rdiff.rb in arachni-0.4.3

- old
+ new

@@ -14,12 +14,10 @@
     limitations under the License.
 =end
 
 module Arachni
 
-require Options.dir['lib'] + 'bloom_filter'
-
 module Element::Capabilities
 
 #
 # Performs boolean, fault injection and behavioral analysis (using the rDiff algorithm)
 # in order to determine whether the web application is responding to the injected data and how.
@@ -32,11 +30,11 @@
 module Auditable::RDiff
 
     def self.included( mod )
         # the rdiff attack performs it own redundancy checks so we need this to
         # keep track of audited elements
-        @@rdiff_audited ||= BloomFilter.new
+        @@rdiff_audited ||= Support::LookUp::HashSet.new
     end
 
     RDIFF_OPTIONS =  {
         # append our seeds to the default values
         format:    [Mutable::Format::APPEND],
@@ -87,23 +85,33 @@
     # @option   opts    [Array<String>] :bools
     #   Array of boolean injection strings (these are supposed to not alter the
     #   webapp behavior when interpreted).
     # @param    [Block]     block
     #   To be used for custom analysis of responses; will be passed the following:
+    #
     #     * injected string
     #     * audited element
     #     * default response body
     #     * boolean response
     #     * fault injection response body
     #
+    # @return   [Bool]
+    #   `true` if the audit was scheduled successfully, `false` otherwise (like
+    #   if the resource is out of scope or already audited).
+    #
     def rdiff_analysis( opts = {}, &block )
+        if skip_path? self.action
+            print_debug "Element's action matches skip rule, bailing out."
+            return false
+        end
+
         opts = self.class::MUTATION_OPTIONS.merge( RDIFF_OPTIONS.merge( opts ) )
 
         # don't continue if there's a missing value
         auditable.values.each { |val| return if !val || val.empty? }
 
-        return if rdiff_audited?
+        return false if rdiff_audited?
         rdiff_audited
 
         responses = {
             # will hold the original, default, response that results from submitting
             orig: nil,
@@ -218,9 +226,11 @@
                     end
 
                 end
             end
         }
+
+        true
     end
 
     private
     def rdiff_audited
         @@rdiff_audited << rdiff_audit_id