Update workflow for PRs to require safe-to-test label to run BrowserStack tests

Bump lodash from 4.17.21 to 4.17.23

.github/workflows/github_actions.yml

@@ -2,18 +2,34 @@ name: 'BrowserStack Test'
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
     branches: [ master ]
-      
+
 jobs:    
   ubuntu-job:
     name: 'BrowserStack Test on Ubuntu'
+    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')
     runs-on: ubuntu-latest  # Can be self-hosted runner also
+    permissions:
+      contents: read
+      pull-requests: write
     environment:
       name: Integrate Pull Request
     env: 
       GITACTIONS: true
     steps:
 
+      - name: 'Remove safe-to-test label'
+        uses: actions/github-script@v6
+        with:
+          script: |
+            github.rest.issues.removeLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              name: 'safe-to-test'
+            })
+
       - name: 'BrowserStack Env Setup'  # Invokes the setup-env action
         uses: browserstack/github-actions/setup-env@master
         with:

Dockerfile

@@ -78,9 +78,20 @@ RUN adduser --home /beef --gecos beef --disabled-password beef \
     zlib1g \
     bison \
     nodejs \
+    firefox-esr \
  && apt-get -y clean \
  && rm -rf /var/lib/apt/lists/*
 
+# Install geckodriver for Selenium tests
+# Pin version and verify checksum to mitigate supply chain attacks
+ENV GECKODRIVER_VERSION=v0.36.0
+ENV GECKODRIVER_SHA256=0bde38707eb0a686a20c6bd50f4adcc7d60d4f73c60eb83ee9e0db8f65823e04
+RUN wget -q "https://github.com/mozilla/geckodriver/releases/download/${GECKODRIVER_VERSION}/geckodriver-${GECKODRIVER_VERSION}-linux64.tar.gz" \
+ && echo "${GECKODRIVER_SHA256}  geckodriver-${GECKODRIVER_VERSION}-linux64.tar.gz" | sha256sum -c - \
+ && tar -xzf "geckodriver-${GECKODRIVER_VERSION}-linux64.tar.gz" -C /usr/local/bin \
+ && chmod +x /usr/local/bin/geckodriver \
+ && rm "geckodriver-${GECKODRIVER_VERSION}-linux64.tar.gz"
+
 # Use gemset created by the builder above
 COPY --chown=beef:beef . /beef
 COPY --from=builder /usr/local/bundle /usr/local/bundle

Gemfile

@@ -63,11 +63,11 @@ end
 group :test do
   gem 'test-unit-full', '~> 0.0.5'
   gem 'rspec', '~> 3.13'
-  gem 'rdoc', '~> 7.0'
+  gem 'rdoc', '~> 7.1'
   gem 'browserstack-local', '~> 1.4'
 
   gem 'irb', '~> 1.16'
-  gem 'pry-byebug', '~> 3.11'
+  gem 'pry-byebug', '~> 3.12'
 
   gem 'rest-client', '~> 2.1.0'
   gem 'websocket-client-simple', '~> 0.6.1'
@@ -79,7 +79,7 @@ group :test do
   # Note: selenium-webdriver 3.x is incompatible with Firefox version 48 and prior
   # gem 'selenium' # Requires old version of selenium which is no longer available
   gem 'geckodriver-helper', '~> 0.24.0'
-  gem 'selenium-webdriver', '~> 4.39'
+  gem 'selenium-webdriver', '~> 4.40'
 
   # Note: nokogiri is needed by capybara which may require one of the below commands
   # sudo apt-get install libxslt-dev libxml2-dev

Gemfile.lock

@@ -1,13 +1,13 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activemodel (8.1.1)
+    activemodel (8.1.2)
-      activesupport (= 8.1.1)
+      activesupport (= 8.1.2)
-    activerecord (8.1.1)
+    activerecord (8.1.2)
-      activemodel (= 8.1.1)
+      activemodel (= 8.1.2)
-      activesupport (= 8.1.1)
+      activesupport (= 8.1.2)
       timeout (>= 0.4.0)
-    activesupport (8.1.1)
+    activesupport (8.1.2)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -34,9 +34,10 @@ GEM
       async
       io-endpoint
     base64 (0.3.0)
-    bigdecimal (3.3.1)
+    bigdecimal (4.0.1)
     browserstack-local (1.4.3)
-    byebug (12.0.0)
+    byebug (13.0.0)
+      reline (>= 0.6.0)
     capybara (3.40.0)
       addressable
       matrix
@@ -47,8 +48,8 @@ GEM
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
     coderay (1.1.3)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.6)
-    connection_pool (2.5.4)
+    connection_pool (3.0.2)
     console (1.34.0)
       fiber-annotation
       fiber-local (~> 1.1)
@@ -78,7 +79,7 @@ GEM
     http-cookie (1.0.8)
       domain_name (~> 0.5)
     http_parser.rb (0.8.0)
-    i18n (1.14.7)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
     io-console (0.8.2)
     io-endpoint (0.15.2)
@@ -99,7 +100,8 @@ GEM
       mime-types-data (~> 3.2025, >= 3.2025.0507)
     mime-types-data (3.2025.0902)
     mini_mime (1.1.5)
-    minitest (5.26.1)
+    minitest (6.0.1)
+      prism (~> 1.5)
     mojo_magick (0.6.8)
     msfrpc-client (1.1.2)
       msgpack (~> 1)
@@ -140,12 +142,13 @@ GEM
       prettyprint
     prettyprint (0.2.0)
     prism (1.7.0)
-    pry (0.15.2)
+    pry (0.16.0)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    pry-byebug (3.11.0)
+      reline (>= 0.6.0)
-      byebug (~> 12.0)
+    pry-byebug (3.12.0)
-      pry (>= 0.13, < 0.16)
+      byebug (~> 13.0)
+      pry (>= 0.13, < 0.17)
     psych (5.3.1)
       date
       stringio
@@ -166,7 +169,7 @@ GEM
       rack (>= 1.3)
     rainbow (3.1.1)
     rake (13.3.1)
-    rdoc (7.0.3)
+    rdoc (7.1.0)
       erb
       psych (>= 4.0.0)
       tsort
@@ -215,7 +218,7 @@ GEM
       json
       rest-client
     securerandom (0.4.1)
-    selenium-webdriver (4.39.0)
+    selenium-webdriver (4.40.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -264,7 +267,7 @@ GEM
       logger
       rack (>= 1, < 4)
     tilt (2.6.1)
-    timeout (0.4.4)
+    timeout (0.6.0)
     timers (4.4.0)
     tins (1.43.0)
       bigdecimal
@@ -320,18 +323,18 @@ DEPENDENCIES
   net-smtp
   otr-activerecord (~> 2.6.0)
   parseconfig (~> 1.1, >= 1.1.2)
-  pry-byebug (~> 3.11)
+  pry-byebug (~> 3.12)
   qr4r (~> 0.6.1)
   rack (~> 3.2)
   rack-protection (~> 4.2.1)
   rake (~> 13.3)
-  rdoc (~> 7.0)
+  rdoc (~> 7.1)
   rest-client (~> 2.1.0)
   rspec (~> 3.13)
   rubocop (~> 1.82.1)
   rubyzip (~> 3.2)
   rushover (~> 0.3.0)
-  selenium-webdriver (~> 4.39)
+  selenium-webdriver (~> 4.40)
   sinatra (~> 4.1)
   slack-notifier (~> 2.4)
   sqlite3 (~> 2.9)

beef

@@ -39,6 +39,10 @@ $root_dir = File.join(File.expand_path(File.dirname(File.realpath(__FILE__))), '
 $:.unshift($root_dir)
 $home_dir = File.expand_path("#{Dir.home}/.beef/", __FILE__).freeze
 
+# @note Parse BeEF CLI options early (prevents Rack help from taking over)
+require 'core/main/console/commandline'
+BeEF::Core::Console::CommandLine.parse
+
 #
 # @note Require core loader
 #

core/main/console/commandline.rb

@@ -3,6 +3,8 @@
 # Browser Exploitation Framework (BeEF) - https://beefproject.com
 # See the file 'doc/COPYING' for copying permission
 #
+require 'optparse'
+
 module BeEF
   module Core
     module Console
@@ -38,7 +40,7 @@ module BeEF
               @options[:verbose] = true
             end
 
-            opts.on('-a', '--ascii_art', 'Prints BeEF ascii art') do
+            opts.on('-a', '--ascii-art', 'Prints BeEF ascii art') do
               @options[:ascii_art] = true
             end
 
@@ -54,14 +56,19 @@ module BeEF
               @options[:ws_port] = ws_port
             end
 
-            opts.on('-ud', '--update_disabled', 'Skips update') do
+            opts.on('-d', '--update-disabled', 'Skips update') do
               @options[:update_disabled] = true
             end
 
-            opts.on('-ua', '--update_auto', 'Automatic update with no prompt') do
+            opts.on('-u', '--update-auto', 'Automatic update with no prompt') do
               @options[:update_auto] = true
             end
 
+            opts.on('-h', '--help', 'Show this help') do
+              puts opts
+              exit 0
+            end
+
           end
 
           optparse.parse!

core/main/router/router.rb

@@ -14,6 +14,19 @@ module BeEF
 
         configure do
           set :show_exceptions, false
+
+          # Configure Rack::Protection::HostAuthorization.
+          # Allow Rack development defaults and dynamically permit the public host
+          # defined by beef.http.public.host to prevent "Host not permitted" errors.
+          permitted = [
+            '.localhost',
+            '.test',
+            IPAddr.new('0.0.0.0/0'),
+            IPAddr.new('::/0')
+          ]
+          public_host = config.get('beef.http.public.host').to_s.strip
+          permitted << public_host unless public_host.empty?
+          set :host_authorization, { permitted_hosts: permitted }
         end
 
         # @note Override default 404 HTTP response

package-lock.json

@@ -666,10 +666,11 @@
             }
         },
         "node_modules/lodash": {
-            "version": "4.17.21",
+            "version": "4.17.23",
-            "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+            "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-            "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+            "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
-            "dev": true
+            "dev": true,
+            "license": "MIT"
         },
         "node_modules/lodash.camelcase": {
             "version": "4.3.0",

spec/spec_helper.rb

@@ -229,8 +229,7 @@ require 'socket'
     @host = '127.0.0.1'
 
     unless port_available?
-      print_error "Port #{@port} is already in use. Exiting."
+      raise "Port #{@port} is already in use. Cannot start BeEF server."
-      exit
     end
     load_beef_extensions_and_modules
     
@@ -317,11 +316,9 @@ require 'socket'
   end
 
   def stop_beef_server(pid)
-    exit if pid.nil?
+    return if pid.nil?
-    # Shutting down server
     Process.kill("KILL", pid) unless pid.nil?
     Process.wait(pid) unless pid.nil? # Ensure the process has exited and the port is released 
-    pid = nil       
   end
 
 end

spec/support/ui_support.rb

@@ -10,29 +10,36 @@ require 'spec/support/constants.rb'
 def start_beef_and_hook_browser()
     reset_beef_db
     pid = start_beef_server_and_wait
-    beef_session = BeefTest.login
-    hooked_browser = BeefTest.new_victim
 
-    expect(hooked_browser).not_to be_nil
+    begin
-    expect(hooked_browser).to be_a(Capybara::Session)
+        beef_session = BeefTest.login
-    expect(hooked_browser).to have_content('BeEF', wait: PAGE_LOAD_TIMEOUT)
+        hooked_browser = BeefTest.new_victim
 
-    expect(beef_session).not_to be_nil
+        expect(hooked_browser).not_to be_nil
-    expect(beef_session).to be_a(Capybara::Session)
+        expect(hooked_browser).to be_a(Capybara::Session)
-    expect(beef_session).to have_content('Hooked Browsers', wait: PAGE_LOAD_TIMEOUT)
+        expect(hooked_browser).to have_content('BeEF', wait: PAGE_LOAD_TIMEOUT)
 
-    navigate_to_hooked_browser(beef_session)
+        expect(beef_session).not_to be_nil
+        expect(beef_session).to be_a(Capybara::Session)
+        expect(beef_session).to have_content('Hooked Browsers', wait: PAGE_LOAD_TIMEOUT)
 
-    expect(beef_session).to have_content('Commands', wait: PAGE_LOAD_TIMEOUT)
+        navigate_to_hooked_browser(beef_session)
-    beef_session.click_on('Commands')
 
-    return pid, beef_session, hooked_browser
+        expect(beef_session).to have_content('Commands', wait: PAGE_LOAD_TIMEOUT)
+        beef_session.click_on('Commands')
+
+        return pid, beef_session, hooked_browser
+    rescue => e
+        # If setup fails, cleanup the server before re-raising
+        stop_beef_server(pid)
+        raise e
+    end
 end
 
 def stop_beef_and_unhook_browser(pid, beef_session, hooked_browser)
     stop_beef_server(pid)
-    beef_session.driver.browser.close
+    beef_session.driver.browser.close if beef_session
-    hooked_browser.driver.browser.close
+    hooked_browser.driver.browser.close if hooked_browser
 end
 
 def navigate_to_hooked_browser(session, hooked_browser_text = nil)