Contents

require 'hpricot'

class Relevance::Tarantula::AttackHandler 
  include ERB::Util
  
  def attacks
    Relevance::Tarantula::AttackFormSubmission.attacks.select(&:output)
  end
  
  def handle(result)
    return unless attacks.size > 0
    regexp = '(' + attacks.map {|a| Regexp.escape a.output}.join('|') + ')'
    response = result.response
    return unless response.html?
    if n = (response.body =~ /#{regexp}/)
      error_result = result.dup
      error_result.success = false
      error_result.description = "XSS error found, match was: #{h($1)}"
      error_result.data = <<-STR
        ########################################################################
        # Text around unescaped string: #{$1}
        ########################################################################
        #{response.body[[0, n - 200].max , 400]}
        
        
        
        
        
        ########################################################################
        # Attack information:
        ########################################################################
        #{attacks.select {|a| a.output == $1}[0].to_yaml}
      STR
      error_result
    end
  end
end

Version data entries

28 entries across 28 versions & 3 rubygems

Version	Path
relevance-tarantula-0.0.1	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.2	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.3	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.5	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.6	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.7.1	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.7	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.8.0	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.0.8.1	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.0	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.1	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.2	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.3	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.4	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.5	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.6	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.7	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.1.8	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.2.0	lib/relevance/tarantula/attack_handler.rb
relevance-tarantula-0.2.1	lib/relevance/tarantula/attack_handler.rb