Skip to content

Commit 788f442

Browse files
postmodernpostmodern
committed
Added missing specs for WebVuln validations.
1 parent d6f557e commit 788f442

File tree

1 file changed

+255
-12
lines changed

1 file changed

+255
-12
lines changed

‎spec/web_vulns_spec.rb‎

Lines changed: 255 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,261 @@
77
expect(described_class.table_name).to eq('ronin_web_vulns')
88
end
99

10+
let(:type) { :lfi }
11+
let(:request_method) { :get }
12+
let(:url_scheme) do
13+
Ronin::DB::URLScheme.find_or_initialize_by(name: 'https')
14+
end
15+
let(:url_host_name) do
16+
Ronin::DB::HostName.find_or_initialize_by(name: 'www.example.com')
17+
end
18+
let(:url_port) do
19+
Ronin::DB::Port.find_or_initialize_by(protocol: :tcp, number: 8080)
20+
end
21+
let(:url) do
22+
Ronin::DB::URL.new(
23+
scheme: url_scheme,
24+
host_name: url_host_name,
25+
port: url_port
26+
)
27+
end
28+
let(:query_param) { 'id' }
29+
30+
subject do
31+
described_class.new(
32+
type: type,
33+
request_method: request_method,
34+
url: url,
35+
query_param: query_param
36+
)
37+
end
38+
39+
describe "validations" do
40+
describe "type" do
41+
it "must require a type" do
42+
web_vuln = described_class.new(
43+
request_method: request_method,
44+
url: url,
45+
query_param: query_param
46+
)
47+
48+
expect(web_vuln).to_not be_valid
49+
expect(web_vuln.errors[:type]).to eq(["can't be blank"])
50+
end
51+
52+
[
53+
:lfi,
54+
:rfi,
55+
:sqli,
56+
:ssti,
57+
:open_redirect,
58+
:reflected_xss,
59+
:command_injection
60+
].each do |valid_type|
61+
it "must accept #{valid_type.inspect}" do
62+
web_vuln = described_class.new(
63+
type: valid_type,
64+
request_method: request_method,
65+
url: url,
66+
query_param: query_param
67+
)
68+
69+
expect(web_vuln).to be_valid
70+
end
71+
end
72+
73+
it "must not accept other values" do
74+
expect {
75+
described_class.new(
76+
type: :other,
77+
request_method: request_method,
78+
url: url,
79+
query_param: query_param
80+
)
81+
}.to raise_error(ArgumentError,"'other' is not a valid type")
82+
end
83+
end
84+
85+
describe "request_method" do
86+
[
87+
:copy,
88+
:delete,
89+
:get,
90+
:head,
91+
:lock,
92+
:mkcol,
93+
:move,
94+
:options,
95+
:patch,
96+
:post,
97+
:propfind,
98+
:proppatch,
99+
:put,
100+
:trace,
101+
:unlock
102+
].each do |valid_request_method|
103+
it "must accept #{valid_request_method.inspect}" do
104+
web_vuln = described_class.new(
105+
type: type,
106+
request_method: valid_request_method,
107+
url: url,
108+
query_param: query_param
109+
)
110+
111+
expect(web_vuln).to be_valid
112+
end
113+
end
114+
115+
it "must not accept other values" do
116+
expect {
117+
described_class.new(
118+
type: type,
119+
request_method: :other,
120+
url: url,
121+
query_param: query_param
122+
)
123+
}.to raise_error(ArgumentError,"'other' is not a valid request_method")
124+
end
125+
end
126+
127+
describe "lfi_os" do
128+
[
129+
nil,
130+
'unix',
131+
'windows'
132+
].each do |valid_lfi_os|
133+
it "must accept #{valid_lfi_os.inspect}" do
134+
web_vuln = described_class.new(
135+
type: :lfi,
136+
lfi_os: valid_lfi_os,
137+
request_method: request_method,
138+
url: url,
139+
query_param: query_param
140+
)
141+
142+
expect(web_vuln).to be_valid
143+
end
144+
end
145+
146+
it "must not accept other values" do
147+
expect {
148+
described_class.new(
149+
type: :lfi,
150+
lfi_os: :other,
151+
request_method: request_method,
152+
url: url,
153+
query_param: query_param
154+
)
155+
}.to raise_error(ArgumentError,"'other' is not a valid lfi_os")
156+
end
157+
end
158+
159+
describe "lfi_filter_bypass" do
160+
[
161+
nil,
162+
'null_byte',
163+
'base64',
164+
'rot13',
165+
'zlib'
166+
].each do |valid_lfi_filter_bypass|
167+
it "must accept #{valid_lfi_filter_bypass.inspect}" do
168+
web_vuln = described_class.new(
169+
type: :lfi,
170+
lfi_filter_bypass: valid_lfi_filter_bypass,
171+
request_method: request_method,
172+
url: url,
173+
query_param: query_param
174+
)
175+
176+
expect(web_vuln).to be_valid
177+
end
178+
end
179+
180+
it "must not accept other values" do
181+
expect {
182+
described_class.new(
183+
type: :lfi,
184+
lfi_filter_bypass: :other,
185+
request_method: request_method,
186+
url: url,
187+
query_param: query_param
188+
)
189+
}.to raise_error(ArgumentError,"'other' is not a valid lfi_filter_bypass")
190+
end
191+
end
192+
193+
describe "rfi_script_lang" do
194+
[
195+
nil,
196+
'asp',
197+
'asp_net',
198+
'cold_fusion',
199+
'jsp',
200+
'perl'
201+
].each do |valid_rfi_script_lang|
202+
it "must accept #{valid_rfi_script_lang.inspect}" do
203+
web_vuln = described_class.new(
204+
type: :rfi,
205+
rfi_script_lang: valid_rfi_script_lang,
206+
request_method: request_method,
207+
url: url,
208+
query_param: query_param
209+
)
210+
211+
expect(web_vuln).to be_valid
212+
end
213+
end
214+
215+
it "must not accept other values" do
216+
expect {
217+
described_class.new(
218+
type: :rfi,
219+
rfi_script_lang: :other,
220+
request_method: request_method,
221+
url: url,
222+
query_param: query_param
223+
)
224+
}.to raise_error(ArgumentError,"'other' is not a valid rfi_script_lang")
225+
end
226+
end
227+
228+
describe "ssti_escape_type" do
229+
[
230+
nil,
231+
'double_curly_braces',
232+
'dollar_curly_braces',
233+
'dollar_double_curly_braces',
234+
'pound_curly_braces',
235+
'angle_brackets_percent',
236+
'custom'
237+
].each do |valid_ssti_escape_type|
238+
it "must accept #{valid_ssti_escape_type.inspect}" do
239+
web_vuln = described_class.new(
240+
type: :ssti,
241+
ssti_escape_type: valid_ssti_escape_type,
242+
request_method: request_method,
243+
url: url,
244+
query_param: query_param
245+
)
246+
247+
expect(web_vuln).to be_valid
248+
end
249+
end
250+
251+
it "must not accept other values" do
252+
expect {
253+
described_class.new(
254+
type: :ssti,
255+
ssti_escape_type: :other,
256+
request_method: request_method,
257+
url: url,
258+
query_param: query_param
259+
)
260+
}.to raise_error(ArgumentError,"'other' is not a valid ssti_escape_type")
261+
end
262+
end
263+
end
264+
10265
describe ".for_host" do
11266
subject { described_class }
12267

@@ -478,18 +733,6 @@
478733
end
479734
end
480735

481-
let(:url_scheme) { Ronin::DB::URLScheme.find_or_initialize_by(name: 'https') }
482-
let(:url_host_name) { Ronin::DB::HostName.find_or_initialize_by(name: 'www.example.com') }
483-
let(:url_port) { Ronin::DB::Port.find_or_initialize_by(protocol: :tcp, number: 8080) }
484-
let(:url) { Ronin::DB::URL.new(scheme: url_scheme, host_name: url_host_name, port: url_port) }
485-
486-
subject do
487-
described_class.new(
488-
url: url,
489-
query_param: query_param
490-
)
491-
end
492-
493736
describe "#param_validations" do
494737
before do
495738
subject.param_validation

0 commit comments

Comments
 (0)