124 lines
3.4 KiB
Ruby
124 lines
3.4 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
describe WPScan::Finders::PluginVersion::Readme do
|
|
subject(:finder) { described_class.new(plugin) }
|
|
let(:plugin) { WPScan::Model::Plugin.new('spec', target) }
|
|
let(:target) { WPScan::Target.new('http://wp.lab/') }
|
|
let(:fixtures) { FINDERS_FIXTURES.join('plugin_version', 'readme') }
|
|
|
|
def version(number, found_by, confidence)
|
|
WPScan::Model::Version.new(
|
|
number,
|
|
found_by: format('Readme - %s (Aggressive Detection)', found_by),
|
|
confidence: confidence,
|
|
interesting_entries: [readme_url]
|
|
)
|
|
end
|
|
|
|
def stable_tag(number)
|
|
version(number, 'Stable Tag', 80)
|
|
end
|
|
|
|
def changelog_section(number)
|
|
version(number, 'ChangeLog Section', 50)
|
|
end
|
|
|
|
describe '#aggressive' do
|
|
before do
|
|
expect(target).to receive(:content_dir).and_return('wp-content')
|
|
|
|
allow(target).to receive(:head_or_get_params).and_return(method: :head)
|
|
|
|
stub_request(:head, /.*/).to_return(status: 404)
|
|
stub_request(:head, readme_url).to_return(status: 200)
|
|
end
|
|
|
|
let(:readme_url) { plugin.url(WPScan::Model::WpItem::READMES.sample) }
|
|
|
|
after do
|
|
stub_request(:get, readme_url).to_return(body: File.read(fixtures.join(@file)))
|
|
|
|
expect(finder.aggressive).to eql @expected
|
|
end
|
|
|
|
context 'when no version' do
|
|
it 'returns nil' do
|
|
@file = 'no_version.txt'
|
|
@expected = nil
|
|
end
|
|
end
|
|
|
|
context 'when the stable tag does not contain numbers' do
|
|
it 'returns nil' do
|
|
@file = 'aa-health-calculator.txt'
|
|
@expected = nil
|
|
end
|
|
end
|
|
|
|
context 'when empty changelog section' do
|
|
it 'returns nil' do
|
|
@file = 'all-in-one-facebook.txt'
|
|
@expected = nil
|
|
end
|
|
end
|
|
|
|
context 'when no changelog section' do
|
|
it 'returns nil' do
|
|
@file = 'blog-reordering.txt'
|
|
@expected = nil
|
|
end
|
|
end
|
|
|
|
context 'when leaked from the stable tag' do
|
|
it 'returns the expected versions' do
|
|
@file = 'simple-login-lockdown-0.4.txt'
|
|
@expected = [stable_tag('0.4'), changelog_section('04')]
|
|
end
|
|
end
|
|
|
|
context 'when leaked from the version' do
|
|
it 'returns it' do
|
|
@file = 'wp-photo-plus-5.1.15.txt'
|
|
@expected = [stable_tag('5.1.15')]
|
|
end
|
|
end
|
|
|
|
context 'when version is in a release date format' do
|
|
it 'detects and returns it' do
|
|
@file = 's2member.txt'
|
|
@expected = [stable_tag('141007')]
|
|
end
|
|
end
|
|
|
|
context 'when version contains letters' do
|
|
it 'returns it' do
|
|
@file = 'beta1.txt'
|
|
@expected = [stable_tag('2.0.0-beta1')]
|
|
end
|
|
end
|
|
|
|
context 'when parsing the changelog for version numbers' do
|
|
{
|
|
'changelog_version' => '1.3',
|
|
'wp_polls' => '2.64',
|
|
'nextgen_gallery' => '2.0.66.33',
|
|
'wp_user_frontend' => '1.2.3',
|
|
'my_calendar' => '2.1.5',
|
|
'nextgen_gallery_2' => '1.9.13',
|
|
'advanced-most-recent-posts-mod' => '1.6.5.2',
|
|
'a-lead-capture-contact-form-and-tab-button-by-awebvoicecom' => '3.1',
|
|
'backup-scheduler' => '1.5.9',
|
|
'release_date_slash' => '1.0.4',
|
|
'cool_tag_cloud' => '2.27'
|
|
}.each do |file, version_number|
|
|
context "whith #{file}.txt" do
|
|
it 'returns the expected version' do
|
|
@file = "#{file}.txt"
|
|
@expected = [changelog_section(version_number)]
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|