Considers valid status when checking full response in enumeration

wpscanteam · Mar 22, 2021 · db0bf96 · db0bf96
1 parent 439d2ef
commit db0bf96
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 3 deletions.
diff --git a/lib/cms_scanner/finders/finder/enumerator.rb b/lib/cms_scanner/finders/finder/enumerator.rb
@@ -59,6 +59,8 @@ def maybe_get_full_response(head_res, opts)
 
           full_res = NS::Browser.get(head_res.effective_url, full_request_params)
 
+          return unless valid_response_codes.include?(full_res.code)
+
           return if target.homepage_or_404?(full_res) ||
                     opts[:exclude_content] && full_res.body&.match(opts[:exclude_content])
 

diff --git a/spec/lib/finders/finder/enumerator_spec.rb b/spec/lib/finders/finder/enumerator_spec.rb
@@ -28,10 +28,11 @@ class DummyEnumeratorFinder < CMSScanner::Finders::Finder
     end
 
     context 'when check_full_response is true' do
-      let(:opts) { super().merge(check_full_response: true) }
-      let(:body) { '' }
+      let(:opts)   { super().merge(check_full_response: true) }
+      let(:body)   { '' }
+      let(:status) { 200 }
 
-      before { stub_request(:get, effective_url).to_return(body: body) }
+      before { stub_request(:get, effective_url).to_return(body: body, status: status) }
 
       context 'when the body matches the 404 homepage' do
         it 'returns nil' do
@@ -41,6 +42,16 @@ class DummyEnumeratorFinder < CMSScanner::Finders::Finder
         end
       end
 
+      context 'when the status is not valid' do
+        let(:status) { 404 }
+
+        it 'returns nil' do
+          allow(target).to receive(:homepage_or_404?).and_return(false)
+
+          expect(finder.maybe_get_full_response(head_res, opts)).to eql nil
+        end
+      end
+
       context 'when the exclude_content is set' do
         before { expect(target).to receive(:homepage_or_404?).and_return(false) }