garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixes #1215

Browse Source
This commit is contained in:
erwanlr
2018-09-28 10:33:19 +01:00
parent 808521fb70
commit 44e1179ce4
3 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/finders/users/rss_generator.rb
View File

@@ -17,7 +17,13 @@ module WPScan
begin
res.xml.xpath('//item/dc:creator').each do |node|
potential_usernames << node.text.to_s unless node.text.to_s.length > 40
potential_username = node.text.to_s
# Ignoring potential username longer than 60 characters and containing accents
# as they are considered invalid. See https://github.com/wpscanteam/wpscan/issues/1215
next if potential_username.length > 60 || potential_username =~ /[^\x00-\x7F]/
potential_usernames << potential_username
end
rescue Nokogiri::XML::XPath::SyntaxError
next

8
spec/app/finders/users/rss_generator_spec.rb
View File

@@ -32,7 +32,7 @@ describe WPScan::Finders::Users::RSSGenerator do
found_by: 'Rss Generator (Aggressive Detection)'
),
CMSScanner::User.new(
'Aa Días-Gildés',
'Aa Dias-Gildes',
confidence: 50,
found_by: 'Rss Generator (Aggressive Detection)'
)
@@ -53,7 +53,7 @@ describe WPScan::Finders::Users::RSSGenerator do
found_by: 'Rss Generator (Passive Detection)'
),
CMSScanner::User.new(
'Aa Días-Gildés',
'Aa Dias-Gildes',
confidence: 50,
found_by: 'Rss Generator (Passive Detection)'
)
@@ -71,7 +71,7 @@ describe WPScan::Finders::Users::RSSGenerator do
found_by: 'Rss Generator (Aggressive Detection)'
),
CMSScanner::User.new(
'Aa Días-Gildés',
'Aa Dias-Gildes',
confidence: 50,
found_by: 'Rss Generator (Aggressive Detection)'
)
@@ -90,7 +90,7 @@ describe WPScan::Finders::Users::RSSGenerator do
found_by: 'Rss Generator (Aggressive Detection)'
),
CMSScanner::User.new(
'Aa Días-Gildés',
'Aa Dias-Gildes',
confidence: 50,
found_by: 'Rss Generator (Aggressive Detection)'
)

10
spec/fixtures/finders/users/rss_generator/feed.xml vendored
View File

@@ -38,6 +38,15 @@
<link>http://ex.lo/2018/09/23/hello-world/</link>
<comments>http://ex.lo/2018/09/23/hello-world/#comments</comments>
<pubDate>Sun, 23 Sep 2018 11:31:56 +0000</pubDate>
<dc:creator><![CDATA[Aa Dias-Gildes]]></dc:creator>
</item>
<item>
<title>Hello world!</title>
<link>http://ex.lo/2018/09/23/hello-world/</link>
<comments>http://ex.lo/2018/09/23/hello-world/#comments</comments>
<pubDate>Sun, 23 Sep 2018 11:31:56 +0000</pubDate>
<!-- Should be ignored as invalid username (contains accent) -->
<dc:creator><![CDATA[Aa Días-Gildés]]></dc:creator>
</item>
@@ -46,6 +55,7 @@
<link>http://ex.lo/2018/09/23/hello-world/</link>
<comments>http://ex.lo/2018/09/23/hello-world/#comments</comments>
<pubDate>Sun, 23 Sep 2018 11:31:56 +0000</pubDate>
<!-- Should be ignored as invalid username (too long, > 60 chars) -->
<dc:creator><dc:creator><![CDATA[Michael Schrage. <p>Michael Schrage is a researcher at the MIT Sloan School of Management Initiative on the Digital Economy, where he does research and advisory work on how digital media transforms agency, human capital, and innovation.</p>
]]></dc:creator></dc:creator>
</item>