tarantula 0.3.3 → 0.4.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (74) hide show
  1. data/.autotest +14 -0
  2. data/.gitignore +9 -0
  3. data/.rvmrc +1 -0
  4. data/DSL_EXAMPLES.md +120 -0
  5. data/Gemfile +2 -0
  6. data/Gemfile.lock +108 -0
  7. data/{MIT-LICENSE → LICENSE} +0 -0
  8. data/README.rdoc +3 -28
  9. data/Rakefile +27 -59
  10. data/lib/relevance/core_extensions/ellipsize.rb +23 -19
  11. data/lib/relevance/core_extensions/file.rb +10 -4
  12. data/lib/relevance/core_extensions/response.rb +9 -6
  13. data/lib/relevance/core_extensions/test_case.rb +14 -12
  14. data/lib/relevance/tarantula.rb +24 -25
  15. data/lib/relevance/tarantula/attack.rb +19 -15
  16. data/lib/relevance/tarantula/attack_handler.rb +32 -26
  17. data/lib/relevance/tarantula/basic_attack.rb +36 -32
  18. data/lib/relevance/tarantula/crawler.rb +222 -216
  19. data/lib/relevance/tarantula/form.rb +27 -21
  20. data/lib/relevance/tarantula/form_submission.rb +79 -73
  21. data/lib/relevance/tarantula/html_document_handler.rb +37 -31
  22. data/lib/relevance/tarantula/html_report_helper.rb +36 -29
  23. data/lib/relevance/tarantula/html_reporter.rb +105 -99
  24. data/lib/relevance/tarantula/invalid_html_handler.rb +21 -15
  25. data/lib/relevance/tarantula/io_reporter.rb +37 -31
  26. data/lib/relevance/tarantula/link.rb +97 -73
  27. data/lib/relevance/tarantula/log_grabber.rb +20 -14
  28. data/lib/relevance/tarantula/rails_integration_proxy.rb +64 -58
  29. data/lib/relevance/tarantula/response.rb +16 -10
  30. data/lib/relevance/tarantula/result.rb +69 -63
  31. data/lib/relevance/tarantula/tidy_handler.rb +22 -17
  32. data/lib/relevance/tarantula/transform.rb +18 -14
  33. data/lib/relevance/tarantula/version.rb +5 -0
  34. data/{tasks → lib/relevance/tasks}/tarantula_tasks.rake +1 -1
  35. data/lib/tarantula-rails3.rb +9 -0
  36. data/{examples/relevance/core_extensions/ellipsize_example.rb → spec/relevance/core_extensions/ellipsize_spec.rb} +2 -2
  37. data/{examples/relevance/core_extensions/file_example.rb → spec/relevance/core_extensions/file_spec.rb} +2 -2
  38. data/{examples/relevance/core_extensions/response_example.rb → spec/relevance/core_extensions/response_spec.rb} +2 -2
  39. data/{examples/relevance/core_extensions/test_case_example.rb → spec/relevance/core_extensions/test_case_spec.rb} +1 -1
  40. data/{examples/relevance/tarantula/attack_handler_example.rb → spec/relevance/tarantula/attack_handler_spec.rb} +1 -1
  41. data/{examples/relevance/tarantula/basic_attack_example.rb → spec/relevance/tarantula/basic_attack_spec.rb} +2 -2
  42. data/{examples/relevance/tarantula/crawler_example.rb → spec/relevance/tarantula/crawler_spec.rb} +2 -2
  43. data/{examples/relevance/tarantula/form_example.rb → spec/relevance/tarantula/form_spec.rb} +2 -2
  44. data/{examples/relevance/tarantula/form_submission_example.rb → spec/relevance/tarantula/form_submission_spec.rb} +3 -3
  45. data/{examples/relevance/tarantula/html_document_handler_example.rb → spec/relevance/tarantula/html_document_handler_spec.rb} +1 -1
  46. data/{examples/relevance/tarantula/html_report_helper_example.rb → spec/relevance/tarantula/html_report_helper_spec.rb} +1 -1
  47. data/{examples/relevance/tarantula/html_reporter_example.rb → spec/relevance/tarantula/html_reporter_spec.rb} +1 -1
  48. data/{examples/relevance/tarantula/invalid_html_handler_example.rb → spec/relevance/tarantula/invalid_html_handler_spec.rb} +1 -1
  49. data/{examples/relevance/tarantula/io_reporter_example.rb → spec/relevance/tarantula/io_reporter_spec.rb} +1 -1
  50. data/{examples/relevance/tarantula/link_example.rb → spec/relevance/tarantula/link_spec.rb} +5 -5
  51. data/{examples/relevance/tarantula/log_grabber_example.rb → spec/relevance/tarantula/log_grabber_spec.rb} +1 -1
  52. data/{examples/relevance/tarantula/rails_integration_proxy_example.rb → spec/relevance/tarantula/rails_integration_proxy_spec.rb} +1 -1
  53. data/{examples/relevance/tarantula/result_example.rb → spec/relevance/tarantula/result_spec.rb} +1 -1
  54. data/{examples/relevance/tarantula/tidy_handler_example.rb → spec/relevance/tarantula/tidy_handler_spec.rb} +1 -1
  55. data/{examples/relevance/tarantula/transform_example.rb → spec/relevance/tarantula/transform_spec.rb} +2 -2
  56. data/{examples/relevance/tarantula_example.rb → spec/relevance/tarantula_spec.rb} +1 -1
  57. data/{examples/example_helper.rb → spec/spec_helper.rb} +6 -14
  58. data/tarantula.gemspec +31 -0
  59. data/template/tarantula_test.rb +1 -1
  60. data/vendor/xss-shield/MIT-LICENSE +20 -0
  61. data/vendor/xss-shield/README +76 -0
  62. data/vendor/xss-shield/init.rb +16 -0
  63. data/vendor/xss-shield/lib/xss_shield.rb +6 -0
  64. data/vendor/xss-shield/lib/xss_shield/erb_hacks.rb +111 -0
  65. data/vendor/xss-shield/lib/xss_shield/haml_hacks.rb +42 -0
  66. data/vendor/xss-shield/lib/xss_shield/safe_string.rb +47 -0
  67. data/vendor/xss-shield/lib/xss_shield/secure_helpers.rb +40 -0
  68. data/vendor/xss-shield/test/test_actionview_integration.rb +40 -0
  69. data/vendor/xss-shield/test/test_erb.rb +44 -0
  70. data/vendor/xss-shield/test/test_haml.rb +43 -0
  71. data/vendor/xss-shield/test/test_helpers.rb +25 -0
  72. data/vendor/xss-shield/test/test_safe_string.rb +55 -0
  73. metadata +170 -99
  74. data/VERSION.yml +0 -4
@@ -1,13 +1,19 @@
1
1
  # Used to create a stub response when we didn't get back a real response
2
- class Relevance::Tarantula::Response
3
- HASHABLE_ATTRS = [:code, :body, :content_type]
4
- attr_accessor *HASHABLE_ATTRS
5
-
6
- def initialize(hash)
7
- hash.each do |k,v|
8
- raise ArgumentError, k unless HASHABLE_ATTRS.member?(k)
9
- self.instance_variable_set("@#{k}", v)
2
+ module Relevance
3
+ module Tarantula
4
+
5
+ class Response
6
+ HASHABLE_ATTRS = [:code, :body, :content_type]
7
+ attr_accessor *HASHABLE_ATTRS
8
+
9
+ def initialize(hash)
10
+ hash.each do |k,v|
11
+ raise ArgumentError, k unless HASHABLE_ATTRS.member?(k)
12
+ self.instance_variable_set("@#{k}", v)
13
+ end
14
+ end
15
+
10
16
  end
17
+
11
18
  end
12
-
13
- end
19
+ end
@@ -1,77 +1,83 @@
1
- class Relevance::Tarantula::Result
2
- HASHABLE_ATTRS = [:success, :method, :url, :response, :referrer, :data, :description, :log, :test_name]
3
- DEFAULT_LOCALHOST = "http://localhost:3000"
4
- attr_accessor *HASHABLE_ATTRS
5
- include Relevance::Tarantula
6
- include Relevance::Tarantula::HtmlReportHelper
7
-
8
- def initialize(hash)
9
- hash.each do |k,v|
10
- raise ArgumentError, k unless HASHABLE_ATTRS.member?(k)
11
- self.instance_variable_set("@#{k}", v)
12
- end
13
- end
1
+ module Relevance
2
+ module Tarantula
14
3
 
15
- def short_description
16
- [method,url].join(" ")
17
- end
4
+ class Result
5
+ HASHABLE_ATTRS = [:success, :method, :url, :response, :referrer, :data, :description, :log, :test_name]
6
+ DEFAULT_LOCALHOST = "http://localhost:3000"
7
+ attr_accessor *HASHABLE_ATTRS
8
+ include Relevance::Tarantula
9
+ include Relevance::Tarantula::HtmlReportHelper
18
10
 
19
- def sequence_number
20
- @sequence_number ||= (self.class.next_number += 1)
21
- end
11
+ def initialize(hash)
12
+ hash.each do |k,v|
13
+ raise ArgumentError, k unless HASHABLE_ATTRS.member?(k)
14
+ self.instance_variable_set("@#{k}", v)
15
+ end
16
+ end
22
17
 
23
- def file_name
24
- "#{sequence_number}.html"
25
- end
18
+ def short_description
19
+ [method,url].join(" ")
20
+ end
26
21
 
27
- def code
28
- response && response.code
29
- end
22
+ def sequence_number
23
+ @sequence_number ||= (self.class.next_number += 1)
24
+ end
30
25
 
31
- def body
32
- response && response.body
33
- end
26
+ def file_name
27
+ "#{sequence_number}.html"
28
+ end
34
29
 
35
- def full_url
36
- "#{DEFAULT_LOCALHOST}#{url}"
37
- end
30
+ def code
31
+ response && response.code
32
+ end
38
33
 
39
- ALLOW_NNN_FOR = /^allow_(\d\d\d)_for$/
34
+ def body
35
+ response && response.body
36
+ end
40
37
 
41
- class << self
42
- attr_accessor :next_number
43
-
44
- def handle(result)
45
- retval = result.dup
46
- retval.success = successful?(result.response) || can_skip_error?(result)
47
- retval.description = "Bad HTTP Response" unless retval.success
48
- retval
49
- end
38
+ def full_url
39
+ "#{DEFAULT_LOCALHOST}#{url}"
40
+ end
50
41
 
51
- def success_codes
52
- %w{200 201 302 401}
53
- end
54
-
55
- # allow_errors_for is a hash
56
- # k=error code,
57
- # v=array of matchers for urls that can skip said error
58
- attr_accessor :allow_errors_for
59
- def can_skip_error?(result)
60
- coll = allow_errors_for[result.code]
61
- return false unless coll
62
- coll.any? {|item| item === result.url}
63
- end
42
+ ALLOW_NNN_FOR = /^allow_(\d\d\d)_for$/
64
43
 
65
- def successful?(response)
66
- success_codes.member?(response.code)
67
- end
44
+ class << self
45
+ attr_accessor :next_number
46
+
47
+ def handle(result)
48
+ retval = result.dup
49
+ retval.success = successful?(result.response) || can_skip_error?(result)
50
+ retval.description = "Bad HTTP Response" unless retval.success
51
+ retval
52
+ end
53
+
54
+ def success_codes
55
+ %w{200 201 302 401}
56
+ end
57
+
58
+ # allow_errors_for is a hash
59
+ # k=error code,
60
+ # v=array of matchers for urls that can skip said error
61
+ attr_accessor :allow_errors_for
62
+ def can_skip_error?(result)
63
+ coll = allow_errors_for[result.code]
64
+ return false unless coll
65
+ coll.any? {|item| item === result.url}
66
+ end
68
67
 
69
- def method_missing(meth, *args)
70
- super unless ALLOW_NNN_FOR =~ meth.to_s
71
- (allow_errors_for[$1] ||= []).push(*args)
68
+ def successful?(response)
69
+ success_codes.member?(response.code)
70
+ end
71
+
72
+ def method_missing(meth, *args)
73
+ super unless ALLOW_NNN_FOR =~ meth.to_s
74
+ (allow_errors_for[$1] ||= []).push(*args)
75
+ end
76
+ end
77
+
78
+ self.allow_errors_for = {}
79
+ self.next_number = 0
72
80
  end
73
- end
74
81
 
75
- self.allow_errors_for = {}
76
- self.next_number = 0
82
+ end
77
83
  end
@@ -9,23 +9,28 @@ end
9
9
  if defined? Tidy
10
10
  Tidy.path = ENV['TIDY_PATH'] if ENV['TIDY_PATH']
11
11
 
12
- class Relevance::Tarantula::TidyHandler
13
- include Relevance::Tarantula
14
- def initialize(options = {})
15
- @options = {:show_warnings=>true}.merge(options)
16
- end
17
- def handle(result)
18
- response = result.response
19
- return unless response.html?
20
- tidy = Tidy.open(@options) do |tidy|
21
- xml = tidy.clean(response.body)
22
- tidy
23
- end
24
- unless tidy.errors.blank?
25
- error_result = result.dup
26
- error_result.description = "Bad HTML (Tidy)"
27
- error_result.data = tidy.errors.inspect
28
- error_result
12
+ module Relevance
13
+ module Tarantula
14
+
15
+ class TidyHandler
16
+ include Relevance::Tarantula
17
+ def initialize(options = {})
18
+ @options = {:show_warnings=>true}.merge(options)
19
+ end
20
+ def handle(result)
21
+ response = result.response
22
+ return unless response.html?
23
+ tidy = Tidy.open(@options) do |tidy|
24
+ xml = tidy.clean(response.body)
25
+ tidy
26
+ end
27
+ unless tidy.errors.blank?
28
+ error_result = result.dup
29
+ error_result.description = "Bad HTML (Tidy)"
30
+ error_result.data = tidy.errors.inspect
31
+ error_result
32
+ end
33
+ end
29
34
  end
30
35
  end
31
36
  end
@@ -1,17 +1,21 @@
1
- class Relevance::Tarantula::Transform
2
- attr_accessor :from, :to
3
- def initialize(from, to)
4
- @from = from
5
- @to = to
6
- end
7
- def [](string)
8
- case to
9
- when Proc
10
- string.gsub(from, &to)
11
- else
12
- string.gsub(from, to)
1
+ module Relevance
2
+ module Tarantula
3
+
4
+ class Transform
5
+ attr_accessor :from, :to
6
+ def initialize(from, to)
7
+ @from = from
8
+ @to = to
9
+ end
10
+ def [](string)
11
+ case to
12
+ when Proc
13
+ string.gsub(from, &to)
14
+ else
15
+ string.gsub(from, to)
16
+ end
17
+ end
13
18
  end
19
+
14
20
  end
15
21
  end
16
-
17
-
@@ -0,0 +1,5 @@
1
+ module Relevance
2
+ module Tarantula
3
+ VERSION = "0.4.0"
4
+ end
5
+ end
@@ -36,7 +36,7 @@ namespace :tarantula do
36
36
  desc 'Generate a default tarantula test'
37
37
  task :setup do
38
38
  mkdir_p "test/tarantula"
39
- template_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "template", "tarantula_test.rb"))
39
+ template_path = File.expand_path(File.join(File.dirname(__FILE__), "../../..", "template", "tarantula_test.rb"))
40
40
  cp template_path, "test/tarantula/"
41
41
  end
42
42
  end
@@ -0,0 +1,9 @@
1
+ module Relevance
2
+ module Tarantula
3
+ class Railtie < ::Rails::Railtie
4
+ rake_tasks do
5
+ load "relevance/tasks/tarantula_tasks.rake"
6
+ end
7
+ end
8
+ end
9
+ end
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "../..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe "Relevance::CoreExtensions::Object#ellipsize" do
4
4
  it "converts nil to empty string" do
@@ -16,4 +16,4 @@ describe "Relevance::CoreExtensions::Object#ellipsize" do
16
16
  it "shortens long strings and adds ..." do
17
17
  "long-string".ellipsize(5).should == "long-..."
18
18
  end
19
- end
19
+ end
@@ -1,8 +1,8 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "../..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
  require 'relevance/core_extensions/file'
3
3
 
4
4
  describe "Relevance::CoreExtensions::File#extension" do
5
5
  it "should return the extension without the leading dot" do
6
6
  File.extension("foo.bar").should == "bar"
7
7
  end
8
- end
8
+ end
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "../..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
  require 'relevance/core_extensions/file'
3
3
 
4
4
  describe "Relevance::CoreExtensions::Response#html?" do
@@ -26,4 +26,4 @@ describe "Relevance::CoreExtensions::Response#html?" do
26
26
  @response.should be_html
27
27
  end
28
28
 
29
- end
29
+ end
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "../..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
  require 'relevance/core_extensions/test_case'
3
3
 
4
4
  describe "TestCase extensions" do
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe "Relevance::Tarantula::AttackHandler" do
4
4
  before do
@@ -1,4 +1,4 @@
1
- require File.dirname(__FILE__) + "/../../example_helper.rb"
1
+ require "spec_helper"
2
2
 
3
3
  describe Relevance::Tarantula::BasicAttack do
4
4
  before do
@@ -9,4 +9,4 @@ describe Relevance::Tarantula::BasicAttack do
9
9
  @attack.random_whole_number.should >= 0
10
10
  Fixnum.should === @attack.random_whole_number
11
11
  end
12
- end
12
+ end
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe Relevance::Tarantula::Crawler do
4
4
 
@@ -372,4 +372,4 @@ describe Relevance::Tarantula::Crawler do
372
372
 
373
373
  end
374
374
 
375
- end
375
+ end
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe "Relevance::Tarantula::Form large example" do
4
4
  before do
@@ -47,4 +47,4 @@ END
47
47
  @form.method.should == "put"
48
48
  end
49
49
 
50
- end
50
+ end
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe Relevance::Tarantula::FormSubmission do
4
4
 
@@ -53,7 +53,7 @@ describe Relevance::Tarantula::FormSubmission do
53
53
  end
54
54
 
55
55
  it "can mutate selects" do
56
- Hpricot::Elements.any_instance.stubs(:rand).returns(stub(:[] => "2006-stub"))
56
+ Hpricot::Elements.any_instance.stubs(:sample).returns(stub(:[] => "2006-stub"))
57
57
  @fs.mutate_selects(@form).should == {"foo[opened_on(1i)]" => "2006-stub"}
58
58
  end
59
59
 
@@ -91,7 +91,7 @@ describe Relevance::Tarantula::FormSubmission do
91
91
  end
92
92
 
93
93
  it "can mutate selects" do
94
- Hpricot::Elements.any_instance.stubs(:rand).returns(stub(:[] => "2006-stub"))
94
+ Hpricot::Elements.any_instance.stubs(:sample).returns(stub(:[] => "2006-stub"))
95
95
  @fs.mutate_selects(@form).should == {"foo[opened_on(1i)]" => "2006-stub"}
96
96
  end
97
97
 
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe "Relevance::Tarantula::HtmlDocumentHandler" do
4
4
 
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  module HtmlReportHelperSpec
4
4
  # Is there an idiom for this?
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe "Relevance::Tarantula::HtmlReporter file output" do
4
4
 
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe "Relevance::Tarantula::InvalidHtmlHandler" do
4
4
  before do
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe 'Relevance::Tarantula::IOReporter' do
4
4
  it "reports errors to stderr and then raises" do
@@ -1,4 +1,4 @@
1
- require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "example_helper.rb"))
1
+ require "spec_helper"
2
2
 
3
3
  describe "Relevance::Tarantula::Link" do
4
4
  include ActionView::Helpers::UrlHelper
@@ -16,19 +16,19 @@ describe "Relevance::Tarantula::Link" do
16
16
  end
17
17
 
18
18
  it "parses anchor tags with POST 'method'" do
19
- link = make_link(Hpricot(%Q{<a href="/foo" onclick="#{method_javascript_function(:post)}">foo</a>}).at('a'))
19
+ link = make_link(Hpricot(%Q{<a href="/foo" onclick="#{Relevance::Tarantula::Link.method_javascript_function(:post)}">foo</a>}).at('a'))
20
20
  link.href.should == '/foo'
21
21
  link.method.should == :post
22
22
  end
23
23
 
24
24
  it "parses anchor tags with PUT 'method'" do
25
- link = make_link(Hpricot(%Q{<a href="/foo" onclick="#{method_javascript_function(:put)}">foo</a>}).at('a'))
25
+ link = make_link(Hpricot(%Q{<a href="/foo" onclick="#{Relevance::Tarantula::Link.method_javascript_function(:put)}">foo</a>}).at('a'))
26
26
  link.href.should == '/foo'
27
27
  link.method.should == :put
28
28
  end
29
29
 
30
30
  it "parses anchor tags with DELETE 'method'" do
31
- link = make_link(Hpricot(%Q{<a href="/foo" onclick="#{method_javascript_function(:delete)}">foo</a>}).at('a'))
31
+ link = make_link(Hpricot(%Q{<a href="/foo" onclick="#{Relevance::Tarantula::Link.method_javascript_function(:delete)}">foo</a>}).at('a'))
32
32
  link.href.should == '/foo'
33
33
  link.method.should == :delete
34
34
  end
@@ -81,4 +81,4 @@ describe "possible conflict when user has an AR model named Link" do
81
81
  }.should_not raise_error
82
82
  end
83
83
 
84
- end
84
+ end