class Arachni::Rest::Server

Constants

VALID_REPORT_FORMATS

Public Class Methods

run!( options ) click to toggle source
# File lib/arachni/rest/server.rb, line 198
def run!( options )
    set :username, options[:username]
    set :password, options[:password]

    server = Puma::Server.new( self )
    server.min_threads = 0
    server.max_threads = 16

    ssl = false
    if options[:ssl_key] && options[:ssl_certificate]
        ctx = Puma::MiniSSL::Context.new

        ctx.key  = options[:ssl_key]
        ctx.cert = options[:ssl_certificate]

        if options[:ssl_ca]
            print_info 'CA provided, peer verification has been enabled.'

            ctx.ca          = options[:ssl_ca]
            ctx.verify_mode = Puma::MiniSSL::VERIFY_PEER |
                Puma::MiniSSL::VERIFY_FAIL_IF_NO_PEER_CERT
        else
            print_info 'CA missing, peer verification has been disabled.'
        end

        ssl = true
        server.binder.add_ssl_listener( options[:bind], options[:port], ctx )
    else
        ssl = false
        server.add_tcp_listener( options[:bind], options[:port] )
    end

    print_status "Listening on http#{'s' if ssl}://#{options[:bind]}:#{options[:port]}"

    begin
        server.run.join
    rescue Interrupt
        server.stop( true )
    end
end

Public Instance Methods

authorized?() click to toggle source
# File lib/arachni/rest/server.rb, line 55
def authorized?
    @auth ||= Rack::Auth::Basic::Request.new( request.env )
    @auth.provided? && @auth.basic? && @auth.credentials == [
        settings.username.to_s, settings.password.to_s
    ]
end
fail_if_not_exists() click to toggle source
# File lib/arachni/rest/server.rb, line 62
def fail_if_not_exists
    token = params[:id]

    return if exists? token

    halt 404, "Scan not found for token: #{h token}."
end
h( text ) click to toggle source
# File lib/arachni/rest/server.rb, line 70
def h( text )
    Rack::Utils.escape_html( text )
end
protected!() click to toggle source
# File lib/arachni/rest/server.rb, line 39
def protected!
    if !settings.respond_to?( :username )
        settings.set :username, nil
    end

    if !settings.respond_to?( :password )
        settings.set :password, nil
    end

    return if !settings.username && !settings.password
    return if authorized?

    headers['WWW-Authenticate'] = 'Basic realm="Restricted Area"'
    halt 401, "Not authorized\n"
end