Class: Arachni::Element::UIForm

Inherits:
Base show all
Includes:
Capabilities::DOMOnly
Defined in:
lib/arachni/element/ui_form.rb,
lib/arachni/element/ui_form/dom.rb

Overview

Author:

  • Tasos “Zapotek” Laskos <tasos.laskos@arachni-scanner.com>

Defined Under Namespace

Classes: DOM

Constant Summary collapse

SUPPORTED_TYPES = 
%w(input button)

Constants included from Capabilities::Inputtable

Capabilities::Inputtable::INPUTTABLE_CACHE

Constants inherited from Base

Base::MAX_SIZE

Instance Attribute Summary collapse

Attributes included from Capabilities::DOMOnly

#method

Attributes included from Capabilities::WithDOM

#dom, #skip_dom

Attributes included from Capabilities::WithSource

#source

Attributes included from Capabilities::Inputtable

#default_inputs, #inputs, #raw_inputs

Attributes included from Capabilities::WithAuditor

#auditor

Attributes inherited from Base

#initialization_options, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Capabilities::DOMOnly

#coverage_hash, #coverage_id, #id, #mutation?, #type

Methods included from Capabilities::WithDOM

#skip_dom?

Methods included from Capabilities::WithNode

#node

Methods included from Capabilities::WithSource

#to_h, #to_rpc_data

Methods included from Capabilities::Inputtable

#[], #[]=, #changes, #has_inputs?, #inputtable_id, inputtable_id, #raw_input?, #reset, #to_h, #try_input, #update, #updated?, #valid_input_data?, #valid_input_name?, #valid_input_name_data?, #valid_input_value?, #valid_input_value_data?

Methods included from Capabilities::WithAuditor

#marshal_dump, #orphan?, #prepare_for_report, #remove_auditor

Methods inherited from Base

#==, #action, from_rpc_data, #hash, #id, #marshal_dump, #marshal_load, #persistent_hash, #prepare_for_report, #reset, #to_h, #to_hash, #to_rpc_data, too_big?, #type, #url, #url=

Methods included from Utilities

#available_port, available_port_mutex, #bytes_to_kilobytes, #bytes_to_megabytes, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_file, #cookies_from_parser, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_parser, #forms_from_response, #full_and_absolute_url?, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_parser, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #regexp_array_match, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Capabilities::WithScope

#scope

Constructor Details

#initialize(options) ⇒ UIForm

Returns a new instance of UIForm.



23
24
25
26
27
 
# File 'lib/arachni/element/ui_form.rb', line 23

def initialize( options )
    super options

    @opening_tags = (options[:opening_tags] || []).dup
end

Instance Attribute Details

#opening_tags ⇒ Object

Returns the value of attribute opening_tags.



21
22
23
 
# File 'lib/arachni/element/ui_form.rb', line 21

def opening_tags
  @opening_tags
end

Class Method Details

.from_browser(browser, page) ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/arachni/element/ui_form.rb', line 39

def self.from_browser( browser, page )
    ui_forms = []

    return ui_forms if !browser.javascript.supported? || !in_html?( page.body )

    # Does the page have any text inputs?
    inputs, opening_tags = inputs_from_page( page )
    return ui_forms if inputs.empty?

    # Looks like we have input groups, get buttons with events.
    browser.each_element_with_events SUPPORTED_TYPES do |locator, events|
        next if locator.tag_name == :input &&
            locator.attributes['type'] != 'button' &&
            locator.attributes['type'] != 'submit'

        events.each do |event, _|
            ui_forms << new(
                action:       page.url,
                source:       locator.to_s,
                method:       event,
                inputs:       inputs,
                opening_tags: opening_tags
            )
        end
    end

    ui_forms
end

.in_html?(html) ⇒ Boolean

Returns:

  • (Boolean) 


68
69
70
71
 
# File 'lib/arachni/element/ui_form.rb', line 68

def self.in_html?( html )
    html.has_html_tag?( 'button' ) ||
        html.has_html_tag?( 'input', /button|submit/ )
end

.inputs_from_page(page) ⇒ Object 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/arachni/element/ui_form.rb', line 73

def self.inputs_from_page( page )
    opening_tags = {}
    inputs       = {}

    if UIInput.with_textarea_in_html?( page.body )
        page.document.nodes_by_name( :textarea ).each do |textarea|
            name = node_to_name( textarea )

            inputs[name]       = textarea.text
            opening_tags[name] =
                Arachni::Browser::ElementLocator.from_node( textarea ).to_s
        end
    end

    if UIInput.with_input_in_html?( page.body )
        page.document.nodes_by_name( :input ).each do |input|
            next if input['type'] && input['type'] != 'text'

            name = node_to_name( input )

            inputs[name]       = input['value'].to_s
            opening_tags[name] =
                Arachni::Browser::ElementLocator.from_node( input ).to_s
        end
    end

    [inputs, opening_tags]
end

.node_to_name(node) ⇒ Object 



102
103
104
105
 
# File 'lib/arachni/element/ui_form.rb', line 102

def self.node_to_name( node )
    node['name'] || node['id'] ||
        Arachni::Browser::ElementLocator.from_node( node ).to_s
end

.type ⇒ Object 



35
36
37
 
# File 'lib/arachni/element/ui_form.rb', line 35

def self.type
    :ui_form
end

Instance Method Details

#dup ⇒ Object 



29
30
31
32
33
 
# File 'lib/arachni/element/ui_form.rb', line 29

def dup
    super.tap do |o|
        o.opening_tags = self.opening_tags.dup
    end
end