headissue / sahi Goto Github PK

When the Proxy has fully started log the port number to stdout

http://sahi.co.in/forums/discussion/3969/get-your-sahi-html-log-minimap

https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_%28XSS%29
http://sourceforge.net/p/sahi/code/HEAD/tree/trunk/sahi/src/net/sf/sahi/command/Log.java#l80

Unescaped parameters: http://localhost:9999/s/dyn/Log_highlight?href=http://ha.ckers.org/xss.js?%3C/h4%3E%3Cimg%20src=http://placekitten.com/200/300%3E

Everyone knowing a running and accessible Sahi Proxy can read and write files, the Sahi Proxy's user has access to.

https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure
https://www.owasp.org/index.php/Path_traversal

E.g. could someone get my public key by requesting http://myIp:9999/s/dyn/ConfigureUI_readFile?fileName=../../../../.ssh/id_rsa

Related files from Sahis orignal repository:
http://sourceforge.net/p/sahi/code/HEAD/tree/trunk/sahi/src/net/sf/sahi/command/Debug.java#l38
http://sourceforge.net/p/sahi/code/HEAD/tree/trunk/sahi/src/net/sf/sahi/command/ConfigureUI.java#l17
http://sourceforge.net/p/sahi/code/HEAD/tree/trunk/sahi/src/net/sf/sahi/command/ConfigureUI.java#l23

Playback tab should show the total number of steps. Going back a few steps should be possible.

_setValue on a textinput does nothing, while other APIs (like click, highlight) work as expected. _setValue does not throw an error when nothing was set.

when using sahi on google maps pages, this appears on the console:

may be a bug in the RemoteRequestProcessor.isDownloadURL method.

29 Apr 2015 07:14:43,021 INFO  pool-1-thread-34 [net.sf.sahi.RemoteRequestProcessor] - 
-- Calling downloadFile --
https://mt0.google.com/vt/pb=!1m4!1m3!1i4!2i8!3i5!2m3!1e0!2sm!3i298103718!3m4!2sen!5e1105!12m1!1e47!4e1!5m4!1e4!8m2!1e0!1e1!6m15!1e12!16e1!19m4!1e1!2e0!4m1!1e0!20m4!1e1!2e3!3m1!1e0!28e5!44e1!1001b1
downloadURL = false
response.isAttachment() = false
fileName = pb=!1m4!1m3!1i4!2i8!3i5!2m3!1e0!2sm!3i298103718!3m4!2sen!5e1105!12m1!1e47!4e1!5m4!1e4!8m2!1e0!1e1!6m15!1e12!16e1!19m4!1e1!2e0!4m1!1e0!20m4!1e1!2e3!3m1!1e0!28e5!44e1!1001b1
contentTypeHeader = application/vnd.google.octet-stream-compressible; charset=x-user-defined
downloadContentType = true
Content-Disposition=null
contentDispositionForcesDownload = false
--
29 Apr 2015 07:14:43,021 INFO  pool-1-thread-34 [net.sf.sahi.RemoteRequestProcessor] - Downloading sahi_5494e64c0cfbb04362097620ed93ca67bb4d__pb=!1m4!1m3!1i4!2i8!3i5!2m3!1e0!2sm!3i298103718!3m4!2sen!5e1105!12m1!1e47!4e1!5m4!1e4!8m2!1e0!1e1!6m15!1e12!16e1!19m4!1e1!2e0!4m1!1e0!20m4!1e1!2e3!3m1!1e0!28e5!44e1!1001b1 to temp directory:
/home/wormi/workspace/Sahi/sahi-core/userdata/temp/download
29 Apr 2015 07:14:43,021 WARN  pool-1-thread-34 [net.sf.sahi.RemoteRequestProcessor] - Could not write to file
29 Apr 2015 07:14:43,022 WARN  pool-1-thread-34 [net.sf.sahi.RemoteRequestProcessor] - java.io.IOException: File name too long
        at java.io.UnixFileSystem.createFileExclusively(Native Method)
        at java.io.File.createNewFile(File.java:1012)
        at net.sf.sahi.RemoteRequestProcessor.save(RemoteRequestProcessor.java:297)
        at net.sf.sahi.RemoteRequestProcessor.downloadFile(RemoteRequestProcessor.java:285)
        at net.sf.sahi.RemoteRequestProcessor.processHttp(RemoteRequestProcessor.java:182)
        at net.sf.sahi.ProxyProcessor.processAsProxy(ProxyProcessor.java:148)
        at net.sf.sahi.ProxyProcessor.run(ProxyProcessor.java:98)
        at net.sf.sahi.ProxyProcessor.processConnect(ProxyProcessor.java:209)
        at net.sf.sahi.ProxyProcessor.processAsProxy(ProxyProcessor.java:141)
        at net.sf.sahi.ProxyProcessor.run(ProxyProcessor.java:98)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)

The SahiController should support HTML5 or at least a meaningful subset of the added elements and attributes.
http://www.w3.org/TR/html5-diff/#new-elements

This may be pretty easy, there are cases where people could add additional selectors e.g. http://stackoverflow.com/questions/12267130/how-to-select-font-node-in-sahi/12285063#12285063

Maintaining certificates on different browsers on multiple machines for a variety of websites is pretty time-consuming.

The browser displays an error page "Request timd out" when e.g Sahi attempts to _click(_submit("button")). The click action is executed, the browsers network log shows a POST has been send but in Sahis traffic logs, there is no POST showing up.

There are encoding issues with umlauts in script names on the s/dyn/Log_viewLogs page.

Hi,

There is a bug in the test runner, when launching it, the proxy.properties (tools directory) gets reverted to the default and overwrites settings you have saved.

This does not happen when using the latest regular sahi pro

Getting environment variables through the initJS parameter is clunky,
there should be a better way through the Sahi API

Maintaining certificates on different browsers on multiple machines for a variety of websites is pretty time-consuming.
Currently you have to add certificate exceptions manually through the Sahi SSLManager.
We currently have a solution working for Linux only. For OS independency, we need OS specific ssl scripts (see http://github.com/headissue/Sahi/blob/master/sahi-core/config/ssl.txt) or some Java Library doing the job (maybe have a look at https://www.bouncycastle.org/java.html)

dragDrop.sah on phantomjs 1.9 and firefox 32

see positionals.sah, there are two asserts commented out. Uncomment then, run it with firefox through the Sahi Controller and with pantomjs through the unittest. On phantomjs these asserts fail

I would like to have support for taking full web page screenshots in sahi through api where I can pass the name of image and location where I would like to save it. This will enable me to compare webpages from one version to another. I can do the same through casperjs (http://casperjs.org/) and phantomjs(http://phantomjs.org/). Casperjs provides navigation api for phantomjs. It also provides access to other api like (capture,captureSelector) to capture high quality images of the web page. Currently, I can use phantomjs as headless browser in sahi but there is no API exposed in sahi yet. I would love to have phantomjs api exposed in sahi.

Rebase to sahi v5.0

http://localhost:9999/ currently redirects to http://localhost:9999/_s_/spr/launch.htm - That Site doesn't work in my Chrome (37.0.2031.2 dev, Ubuntu 14.04) and doesn't hint the user what to do next.

A possible solution: Redirect to http://localhost:9999/_s_/dyn/Driver_initialized, that page has a little bit more information.

expected _setValue(_textarea("ta1"), "ab\ncd"); to result in

ab
cd

but is

abcd