Class: Arachni::Element::Link

Inherits:
Base show all
Includes:
Capabilities::Analyzable, Capabilities::Refreshable, Capabilities::WithDOM, Capabilities::WithNode
Defined in:
lib/arachni/element/link.rb,
lib/arachni/element/link/dom.rb

Overview

Represents an auditable link element

Author:

Defined Under Namespace

Classes: DOM

Constant Summary

Constants included from Capabilities::Analyzable::Differential

Capabilities::Analyzable::Differential::DIFFERENTIAL_OPTIONS

Constants included from Capabilities::Analyzable::Taint

Capabilities::Analyzable::Taint::TAINT_OPTIONS

Constants included from Capabilities::Auditable

Capabilities::Auditable::OPTIONS

Constants included from Capabilities::Mutable

Capabilities::Mutable::MUTATION_OPTIONS

Instance Attribute Summary

Attributes included from Capabilities::Auditable

#audit_options

Attributes included from Capabilities::WithAuditor

#auditor

Attributes included from Capabilities::Mutable

#affected_input_name, #format, #seed

Attributes included from Capabilities::Inputtable

#default_inputs, #inputs

Attributes included from Capabilities::WithNode

#html

Attributes inherited from Base

#initialization_options, #page

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Capabilities::Refreshable

#refresh, #refresh_id

Methods included from Capabilities::Analyzable

has_timeout_candidates?, reset, timeout_audit_run

Methods included from Capabilities::Analyzable::Differential

#differential_analysis, reset

Methods included from Capabilities::Analyzable::Timeout

add_phase_2_candidate, candidates_include?, deduplicate, deduplicate?, do_not_deduplicate, #ensure_responsiveness, has_candidates?, payload_delay_from_options, reset, run, #timeout_analysis, timeout_from_options, #timeout_id, #timing_attack_probe, #timing_attack_verify

Methods included from Capabilities::Analyzable::Taint

#taint_analysis

Methods included from Capabilities::Auditable

#audit, #audit_id, #audit_status_message, #audit_status_message_action, #audit_verbose_message, #coverage_hash, #dup, #matches_skip_like_blocks?, #reset, reset, #skip?, skip_like

Methods included from Capabilities::WithAuditor

#dup, #marshal_dump, #orphan?, #prepare_for_report, #remove_auditor

Methods included from Capabilities::Mutable

#affected_input_value, #affected_input_value=, #dup, #each_mutation, #immutables, #mutation?, #mutations, #reset, #switch_method, #to_h

Methods included from Capabilities::Submittable

#action, #dup, #http, #method, #method=, #platforms, #submit, #to_h

Methods included from Capabilities::Inputtable

#[], #[]=, #changes, #dup, #has_inputs?, #inputtable_id, #reset, #to_h, #try_input, #update, #valid_input_data?, #valid_input_name?, #valid_input_name_data?, #valid_input_value?, #valid_input_value_data?

Methods included from Utilities

#available_port, #caller_name, #caller_path, #cookie_decode, #cookie_encode, #cookies_from_document, #cookies_from_file, #cookies_from_response, #exception_jail, #exclude_path?, #follow_protocol?, #form_decode, #form_encode, #forms_from_document, #forms_from_response, #generate_token, #get_path, #hms_to_seconds, #html_decode, #html_encode, #include_path?, #links_from_document, #links_from_response, #normalize_url, #page_from_response, #page_from_url, #parse_set_cookie, #path_in_domain?, #path_too_deep?, #port_available?, #rand_port, #random_seed, #redundant_path?, #remove_constants, #request_parse_body, #seconds_to_hms, #skip_page?, #skip_path?, #skip_resource?, #skip_response?, #to_absolute, #uri_decode, #uri_encode, #uri_parse, #uri_parse_query, #uri_parser, #uri_rewrite

Methods included from Capabilities::WithDOM

#dup

Methods included from Capabilities::WithNode

#dup, #node, #to_h

Methods inherited from Base

#==, #action, #dup, from_rpc_data, #hash, #marshal_dump, #marshal_load, #persistent_hash, #prepare_for_report, #reset, #to_h, #to_hash, #type, type, #url, #url=

Methods included from Capabilities::WithScope

#scope

Constructor Details

#initialize(options) ⇒ Link

Returns a new instance of Link.

Parameters:

Options Hash (options):

  • :url (String) —

    URL of the page which includes the link.

  • :action (String) —

    Link URL – defaults to ‘:url`.

  • :inputs (Hash) —

    Query parameters as ‘name => value` pairs. If none have been provided they will automatically be extracted from Capabilities::Submittable#action.



33
34
35
36
37
38
 
# File 'lib/arachni/element/link.rb', line 33

def initialize( options )
    super( options )

    self.inputs     = (self.inputs || {}).merge( options[:inputs] || {} )
    @default_inputs = self.inputs.dup.freeze
end

Class Method Details

.decode(*args) ⇒ Object 



166
167
168
 
# File 'lib/arachni/element/link.rb', line 166

def decode( *args )
    ::URI.decode( *args )
end

.encode(*args) ⇒ Object 



162
163
164
 
# File 'lib/arachni/element/link.rb', line 162

def encode( *args )
    ::URI.encode( *args )
end

.encode_query_params(param) ⇒ Object 



158
159
160
 
# File 'lib/arachni/element/link.rb', line 158

def encode_query_params( param )
    encode( encode( param ), '=' )
end

.from_document(url, document) ⇒ Array<Link>

Extracts links from a document.

Parameters:

  • url (String) —

    URL of the document – used for path normalization purposes.

  • document (String, Nokogiri::HTML::Document)

Returns:



134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
 
# File 'lib/arachni/element/link.rb', line 134

def from_document( url, document )
    document = Nokogiri::HTML( document.to_s ) if !document.is_a?( Nokogiri::HTML::Document )
    base_url =  begin
        document.search( '//base[@href]' )[0]['href']
    rescue
        url
    end

    document.search( '//a' ).map do |link|
        href = to_absolute( link['href'], base_url )
        next if !href

        if (parsed_url = Arachni::URI( href ))
            next if parsed_url.scope.out?
        end

        new(
            url:    url.freeze,
            action: href.freeze,
            html:   link.to_html.freeze
        )
    end.compact
end

.from_response(response) ⇒ Array<Link>

Extracts links from an HTTP response.

Parameters:

Returns:



122
123
124
125
 
# File 'lib/arachni/element/link.rb', line 122

def from_response( response )
    url = response.url
    [new( url: url )] | from_document( url, response.body )
end

Instance Method Details

#action=(url) ⇒ Object

Note:

Will Options.rewrite the ‘url`.

Note:

Will update the Capabilities::Inputtable#inputs from the URL query.



60
61
62
63
64
65
 
# File 'lib/arachni/element/link.rb', line 60

def action=( url )
    rewritten   = uri_parse( url ).rewrite
    self.inputs = rewritten.query_parameters.merge( self.inputs || {} )

    super rewritten.without_query
end

#coverage_id ⇒ Object 



101
102
103
 
# File 'lib/arachni/element/link.rb', line 101

def coverage_id
    dom_data ? "#{super}:#{dom_data[:inputs].keys.sort}" : super
end

#decode(*args) ⇒ Object

See Also:



97
98
99
 
# File 'lib/arachni/element/link.rb', line 97

def decode( *args )
    self.class.decode( *args )
end

#dom ⇒ DOM

Returns:



41
42
43
44
45
46
 
# File 'lib/arachni/element/link.rb', line 41

def dom
    return @dom if @dom
    return if !dom_data

    super
end

#encode(*args) ⇒ Object

See Also:



89
90
91
 
# File 'lib/arachni/element/link.rb', line 89

def encode( *args )
    self.class.encode( *args )
end

#encode_query_params(*args) ⇒ Object

See Also:



81
82
83
 
# File 'lib/arachni/element/link.rb', line 81

def encode_query_params( *args )
    self.class.encode_query_params( *args )
end

#id ⇒ Object 



105
106
107
 
# File 'lib/arachni/element/link.rb', line 105

def id
    dom_data ? "#{super}:#{dom_data[:inputs].sort_by { |k,_| k }}" : super
end

#simple ⇒ Hash

Returns Simple representation of self in the form of ‘{ Capabilities::Submittable#action => Capabilities::Inputtable#inputs }`.

Returns:



50
51
52
 
# File 'lib/arachni/element/link.rb', line 50

def simple
    { self.action => self.inputs }
end

#to_rpc_data ⇒ Object 



109
110
111
112
113
 
# File 'lib/arachni/element/link.rb', line 109

def to_rpc_data
    data = super
    data.delete 'dom_data'
    data
end

#to_s ⇒ String

Returns Absolute URL with a merged version of Capabilities::Submittable#action and Capabilities::Inputtable#inputs as a query.

Returns:



69
70
71
72
73
74
75
 
# File 'lib/arachni/element/link.rb', line 69

def to_s
    uri = uri_parse( self.action ).dup
    uri.query = self.inputs.
        map { |k, v| "#{encode_query_params(k)}=#{encode_query_params(v)}" }.
        join( '&' )
    uri.to_s
end