def test_get_plugin_key_from_name_in_string(self):
plugin_string0 = "BEGIN wp-parsely Plugin Version 1.10.2 "
plugin_string1 = "This site uses the wp-captcha plugin."
plugin_string2 = "No plugin name in this string"
plugin_string3 = "This site uses the Google Analytics by MonsterInsights plugin"
plugin0_meta = Meta(key="plugins/wp-parsely", name="Parse.ly")
plugin1_meta = Meta(key="plugins/wp-captcha", name="WP Captcha")
self.plugin_finder.meta_list = MetaList(
key="plugins",
metas=[plugin0_meta, plugin1_meta, self.google_analytics_meta])
plugin0_key = self.plugin_finder._get_plugin_key_from_name_in_string(
plugin_string0)
plugin1_key = self.plugin_finder._get_plugin_key_from_name_in_string(
plugin_string1)
plugin2_key = self.plugin_finder._get_plugin_key_from_name_in_string(
plugin_string2)
plugin3_key = self.plugin_finder._get_plugin_key_from_name_in_string(
plugin_string3)
self.assertEqual(plugin0_key, plugin0_meta.key)
self.assertEqual(plugin1_key, plugin1_meta.key)
self.assertIsNone(plugin2_key)
self.assertEqual(plugin3_key, self.google_analytics_meta.key)
def test_format_format_vulnerabilities_of_component(self):
with patch("vane.outputmanager.termcolor.colored", fake_colored):
plugin0_meta = Meta(key="plugins/plugin0",
name="Plugin 0",
url="http://www.plugin.com/")
plugin1_meta = Meta(key="plugins/plugin1",
name="Plugin 1",
url="http://www.plugin.com/")
self.pretty_output.add_plugin("plugins/plugin0", "1.2.3",
plugin0_meta)
self.pretty_output.add_plugin("plugins/plugin1", "4.5.6",
plugin1_meta)
self.pretty_output.add_vulnerability("plugins/plugin0", {
"id": "12345",
"title": "vuln"
})
self.pretty_output.add_vulnerability("plugins/plugin1", {
"id": "23456",
"title": "vuln"
})
output = self.pretty_output.format(self.pretty_output.data)
self.assertEqual(
"Plugins:\nPlugin 0 version 1.2.3\turl: http://www.plugin.com/\nVulnerabilities:\nvuln\n\n"
"Plugin 1 version 4.5.6\turl: http://www.plugin.com/\nVulnerabilities:\nvuln\n\n",
output)
def setUp(self):
self.plugin_finder = PassivePluginsFinder(None)
self.yoast_seo_meta = Meta(
key="plugins/wordpress-seo",
name="Yoast SEO",
url=
"https://yoast.com/wordpress/plugins/seo/#utm_source=wpadmin&utm_medium="
"plugin&utm_campaign=wpseoplugin")
self.google_analytics_meta = Meta(
key="plugins/google-analytics-for-wordpress",
name="Google Analytics by MonsterInsights",
url=
"https://www.monsterinsights.com/pricing/#utm_source=wordpress&utm_medium"
"=plugin&utm_campaign=wpgaplugin&utm_content=v504")
self.postratings_meta = Meta(key="plugins/wp-postratings",
name="WP-PostRatings")
self.total_cache_meta = Meta(
key="plugins/w3-total-cache",
name="W3 Total Cache",
url="http://www.w3-edge.com/wordpress-plugins/w3-total-cache/")
self.plugin_finder.meta_list = MetaList(key="plugins",
metas=[
self.yoast_seo_meta,
self.google_analytics_meta,
self.postratings_meta,
self.total_cache_meta
])
def test_find_plugin_in_string_find_plugin_in_comment_that_match_plugin_name_in_meta_list(
self):
parsely_meta = Meta(key="plugins/wp-parsely", name="Parse.ly")
add_meta_tags_meta = Meta(key="plugins/add-meta-tags",
name="Add Meta Tags")
self.plugin_finder.meta_list.metas.extend(
[parsely_meta, add_meta_tags_meta])
comment0 = "This site uses the Google Analytics by MonsterInsights plugin v5.5.4 - Universal enabled - https://www.monsterinsights.com/"
comment1 = "This site is optimized with the Yoast SEO plugin v4.0.2 - https://yoast.com/wordpress/plugins/seo/"
comment2 = " BEGIN wp-parsely Plugin Version 1.10.2 "
comment3 = " / Yoast SEO plugin. "
comment4 = " BEGIN Metadata added by the Add-Meta-Tags WordPress plugin "
plugin0 = self.plugin_finder._find_plugin_in_string(comment0)
plugin1 = self.plugin_finder._find_plugin_in_string(comment1)
plugin2 = self.plugin_finder._find_plugin_in_string(comment2)
plugin3 = self.plugin_finder._find_plugin_in_string(comment3)
plugin4 = self.plugin_finder._find_plugin_in_string(comment4)
self.assertEqual(plugin0, {self.google_analytics_meta.key: "5.5.4"})
self.assertEqual(plugin1, {self.yoast_seo_meta.key: "4.0.2"})
self.assertEqual(plugin2, {parsely_meta.key: "1.10.2"})
self.assertEqual(plugin3, {self.yoast_seo_meta.key: None})
self.assertEqual(plugin4, {add_meta_tags_meta.key: None})
def test_format_regroup_related_components(self):
with patch("vane.outputmanager.termcolor.colored", fake_colored):
plugin0_meta = Meta(key="plugins/plugin0",
name="Plugin 0",
url="http://www.plugin0.com/")
plugin1_meta = Meta(key="plugins/plugin1",
name="Plugin 1",
url="http://www.plugin1.com/")
self.pretty_output.add_plugin("plugins/plugin0", "1.2.3",
plugin0_meta)
self.pretty_output.add_plugin("plugins/plugin1", "4.5.6",
plugin1_meta)
theme0_meta = Meta(key="themes/theme0",
name="Theme 0",
url="http://www.theme0.com/")
theme1_meta = Meta(key="themes/theme1",
name="Theme 1",
url="http://www.theme1.com/")
self.pretty_output.add_theme("themes/theme0", "3.2.1", theme0_meta)
self.pretty_output.add_theme("themes/theme1", "1.2.0", theme1_meta)
output = self.pretty_output.format(self.pretty_output.data)
self.assertIn(
"Plugins:\nPlugin 0 version 1.2.3\turl: http://www.plugin0.com/\nNo known vulnerabilities\n\n"
"Plugin 1 version 4.5.6\turl: http://www.plugin1.com/\nNo known vulnerabilities\n\n",
output)
self.assertIn(
"Themes:\nTheme 0 version 3.2.1\turl: http://www.theme0.com/\nNo known vulnerabilities\n\n"
"Theme 1 version 1.2.0\turl: http://www.theme1.com/\nNo known vulnerabilities\n\n",
output)
def test_add_meta_to_component_set_default_value_for_missing_meta(self):
component0 = OrderedDict([("key", "plugins/plugin")])
meta0 = Meta(key="plugins/plugin", name="Plugin")
component1 = OrderedDict([("key", "themes/theme")])
meta1 = Meta(key="themes/theme", url="http://www.theme.example")
self.output_manager._add_meta_to_component(component0, meta0)
self.output_manager._add_meta_to_component(component1, meta1)
self.assertEqual(component0["url"], None)
self.assertEqual(component1["name"], "theme")
def test_find_plugin_in_string_return_longest_match(self):
self.plugin_finder.meta_list = MetaList(key="plugins")
self.plugin_finder.meta_list.metas = [
Meta(key="plugins/captcha"),
Meta(key="plugins/wp-captcha")
]
string = "This site uses the wp-captcha plugin."
key, version = self.plugin_finder._find_plugin_in_string(
string).popitem()
self.assertEqual(key, "plugins/wp-captcha")
def test_find_plugin_in_string_doesnt_return_words_containing_plugin_names(
self):
meta_list = MetaList(key="plugins",
metas=[
Meta(key="plugins/nofollow"),
Meta(key="plugins/recentcomments")
])
self.plugin_finder.set_plugins_meta_list(meta_list)
string1 = "external nofollow"
string2 = "recentcomments"
self.assertIsNone(self.plugin_finder._find_plugin_in_string(string1))
self.assertIsNone(self.plugin_finder._find_plugin_in_string(string2))
def test_find_plugin_in_string_only_return_full_match(self):
self.plugin_finder.meta_list = MetaList(key="plugins")
self.plugin_finder.meta_list.metas = [
Meta(key="plugins/recaptcha"),
Meta(key="plugins/spam-captcha"),
Meta(key="plugins/pluscaptcha"),
Meta(key="plugins/wp-captcha"),
Meta(key="plugins/typing-lag-fix-for-yoast-seo",
name="Typing Lag Fix for Yoast SEO")
]
string0 = "This site uses the captcha plugin."
string1 = "This site is optimized with the Yoast SEO plugin v4.0.2 - https://yoast.com/wordpress/plugins/seo/"
self.assertIsNone(self.plugin_finder._find_plugin_in_string(string0))
self.assertIsNone(self.plugin_finder._find_plugin_in_string(string1))
async def test_collect_from_meta_for_plugin(self, fake_future):
workspace = MagicMock()
workspace.prepare.return_value = fake_future(None)
@contextmanager
def workspace_provider(repository):
self.assertEqual(repository, "https://svn.example.com/a-plugin")
yield workspace
subversion = MagicMock()
subversion.workspace = workspace_provider
meta = Meta(key="plugins/a-plugin",
name="A Plugin",
repositories=[
Repository(
type="subversion",
location="https://svn.example.com/a-plugin"),
])
hasher = RepositoryHasher(storage=MagicMock(),
hasher=MagicMock(),
subversion=subversion)
hasher.collect_for_workspace = MagicMock()
hasher.collect_for_workspace.return_value = fake_future(None)
self.assertTrue(await hasher.collect_from_meta(
meta, prefix_pattern="wp-content/{meta.key}"))
workspace.prepare.assert_called_once_with()
hasher.collect_for_workspace.assert_called_with(
"plugins/a-plugin",
workspace,
prefix="wp-content/plugins/a-plugin")
async def test_with_multiple_repos(self, fake_future):
workspace = MagicMock()
workspace.prepare.return_value = fake_future(None)
@contextmanager
def workspace_provider(repository):
self.assertEqual(repository, "https://svn.example.com")
yield workspace
subversion = MagicMock()
subversion.workspace = workspace_provider
meta = Meta(key="wordpress",
name="WordPress",
repositories=[
Repository(type="cvs", location="1990s"),
Repository(type="subversion",
location="https://svn.example.com"),
Repository(type="subversion",
location="https://mirror.example.com"),
])
hasher = RepositoryHasher(storage=MagicMock(),
hasher=MagicMock(),
subversion=subversion)
hasher.collect_for_workspace = MagicMock()
hasher.collect_for_workspace.return_value = fake_future(None)
self.assertTrue(await hasher.collect_from_meta(meta))
workspace.prepare.assert_called_once_with()
def test_popular_mark(self):
plugin = Meta(key="plugins/wordpress-importer",
name="WordPress Importer",
is_popular=True)
data, err = serialize(MetaSchema(), plugin)
self.assertIn('"is_popular": true', data)
def test_format_set_components_group_name_in_blue_bold(self):
plugin_meta = Meta(key="plugins/plugin",
name="Plugin",
url="https://www.plugin.com/")
self.pretty_output.add_plugin("plugins/plugin", "1.2.3", plugin_meta)
theme_meta = Meta(key="themes/theme",
name="Theme",
url="https://www.theme.com/")
self.pretty_output.add_theme("themes/theme", "1.2.0", theme_meta)
output = self.pretty_output.format(self.pretty_output.data)
cyan_bold_char = "\x1B[{0}m\x1B[{1}m".format(
termcolor.ATTRIBUTES["bold"], termcolor.COLORS["blue"])
self.assertIn("%sPlugins:" % cyan_bold_char, output)
self.assertIn("%sThemes:" % cyan_bold_char, output)
def test_find_plugin_in_string_doesnt_find_name_that_are_part_of_larger_word(
self):
"""Test that a word like 'secondary' in a comment doesn't match a plugin like 'econda'."""
meta_list = MetaList(key="plugins",
metas=[
Meta(key="plugins/econda"),
Meta(key="plugins/nofollow"),
Meta(key="plugins/recentcomments"),
Meta(key="plugins/google")
])
self.plugin_finder.set_plugins_meta_list(meta_list)
string0 = "secondary-toggle"
string3 = "//fonts.googleapis.com/css"
self.assertIsNone(self.plugin_finder._find_plugin_in_string(string0))
self.assertIsNone(self.plugin_finder._find_plugin_in_string(string3))
def test_format_component_dont_add_url_if_url_is_none(self):
self.pretty_output.add_plugin(
"plugins/plugin", "1.0", Meta(key="plugins/plugin", name="Plugin"))
output = self.pretty_output._format_components(
self.pretty_output.data["plugins"], "Plugins")
self.assertIn("Plugin version 1.0", output)
def test_find_plugin_in_string_find_plugin_from_path_in_comment(self):
comment = "this is a comment with a plugin url: http://www.wpsite.com/wp-content/plugins/my-plugin/script.js"
self.plugin_finder.meta_list = MetaList(
key="plugins", metas=[Meta(key="plugins/my-plugin")])
plugin_key, version = self.plugin_finder._find_plugin_in_string(
comment).popitem()
self.assertEqual(plugin_key, "plugins/my-plugin")
def test_list_popular_list_keys_of_popular_plugins_or_themes(self):
files = ["META.json", "versions.json"]
self.storage.meta_list = [
Meta(key='plugins/plugin0', is_popular=True),
Meta(key='plugins/plugin1', is_popular=False),
Meta(key='themes/theme0', is_popular=True),
Meta(key='themes/theme1', is_popular=False)
]
self.storage.content = [
("plugins/plugin0", "dirpath", "dirnames", files),
("plugins/plugin1", "dirpath", "dirnames", files),
("themes/theme0", "dirpath", "dirnames", files),
("themes/theme1", "dirpath", "dirnames", files)
]
plugin_key = list(self.exporter._list_popular("plugins"))
theme_key = list(self.exporter._list_popular("themes"))
self.assertEqual(plugin_key, ["plugins/plugin0"])
self.assertEqual(theme_key, ["themes/theme0"])
def test_format_component_add_message_if_no_vulnerabilities_for_component(
self):
self.pretty_output.add_plugin(
"plugins/plugin", "1.0",
Meta(key="plugins/plugin", name="Plugin", url="url"))
output = self.pretty_output._format_components(
self.pretty_output.data["plugins"], "Plugins")
self.assertIn("No known vulnerabilities", output)
def test_format_format_output_with_defined_order(self):
with patch("vane.outputmanager.termcolor.colored", fake_colored):
self.pretty_output.log_message("message...")
self.pretty_output.add_plugin(
"plugins/plugin", "1.2.3",
Meta(key="plugins/plugin", name="Plugin", url="url"))
self.pretty_output.add_theme(
"themes/theme", "3.2.1",
Meta(key="themes/theme", name="Theme", url="url"))
self.pretty_output.set_wordpress_version(
"4.3.1", Meta(key="wordpress", name="Wordpress", url="url"))
output = self.pretty_output.format(self.pretty_output.data)
expected_output = "{0}Plugins:\n{1}Themes:\n{2}General Log:\nmessage...\n"\
.format(self.pretty_output._format_component(self.pretty_output.data["wordpress"]),
self.pretty_output._format_component(self.pretty_output.data["plugins"][0]),
self.pretty_output._format_component(self.pretty_output.data["themes"][0]))
self.assertEqual(output, expected_output)
def test_format_put_component_meta_and_version_on_a_single_line(self):
with patch("vane.outputmanager.termcolor.colored", fake_colored):
wordpress_meta = Meta(key="wordpress",
name="Wordpress",
url="https://wordpress.org/")
self.pretty_output.set_wordpress_version("4.7.5", wordpress_meta)
pretty_output = self.pretty_output.format(self.pretty_output.data)
self.assertIn(
"Wordpress version 4.7.5\turl: https://wordpress.org/\n",
pretty_output)
def test_find_plugin_in_string_return_plugin_key_with_key_in_meta_that_matches_string(
self):
string0 = "BEGIN wp-parsely Plugin Version 1.10.2 "
string1 = "This site uses the wp-captcha plugin."
string2 = "No plugin name in this string"
self.plugin_finder.meta_list = MetaList(key="plugins")
self.plugin_finder.meta_list.metas.append(
Meta(key="plugins/wp-parsely", name="Parse.ly"))
self.plugin_finder.meta_list.metas.append(
Meta(key="plugins/wp-captcha", name="WP Captcha"))
plugin_key0, version = self.plugin_finder._find_plugin_in_string(
string0).popitem()
plugin_key1, version = self.plugin_finder._find_plugin_in_string(
string1).popitem()
plugin_key2 = self.plugin_finder._find_plugin_in_string(string2)
self.assertEqual(plugin_key0, "plugins/wp-parsely")
self.assertEqual(plugin_key1, "plugins/wp-captcha")
self.assertIsNone(plugin_key2)
def test_read_and_write_cpe(self):
plugin = Meta(key="plugins/test-plugin",
name="Test Plugin",
cpe_names=["cpe:2.3:a:vendor_x:test_plugin"])
schema = MetaSchema()
as_string, _ = serialize(schema, plugin)
self.assertIn("cpe:2.3:a:vendor_x:test_plugin", as_string)
found_back, _ = schema.loads(as_string)
self.assertIsNot(plugin, found_back)
self.assertEqual(plugin, found_back)
def test_get_plugin_key_from_meta_url_in_string_return_key_with_longest_url_match(
self):
# This string has the plugin name and a part of its url:
string = "This site is optimized with the Yoast SEO plugin v4.0.2 - https://yoast.com/wordpress/plugins/seo/"
email_commenter_meta = Meta(
key="plugins/email-commenters",
name="Email Commenters",
# url matches, but shorter than the other match
url="http://yoast.com/wordpress/email-commenters/")
self.plugin_finder.meta_list.metas.append(email_commenter_meta)
plugin_key = self.plugin_finder._get_plugin_key_from_meta_url_in_string(
string)
self.assertEqual(plugin_key, self.yoast_seo_meta.key)
def test_format_component_set_vulnerabilities_first_line_in_bold_red(self):
self.pretty_output.add_plugin(
"plugins/plugin", "1.0",
Meta(key="plugins/plugin", name="Plugin", url="url"))
self.pretty_output.add_vulnerability("plugins/plugin", {
"id": "1234",
"title": "Title of the vuln."
})
output = self.pretty_output._format_component(
self.pretty_output.data["plugins"][0])
esc_char = "\x1B[%d"
self.assertIn(esc_char % termcolor.COLORS["red"], output)
self.assertIn(esc_char % termcolor.ATTRIBUTES["bold"], output)
def test_read_and_write_minimal(self):
plugin = Meta(key="plugins/test-plugin")
schema = MetaSchema()
as_string, _ = serialize(schema, plugin)
self.assertIn("test-plugin", as_string)
self.assertNotIn("url", as_string)
self.assertNotIn("repositories", as_string)
self.assertNotIn("name", as_string)
found_back, _ = schema.loads(as_string)
self.assertIsNot(plugin, found_back)
self.assertEqual(plugin, found_back)
def test_read_and_write_full_meta(self):
repo = Repository(type="subversion",
location="http://svn.example.com/test-plugin")
plugin = Meta(key="plugins/test-plugin",
name="Test Plugin",
url="http://example.com/plugins/test-plugin",
repositories=[repo],
hints=[Reference(type="test", id="hello")])
schema = MetaSchema()
as_string, _ = serialize(schema, plugin)
self.assertIn("Test Plugin", as_string)
found_back, _ = schema.loads(as_string)
self.assertIsNot(plugin, found_back)
self.assertEqual(plugin, found_back)
def test_list_plugins_find_plugin_references_and_version_in_page_source(
self):
# yoast seo, disqus comment system and google analytics by monster insights:
sample_page0 = join(dirname(__file__), "samples/delvelabs.html")
# yoast seo, jm-twitter-cards (impossible à trouver?), yet-another-related-posts-plugin, cyclone-slider-2,
# wp-jquery-lightbox, panopress, sitepress-multilingual-cms, W3 Total Cache
# possibles: MH Cookie, DOL Web Analytics
sample_page1 = join(dirname(__file__), "samples/starwars.html")
# wp-polls, lift-search, wp-postratings, jetpack, Google Analytics by MonsterInsights, audio-player
# possibles: scea-omniture, image-rotator-2
sample_page2 = join(dirname(__file__), "samples/playstation.html")
page0_response = html_file_to_hammertime_response(sample_page0)
page1_response = html_file_to_hammertime_response(sample_page1)
page2_response = html_file_to_hammertime_response(sample_page2)
disqus_meta = Meta(key="plugins/disqus-comment-system",
name="Disqus Comment System")
jetpack_meta = Meta(key="plugins/jetpack",
name="Jetpack by WordPress.com")
cyclone_slider_meta = Meta(key="plugins/cyclone-slider-2",
name="Cyclone Slider 2")
sitepress_meta = Meta(key="plugins/sitepress-multilingual-cms")
audio_player_meta = Meta(key="plugins/audio-player")
lightbox_meta = Meta(key="plugins/wp-jquery-lightbox",
name="WP jQuery Lightbox")
panopress_meta = Meta(key="plugins/panopress", name="PanoPress")
wp_polls_meta = Meta(key="plugins/wp-polls", name="WP-Polls")
posts_plugin_meta = Meta(
key="plugins/yet-another-related-posts-plugin",
name="Yet Another Related Posts Plugin (YARPP)")
lift_search_meta = Meta(key="plugins/lift-search",
name="Lift: Search for WordPress")
self.plugin_finder.meta_list.metas.extend([
disqus_meta, jetpack_meta, cyclone_slider_meta, sitepress_meta,
audio_player_meta, lightbox_meta, panopress_meta, wp_polls_meta,
posts_plugin_meta, lift_search_meta
])
plugins_in_page0 = self.plugin_finder.list_plugins(page0_response)
plugins_in_page1 = self.plugin_finder.list_plugins(page1_response)
plugins_in_page2 = self.plugin_finder.list_plugins(page2_response)
self.assertIn(disqus_meta.key, plugins_in_page0)
self.assertIn(self.yoast_seo_meta.key, plugins_in_page0)
self.assertIn(self.google_analytics_meta.key, plugins_in_page0)
self.assertEqual(plugins_in_page0[self.yoast_seo_meta.key], "4.0.2")
self.assertEqual(plugins_in_page0[self.google_analytics_meta.key],
"5.5.4")
self.assertEqual(len(plugins_in_page0), 3)
self.assertIn(cyclone_slider_meta.key, plugins_in_page1)
self.assertIn(sitepress_meta.key, plugins_in_page1)
self.assertIn(lightbox_meta.key, plugins_in_page1)
self.assertIn(panopress_meta.key, plugins_in_page1)
self.assertIn(posts_plugin_meta.key, plugins_in_page1)
self.assertIn(self.yoast_seo_meta.key, plugins_in_page1)
self.assertEqual(plugins_in_page1[self.yoast_seo_meta.key], "3.4.1")
self.assertIn(self.total_cache_meta.key, plugins_in_page1)
self.assertEqual(len(plugins_in_page1), 7)
self.assertIn(wp_polls_meta.key, plugins_in_page2)
self.assertIn(self.postratings_meta.key, plugins_in_page2)
self.assertIn(lift_search_meta.key, plugins_in_page2)
self.assertIn(jetpack_meta.key, plugins_in_page2)
self.assertIn(audio_player_meta.key, plugins_in_page2)
self.assertIn(self.google_analytics_meta.key, plugins_in_page2)
self.assertEqual(plugins_in_page2[self.google_analytics_meta.key],
"5.5.2")
self.assertEqual(len(plugins_in_page2), 6)
def setUp(self):
meta_list = MetaList(
key="themes",
metas=[Meta(key="themes/twenty11"),
Meta(key="themes/kratos")])
self.themes_finder = PassiveThemesFinder(meta_list)
def setUp(self):
self.output_manager = OutputManager()
self.fake_meta = Meta(key="meta", name="Name", url="example.com")