wpscanteam / wpscan / 25933768495

95%

push

github

Add SAML authentication support via --expect-saml flag (#2035)

* Add SAML authentication support via --expect-saml flag

* Check redirect chain for SAML detection instead of only final URL

* Add original_argv storage to preserve user-provided CLI arguments

* Fix SAML rescan to preserve user arguments and accept VULNERABLE exit code

* Fix RuboCop line length violation in core_spec

* Fix shell injection in SAML cookie handling

* Improve option filtering logic with index-based iteration

* Moved some things around so we don't need to run another wpscan-subcommand anymore but just handle everything internally. Removed things that became obsolete due to this change.

* Moved --expect-saml to a more appropriate option place and extended the description a bit.

* Some smaller refactorings, most importantly: Check that cookies only have safe characters, and make sure we're failing SAML on a non-tty because we need an actual browser for the user to do the authentication.

* Added tests for BrowserAuthenticator and removed coverage exclusions for code that is actually reachable in tests.

* Improved error handling when Ferrum cannot launch a browser for --expect-saml.

* Made Location header parsing a bit simpler and fixed one potential warning.

---------

Co-authored-by: Kolja Zuelsdorf <kolja.zuelsdorf@automattic.com>

1945 of 2543 branches covered (76.48%)

61 of 66 new or added lines in 7 files covered. (92.42%)

4471 of 4865 relevant lines covered (91.9%)

17432.23 hits per line