Picture of stu

Tarantula vs. your Rails app

  • Posted By Stuart Halloway on February 26, 2008

The Tarantula is a fuzzy spider. It crawls your rails app, fuzzing inputs and analyzing what comes back. We have pointed Tarantula at about 20 Rails applications, both commercial and open source, and have never failed to uncover flaws.

How does your Rails app stand up? It's easy to find out. Install the plugin, and create a Tarantula integration test: (Update: Note that Tarantula integration tests live in test/tarantula so that you can treat them separately in your cruise builds. For a substantial app or fixture set Tarantula can take a while to run!)

 
# somewhere in your test
require 'relevance/tarantula'            

# customize to match your security setup  
def test_with_login
  post '/sessions/create', :password => 'your-pass'
  assert_response :redirect
  assert_redirected_to '/'
  follow_redirect!
  t = tarantula_crawler(self)
  t.crawl '/'
end

Then rake tarantula:test, and then start looking through the Failures section of the HTML report.

Tarantula is just a baby now, but we plan to feed it until it is a lot bigger and meaner. Suggestions and contributions are welcome via the Relevance Open Source Trac.

Hat tip to Courtenay, whose SpiderTest plugin inspired me to go down this road. Also congrats to Mephisto, which is the best behaved app under Tarantula to date (only three problems, all minor broken windows).

Comments
  1. Dan Kubb — February 26, 2008 @ 09:03 PM

    Any plans to move Tarantula into a gem so plugins for other frameworks, like merb, could be made?

  2. simon — February 26, 2008 @ 09:52 PM

    And symfony :)

  3. Rob Sanheim — February 27, 2008 @ 12:12 AM

    Dan: Yes, we plan to gem it very soon. One or two weeks, tops.

    Simon: Eventually we hope it is framework/language independent, but right now its pretty closely tied to ruby/rails.

  4. Glenn Rempe — February 27, 2008 @ 02:18 AM

    FYI. This plugin has some gem dependencies that you will have to install first, which are not mentioned in the README (hint hint).

    I had to install:

    sudo gem install facets sudo gem install htmlentities

    Cheers.

  5. Stu — February 27, 2008 @ 02:39 AM

    Glenn: README updated. Thanks!

  6. courtenay — February 27, 2008 @ 09:28 PM

    Awesome! I love it when I can inspire people to rewrite my shoddy code as a nice, solid toolset. (See also: tinder).

  7. Tim Haines — February 29, 2008 @ 12:53 AM

    Hey Stu,

    Sounds like a good think. I’ve tried to install it (twice) and it seems all the files came down, but then it choked at the end.

    I’m on windows.. When I try and run it, I see two things spit out to the command line: rm -rf tmp/tarantula c:/program files/ruby/bin/ruby -Ilib;test “C:\Program Files\ruby\lib\ruby\gems\1.8\gems\rake-0.8.1\lib\rake\rake_test_loader.rb”

    and that’s it. No report is generated. Have I got something configured wrong here?

  8. Tim Haines — February 29, 2008 @ 01:03 AM

    Just ran the tests to make sure it was all working. 130 tests passed, 1 failure.

    This one fails on the should = 11 – it comes up with 12:

    it "can clear the log file" do
  File.open(log_file, "w") {|f| f.puts "sample log"}
  File.size(log_file).should  11  
  @grabber.clear!
  File.size(log_file).should  0  
end
  9. Stu — February 29, 2008 @ 06:45 PM

    Tim: The failing unit test is a cross-platform issue in the tests only, and shouldn’t cause you any trouble. It is fixed in R246. With regard to you test not running—is it in the test/tarantula directory? That’s where the rake task looks.

  10. Tim Haines — March 01, 2008 @ 12:49 AM

    Ahhh – the problem was that I was missing the _test from the filename..

  11. Jens-Christian Fischer — March 05, 2008 @ 09:34 PM

    When I try to install the plugin, the process dies with the following messages:

    + ./vendor/xss-shield/test/test_safe_string.rb svn: URL ‘svn://rubyforge.org/var/svn/laszlo-plugin/rails/plugins’ non-existent in that revision svn: No repository found in ‘svn://rubyforge.org/var/svn/actsaslocatable/plugins’ svn: Can’t connect to host ‘svn.nkryptic.com’: Operation timed out svn: Can’t connect to host ‘dvisionfactory.com’: Connection refused Plugin not found: [“http://opensource.thinkrelevance.com/svn/rubygems/tarantula/trunk”, “tarantula”]

    ideas?