class Acunetix::Vulnerability
Attributes
xml[RW]
Public Class Methods
new(xml_node)
click to toggle source
Accepts an XML node from Nokogiri::XML.
# File lib/acunetix/vulnerability.rb, line 8 def initialize(xml_node) @xml = xml_node end
Public Instance Methods
method_missing(method, *args)
click to toggle source
This method is invoked by Ruby when a method that is not defined in this instance is called.
In our case we inspect the @method@ parameter and try to find the attribute, simple descendent or collection that it maps to in the XML tree.
Calls superclass method
# File lib/acunetix/vulnerability.rb, line 41 def method_missing(method, *args) # We could remove this check and return nil for any non-recognized tag. # The problem would be that it would make tricky to debug problems with # typos. For instance: <>.potr would return nil instead of raising an # exception unless supported_tags.include?(method) super return end translations_table = vulnerability_table.merge(evidence_table) method_name = translations_table.fetch(method, method.to_s.dasherize) # then we try the children tags tag = xml.at_xpath("./#{method_name}") if tag && !tag.text.blank? if tags_with_html_content.include?(method) return cleanup_html(tag.text) else return tag.text end else 'n/a' end # nothing found return nil end
respond_to?(method, include_private=false)
click to toggle source
This allows external callers (and specs) to check for implemented properties
Calls superclass method
# File lib/acunetix/vulnerability.rb, line 30 def respond_to?(method, include_private=false) return true if supported_tags.include?(method.to_sym) super end
Private Instance Methods
evidence_table()
click to toggle source
# File lib/acunetix/vulnerability.rb, line 100 def evidence_table { http_request: 'http-request/content', http_request_method: 'http-request/method', http_response: 'http-response/content', http_response_status_code: 'http-response/status-code', http_response_duration: 'http-response/duration' } end
vulnerability_table()
click to toggle source
Define a hash to get the actual XPATH operator we will use to find the field value, given a field name.
# File lib/acunetix/vulnerability.rb, line 75 def vulnerability_table owasp_fields = [ :owasp, :wasc, :cwe, :capec, :pci32, :hipaa, :owasppc, :iso27001 ] vulnerability_table = { cvss_vector: 'cvss/vector', cvss_base: 'cvss/score/type[. = "Base"]/following::value', cvss_temporal: 'cvss/score/type[. = "Temporal"]/following::value', cvss_environmental: 'cvss/score/type[. = "Environmental"]/following::value', cvss31_vector: 'cvss31/vector', cvss31_base: 'cvss31/score/type[. = "Base"]/following::value', cvss31_temporal: 'cvss31/score/type[. = "Temporal"]/following::value', cvss31_environmental: 'cvss31/score/type[. = "Environmental"]/following::value', } vulnerability_table.merge! Hash[owasp_fields.map { |field| [field, field.to_s] }] # Append the 'classifications' parent to each translated field name vulnerability_table.each do |_, value| value.replace("classification/#{value}") end vulnerability_table end