Javier,
On Mon, Nov 21, 2011 at 11:48 AM, Javier Andalia
<javier_andalia@...> wrote:
>
> On 11/19/2011 02:11 PM, Andres Riancho wrote:
>>
>> Javier,
>>
>> Some comments on your code:
>>
>> * trunk/core/controllers/basePlugin/baseAttackPlugin.py:115 , should
>> that be getURI() instead of getURL() ?
>
> Hmmm... that wasn't changed at all in the new version. Think it has more
> sense the way it is right now (and before). The DataContainer is actually
> the QueryString. What's your opinion?
I think we might be missing the parameters by using getURL() but it
has been working like that from the beginning anyways so we should let
it as it is now.
>> * trunk/core/data/exchangableMethods.py:57 ,
>> qsr.setDc(fuzzableRequest.getDc()) why don't you use the __init__
>> parameter of qsr to pass this value?
>
> HTTPQSRequest class doesn't include 'dc' (DataContainer param) in its
> '__init__' parameters. By default, when the object is instantiated it infers
> it from the passed URI. However, if the idea is to overwrite the object's
> inferred dc it may be used 'setDc' method.
Understood
>> * I like this name change:
>> 42 from core.data.request.httpQsRequest import
>> httpQsRequest
>> 42 from core.data.request.httpQsRequest import
>> HTTPQSRequest
>
> Yes, it is PEP08 compatible. We really need to make more progress in that
> direction.
>
>> * trunk/core/data/request/frFactory.py:135 and 141, what are those XXX?
>> * Grep for all the places where you have those XXX and replace with
>> something more meaningful
>
> They shouldn't be there. Forgot to add the right methods' doc
> strings/comments.
>
>> * For things like this:
>> 451 def copy( self ):
>> 428 def copy(self):
>> Should we have a code style checker in eclipse+pydev?
>
> Yes, totally.
I've searched for a bit and it seems that pydev supports pylint for
checking code style, but pylint doesn't "cover all of the pep-8", so
it sounds like we've hit a dead-end.
>> All in all, the change looks good! Let's focus now on finishing
>> multiprocessing!
>>
>> Regards,
>>
>> On Fri, Nov 18, 2011 at 10:08 PM,<javierandalia@...>
>> wrote:
>>>
>>> Revision: 4490
>>> http://w3af.svn.sourceforge.net/w3af/?rev=4490&view=rev
>>> Author: javierandalia
>>> Date: 2011-11-19 01:08:26 +0000 (Sat, 19 Nov 2011)
>>> Log Message:
>>> -----------
>>> Some code refactoring in "FuzzableRequest" Area - reason: readability
>>> counts - tests were updated, all of them pass.
>>>
>>> Modified Paths:
>>> --------------
>>> trunk/core/controllers/basePlugin/baseAttackPlugin.py
>>> trunk/core/controllers/daemons/proxy.py
>>> trunk/core/data/exchangableMethods.py
>>> trunk/core/data/fuzzer/fuzzer.py
>>> trunk/core/data/fuzzer/mutant.py
>>> trunk/core/data/fuzzer/mutantCookie.py
>>> trunk/core/data/fuzzer/mutantFileName.py
>>> trunk/core/data/fuzzer/mutantQs.py
>>> trunk/core/data/parsers/httpRequestParser.py
>>> trunk/core/data/parsers/urlParser.py
>>> trunk/core/data/request/frFactory.py
>>> trunk/core/data/request/fuzzableRequest.py
>>> trunk/core/data/request/httpPostDataRequest.py
>>> trunk/core/data/request/httpQsRequest.py
>>> trunk/core/data/request/jsonPostDataRequest.py
>>> trunk/core/data/request/variant_identification.py
>>> trunk/core/data/request/wsPostDataRequest.py
>>> trunk/core/data/request/xmlrpcRequest.py
>>> trunk/core/data/url/handlers/localCache.py
>>> trunk/core/data/url/handlers/logHandler.py
>>> trunk/core/data/url/handlers/mangleHandler.py
>>> trunk/core/data/url/httpResponse.py
>>> trunk/core/data/url/xUrllib.py
>>> trunk/plugins/attack/sql_webshell.py
>>> trunk/plugins/attack/sqlmap.py
>>> trunk/plugins/discovery/archiveDotOrg.py
>>> trunk/plugins/discovery/importResults.py
>>> trunk/plugins/grep/ajax.py
>>> trunk/plugins/grep/blankBody.py
>>> trunk/plugins/grep/codeDisclosure.py
>>> trunk/plugins/grep/collectCookies.py
>>> trunk/plugins/grep/httpAuthDetect.py
>>> trunk/plugins/grep/oracle.py
>>> trunk/plugins/grep/pathDisclosure.py
>>> trunk/plugins/grep/ssn.py
>>> trunk/plugins/grep/strangeHTTPCode.py
>>> trunk/plugins/grep/symfony.py
>>> trunk/plugins/grep/tests/test_all.py
>>> trunk/plugins/grep/tests/test_codeDisclosure.py
>>> trunk/plugins/grep/user_defined_regex.py
>>> trunk/plugins/grep/wsdlGreper.py
>>> trunk/plugins/mangle/sed.py
>>>
>>> This was sent by the SourceForge.net collaborative development platform,
>>> the world's largest Open Source development site.
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> All the data continuously generated in your IT infrastructure
>>> contains a definitive record of customers, application performance,
>>> security threats, fraudulent activity, and more. Splunk takes this
>>> data and makes sense of it. IT sense. And common sense.
>>> http://p.sf.net/sfu/splunk-novd2d
>>> _______________________________________________
>>> W3af-svn-notify mailing list
>>> W3af-svn-notify@...
>>> https://lists.sourceforge.net/lists/listinfo/w3af-svn-notify
>>>
>>
>>
>
>
--
Andrés Riancho
Director of Web Security at Rapid7 LLC
Founder at Bonsai Information Security
Project Leader at w3af
|