diff --git a/lib/common/models/wp_plugin/vulnerable.rb b/lib/common/models/wp_plugin/vulnerable.rb index 72c16376..b43026b8 100644 --- a/lib/common/models/wp_plugin/vulnerable.rb +++ b/lib/common/models/wp_plugin/vulnerable.rb @@ -3,6 +3,7 @@ class WpPlugin < WpItem module Vulnerable + # @return [ String ] The path to the file containing vulnerabilities def vulns_file unless @vulns_file @vulns_file = PLUGINS_VULNS_FILE @@ -10,6 +11,7 @@ class WpPlugin < WpItem @vulns_file end + # @return [ String ] def vulns_xpath "//plugin[@name='#{@name}']/vulnerability" end diff --git a/lib/common/models/wp_theme/findable.rb b/lib/common/models/wp_theme/findable.rb index 8626537e..1ef6c32e 100755 --- a/lib/common/models/wp_theme/findable.rb +++ b/lib/common/models/wp_theme/findable.rb @@ -4,19 +4,28 @@ class WpTheme < WpItem module Findable # Find the main theme of the blog - # returns a WpTheme object or nil + # + # @param [ URI ] target_uri + # + # @return [ WpTheme ] def find(target_uri) - methods.grep(/find_from_/).each do |method| + methods.grep(/^find_from_/).each do |method| if wp_theme = self.send(method, target_uri) wp_theme.found_from = method return wp_theme end end + nil end protected - # Discover the wordpress theme name by parsing the css link rel + + # Discover the wordpress theme by parsing the css link rel + # + # @param [ URI ] target_uri + # + # @return [ WpTheme ] def find_from_css_link(target_uri) response = Browser.instance.get_and_follow_location(target_uri.to_s) @@ -35,22 +44,25 @@ class WpTheme < WpItem end # http://code.google.com/p/wpscan/issues/detail?id=141 + # + # @param [ URI ] target_uri + # + # @return [ WpTheme ] def find_from_wooframework(target_uri) body = Browser.instance.get(target_uri.to_s).body regexp = %r{\s+} - matches = regexp.match(body) - if matches + + if matches = regexp.match(body) woo_theme_name = matches[1] woo_theme_version = matches[2] - woo_framework_version = matches[3] # Not used at this time + #woo_framework_version = matches[3] # Not used at this time return new( target_uri, { name: woo_theme_name, version: woo_theme_version - #path: woo_theme_name } ) end diff --git a/spec/lib/common/models/wp_theme/findable_spec.rb b/spec/lib/common/models/wp_theme/findable_spec.rb new file mode 100644 index 00000000..79c79b67 --- /dev/null +++ b/spec/lib/common/models/wp_theme/findable_spec.rb @@ -0,0 +1,135 @@ +# encoding: UTF-8 + +require 'spec_helper' + +describe 'WpTheme::Findable' do + let(:fixtures_dir) { MODELS_FIXTURES + '/wp_theme/findable' } + let(:uri) { URI.parse('http://example.com/') } + + describe '::find_from_css_link' do + after do + @body ||= File.new(fixtures_dir + '/css_link/' + @file) + stub_request(:get, uri.to_s).to_return(status: 200, body: @body) + + wp_theme = WpTheme.send(:find_from_css_link, uri) + + if @expected + wp_theme.should be_a WpTheme + end + wp_theme.should == @expected + end + + context 'when theme is not present' do + it 'returns nil' do + @body = '' + @expected = nil + end + end + + context 'when the theme name has spaces or special chars' do + it 'returns the WpTheme' do + @file = 'theme-name-with-spaces.html' + @expected = WpTheme.new(uri, name: 'Copia di simplefolio') + end + end + + context 'when is inline' do + it 'returns the WpTheme' do + @file = 'inline_link_tag.html' + @expected = WpTheme.new(uri, name: 'inline') + end + end + + # FIXME: the style_url should be checked in WpTheme for absolute / relative + context 'when relative url is used' do + it 'returns the WpTheme' do + @file = 'relative_urls.html' + @expected = WpTheme.new(uri, name: 'theme_name') + end + end + + end + + describe '::find_from_wooframework' do + after do + @body ||= File.new(fixtures_dir + '/wooframework/' + @file) + stub_request(:get, uri.to_s).to_return(status: 200, body: @body) + + wp_theme = WpTheme.send(:find_from_wooframework, uri) + + if @expected + wp_theme.should be_a WpTheme + end + wp_theme.should == @expected + end + + context 'when theme is not present' do + it 'returns nil' do + @body = '' + @expected = nil + end + end + + it 'returns the WpTheme' do + @file = 'merchant-no-version.html' + @expected = WpTheme.new(uri, name: 'Merchant') + end + + context 'when the version is present' do + it 'returns the WpTheme with it' do + @file = 'editorial-1.3.5.html' + @expected = WpTheme.new(uri, name: 'Editorial', version: '1.3.5') + end + end + + end + + describe '::find' do + # Stub all WpTheme::find_from_* to return nil + def stub_all_to_nil + WpTheme.methods.grep(/^find_from_/).each do |method| + WpTheme.stub(method).and_return(nil) + end + end + + context 'when a method is named s_find_from_s' do + it 'does not call it' do + + class WpTheme + module Findable + extend self + def s_find_from_s(s); raise 'I should not be called by ::find' end + end + end + + stub_all_to_nil() + + expect { WpTheme.find(uri) }.to_not raise_error + end + end + + context 'when the theme is not found' do + it 'returns nil' do + stub_all_to_nil() + + WpTheme.find(uri).should be_nil + end + end + + context 'when the theme is found' do + it 'returns it, with the :found_from sets' do + stub_all_to_nil() + expected = WpTheme.new(uri, name: 'the-oracle') + + WpTheme.stub(:find_from_css_link).and_return(expected) + wp_theme = WpTheme.find(uri) + + wp_theme.should be_a WpTheme + wp_theme.should == expected + wp_theme.found_from.should === 'css link' + end + end + + end + +end diff --git a/spec/samples/wpscan/wp_theme/find/css_link/inline_link_tag.html b/spec/samples/common/models/wp_theme/findable/css_link/inline_link_tag.html similarity index 100% rename from spec/samples/wpscan/wp_theme/find/css_link/inline_link_tag.html rename to spec/samples/common/models/wp_theme/findable/css_link/inline_link_tag.html diff --git a/spec/samples/wpscan/wp_theme/find/css_link/relative_urls.html b/spec/samples/common/models/wp_theme/findable/css_link/relative_urls.html similarity index 100% rename from spec/samples/wpscan/wp_theme/find/css_link/relative_urls.html rename to spec/samples/common/models/wp_theme/findable/css_link/relative_urls.html diff --git a/spec/samples/common/models/wp_theme/findable/css_link/theme-name-with-spaces.html b/spec/samples/common/models/wp_theme/findable/css_link/theme-name-with-spaces.html new file mode 100644 index 00000000..f8d6b231 --- /dev/null +++ b/spec/samples/common/models/wp_theme/findable/css_link/theme-name-with-spaces.html @@ -0,0 +1,32 @@ + + + + + + + + + + +wordpress-3.2.1 | Just another WordPress site + + + + + + + + + + + + + diff --git a/spec/samples/wpscan/wp_theme/find/wooframework/editorial-1.3.5.html b/spec/samples/common/models/wp_theme/findable/wooframework/editorial-1.3.5.html similarity index 100% rename from spec/samples/wpscan/wp_theme/find/wooframework/editorial-1.3.5.html rename to spec/samples/common/models/wp_theme/findable/wooframework/editorial-1.3.5.html diff --git a/spec/samples/wpscan/wp_theme/find/wooframework/merchant-no-version.html b/spec/samples/common/models/wp_theme/findable/wooframework/merchant-no-version.html similarity index 100% rename from spec/samples/wpscan/wp_theme/find/wooframework/merchant-no-version.html rename to spec/samples/common/models/wp_theme/findable/wooframework/merchant-no-version.html diff --git a/spec/samples/wpscan/wp_theme/find/css_link/theme-name-with-spaces.html b/spec/samples/wpscan/wp_theme/find/css_link/theme-name-with-spaces.html deleted file mode 100644 index 27199251..00000000 --- a/spec/samples/wpscan/wp_theme/find/css_link/theme-name-with-spaces.html +++ /dev/null @@ -1,131 +0,0 @@ - - - - - - - - - - -wordpress-3.2.1 | Just another WordPress site - - - - - - - - - - - - - - -
- - - -
-
-
- - - - - - - - - - -
-
- - - -
- - -
- - - - diff --git a/spec/samples/wpscan/wp_theme/find/css_link/wordpress-twentyeleven.htm b/spec/samples/wpscan/wp_theme/find/css_link/wordpress-twentyeleven.htm deleted file mode 100755 index 923be3e9..00000000 --- a/spec/samples/wpscan/wp_theme/find/css_link/wordpress-twentyeleven.htm +++ /dev/null @@ -1,131 +0,0 @@ - - - - - - - - - - -wordpress-3.2.1 | Just another WordPress site - - - - - - - - - - - - - - -
- - - -
-
-
- - - - - - - - - - -
-
- - - -
- - -
- - - - \ No newline at end of file