wpscanteam / wpscan / 25933768495 / 1

95%

master: 95%

push

github

Add SAML authentication support via --expect-saml flag (#2035)

* Add SAML authentication support via --expect-saml flag

* Check redirect chain for SAML detection instead of only final URL

* Add original_argv storage to preserve user-provided CLI arguments

* Fix SAML rescan to preserve user arguments and accept VULNERABLE exit code

* Fix RuboCop line length violation in core_spec

* Fix shell injection in SAML cookie handling

* Improve option filtering logic with index-based iteration

* Moved some things around so we don't need to run another wpscan-subcommand anymore but just handle everything internally. Removed things that became obsolete due to this change.

* Moved --expect-saml to a more appropriate option place and extended the description a bit.

* Some smaller refactorings, most importantly: Check that cookies only have safe characters, and make sure we're failing SAML on a non-tty because we need an actual browser for the user to do the authentication.

* Added tests for BrowserAuthenticator and removed coverage exclusions for code that is actually reachable in tests.

* Improved error handling when Ferrum cannot launch a browser for --expect-saml.

* Made Location header parsing a bit simpler and fixed one potential warning.

---------

Co-authored-by: Kolja Zuelsdorf <kolja.zuelsdorf@automattic.com>

2165 of 2834 branches covered (76.39%)

8888 of 9734 relevant lines covered (91.31%)

2902.89 hits per line