Added --scope-dom-event-inheritance-limit

[Issue #862]
Arachni · May 3, 2017 · 77611a4 · 77611a4
1 parent 16924de
commit 77611a4
Show file tree

Hide file tree

Showing 5 changed files with 54 additions and 13 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 ## Under development
 
+- Options
+    - New
+        - `--scope-dom-event-inheritance-limit` -- Limits the amount of inherited events.
+- `Browser`
+    - `Javascript`
+        - `DOMMonitor`
+            - `#elements_with_events` -- Optionally limits event inheritance.
 - `Rest::Server`
     - Added `/scans/:id/report.afr`.
 - `Support`

diff --git a/lib/arachni/browser/javascript.rb b/lib/arachni/browser/javascript.rb
@@ -382,6 +382,7 @@ def inject( response )
 <script src="#{script_url_for( :taint_tracer )}"></script> #{html_comment}
 <script src="#{script_url_for( :dom_monitor )}"></script> #{html_comment}
 <script>
+#{wrapped_dom_monitor_initializer}
 #{wrapped_taint_tracer_initializer( response )}
 #{js_initialization_signal};
 
@@ -489,6 +490,12 @@ def update_custom_code( body )
         )
     end
 
+    def wrapped_dom_monitor_initializer
+        "/* #{token}_tokenDOMMonitor_initialize_start */ " <<
+            "#{@dom_monitor.stub.function( :initialize, Options.scope.dom_event_inheritance_limit )} " <<
+            "/* #{token}_tokenDOMMonitor_initialize_stop */"
+    end
+
     def wrapped_taint_tracer_initializer( response )
         "/* #{token}_initialize_start */ " <<
             "#{@taint_tracer.stub.function( :initialize, taints( response ) )} " <<

diff --git a/lib/arachni/browser/javascript/scripts/dom_monitor.js b/lib/arachni/browser/javascript/scripts/dom_monitor.js
@@ -23,6 +23,8 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
     // for this document.
     initialized:         false,
 
+    event_inheritance_limit: null,
+
     // Keeps track of setTimeout() calls.
     timeouts:            [],
 
@@ -149,9 +151,11 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         "input" : true
     },
 
-    initialize: function () {
+    initialize: function ( event_inheritance_limit ) {
         if( _tokenDOMMonitor.initialized ) return;
 
+        _tokenDOMMonitor.event_inheritance_limit = event_inheritance_limit;
+
         _tokenDOMMonitor.track_setTimeout();
         _tokenDOMMonitor.track_addEventListener();
 
@@ -191,6 +195,8 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         // `offset` and `batch_size`.
         var relevant_element_index = 0;
 
+        var event_inheritance_limit   = 0;
+
         for( var i = 0; i < length; i++ ) {
             var element = elements[i];
 
@@ -213,11 +219,19 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
                 attributes: {}
             };
 
-            // If the current element is allowed to have inherited events
-            // merge them with its own.
-            if( _tokenDOMMonitor.is_allowed_element_with_inherited_events( e.tag_name ) ) {
+            // If we haven't reached the event bubbling depth limit and the
+            // current element is allowed to have inherited events, merge them
+            // with its own.
+            if(
+                (
+                    !_tokenDOMMonitor.event_inheritance_limit ||
+                    event_inheritance_limit < _tokenDOMMonitor.event_inheritance_limit
+                ) && _tokenDOMMonitor.is_allowed_element_with_inherited_events( e.tag_name )
+            ) {
                 e.events = e.events.concat( element._arachni_inherited_events || [] );
                 e.events = _tokenDOMMonitor.arrayUnique( e.events.concat( global_events ) );
+
+                event_inheritance_limit++;
             }
 
             var attributes  = element.attributes;
@@ -561,5 +575,3 @@ var _tokenDOMMonitor = _tokenDOMMonitor || {
         return hash;
     }
 };
-
-_tokenDOMMonitor.initialize();
diff --git a/lib/arachni/option_groups/scope.rb b/lib/arachni/option_groups/scope.rb
@@ -38,6 +38,14 @@ class Scope < Arachni::OptionGroup
     # @see Browser#trigger_events
     attr_accessor :dom_event_limit
 
+    # @note `nil` is infinite -- default is `nil`.
+    #
+    # @return    [Integer]
+    #   How many elements should inherit the DOM events of their parents.
+    #
+    # @see Browser#trigger_events
+    attr_accessor :dom_event_inheritance_limit
+
     # @note `nil` is infinite -- default is `nil`.
     #
     # @return    [Integer]

diff --git a/ui/cli/framework/option_parser.rb b/ui/cli/framework/option_parser.rb
@@ -164,10 +164,16 @@ def scope
                 substitution
         end
 
+        on( '--scope-https-only', 'Forces the system to only follow HTTPS URLs.',
+            "(Default: #{!!options.scope.https_only})"
+        ) do
+            options.scope.https_only = true
+        end
+
         on( '--scope-dom-depth-limit LIMIT', Integer,
-               'How deep to go into the DOM tree of each page, for pages with JavaScript code.',
-               "(Default: #{options.scope.dom_depth_limit})",
-               "(Setting it to '0' will disable browser analysis.)"
+            'How deep to go into the DOM tree of each page, for pages with JavaScript code.',
+            "(Default: #{options.scope.dom_depth_limit})",
+            "(Setting it to '0' will disable browser analysis.)"
         ) do |limit|
             options.scope.dom_depth_limit = limit
         end
@@ -179,10 +185,11 @@ def scope
             options.scope.dom_event_limit = limit
         end
 
-        on( '--scope-https-only', 'Forces the system to only follow HTTPS URLs.',
-            "(Default: #{!!options.scope.https_only})"
-        ) do
-            options.scope.https_only = true
+        on( '--scope-dom-event-inheritance-limit LIMIT', Integer,
+            'How many elements should inherit the DOM events of their parents.',
+            "(Default: #{options.scope.dom_event_inheritance_limit.nil? ? 'inf' : options.scope.dom_event_inheritance_limit })",
+        ) do |limit|
+            options.scope.dom_event_inheritance_limit = limit
         end
     end