Ticket #13: tarantula_fuzzers.patch.txt

diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/lib/relevance/tarantula/crawler.rb tarantula.xss_check/lib/relevance/tarantula/crawler.rb
--- tarantula.orig/lib/relevance/tarantula/crawler.rb   2008-05-04 15:09:03.000000000 -0400
+++ tarantula.xss_check/lib/relevance/tarantula/crawler.rb      2008-05-04 16:25:18.000000000 -0400
@@ -7,7 +7,8 @@
   
   attr_accessor :proxy, :handlers, :skip_uri_patterns, :log_grabber,
                 :reporters, :links_to_crawl, :links_queued, :forms_to_crawl,
-                :form_signatures_queued, :max_url_length, :response_code_handler
+                :form_signatures_queued, :max_url_length, :response_code_handler,
+                :times_to_crawl, :fuzzers
   attr_reader   :transform_url_patterns, :referrers, :failures, :successes
    
   def initialize
@@ -30,7 +31,8 @@
     ]
     @reporters = [Relevance::Tarantula::IOReporter.new($stderr)]
     @decoder = HTMLEntities.new
-    
+    @times_to_crawl = 1
+    @fuzzers = [Relevance::Tarantula::FormSubmission]
   end
   
   def method_missing(meth, *args)
@@ -45,8 +47,18 @@
   end
   
   def crawl(url = "/")
-    queue_link url
-    do_crawl
+    @times_to_crawl.times do |i|
+      queue_link url
+      do_crawl
+      
+      puts "#{(i+1).ordinalize} crawl" if @times_to_crawl > 1
+      
+      if i + 1 < @times_to_crawl
+        @links_queued = Set.new
+        @form_signatures_queued = Set.new
+        @referrers = {}
+      end
+    end
   rescue Interrupt
     $stderr.puts "CTRL-C"
   ensure
@@ -165,12 +177,16 @@
   end
   
   def queue_form(form, referrer = nil)
-    fs = FormSubmission.new(Form.new(form))
-    fs.action = transform_url(fs.action)
-    return if should_skip_form_submission?(fs)
-    @referrers[fs.action] = referrer if referrer
-    @forms_to_crawl << fs
-    @form_signatures_queued << fs.signature
+    fuzzers.each do |fuzzer|
+      fuzzer.mutate(Form.new(form)).each do |fs|
+        # fs = fuzzer.new(Form.new(form))
+        fs.action = transform_url(fs.action)
+        return if should_skip_form_submission?(fs)
+        @referrers[fs.action] = referrer if referrer
+        @forms_to_crawl << fs
+        @form_signatures_queued << fs.signature
+      end
+    end
   end
   
   def report_dir
diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/lib/relevance/tarantula/form_submission.rb tarantula.xss_check/lib/relevance/tarantula/form_submission.rb
--- tarantula.orig/lib/relevance/tarantula/form_submission.rb   2008-05-04 15:08:57.000000000 -0400
+++ tarantula.xss_check/lib/relevance/tarantula/form_submission.rb      2008-05-04 14:22:35.000000000 -0400
@@ -6,6 +6,10 @@
     @data = mutate_selects(form).merge(mutate_text_areas(form)).merge(mutate_inputs(form))
   end
   
+  def self.mutate(form)
+    [self.new(form)]
+  end
+  
   def to_s
     "#{action} #{method} #{data.inspect}"
   end
diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/lib/relevance/tarantula/html_report_helper.rb tarantula.xss_check/lib/relevance/tarantula/html_report_helper.rb
--- tarantula.orig/lib/relevance/tarantula/html_report_helper.rb        2008-05-03 18:49:16.000000000 -0400
+++ tarantula.xss_check/lib/relevance/tarantula/html_report_helper.rb   2008-05-03 19:33:46.000000000 -0400
@@ -1,4 +1,6 @@
+require "erb"
 module Relevance::Tarantula::HtmlReportHelper 
+  include ERB::Util
   include Relevance::Tarantula
   def wrap_in_line_number_table(text, &blk)
     x = Builder::XmlMarkup.new
@@ -43,12 +45,12 @@
   
   def wrap_stack_trace_line(text)
     if text =~ %r{^\s*(/[^:]+):(\d+):([^:]+)$}
-      file = $1.to_s_xss_protected
+      file = h($1) # .to_s_xss_protected
       line_number = $2
-      message = $3.to_s_xss_protected
-      "<a href='#{textmate_url(file, line_number)}'>#{file}:#{line_number}</a>:#{message}".mark_as_xss_protected
+      message = h($3) # .to_s_xss_protected
+      "<a href='#{textmate_url(file, line_number)}'>#{file}:#{line_number}</a>:#{message}" # .mark_as_xss_protected
     else
-      text.to_s_xss_protected
+      h(text) # .to_s_xss_protected
     end
   end
 end
diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/lib/relevance/tarantula/xss_document_checker_handler.rb tarantula.xss_check/lib/relevance/tarantula/xss_document_checker_handler.rb
--- tarantula.orig/lib/relevance/tarantula/xss_document_checker_handler.rb      1969-12-31 19:00:00.000000000 -0500
+++ tarantula.xss_check/lib/relevance/tarantula/xss_document_checker_handler.rb 2008-05-04 20:46:50.000000000 -0400
@@ -0,0 +1,35 @@
+require 'hpricot'
+
+class Relevance::Tarantula::XssDocumentCheckerHandler 
+  
+  def initialize(attacks)
+    @attacks = attacks
+    @regexp = '(' + attacks.map {|a| Regexp.escape a['code']}.join('|') + ')'
+  end
+  
+  def handle(result)
+    response = result.response
+    return unless response.html?
+    if n = (response.body =~ /#{@regexp}/)
+      error_result = result.dup
+      error_result.success = false
+      error_result.description = "XSS error found, match was: #{$1}"
+      error_result.data = <<-STR
+        ########################################################################
+        # Text around unescaped string: #{$1}
+        ########################################################################
+        #{response.body[[0, n - 200].max , 400]}
+        
+        
+        
+        
+        
+        ########################################################################
+        # Attack information:
+        ########################################################################
+        #{@attacks.select {|a| a['code'] == $1}[0].to_yaml}
+      STR
+      error_result
+    end
+  end
+end
diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/lib/relevance/tarantula/xss_form_submission.rb tarantula.xss_check/lib/relevance/tarantula/xss_form_submission.rb
--- tarantula.orig/lib/relevance/tarantula/xss_form_submission.rb       1969-12-31 19:00:00.000000000 -0500
+++ tarantula.xss_check/lib/relevance/tarantula/xss_form_submission.rb  2008-05-04 21:38:31.000000000 -0400
@@ -0,0 +1,60 @@
+class Relevance::Tarantula::XssFormSubmission
+  attr_accessor :method, :action, :data, :attack
+  
+  cattr_accessor :attacks
+  
+  def initialize(form, attack = nil)
+    @method = form.method
+    @action = form.action
+    @attack = attack
+    @data = mutate_selects(form).merge(mutate_text_areas(form)).merge(mutate_inputs(form))
+  end
+  
+  def self.mutate(form)
+    attacks and attacks.map do |attack|
+      self.new(form, attack)
+    end
+  end
+  
+  def to_s
+    "#{action} #{method} #{data.inspect} #{attack.inspect}"
+  end
+  
+  # a form's signature is what makes it unique (e.g. action + fields)
+  # used to keep track of which forms we have submitted already
+  def signature
+    [action, data.keys.sort, attack['name']]
+  end
+  
+  def create_random_data_for(form, tag_selector)
+    form.search(tag_selector).inject({}) do |form_args, input|
+      # TODO: test
+      form_args[input['name']] = random_data(input) if input['name']
+      form_args
+    end
+  end
+
+  def mutate_inputs(form)
+    create_random_data_for(form, 'input')
+  end
+
+  def mutate_text_areas(form)
+    create_random_data_for(form, 'textarea')
+  end
+  
+  def mutate_selects(form)
+    form.search('select').inject({}) do |form_args, select|
+      options = select.search('option')
+      option = options.rand
+      form_args[select['name']] = option['value'] 
+      form_args
+    end
+  end
+  
+  def random_data(input)
+    case input['name']
+      when /^_method$/      : input['value']
+      else                    attack['code']
+    end
+  end
+end
diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/lib/relevance/tarantula.rb tarantula.xss_check/lib/relevance/tarantula.rb
--- tarantula.orig/lib/relevance/tarantula.rb   2008-05-04 15:09:03.000000000 -0400
+++ tarantula.xss_check/lib/relevance/tarantula.rb      2008-05-04 21:02:28.000000000 -0400
@@ -9,9 +9,9 @@
 gem 'actionpack'
 require 'active_support'
 require 'action_controller'
-xss_shield_path = File.join(TARANTULA_ROOT, %w{vendor xss-shield})
-$: << File.join(xss_shield_path, "lib")
-require File.join(xss_shield_path, "init")
+#xss_shield_path = File.join(TARANTULA_ROOT, %w{vendor xss-shield})
+#$: << File.join(xss_shield_path, "lib")
+#require File.join(xss_shield_path, "init")
 
 gem 'facets'
 gem 'htmlentities'
@@ -57,5 +57,7 @@
 require 'relevance/tarantula/crawler'
 require 'relevance/tarantula/form'
 require 'relevance/tarantula/form_submission'
+require 'relevance/tarantula/xss_form_submission'
+require 'relevance/tarantula/xss_document_checker_handler'
 
 require 'relevance/tarantula/tidy_handler' if ENV['TIDY_PATH']
diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/test/relevance/tarantula/xss_document_checker_handler_test.rb tarantula.xss_check/test/relevance/tarantula/xss_document_checker_handler_test.rb
--- tarantula.orig/test/relevance/tarantula/xss_document_checker_handler_test.rb        1969-12-31 19:00:00.000000000 -0500
+++ tarantula.xss_check/test/relevance/tarantula/xss_document_checker_handler_test.rb   2008-05-04 21:39:32.000000000 -0400
@@ -0,0 +1,14 @@
+require File.join(File.dirname(__FILE__), "..", "..", "test_helper.rb")
+include Relevance::Tarantula
+
+describe "Relevance::Tarantula::XssDocumentCheckerHandler" do
+  before do
+    @handler = Relevance::Tarantula::XssDocumentCheckerHandler.new([{'name' => 'foo_name', 'code' => 'foo_code', 'desc' => 'foo_desc'}])
+  end
+  
+  it "detects the supplied code" do
+    # @handler.expects(:queue_link).never
+    result = @handler.handle(Result.new(:response => stub(:html? => true, :body => '<a href="/foo">foo_code</a>')))
+    result.success.should == false
+  end
+end
diff -Naru --exclude=.svn --exclude='*~' tarantula.orig/test/relevance/tarantula/xss_form_submission_test.rb tarantula.xss_check/test/relevance/tarantula/xss_form_submission_test.rb
--- tarantula.orig/test/relevance/tarantula/xss_form_submission_test.rb 1969-12-31 19:00:00.000000000 -0500
+++ tarantula.xss_check/test/relevance/tarantula/xss_form_submission_test.rb    2008-05-04 21:39:17.000000000 -0400
@@ -0,0 +1,74 @@
+require File.join(File.dirname(__FILE__), "..", "..", "test_helper.rb")
+
+describe "Relevance::Tarantula::XssFormSubmission" do
+  
+  # TODO: add more from field types to this example form as needed
+  before do
+    @tag = Hpricot(<<END)
+<form action="/session" method="post">
+  <input id="email" name="email" size="30" type="text" />
+  <textarea id="comment" name="comment"value="1" />
+  <input name="commit" type="submit" value="Postit" />
+  <input name="secret" type="hidden" value="secret" />
+  <select id="foo_opened_on_1i" name="foo[opened_on(1i)]">
+    <option value="2003">2003</option>
+    <option value="2004">2004</option>
+  </select> 
+</form>
+END
+    @form = Relevance::Tarantula::Form.new(@tag.at('form'))
+    @fs = Relevance::Tarantula::XssFormSubmission.new(@form, {'name' => 'foo_name', 'code' => 'foo_code', 'desc' => 'foo_desc'})
+  end
+  
+  it "can mutate text areas" do
+    @fs.mutate_text_areas(@form).should == {"comment" => "foo_code"}
+  end
+  
+  it "can mutate selects" do
+    Hpricot::Elements.any_instance.stubs(:rand).returns(stub(:[] => "2006-stub"))
+    @fs.mutate_selects(@form).should == {"foo[opened_on(1i)]" => "2006-stub"}
+  end
+  
+  it "can mutate inputs" do
+    @fs.mutate_inputs(@form).should == {"commit"=>"foo_code", "secret"=>"foo_code", "email"=>"foo_code"}
+  end
+
+  it "has a signature based on action,  fields, and attack name" do
+    @fs.signature.should == ['/session', [
+      "comment", 
+      "commit", 
+      "email", 
+      "foo[opened_on(1i)]", 
+      "secret"],
+      "foo_name"
+    ]
+  end
+  
+  it "has a friendly to_s" do
+    @fs.to_s.should =~ %r{^/session post}
+  end
+  
+  it "processes all its attacks" do
+    Relevance::Tarantula::XssFormSubmission.attacks = [
+      {'name' => 'foo_name1', 'code1' => 'foo_code1', 'desc' => 'foo_desc1'},
+      {'name' => 'foo_name2', 'code2' => 'foo_code2', 'desc' => 'foo_desc2'},
+    ]
+    Relevance::Tarantula::XssFormSubmission.mutate(@form).size.should == 2
+  end
+end
+
+describe "Relevance::Tarantula::XssFormSubmission for a crummy form" do
+  before do
+    @tag = Hpricot(<<END)
+<form action="/session" method="post">
+  <input value="no_name" />
+</form>
+END
+    @form = Relevance::Tarantula::Form.new(@tag.at('form'))
+    @fs = Relevance::Tarantula::XssFormSubmission.new(@form, {'name' => 'foo_name', 'code' => 'foo_code', 'desc' => 'foo_desc'})
+  end
+  
+  it "ignores unnamed inputs" do
+    @fs.mutate_inputs(@form).should == {}
+  end
+end