tarantula 0.3.3 → 0.4.0

data/.autotest

@@ -0,0 +1,14 @@
+Autotest.add_hook :initialize do |autotest|
+
+ # Check every 5 seconds
+ # autotest.sleep = 3
+
+ # Ignore files with suffix
+ %w{.svn .log .hg .git .erb .rhtml .png .txt .sh .project .rjs .rake .jpg .css .xml}.each { |exception| autotest.add_exception(exception) }
+
+ autotest.add_mapping(/relevance\/tarantula/) do |f, _|
+   autotest.files_matching(/^test.*rb$/)
+ end
+
+end
+

data/.gitignore

@@ -0,0 +1,9 @@
+rcov_tmp
+tmp
+pkg
+rdoc
+.zsh_rake_cache
+doc
+TAGS
+coverage
+*.gem

data/.rvmrc

@@ -0,0 +1 @@
+rvm use 1.9.2@tarantula

data/DSL_EXAMPLES.md

@@ -0,0 +1,120 @@
+# Tarantula DSL-based API examples
+
+I'm planning to change the Tarantula configuration API to be more
+Ruby-ish, declarative and DSL-like.
+This document contains examples of what I'm aiming for, 
+as a record of ideas and for discussion.
+
+**This is not a promise to implement all of these features.**
+I think all of these feature ideas would be useful, but I already know
+some of them will be very costly and difficult to implement.
+I'm including them all here because I want to come up with an API
+syntax and style that will accommodate a lot of different things.
+
+I don't yet know whether I'll maintain the current association with
+test cases; it seems that it might be better to have a standalone
+`tarantula_config.rb` file or something like that, with a custom 
+Tarantula runner that doesn't depend on test/unit or RSpec.
+
+## Basic crawl, starting from '/'
+
+    Tarantula.crawl
+    
+## Basic crawl, starting from '/' and '/admin'
+
+    Tarantula.crawl('both') do |t|
+      t.root_page '/'
+      t.root_page '/admin'
+    end
+    
+## Crawl with the Tidy handler
+
+    # the operand to the crawl method, if supplied, will be used
+    # as the tab label in the report.
+    Tarantula.crawl("tidy") do |t|
+      t.add_handler :tidy
+    end
+    
+## Reorder requests on the queue
+
+This is necessary to fix [this bug](http://github.com/relevance/tarantula/issues#issue/3)
+
+    Tarantula.crawl do |t|
+      # Treat the following controllers as "resourceful",
+      # reordering appropriately (see my comment on
+      # <http://github.com/relevance/tarantula/issues#issue/3>)
+      t.resources 'post', 'comment'
+      
+      # For the 'news' controller, order the actions this way:
+      t.reorder_for 'news', :actions => %w{show read unread mark_read}
+      
+      # For the 'history' controller, supply a comparison function:
+      t.reorder_for 'history', :compare => lambda{|x, y| ... }
+    end
+    
+(Unlike most of the declarations in this example document, these will
+need to be reusable across multiple crawl blocks somehow.)
+
+## Selectively allowing errors
+
+    Tarantula.crawl("ignoring not-found users") do |t|
+      t.allow_errors :not_found, %r{/users/\d+/}
+      # or
+      t.allow_errors :not_found, :controller => 'users', :action => 'show'
+    end
+
+## Attacks
+
+    Tarantula.crawl("attacks") do |t|
+      t.attack :xss, :input => "<script>gotcha!</script>", :output => :input
+      t.attack :sql_injection, :input => "a'; DROP TABLE posts;"
+      t.times_to_crawl 2
+    end
+    
+We should have prepackaged attack suites that understand various techniques.
+
+    Tarantula.crawl("xss suite") do |t|
+      t.attack :xss, :suite => 'standard'
+    end
+    
+    Tarantula.crawl("sql injection suite") do |t|
+      t.attack :sql_injection, :suite => 'standard'
+    end
+    
+## Timeout
+
+    Tarantula.crawl do |t|
+      t.times_to_crawl 2
+      t.stop_after 2.minutes
+    end
+    
+## Fuzzing
+
+    Tarantula.crawl do |t|
+      # :valid input uses SQL types and knowledge of model validations
+      # to attempt to generate valid input.  You can override the defaults.
+      t.fuzz_with :valid_input do |f|
+        f.fuzz(Post, :title) { random_string(1..40) }
+        f.fuzz(Person, :phone) { random_string("%03d-%03d-%04d") }
+      end
+      
+      # The point of fuzzing is to keep trying a lot of things to 
+      # see if you can find breakage.
+      t.crawl_for 45.minutes
+    end
+    
+    Tarantula.crawl do |t|
+      # :typed_input uses SQL types to generate "reasonable" but probably
+      # invalid input (e.g., numeric fields will get strings of digits, 
+      # but they'll be too large or negative; date fields will get dates,
+      # but very far in the past or future; string fields will get very 
+      # large strings.)
+      t.fuzz_with :typed_input
+      t.crawl_for 30.minutes
+    end
+    
+    Tarantula.crawl do |t|
+      # :random_input just plugs in random strings everywhere.
+      t.fuzz_with :random_input
+      t.crawl_for 2.hours
+    end

data/Gemfile

@@ -0,0 +1,2 @@
+source "https://rubygems.org"
+gemspec

data/Gemfile.lock

@@ -0,0 +1,108 @@
+PATH
+  remote: .
+  specs:
+    relevance/tarantula (0.4.0)
+      hpricot (~> 0.8.4)
+      htmlentities (~> 4.3.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    abstract (1.0.0)
+    actionmailer (3.0.10)
+      actionpack (= 3.0.10)
+      mail (~> 2.2.19)
+    actionpack (3.0.10)
+      activemodel (= 3.0.10)
+      activesupport (= 3.0.10)
+      builder (~> 2.1.2)
+      erubis (~> 2.6.6)
+      i18n (~> 0.5.0)
+      rack (~> 1.2.1)
+      rack-mount (~> 0.6.14)
+      rack-test (~> 0.5.7)
+      tzinfo (~> 0.3.23)
+    activemodel (3.0.10)
+      activesupport (= 3.0.10)
+      builder (~> 2.1.2)
+      i18n (~> 0.5.0)
+    activerecord (3.0.10)
+      activemodel (= 3.0.10)
+      activesupport (= 3.0.10)
+      arel (~> 2.0.10)
+      tzinfo (~> 0.3.23)
+    activeresource (3.0.10)
+      activemodel (= 3.0.10)
+      activesupport (= 3.0.10)
+    activesupport (3.0.10)
+    arel (2.0.10)
+    builder (2.1.2)
+    diff-lcs (1.1.2)
+    erubis (2.6.6)
+      abstract (>= 1.0.0)
+    hpricot (0.8.4)
+    htmlentities (4.3.0)
+    i18n (0.5.0)
+    json (1.5.3)
+    log_buddy (0.6.0)
+    mail (2.2.19)
+      activesupport (>= 2.3.6)
+      i18n (>= 0.4.0)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.16)
+    mocha (0.9.12)
+    polyglot (0.3.2)
+    rack (1.2.3)
+    rack-mount (0.6.14)
+      rack (>= 1.0.0)
+    rack-test (0.5.7)
+      rack (>= 1.0)
+    rails (3.0.10)
+      actionmailer (= 3.0.10)
+      actionpack (= 3.0.10)
+      activerecord (= 3.0.10)
+      activeresource (= 3.0.10)
+      activesupport (= 3.0.10)
+      bundler (~> 1.0)
+      railties (= 3.0.10)
+    railties (3.0.10)
+      actionpack (= 3.0.10)
+      activesupport (= 3.0.10)
+      rake (>= 0.8.7)
+      rdoc (~> 3.4)
+      thor (~> 0.14.4)
+    rake (0.9.2)
+    rdiscount (1.6.8)
+    rdoc (3.9.2)
+    rspec (2.6.0)
+      rspec-core (~> 2.6.0)
+      rspec-expectations (~> 2.6.0)
+      rspec-mocks (~> 2.6.0)
+    rspec-core (2.6.4)
+    rspec-expectations (2.6.0)
+      diff-lcs (~> 1.1.2)
+    rspec-mocks (2.6.0)
+    sdoc (0.3.0)
+      json (>= 1.1.3)
+      rdoc (~> 3)
+    sdoc-helpers (0.1.4)
+      sdoc (~> 0.2)
+    thor (0.14.6)
+    treetop (1.4.10)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.29)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  log_buddy (~> 0.6.0)
+  mocha (~> 0.9.12)
+  rails (~> 3.0.9)
+  rdiscount (~> 1.6.8)
+  relevance/tarantula!
+  rspec (~> 2.6.0)
+  sdoc (~> 0.3.0)
+  sdoc-helpers (~> 0.1.4)

data/README.rdoc

@@ -2,7 +2,7 @@
 
 == DESCRIPTION
 
-Tarantula is a big fuzzy spider. It crawls your Rails application, fuzzing data to see what breaks.
+Tarantula is a big fuzzy spider. It crawls your Rails 3 application, fuzzing data to see what breaks.
 
 == Usage
 
@@ -11,33 +11,7 @@ Tarantula is a big fuzzy spider. It crawls your Rails application, fuzzing data
 The latest and greatest version is always available on GitHub. (See the rakefile for dependencies, or
 just let RubyGems handle it.)
 
-    gem sources -a http://gems.github.com
-    gem install relevance-tarantula
-
-You can also grab it from RubyForge, where we will push stable releases but may not be as bleeding edge
-as the GitHub gem.
-
-    gem install tarantula
-
-=== Project Setup
-
-To set up Tarantula into your application, add the following line into either config/environment.rb or
-config/environments/test.rb (preferred). This assumes that you have Rails 2.1 or higher installed.
-
-    config.gem 'relevance-tarantula', :source => "http://gems.github.com", :lib => 'relevance/tarantula'
-
-Since Rails doesn't (yet) support automatically loading rake tasks that live inside gems, you will need
-to update your Rakefile to load Tarantula's rake tasks. The simplest approach is to start by vendoring 
-Tarantula into your Rails app.
-
-    mkdir -p vendor/gems
-    cd vendor/gems
-    gem unpack relevance-tarantula
-
-You can then add the following line into your Rakefile, which will allow your application to discover 
-Tarantula's rake tasks.
-
-  load File.join(RAILS_ROOT, Dir["vendor/gems/relevance-tarantula-*/tasks/*.rake"])
+    gem install tarantula-rails3
 
 === Crawling Your App
 
@@ -51,6 +25,7 @@ Take a moment to familiarize yourself with the generated test. If parts of your
 login, update the test to make sure Tarantula can access those parts of your app.
 
    require "relevance/tarantula"
+   require "test_helper"
    
    class TarantulaTest < ActionController::IntegrationTest
      # Load enough test data to ensure that there's a link to every page in your

data/Rakefile

@@ -1,72 +1,40 @@
 require 'rake'
 require 'rake/testtask'
 require 'rake/rdoctask'
-require 'micronaut'
-require 'micronaut/rake_task'
 
 begin
-  require 'jeweler'
-  files = ["CHANGELOG", "MIT-LICENSE", "Rakefile", "README.rdoc", "VERSION.yml"]
-  files << Dir["examples/**/*", "laf/**/*", "lib/**/*", "tasks/**/*", "template/**/*"]
-  
-  Jeweler::Tasks.new do |s|
-    s.name = "tarantula"
-    s.summary = "A big hairy fuzzy spider that crawls your site, wreaking havoc"
-    s.description = "A big hairy fuzzy spider that crawls your site, wreaking havoc"
-    s.homepage = "http://github.com/relevance/tarantula"
-    s.email = "opensource@thinkrelevance.com"
-    s.authors = ["Relevance, Inc."]
-    s.require_paths = ["lib"]
-    s.files = files.flatten
-    s.add_dependency 'htmlentities'
-    s.add_dependency 'hpricot'
-    s.rubyforge_project = 'thinkrelevance'
-  end
-rescue LoadError
-  puts "Jeweler not available. Install it with: sudo gem install technicalpickles-jeweler -s http://gems.github.com"
-end
-
-desc 'Generate documentation for the tarantula plugin.'
-Rake::RDocTask.new(:rdoc) do |rdoc|
-  rdoc.rdoc_dir = 'rdoc'
-  rdoc.title    = 'Tarantula'
-  rdoc.options << '--line-numbers' << '--inline-source'
-  rdoc.rdoc_files.include('README.rdoc')
-  rdoc.rdoc_files.include('lib/**/*.rb')
-end
+  require 'rspec'
+  require 'rspec/core/rake_task'
 
-desc "Run all micronaut examples"
-Micronaut::RakeTask.new :examples do |t|
-  t.pattern = "examples/**/*_example.rb"
-end
+  RSpec::Core::RakeTask.new('spec') do |t|
+    t.verbose = true
+  end
 
-namespace :examples do
-  desc "Run all micronaut examples using rcov"
-  Micronaut::RakeTask.new :coverage do |t|
-    t.pattern = "examples/**/*_example.rb"
+  desc "Run all RSpec specs using rcov"
+  RSpec::Core::RakeTask.new :rcov do |t|
+    t.pattern = File.dirname(__FILE__)+"/spec/**/*_spec.rb"
     t.rcov = true
     t.rcov_opts = %[--exclude "gems/*,/Library/Ruby/*,config/*" --text-summary  --sort coverage]
   end
-  
-  RAILS_VERSIONS = %w[2.3.2 2.3.4]
-  
-  unless RUBY_VERSION =~ /^1\.9\./
-    RAILS_VERSIONS.unshift(*%w[2.0.2 2.1.0 2.1.1 2.2.2 2.3.3])
-    RAILS_VERSIONS.sort!
-  end
-  
-  desc "Run examples with multiple versions of rails"
-  task :multi_rails do
-    RAILS_VERSIONS.each do |rails_version|
-      puts
-      sh "RAILS_VERSION='#{rails_version}' rake examples"
-    end
-  end
-  
+
+  task :default => :spec
+rescue LoadError
+  puts "rspec, or one of its dependencies, is not available. Install it with: sudo gem install rspec"
 end
 
-if ENV["RUN_CODE_RUN"]
-  task :default => "examples:multi_rails"
-else
-  task :default => "examples"
+begin
+  %w{sdoc sdoc-helpers rdiscount}.each { |name| gem name }
+  require 'sdoc_helpers'
+rescue LoadError => ex
+  puts "sdoc support not enabled:"
+  puts ex.inspect
+end
+
+require 'rake/rdoctask'
+Rake::RDocTask.new do |rdoc|
+  version = File.exist?('VERSION') ? File.read('VERSION') : ''
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "tarantula #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
 end

data/lib/relevance/core_extensions/ellipsize.rb

@@ -1,22 +1,26 @@
-module Relevance::CoreExtensions::Nil
-  def ellipsize(cutoff = 20)
-    ""
-  end
-end
+module Relevance
+  module CoreExtensions
+    module Nil
+      def ellipsize(cutoff = 20)
+        ""
+      end
+    end
 
-module Relevance::CoreExtensions::String
-  def ellipsize(cutoff = 20)
-    if length > cutoff
-      "#{self[0...cutoff]}..."
-    else
-      self
+    module String
+      def ellipsize(cutoff = 20)
+        if length > cutoff
+          "#{self[0...cutoff]}..."
+        else
+          self
+        end
+      end
+    end
+
+    module Object
+      def ellipsize(cutoff = 20)
+        inspect.ellipsize(cutoff)
+      end
     end
-  end
-end
- 
-module Relevance::CoreExtensions::Object
-  def ellipsize(cutoff = 20)
-    inspect.ellipsize(cutoff)
   end
 end
 
@@ -29,6 +33,6 @@ end
 class NilClass
   include Relevance::CoreExtensions::Nil
 end
-  
-  
+
+