Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/improve autocomplete js #18552

Open
wants to merge 14 commits into
base: develop
Choose a base branch
from
Open

Feature/improve autocomplete js #18552

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
50cb5a5
brought back FormInputSubmitStrategy, better alghoritm of discovering…
Q-back May 12, 2020
13a5d0d
fix _handle_authentication_success breaking parent's functionality in…
Q-back May 12, 2020
e04104f
revert enabling FormInputSubmitStrategy from pre-previous commit
Q-back May 12, 2020
389646d
new options in autocomplete_js to manually provide username/submit bu…
Q-back May 13, 2020
52b8f39
don't create new chrome instance when running autocomplete_js.has_act…
Q-back May 13, 2020
2192ca5
fix after rebase
Q-back May 13, 2020
1723b6b
reloading chrome when checking active session may break the session
Q-back May 21, 2020
b81b71d
implemented _login_using_existing_form
Q-back May 21, 2020
d4b6531
fix iterate error in frame manager, don't kill chrome in autocomplete…
Q-back Jun 1, 2020
25a1125
better description for new params in autocomplete_js
Q-back Jun 3, 2020
888eea6
sometimes login button doesn't contain 'log' characters in it's text,…
Q-back Jun 3, 2020
27ede04
add option to click on element before autocompleting form
Q-back Jun 4, 2020
5854763
fix error when user provides CSS selectors with quotes. Slightly bett…
Q-back Jun 9, 2020
8d520bc
fix error when empty list was returned by querySelectorAll to Instrum…
Q-back Jun 10, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Prev Previous commit
Next Next commit
fix error when user provides CSS selectors with quotes. Slightly bett… 
…er exception handling during js login process
  • Loading branch information
@Q-back
Q-back committed Jun 9, 2020
commit 5854763d7786802b7dceac8b686ff9d8dc25454a
8 changes: 8 additions & 0 deletions w3af/core/controllers/chrome/devtools/exceptions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,3 +27,11 @@ class ChromeInterfaceException(Exception):

class ChromeInterfaceTimeout(Exception):
pass


class ChromeScriptRuntimeException(Exception):
def __init__(self, message, function_called=None, *args):
if function_called:
message = "function: {}, exception: {}".format(function_called, message)
super(ChromeScriptRuntimeException, self).__init__(message, *args)
pass
29 changes: 12 additions & 17 deletions w3af/core/controllers/chrome/instrumented/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import json

import w3af.core.controllers.output_manager as om
from w3af.core.controllers.chrome.devtools.exceptions import ChromeScriptRuntimeException

from w3af.core.data.parsers.doc.url import URL
from w3af.core.controllers.chrome.instrumented.instrumented_base import InstrumentedChromeBase
Expand Down Expand Up @@ -307,8 +308,8 @@ def get_login_forms(self, exact_css_selectors):
'window._DOMAnalyzer.getLoginForms("{}", "{}")'
)
func = func.format(
exact_css_selectors.get('username_input', ''),
exact_css_selectors.get('login_button', ''),
exact_css_selectors.get('username_input', '').replace('"', '\\"'),
exact_css_selectors.get('login_button', '').replace('"', '\\"'),
)
result = self.js_runtime_evaluate(func)

Expand All @@ -335,8 +336,8 @@ def get_login_forms_without_form_tags(self, exact_css_selectors):
'window._DOMAnalyzer.getLoginFormsWithoutFormTags("{}", "{}")'
)
func = func.format(
exact_css_selectors.get('username_input', ''),
exact_css_selectors.get('login_button', ''),
exact_css_selectors.get('username_input', '').replace('"', '\\"'),
exact_css_selectors.get('login_button', '').replace('"', '\\"'),
)
result = self.js_runtime_evaluate(func)

Expand Down Expand Up @@ -607,19 +608,13 @@ def js_runtime_evaluate(self, expression, timeout=5):
timeout=timeout)

# This is a rare case where the DOM is not present
if result is None:
return None

if 'result' not in result:
return None

if 'result' not in result['result']:
return None

if 'value' not in result['result']['result']:
return None

return result['result']['result']['value']
runtime_exception = result.get('result', {}).get('exceptionDetails')
if runtime_exception:
raise ChromeScriptRuntimeException(
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is new! Are you sure it is handled in all calls to this method? In the past we were returning None and now we raise an exception. Make sure to search all calls for this method and modify error handling appropiately.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I have added few more fixes in this PR.
This works for sure. It's additional (new) exception which is raised when underlying script throws internal JS exception. We still return None in other cases here https://github.com/andresriancho/w3af/pull/18552/files/8d520bc067455089a9fccac9c395f9114f521e8a#diff-4a954d4e5c6123fad237c66f5399b9dfR617

runtime_exception,
function_called=expression
)
return result.get('result', {}).get('result', {}).get('value', None)

def get_js_variable_value(self, variable_name):
"""
Expand Down
1 change: 1 addition & 0 deletions w3af/core/controllers/chrome/js/dom_analyzer.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1052,6 +1052,7 @@ var _DOMAnalyzer = _DOMAnalyzer || {
clickOnSelector(exactSelector) {
let element = document.querySelector(exactSelector);
element.click();
return 'success'
},

sliceAndSerialize: function (filtered_event_listeners, start, count) {
Expand Down
2 changes: 1 addition & 1 deletion w3af/core/controllers/chrome/login/find_form/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,6 @@ def find_forms(self, css_selectors=None):
except Exception as e:
msg = 'Form finder strategy %s raised exception: "%s" (did: %s)'
args = (strategy.get_name(),
e,
repr(e),
self.debugging_id)
om.out.debug(msg % args)
4 changes: 2 additions & 2 deletions w3af/core/controllers/chrome/login/find_form/strategies/base_find_form_strategy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@ def prepare(self):
"""
form_activator_selector = self.exact_css_selectors.get('form_activator')
if form_activator_selector:
func = 'window._DOMAnalyzer.clickOnSelector({})'.format(
form_activator_selector
func = 'window._DOMAnalyzer.clickOnSelector("{}")'.format(
form_activator_selector.replace('"', '\\"')
)
result = self.chrome.js_runtime_evaluate(func)
if result is None:
Expand Down