garfield/wpscan
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Forces UTF-8 encoding when enumerating usernames - Fixes #801

Browse Source
This commit is contained in:
erwanlr
2015-04-11 12:26:15 +01:00
parent 4fbc535b0c
commit a4bbf41086
3 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/common/models/wp_user/existable.rb
View File

@@ -39,7 +39,9 @@ class WpUser < WpItem
# #
# @return [ String ] The login # @return [ String ] The login
def self.login_from_author_pattern(text) def self.login_from_author_pattern(text)
text[%r{/author/([^/\b]+)/?}i, 1] return unless text =~ %r{/author/([^/\b]+)/?}i
Regexp.last_match[1].force_encoding('UTF-8')
end end
# @param [ String ] body # @param [ String ] body
@@ -52,6 +54,7 @@ class WpUser < WpItem
unless login unless login
# No Permalinks # No Permalinks
login = body[%r{<body class="archive author author-([^\s]+)[ "]}i, 1] login = body[%r{<body class="archive author author-([^\s]+)[ "]}i, 1]
login ? login.force_encoding('UTF-8') : nil
end end
login login

10
spec/samples/common/models/wp_user/existable/chinese_chars.html Normal file
View File

@@ -0,0 +1,10 @@
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8" />
<meta name="renderer" content="webkit">
<title>一路疯下去</title>
<link rel="profile" href="http://gmpg.org/xfn/11" />
<link rel="pingback" href="http://wp.lab/xmlrpc.php" />
<link rel="canonical" href="http://wp.lab/author/一路疯下去/">
<body class="archive author author-78">

13
spec/shared_examples/wp_user/existable.rb
View File

@@ -2,7 +2,7 @@
shared_examples 'WpUser::Existable' do shared_examples 'WpUser::Existable' do
let(:mod) { WpUser::Existable } let(:mod) { WpUser::Existable }
let(:fixtures_dir) { MODELS_FIXTURES + '/wp_user/existable' } let(:fixtures_dir) { File.join(MODELS_FIXTURES, 'wp_user', 'existable') }
describe '::login_from_author_pattern' do describe '::login_from_author_pattern' do
after do after do
@@ -145,7 +145,7 @@ shared_examples 'WpUser::Existable' do
end end
context 'with a 200' do context 'with a 200' do
let(:resp_opt) { { code: 200, body: File.new(fixtures_dir + '/admin.html').read } } let(:resp_opt) { { code: 200, body: File.read(File.join(fixtures_dir, 'admin.html')) } }
it 'loads the correct values' do it 'loads the correct values' do
@login = 'admin' @login = 'admin'
@@ -153,6 +153,15 @@ shared_examples 'WpUser::Existable' do
end end
end end
context 'when chinese chars' do
let(:resp_opt) { { code: 200, body: File.read(File.join(fixtures_dir, 'chinese_chars.html')) } }
it 'loads the correct values' do
@login = '一路疯下去'
@display_name = nil
end
end
context 'otherwise' do context 'otherwise' do
it 'does not do anything' do it 'does not do anything' do
@resp_opt = { code: 404 } @resp_opt = { code: 404 }