @href = link['href'].downcase
+      @tag = link
+    end
+  end
+  
+  def method
+    @method ||= begin
+      (@tag &&
+       [:put, :delete, :post].detect do |m| # post should be last since it's least specific
+         @tag['onclick'] =~ METHOD_REGEXPS[m]
+       end) ||
+      :get
+    end
+  end
+  
+  def ==(obj)
+    obj.respond_to?(:href) && obj.respond_to?(:method) &&
+      self.href.to_s == obj.href.to_s && self.method.to_s == obj.method.to_s
+  end
+  alias :eql? :==
+  
+  def hash
+    to_s.hash
+  end
+  
+  def to_s
+    "<Relevance::Tarantula::Link href=#{href}, method=#{method}>"
+  end
+  
+end

data/lib/relevance/tarantula/log_grabber.rb

@@ -0,0 +1,16 @@
+class Relevance::Tarantula::LogGrabber
+  attr_accessor :path
+  def initialize(path)
+    @path = path
+  end
+  
+  def clear!
+    File.open(@path, "w")
+  end
+  
+  def grab!
+    File.read(@path)
+  ensure
+    clear!
+  end
+end

data/lib/relevance/tarantula/rails_integration_proxy.rb

@@ -0,0 +1,70 @@
+require 'test/unit'
+
+class Relevance::Tarantula::RailsIntegrationProxy
+  include Relevance::Tarantula
+  extend Relevance::Tarantula
+  extend Forwardable
+  attr_accessor :integration_test
+
+  def self.rails_integration_test(integration_test, options = {})
+    t = Crawler.new
+    t.max_url_length = options[:max_url_length] if options[:max_url_length] 
+    t.proxy = RailsIntegrationProxy.new(integration_test)    
+    t.handlers << HtmlDocumentHandler.new(t)
+    t.handlers << InvalidHtmlHandler.new
+    t.log_grabber = Relevance::Tarantula::LogGrabber.new(File.join(rails_root, "log/test.log"))
+    t.skip_uri_patterns << /logout$/
+    t.transform_url_patterns += [
+      [/\?\d+$/, ''],                               # strip trailing numbers for assets
+      [/^http:\/\/#{integration_test.host}/, '']    # strip full path down to relative
+    ]
+    t.test_name = t.proxy.integration_test.method_name
+    t.reporters << Relevance::Tarantula::HtmlReporter.new(t.report_dir)
+    t
+  end
+
+  def initialize(integration_test)
+    @integration_test = integration_test
+    @integration_test.meta.attr_accessor :response
+  end
+  
+  [:get, :post, :put, :delete].each do |verb|
+    define_method(verb) do |url, *args|
+      integration_test.send(verb, url, *args)
+      response = integration_test.response
+      patch_response(url, response)
+      response
+    end
+  end
+
+  def patch_response(url, response)
+    if response.code == '404'
+      if File.exist?(static_content_path(url))
+        case ext = File.extension(url)
+        when /jpe?g|gif|psd|png|eps|pdf/
+          log "Skipping #{url} (for now)"
+        when /html|te?xt|css|js/
+          response.body = static_content_file(url)
+          response.headers["type"] = "text/#{ext}"  # readable as response.content_type
+          response.meta.attr_accessor :code
+          response.code = "200"
+        else
+          log "Skipping unknown type #{url}"
+        end
+      end
+    end
+    # don't count on metaclass taking block, e.g.
+    # http://relevancellc.com/2008/2/12/how-should-metaclass-work
+    response.metaclass.class_eval do
+      include Relevance::CoreExtensions::Response
+    end
+  end
+  
+  def static_content_file(url)
+    File.read(static_content_path(url))
+  end
+  
+  def static_content_path(url)
+    File.expand_path(File.join(rails_root, "public", url))
+  end
+end

data/lib/relevance/tarantula/recording.rb

@@ -0,0 +1,12 @@
+module Recording
+  def self.stderr
+    $stderr = recorder = StringIO.new
+    begin
+      yield
+    ensure
+      $stderr = STDERR
+    end
+    recorder.rewind
+    recorder.read
+  end
+end

data/lib/relevance/tarantula/response.rb

@@ -0,0 +1,13 @@
+# Used to create a stub response when we didn't get back a real response
+class Relevance::Tarantula::Response
+  HASHABLE_ATTRS = [:code, :body, :content_type]
+  attr_accessor *HASHABLE_ATTRS
+
+  def initialize(hash)
+    hash.each do |k,v|
+      raise ArgumentError, k unless HASHABLE_ATTRS.member?(k)
+      self.instance_variable_set("@#{k}", v)
+    end
+  end
+  
+end

data/lib/relevance/tarantula/result.rb

@@ -0,0 +1,66 @@
+class Relevance::Tarantula::Result
+  HASHABLE_ATTRS = [:success, :method, :url, :response, :referrer, :data, :description, :log, :test_name]
+  DEFAULT_LOCALHOST = "http://localhost:3000"
+  attr_accessor *HASHABLE_ATTRS
+  include Relevance::Tarantula
+  include Relevance::Tarantula::HtmlReportHelper
+
+  def initialize(hash)
+    hash.each do |k,v|
+      raise ArgumentError, k unless HASHABLE_ATTRS.member?(k)
+      self.instance_variable_set("@#{k}", v)
+    end
+  end
+  def short_description
+    [method,url].join(" ")
+  end
+  def sequence_number
+    @sequence_number ||= (self.class.next_number += 1)
+  end
+  def file_name
+    "#{sequence_number}.html"
+  end
+  def code
+    response && response.code
+  end
+  def body
+    response && response.body
+  end
+  def full_url
+    "#{DEFAULT_LOCALHOST}#{url}"
+  end
+  ALLOW_NNN_FOR = /^allow_(\d\d\d)_for$/
+  class << self
+    attr_accessor :next_number
+    def handle(result)
+      retval = result.dup
+      retval.success = successful?(result.response) || can_skip_error?(result)
+      retval.description = "Bad HTTP Response" unless retval.success
+      retval
+    end
+    def success_codes 
+      %w{200 201 302 401}
+    end
+    
+    # allow_errors_for is a hash 
+    #  k=error code,
+    #  v=array of matchers for urls that can skip said error
+    attr_accessor :allow_errors_for
+    def can_skip_error?(result)
+      coll = allow_errors_for[result.code]
+      return false unless coll
+      coll.any? {|item| item === result.url}
+    end
+    def successful?(response)
+      success_codes.member?(response.code)
+    end
+    def method_missing(meth, *args)  
+      super unless ALLOW_NNN_FOR =~ meth.to_s
+      (allow_errors_for[$1] ||= []).push(*args)
+    end
+  end
+  self.allow_errors_for = {}
+  self.next_number = 0
+  
+  
+end

data/lib/relevance/tarantula/test_report.html.erb

@@ -0,0 +1,34 @@
+<div id="<%= test_name %>">
+  <% %w{failures successes}.each do |result_type| %>
+    <table class="grid tablesorter" cellspacing="0">
+      <caption><%= result_type.capitalize %> (<%= send(result_type).size %>)</caption>
+      <thead>
+        <tr>
+          <th class="sort asc"><span>URL</span><span class="sort"><em>&#8613;</em></span></th>
+          <th><span>Action</span><span class="sort"><em>&#8613;</em></span></th>
+          <th><span>Response</span><span class="sort"><em>&#8613;</em></span></th>
+          <th><span>Description</span><span class="sort"><em>&#8613;</em></span></th>
+          <th><span>Referrer</span><span class="sort"><em>&#8613;</em></span></th>
+        </tr>
+      </thead>
+      <tfoot>
+        <tr>
+          <td colspan="5">
+            Footer
+          </td>
+        </tr>
+      </tfoot>
+      <tbody>
+        <% send(result_type).sort{|x,y| y.code.to_s <=> x.code.to_s}.each do |result| %>
+          <tr>
+            <td class="left"><a href="<%= "#{test_name}/#{result.file_name}" %>"><%= result.url.ellipsize(30) %></a></td>
+            <td class="center"><%= result.method %></td>
+            <td class="center"><span class="<%= class_for_code(result.code) %>"><%= result.code %></span></td>
+            <td><%= result.description %></td>
+            <td><%= result.referrer.ellipsize(30) %></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  <% end %>
+</div>

data/lib/relevance/tarantula/tidy_handler.rb

@@ -0,0 +1,32 @@
+require 'rubygems'
+begin
+  gem 'tidy'
+  require 'tidy'
+rescue Gem::LoadError
+  # tidy not available
+end
+
+if defined? Tidy
+  Tidy.path = ENV['TIDY_PATH'] if ENV['TIDY_PATH']
+
+  class Relevance::Tarantula::TidyHandler 
+    include Relevance::Tarantula
+    def initialize(options = {})
+      @options = {:show_warnings=>true}.merge(options)
+    end
+    def handle(result)
+      response = result.response
+      return unless response.html?
+      tidy = Tidy.open(@options) do |tidy|
+        xml = tidy.clean(response.body)
+        tidy
+      end
+      unless tidy.errors.blank?
+        error_result = result.dup
+        error_result.description = "Bad HTML (Tidy)"
+        error_result.data = tidy.errors.inspect
+        error_result
+      end
+    end
+  end
+end

data/lib/relevance/tarantula/transform.rb

@@ -0,0 +1,17 @@
+class Relevance::Tarantula::Transform 
+  attr_accessor :from, :to
+  def initialize(from, to)
+    @from = from
+    @to = to
+  end
+  def [](string)
+    case to
+    when Proc
+      string.gsub(from, &to)
+    else
+      string.gsub(from, to)
+    end
+  end
+end
+
+

data/manifest.txt

@@ -0,0 +1,117 @@
+CHANGELOG
+init.rb
+install.rb
+laf/images/background.jpg
+laf/images/relevance-os-logo.gif
+laf/images/tab.png
+laf/images/table-sort.gif
+laf/images/tarantula-sprites.png
+laf/javascripts/jquery-1.2.3.js
+laf/javascripts/jquery-ui-tabs.js
+laf/javascripts/jquery.tablesorter.js
+laf/javascripts/tarantula.js
+laf/stylesheets/tarantula.css
+laf/stylesheets/ui.tabs.css
+lib/relevance/core_extensions/ellipsize.rb
+lib/relevance/core_extensions/file.rb
+lib/relevance/core_extensions/response.rb
+lib/relevance/core_extensions/test_case.rb
+lib/relevance/tarantula/attack.rb
+lib/relevance/tarantula/attack_form_submission.rb
+lib/relevance/tarantula/attack_handler.rb
+lib/relevance/tarantula/crawler.rb
+lib/relevance/tarantula/detail.html.erb
+lib/relevance/tarantula/form.rb
+lib/relevance/tarantula/form_submission.rb
+lib/relevance/tarantula/html_document_handler.rb
+lib/relevance/tarantula/html_report_helper.rb
+lib/relevance/tarantula/html_reporter.rb
+lib/relevance/tarantula/index.html.erb
+lib/relevance/tarantula/invalid_html_handler.rb
+lib/relevance/tarantula/io_reporter.rb
+lib/relevance/tarantula/link.rb
+lib/relevance/tarantula/log_grabber.rb
+lib/relevance/tarantula/rails_integration_proxy.rb
+lib/relevance/tarantula/recording.rb
+lib/relevance/tarantula/response.rb
+lib/relevance/tarantula/result.rb
+lib/relevance/tarantula/test_report.html.erb
+lib/relevance/tarantula/tidy_handler.rb
+lib/relevance/tarantula/transform.rb
+lib/relevance/tarantula.rb
+manifest.txt
+MIT-LICENSE
+rails/init.rb
+Rakefile
+README.rdoc
+tarantula.gemspec
+tasks/tarantula_tasks.rake
+template/tarantula_test.rb
+test/relevance/core_extensions/ellipsize_test.rb
+test/relevance/core_extensions/file_test.rb
+test/relevance/core_extensions/response_test.rb
+test/relevance/core_extensions/test_case_test.rb
+test/relevance/tarantula/attack_form_submission_test.rb
+test/relevance/tarantula/attack_handler_test.rb
+test/relevance/tarantula/crawler_test.rb
+test/relevance/tarantula/form_submission_test.rb
+test/relevance/tarantula/form_test.rb
+test/relevance/tarantula/html_document_handler_test.rb
+test/relevance/tarantula/html_report_helper_test.rb
+test/relevance/tarantula/html_reporter_test.rb
+test/relevance/tarantula/invalid_html_handler_test.rb
+test/relevance/tarantula/io_reporter_test.rb
+test/relevance/tarantula/link_test.rb
+test/relevance/tarantula/log_grabber_test.rb
+test/relevance/tarantula/rails_integration_proxy_test.rb
+test/relevance/tarantula/result_test.rb
+test/relevance/tarantula/tidy_handler_test.rb
+test/relevance/tarantula/transform_test.rb
+test/relevance/tarantula_test.rb
+test/test_helper.rb
+tmp/test_output/images/background.jpg
+tmp/test_output/images/relevance-os-logo.gif
+tmp/test_output/images/tab.png
+tmp/test_output/images/table-sort.gif
+tmp/test_output/images/tarantula-sprites.png
+tmp/test_output/index.html
+tmp/test_output/javascripts/jquery-1.2.3.js
+tmp/test_output/javascripts/jquery-ui-tabs.js
+tmp/test_output/javascripts/jquery.tablesorter.js
+tmp/test_output/javascripts/tarantula.js
+tmp/test_output/stylesheets/tarantula.css
+tmp/test_output/stylesheets/ui.tabs.css
+tmp/test_output/test_user_pages/1.html
+tmp/test_output/test_user_pages/10.html
+tmp/test_output/test_user_pages/11.html
+tmp/test_output/test_user_pages/12.html
+tmp/test_output/test_user_pages/13.html
+tmp/test_output/test_user_pages/14.html
+tmp/test_output/test_user_pages/15.html
+tmp/test_output/test_user_pages/16.html
+tmp/test_output/test_user_pages/17.html
+tmp/test_output/test_user_pages/18.html
+tmp/test_output/test_user_pages/19.html
+tmp/test_output/test_user_pages/2.html
+tmp/test_output/test_user_pages/20.html
+tmp/test_output/test_user_pages/3.html
+tmp/test_output/test_user_pages/4.html
+tmp/test_output/test_user_pages/5.html
+tmp/test_output/test_user_pages/6.html
+tmp/test_output/test_user_pages/7.html
+tmp/test_output/test_user_pages/8.html
+tmp/test_output/test_user_pages/9.html
+uninstall.rb
+vendor/xss-shield/init.rb
+vendor/xss-shield/lib/xss_shield/erb_hacks.rb
+vendor/xss-shield/lib/xss_shield/haml_hacks.rb
+vendor/xss-shield/lib/xss_shield/safe_string.rb
+vendor/xss-shield/lib/xss_shield/secure_helpers.rb
+vendor/xss-shield/lib/xss_shield.rb
+vendor/xss-shield/MIT-LICENSE
+vendor/xss-shield/README
+vendor/xss-shield/test/test_actionview_integration.rb
+vendor/xss-shield/test/test_erb.rb
+vendor/xss-shield/test/test_haml.rb
+vendor/xss-shield/test/test_helpers.rb
+vendor/xss-shield/test/test_safe_string.rb