wpscan 3.8.28 → 4.0.0

data/lib/opt_parse_validator/opts/integer.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the Integer Option
+  class OptInteger < OptBase
+    # @param [ String ] value
+    #
+    # @return [ Integer ]
+    def validate(value)
+      raise Error, "#{value} is not an integer" if value.to_i.to_s != value
+
+      value.to_i
+    end
+  end
+end

data/lib/opt_parse_validator/opts/integer_range.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the Integer Range Option
+  class OptIntegerRange < OptBase
+    # @return [ Void ]
+    def append_help_messages
+      option << "Range separator to use: '#{separator}'"
+
+      super
+    end
+
+    # @param [ String ] value
+    #
+    # @return [ Range ]
+    def validate(value)
+      a = super.split(separator)
+
+      raise Error, "Incorrect number of ranges found: #{a.size}, should be 2" unless a.size == 2
+
+      first_integer = a.first.to_i
+      last_integer  = a.last.to_i
+
+      unless first_integer.to_s == a.first && last_integer.to_s == a.last
+        raise Error,
+              'Argument is not a valid integer range'
+      end
+
+      (first_integer..last_integer)
+    end
+
+    # @return [ String ]
+    def separator
+      attrs[:separator] || '-'
+    end
+  end
+end

data/lib/opt_parse_validator/opts/multi_choices.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the MultiChoices Option
+  class OptMultiChoices < OptArray
+    # @param [ Array ] option See OptBase#new
+    # @param [ Hash ] attrs
+    # @option attrs [ Hash ] :choices
+    # @option attrs [ Array<Array> ] :incompatible
+    # @options attrs [ String ] :separator See OptArray#new
+    def initialize(option, attrs = {})
+      raise Error, 'The :choices attribute is mandatory' unless attrs.key?(:choices)
+      raise Error, 'The :choices attribute must be a hash' unless attrs[:choices].is_a?(Hash)
+
+      super
+    end
+
+    def append_help_messages
+      option << 'Available Choices:'
+
+      append_choices_help_messages
+
+      super
+
+      append_incompatible_help_messages
+    end
+
+    def append_choices_help_messages
+      max_spaces = choices.keys.max_by(&:size).size
+
+      choices.each do |key, opt|
+        first_line_prefix  = " #{key} #{' ' * (max_spaces - key.length)}"
+        other_lines_prefix = ' ' * first_line_prefix.size
+
+        opt_help_messages(opt).each_with_index do |message, index|
+          option << "#{index.zero? ? first_line_prefix : other_lines_prefix} #{message}"
+        end
+      end
+    end
+
+    def help_message_for_default
+      msg = +''
+
+      default.each do |key, value|
+        msg << if value == true
+                 key.to_s.titleize
+               else
+                 "#{key.to_s.titleize}: #{value}"
+               end
+        msg << ', '
+      end
+
+      msg.chomp(', ')
+    end
+
+    # @param [ OptBase ] opt
+    #
+    # @return [ Array<String> ]
+    def opt_help_messages(opt)
+      opt.help_messages.empty? ? [opt.to_s.humanize] : opt.help_messages
+    end
+
+    def append_incompatible_help_messages
+      return if incompatible.empty?
+
+      option << 'Incompatible choices (only one of each group/s can be used):'
+
+      incompatible.each do |a|
+        option << " - #{a.join(', ')}"
+      end
+    end
+
+    # @param [ String ] value
+    #
+    # @return [ Hash ]
+    def validate(value)
+      results = {}
+
+      super.each do |item|
+        opt = choices[item.to_sym]
+
+        if opt
+          opt_value = opt.value_if_empty.nil? || opt.value_if_empty
+        else
+          opt, opt_value = value_from_pattern(item)
+        end
+
+        results[opt.to_sym] = opt.normalize(opt.validate(opt_value))
+      end
+
+      verify_compatibility(results)
+    end
+
+    # @return [ Array ]
+    def value_from_pattern(item)
+      choices.each do |key, opt|
+        next unless item =~ /\A#{key}(.*)\z/
+
+        return [opt, Regexp.last_match[1]]
+      end
+
+      raise Error, "Unknown choice: #{item}"
+    end
+
+    # @return [ Array<Array<Symbol>> ]
+    def incompatible
+      Array(attrs[:incompatible])
+    end
+
+    # @param [ Hash ] values
+    #
+    # @return [ Hash ]
+    def verify_compatibility(values)
+      incompatible.each do |a|
+        last_match = ''
+
+        a.each do |key|
+          sym = choices[key].to_sym
+
+          next unless values.key?(sym)
+
+          raise Error, "Incompatible choices detected: #{last_match}, #{key}" unless last_match.empty?
+
+          last_match = key
+        end
+      end
+      values
+    end
+
+    # No normalization
+    def normalize(value)
+      value
+    end
+  end
+end

data/lib/opt_parse_validator/opts/path.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the Path Option
+  class OptPath < OptBase
+    # Initialize attrs:
+    #
+    # :create     if set to true, will create the path
+    #
+    # :exists     if set to false, will ignore the file? and directory? checks
+    #
+    # :file       Check if the path is a file
+    # :directory  Check if the path is a directory
+    #
+    # :executable
+    # :readable
+    # :writable
+    #
+
+    # @param [ String ] value
+    #
+    # @return [ Pathname ]
+    def validate(value)
+      path = Pathname.new(value)
+
+      allowed_attrs.each do |key|
+        method = "check_#{key}"
+        send(method, path) if respond_to?(method) && attrs[key]
+      end
+
+      path
+    end
+
+    def allowed_attrs
+      %i[create file directory executable readable writable]
+    end
+
+    # check_create is implemented in the file_path and directory_path opts
+
+    # @param [ Pathname ] path
+    def check_file(path)
+      raise Error, "The path '#{path}' does not exist or is not a file" unless path.file? || attrs[:exists] == false
+    end
+
+    # @param [ Pathname ] path
+    def check_directory(path)
+      return if path.directory? || attrs[:exists] == false
+
+      raise Error,
+            "The path '#{path}' does not exist or is not a directory"
+    end
+
+    # @param [ Pathname ] path
+    def check_executable(path)
+      raise Error, "The path '#{path}' is not executable#{process_identity}" unless path.executable?
+    end
+
+    # @param [ Pathname ] path
+    def check_readable(path)
+      raise Error, "The path '#{path}' is not readable#{process_identity}" unless path.readable?
+    end
+
+    # If the path does not exist, it will check for the parent
+    # directory write permission
+    #
+    # @param [ Pathname ] path
+    def check_writable(path)
+      return unless (path.exist? && !path.writable?) || !path.parent.writable?
+
+      raise Error, "The path '#{path}' is not writable#{process_identity}"
+    end
+
+    # @return [ String ] Current process uid/gid, formatted for inclusion in error messages
+    def process_identity
+      " (uid=#{Process.uid}, gid=#{Process.gid})"
+    end
+  end
+end

data/lib/opt_parse_validator/opts/positive_integer.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the Positive Integer Option
+  class OptPositiveInteger < OptInteger
+    # @param [ String ] value
+    #
+    # @return [ Integer ]
+    def validate(value)
+      i = super
+      raise Error, "#{i} is not > 0" unless i.positive?
+
+      i
+    end
+  end
+end

data/lib/opt_parse_validator/opts/proxy.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the Proxy Option
+  class OptProxy < OptURI
+  end
+end

data/lib/opt_parse_validator/opts/regexp.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the Regexp Option
+  # See http://ruby-doc.org/core-2.2.1/Regexp.html#method-c-new for expected values in :options
+  class OptRegexp < OptBase
+    # @param [ String ] value
+    #
+    # @return [ Regexp ]
+    def validate(value)
+      Regexp.new(super, attrs[:options])
+    end
+  end
+end

data/lib/opt_parse_validator/opts/smart_list.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the SmartList Option
+  # Such option allow users to supply a list like
+  # - name1
+  # - name1,name2,name3
+  # - /tmp/names.txt
+  class OptSmartList < OptArray
+    # @return [ Void ]
+    def append_help_messages
+      super
+      # removes the help message from OptArray about the separator as useless here
+      # can't use option as it's an attr_reader only
+      @option -= ["Separator to use between the values: '#{separator}'"]
+
+      option << "Examples: 'a1', '#{%w[a1 a2 a3].join(separator)}', '/tmp/a.txt'"
+    end
+
+    # @param [ String ] value
+    #
+    # @return [ Array<String> ]
+    def validate(value)
+      # Might be a better way to do this especially with a big file
+      File.open(value) { |f| f.map(&:chomp) }
+    rescue Errno::ENOENT, Errno::ENAMETOOLONG
+      super
+    end
+  end
+end

data/lib/opt_parse_validator/opts/string.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Alias of OptBase
+  # Used for convenience
+  class OptString < OptBase
+  end
+end

data/lib/opt_parse_validator/opts/uri.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the URI Option
+  class OptURI < OptBase
+    # return [ Void ]
+    def append_help_messages
+      option << "Allowed Protocols: #{allowed_protocols.join(', ')}" unless allowed_protocols.empty?
+      option << "Default Protocol if none provided: #{default_protocol}" if default_protocol
+
+      super
+    end
+
+    # @return [ Array<String> ]
+    def allowed_protocols
+      @allowed_protocols ||= Array(attrs[:protocols]).map(&:downcase)
+    end
+
+    # The default protocol (or scheme) to use if none was given
+    def default_protocol
+      @default_protocol ||= attrs[:default_protocol]&.downcase
+    end
+
+    # @param [ String ] value
+    #
+    # @return [ String ]
+    def validate(value)
+      uri = Addressable::URI.parse(value)
+
+      uri = Addressable::URI.parse("#{default_protocol}://#{value}") if !uri.scheme && default_protocol
+
+      unless allowed_protocols.empty? || allowed_protocols.include?(uri.scheme&.downcase)
+        # For future refs: will have to check if the uri.scheme exists,
+        # otherwise it means that the value was empty
+        raise Addressable::URI::InvalidURIError
+      end
+
+      uri.to_s
+    end
+  end
+end

data/lib/opt_parse_validator/opts/url.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module OptParseValidator
+  # Implementation of the URL Option
+  class OptURL < OptURI
+    # @return [ Array ] The allowed protocols
+    def allowed_protocols
+      %w[http https]
+    end
+  end
+end

data/lib/opt_parse_validator/opts.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+%w[
+  base string integer positive_integer choice boolean uri url proxy credentials
+  path file_path directory_path array integer_range multi_choices regexp headers
+  smart_list alias
+].each do |opt|
+  require "opt_parse_validator/opts/#{opt}"
+end

data/lib/opt_parse_validator/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Gem Version
+module OptParseValidator
+  VERSION = '1.10.1'
+end

data/lib/opt_parse_validator.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+# Gems
+require 'addressable/uri'
+require 'active_support/inflector'
+require 'active_support/core_ext/hash'
+# Standard Libs
+require 'optparse'
+require 'pathname'
+# Custom Libs
+require 'opt_parse_validator/errors'
+require 'opt_parse_validator/hacks'
+require 'opt_parse_validator/opts'
+require 'opt_parse_validator/version'
+require 'opt_parse_validator/config_files_loader_merger' # Could even create a gem out of it, as completely independent
+
+# Gem namespace
+module OptParseValidator
+  # Validator
+  class OptParser < OptionParser
+    attr_reader :symbols_used, :opts
+
+    def initialize(banner = nil, width = 32, indent = ' ' * 4)
+      @results      = {}
+      @symbols_used = []
+      @opts         = []
+
+      super
+    end
+
+    # @return [ OptParseValidator::ConfigFilesLoaderMerger ]
+    def config_files
+      @config_files ||= ConfigFilesLoaderMerger.new
+    end
+
+    # @param [ Array<OptBase> ] options
+    #
+    # @return [ Self ] For chaining #new.add.results
+    def add(*options)
+      options.each do |option|
+        check_option(option)
+
+        @opts << option
+        @symbols_used << option.to_sym
+
+        # Set the default option value if it exists
+        # The default value is not validated as it is provided by devs
+        # and should be set to the correct format/value directly
+        @results[option.to_sym] = option.default unless option.default.nil?
+
+        register_callback(option)
+      end
+
+      self
+    end
+
+    # @return [ Hash ]
+    def results(argv = default_argv)
+      load_config_files
+      parse!(argv)
+      post_processing
+
+      @results
+    rescue StandardError => e
+      # Raise it as an OptParseValidator::Error if not already one
+      raise e.is_a?(Error) ? e.class : Error, e.message
+    end
+
+    # @return [ String ] The simplified help (without any of the advanced option/s listed)
+    def simple_help
+      help = to_s
+
+      # Removes all advanced help messages
+      @opts.select(&:advanced?).each do |opt|
+        messages_pattern = //
+
+        opt.help_messages.each do |msg|
+          messages_pattern = /#{messages_pattern}\s*#{Regexp.escape(msg)}/
+        end
+
+        pattern = /\s*#{Regexp.escape(opt.option[0..1].select { |o| o[0] == '-' }.join(', '))}#{messages_pattern}/
+
+        help.gsub!(pattern, '')
+      end
+
+      help
+    end
+
+    # @return [ String ] The full help, with the advanced option/s listed
+    def full_help
+      to_s
+    end
+
+    protected
+
+    # Ensures the opt given is valid
+    #
+    # @param [ OptBase ] opt
+    #
+    # @return [ void ]
+    def check_option(opt)
+      raise Error, "The option is not an OptBase, #{opt.class} supplied" unless opt.is_a?(OptBase)
+      raise Error, "The option #{opt.to_sym} is already used !" if @symbols_used.include?(opt.to_sym)
+    end
+
+    # @param [ OptBase ] opt
+    #
+    # @return [ void ]
+    def register_callback(opt)
+      on(*opt.option) do |arg|
+        if opt.alias?
+          parse!(opt.alias_for.split)
+        else
+          @results[opt.to_sym] = opt.normalize(opt.validate(arg))
+        end
+      rescue StandardError => e
+        # Adds the long option name to the message
+        # And raises it as an OptParseValidator::Error if not already one
+        # e.g --proxy Invalid Scheme format.
+        raise e.is_a?(Error) ? e.class : Error, "#{opt.to_long} #{e}"
+      end
+    end
+
+    # @return [ Void ]
+    def load_config_files
+      files_data = config_files.parse
+
+      @opts.each do |opt|
+        next unless files_data.key?(opt.to_sym)
+
+        begin
+          @results[opt.to_sym] = opt.normalize(opt.validate(files_data[opt.to_sym].to_s))
+        rescue StandardError => e
+          # Adds the long option name to the message
+          # And raises it as an OptParseValidator::Error if not already one
+          # e.g --proxy Invalid Scheme format.
+          raise e.is_a?(Error) ? e.class : Error, "#{opt.to_long} #{e}"
+        end
+      end
+    end
+
+    # Ensure that all required options are supplied
+    # Should be overriden to modify the behavior
+    #
+    # @return [ Void ]
+    def post_processing
+      @opts.each do |opt|
+        raise NoRequiredOption, "The option #{opt.to_long} is required" if opt.required? && !@results.key?(opt.to_sym)
+
+        next if opt.required_unless.empty? || @results.key?(opt.to_sym)
+
+        fail_msg = 'One of the following options is required: ' \
+                   "#{opt.to_long}, --#{opt.required_unless.join(', --').tr('_', '-')}"
+
+        raise NoRequiredOption, fail_msg unless opt.required_unless.any? do |sym|
+          @results.key?(sym)
+        end
+      end
+    end
+  end
+end

data/lib/wpscan/browser/actions.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module WPScan
+  class Browser
+    # Browser Actions (get, post etc)
+    module Actions
+      # @param [ String ] url
+      # @param [ Hash ] params
+      #
+      # @return [ Typhoeus::Request ]
+      def forge_request(url, params = {})
+        WPScan::Browser.instance.forge_request(url, params)
+      end
+
+      # @param [ String ] url
+      # @param [ Hash ] params
+      #
+      # @return [ Typhoeus::Response ]
+      def get(url, params = {})
+        forge_request(url, params.merge(method: :get)).run
+      end
+
+      # @param [ String ] url
+      # @param [ Hash ] params
+      #
+      # @return [ Typhoeus::Response ]
+      def post(url, params = {})
+        forge_request(url, params.merge(method: :post)).run
+      end
+
+      # @param [ String ] url
+      # @param [ Hash ] params
+      #
+      # @return [ Typhoeus::Response ]
+      def head(url, params = {})
+        forge_request(url, params.merge(method: :head)).run
+      end
+
+      # @param [ String ] url
+      # @param [ Hash ] params
+      #
+      # @return [ Typhoeus::Response ]
+      def get_and_follow_location(url, params = {})
+        get(url, { followlocation: true, maxredirs: 3 }.merge(params))
+      end
+    end
+  end
+end