Adds more improvements re passive scanning when there are a lot of urls

spec/app/finders/interesting_findings/mu_plugins_spec.rb

@@ -6,8 +6,55 @@ describe WPScan::Finders::InterestingFindings::MuPlugins do
   let(:url)        { 'http://ex.lo/' }
   let(:fixtures)   { FINDERS_FIXTURES.join('interesting_findings', 'mu_plugins') }
 
+  before do
+    expect(target).to receive(:content_dir).at_least(1).and_return('wp-content')
+  end
+
   describe '#passive' do
-    xit
+    before { stub_request(:get, url).to_return(body: body) }
+
+    context 'when no uris' do
+      let(:body) { '' }
+
+      its(:passive) { should be nil }
+    end
+
+    context 'when a large amount of unrelated uris' do
+      let(:body) do
+        Array.new(250) { |i| "<a href='#{url}#{i}.html'>Some Link</a><img src='#{url}img-#{i}.png'/>" }.join("\n")
+      end
+
+      it 'should not take a while to process the page' do
+        time_start = Time.now
+        result = finder.passive
+        time_end = Time.now
+
+        expect(result).to be nil
+        expect(time_end - time_start).to be < 1
+      end
+    end
+
+    context 'when uris' do
+      let(:body) { File.read(fixtures.join(fixture)) }
+
+      context 'when none matching' do
+        let(:fixture) { 'no_match.html' }
+
+        its(:passive) { should be nil }
+      end
+
+      context 'when matching via href' do
+        let(:fixture) { 'match_href.html' }
+
+        its(:passive) { should be_a WPScan::Model::MuPlugins }
+      end
+
+      context 'when matching from src' do
+        let(:fixture) { 'match_src.html' }
+
+        its(:passive) { should be_a WPScan::Model::MuPlugins }
+      end
+    end
   end
 
   describe '#aggressive' do

spec/app/finders/users/author_id_brute_forcing_spec.rb

@@ -19,7 +19,7 @@ describe WPScan::Finders::Users::AuthorIdBruteForcing do
     end
   end
 
-  describe '#potential_username' do
+  describe '#username_from_response' do
     [
       '4.1.1', '4.1.1-permalink',
       '3.0', '3.0-permalink',
@@ -32,6 +32,19 @@ describe WPScan::Finders::Users::AuthorIdBruteForcing do
         expect(finder.username_from_response(res)).to eql 'admin'
       end
     end
+
+    context 'when a lot of unrelated links' do
+      it 'should not take a while to process the page' do
+        body = Array.new(300) { |i| "<a href='#{url}#{i}.html'>Some Link</a>" }.join("\n")
+        body << '<a href="https://wp.lab/author/test/">Link</a>'
+
+        time_start = Time.now
+        expect(finder.username_from_response(Typhoeus::Response.new(body: body))).to eql 'test'
+        time_end = Time.now
+
+        expect(time_end - time_start).to be < 1
+      end
+    end
   end
 
   describe '#display_name_from_body' do

spec/app/finders/users/author_posts_spec.rb

@@ -16,12 +16,31 @@ describe WPScan::Finders::Users::AuthorPosts do
 
       results = finder.potential_usernames(res)
 
-      expect(results).to eql([
-                               ['admin', 'Author Pattern', 100],
-                               ['admin display_name', 'Display Name', 30],
-                               ['editor', 'Author Pattern', 100],
-                               ['editor', 'Display Name', 30]
-                             ])
+      expect(results).to eql [
+        ['admin', 'Author Pattern', 100],
+        ['admin display_name', 'Display Name', 30],
+        ['editor', 'Author Pattern', 100],
+        ['editor', 'Display Name', 30]
+      ]
+    end
+
+    context 'when a lot of unrelated uris' do
+      it 'should not take a while to process the page' do
+        body =  Array.new(300) { |i| "<a href='#{url}#{i}.html'>Some Link</a>" }.join("\n")
+        body << "<a href='#{url}author/admin/'>Other Link</a>"
+        body << "<a href='#{url}?author=2'>user display name</a>"
+
+        time_start = Time.now
+        results = finder.potential_usernames(Typhoeus::Response.new(body: body))
+        time_end = Time.now
+
+        expect(results).to eql [
+          ['admin', 'Author Pattern', 100],
+          ['user display name', 'Display Name', 30]
+        ]
+
+        expect(time_end - time_start).to be < 1
+      end
     end
   end
 end