activeadmin 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 13d4e946e40362654bc8af6e1e905e8c7a3a679d
-  data.tar.gz: bd8a87269036be0171e9731f4239cea4dd3ca667
+  metadata.gz: 168e2543c7194997fc761400f0c846da32cf6efc
+  data.tar.gz: e329bd016b402f20b119611a16b7753417d28225
 SHA512:
-  metadata.gz: 6b0a1f546b0d811e928f3ca6e94972ea1742e8ec57e3e78b5cbc49535907be1097c27e1eb3ed779b8bacc5538a344c94b81aa368374edda389bf144ecffef995
-  data.tar.gz: 21e63c49e42e02777083b3a4ee1b7bb77ba63b11fefd894b25378f61ba2a3d51e66097e6cbc256d8877b61abf399c8f81a05c105bde672b7532c8ecbf09948a1
+  metadata.gz: 9001bf292733c65ea736a38e728c4fc4c9ccf0179fdd2dc99bb19f1e2c7007f40b5693c67fead61a55dd5187fa09979f31fe868ec79d6f060b881e6f9d46d636
+  data.tar.gz: a0251c53c84b1beea54c3a7f880a8c1349e9f7643f7d3b1cf4293e2800b76d6f6951b63fbe0b9f79eb66e18c1700390c92032c80523e22ccedf5288e306a3caa

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.2.1 [☰](https://github.com/activeadmin/activeadmin/compare/v1.2.0...v1.2.1)
+
+### Bug Fixes
+
+* Resolve issue with [#5275][] preventing XSS in filters sidebar [#5299][] by [@faucct][].
+
 ## 1.2.0 [☰](https://github.com/activeadmin/activeadmin/compare/v1.1.0...v1.2.0)
 
 ### Enhancements
@@ -25,7 +31,7 @@
 * Fix a couple of issues rendering filter labels [#5223][] by [@wspurgin][]
 * Prevent NameError when filtering on a namespaced association [#5240][] by [@DanielHeath][]
 * Fix undefined method error in Ransack when building filters [#5238][] by [@wspurgin][]
-* Fixed [#5198][] Prevent XSS on sidebar's current filter rendering [#5272][] by [@deivid-rodriguez][]
+* Fixed [#5198][] Prevent XSS on sidebar's current filter rendering [#5275][] by [@deivid-rodriguez][].
 * Sanitize display_name [#5284][] by [@markstory][].
 
 ## 1.1.0 [☰](https://github.com/activeadmin/activeadmin/compare/v1.0.0...v1.1.0)

data/features/index/filters.feature

@@ -32,7 +32,7 @@ Feature: Index Filtering
     """
     When I fill in "Title" with "<script>alert('hax')</script>"
     And I press "Filter"
-    Then I should see current filter "title_contains" equal to "alert('hax')" with label "Title contains"
+    Then I should see current filter "title_contains" equal to "<script>alert('hax')</script>" with label "Title contains"
 
   Scenario: Filtering posts with no results
     Given 3 posts exist

data/lib/active_admin/filters/active_sidebar.rb

@@ -28,7 +28,7 @@ module ActiveAdmin
                         text_node filter.label
                       end
                       b do
-                        text_node filter.values.map { |v| pretty_format(v) }.to_sentence.html_safe
+                        text_node to_sentence(filter.values.map { |v| pretty_format(v) })
                       end
                     end
                   end

data/lib/active_admin/helpers/output_safety_helper.rb

@@ -0,0 +1,35 @@
+module ActiveAdmin
+  module OutputSafetyHelper
+    # Converts the array to a comma-separated sentence where the last element is
+    # joined by the connector word. This is the html_safe-aware version of
+    # ActiveSupport's {Array#to_sentence}[http://api.rubyonrails.org/classes/Array.html#method-i-to_sentence].
+    #
+    # Copied from Rails 5 to support Rails 4.
+    # https://github.com/rails/rails/blob/9c35bf2a6a27431c6aa283db781c19f61c5155be/actionview/lib/action_view/helpers/output_safety_helper.rb#L43
+    def to_sentence(array, options = {})
+      options.assert_valid_keys(:words_connector, :two_words_connector, :last_word_connector, :locale)
+
+      default_connectors = {
+        words_connector: ", ",
+        two_words_connector: " and ",
+        last_word_connector: ", and "
+      }
+      if defined?(::I18n)
+        i18n_connectors = ::I18n.translate(:'support.array', locale: options[:locale], default: {})
+        default_connectors.merge!(i18n_connectors)
+      end
+      options = default_connectors.merge!(options)
+
+      case array.length
+      when 0
+        "".html_safe
+      when 1
+        ERB::Util.html_escape(array[0])
+      when 2
+        safe_join([array[0], array[1]], options[:two_words_connector])
+      else
+        safe_join([safe_join(array[0...-1], options[:words_connector]), options[:last_word_connector], array[-1]], nil)
+      end
+    end
+  end
+end

data/lib/active_admin/version.rb

@@ -1,3 +1,3 @@
 module ActiveAdmin
-  VERSION = '1.2.0'
+  VERSION = '1.2.1'
 end

data/lib/active_admin/view_helpers/display_helper.rb

@@ -66,7 +66,7 @@ module ActiveAdmin
       def pretty_format(object)
         case object
         when String, Numeric, Symbol, Arbre::Element
-          sanitize(object.to_s)
+          object.to_s
         when Date, Time
           I18n.localize object, format: active_admin_application.localize_format
         else

data/lib/active_admin/views/components/sidebar_section.rb

@@ -1,8 +1,11 @@
+require 'active_admin/helpers/output_safety_helper'
+
 module ActiveAdmin
   module Views
 
     class SidebarSection < Panel
       builder_method :sidebar_section
+      include OutputSafetyHelper
 
       # Takes a ActiveAdmin::SidebarSection instance
       def build(section)

data/spec/unit/helpers/output_safety_helper_spec.rb

@@ -0,0 +1,79 @@
+require 'rails_helper'
+
+# Adapted from Rails 5 to support Rails 4.
+# https://github.com/rails/rails/blob/9c35bf2a6a27431c6aa283db781c19f61c5155be/actionview/test/template/output_safety_helper_test.rb
+RSpec.describe ActiveAdmin::OutputSafetyHelper, type: :view do
+  include described_class
+
+  before do
+    @string = "hello"
+  end
+
+  describe "to_sentence" do
+    it "escapes non-html_safe values" do
+      actual = to_sentence(%w(< > & ' "))
+      assert actual.html_safe?
+      assert_equal("&lt;, &gt;, &amp;, &#39;, and &quot;", actual)
+
+      actual = to_sentence(%w(<script>))
+      assert actual.html_safe?
+      assert_equal("&lt;script&gt;", actual)
+    end
+
+    it "does not double escape if single value is html_safe" do
+      assert_equal("&lt;script&gt;", to_sentence([ERB::Util.html_escape("<script>")]))
+      assert_equal("&lt;script&gt;", to_sentence(["&lt;script&gt;".html_safe]))
+      assert_equal("&amp;lt;script&amp;gt;", to_sentence(["&lt;script&gt;"]))
+    end
+
+    it "checks connector words for html safety" do
+      assert_equal "one & two, and three", to_sentence(["one", "two", "three"], words_connector: " & ".html_safe)
+      assert_equal "one & two", to_sentence(["one", "two"], two_words_connector: " & ".html_safe)
+      assert_equal "one, two &lt;script&gt;alert(1)&lt;/script&gt; three", to_sentence(["one", "two", "three"], last_word_connector: " <script>alert(1)</script> ")
+    end
+
+    it "does not escape html_safe values" do
+      ptag = content_tag("p") do
+        safe_join(["<marquee>shady stuff</marquee>", tag("br")])
+      end
+      url = "https://example.com"
+      expected = %(<a href="#{url}">#{url}</a> and <p>&lt;marquee&gt;shady stuff&lt;/marquee&gt;<br /></p>)
+      actual = to_sentence([link_to(url, url), ptag])
+      assert actual.html_safe?
+      assert_equal(expected, actual)
+    end
+
+    it "handles blank strings" do
+      actual = to_sentence(["", "two", "three"])
+      assert actual.html_safe?
+      assert_equal ", two, and three", actual
+    end
+
+    it "handles nil values" do
+      actual = to_sentence([nil, "two", "three"])
+      assert actual.html_safe?
+      assert_equal ", two, and three", actual
+    end
+
+    it "still supports ActiveSupports Array#to_sentence arguments" do
+      assert_equal "one two, and three", to_sentence(["one", "two", "three"], words_connector: " ")
+      assert_equal "one & two, and three", to_sentence(["one", "two", "three"], words_connector: " & ".html_safe)
+      assert_equal "onetwo, and three", to_sentence(["one", "two", "three"], words_connector: nil)
+      assert_equal "one, two, and also three", to_sentence(["one", "two", "three"], last_word_connector: ", and also ")
+      assert_equal "one, twothree", to_sentence(["one", "two", "three"], last_word_connector: nil)
+      assert_equal "one, two three", to_sentence(["one", "two", "three"], last_word_connector: " ")
+      assert_equal "one, two and three", to_sentence(["one", "two", "three"], last_word_connector: " and ")
+    end
+
+    it "is not affected by $," do
+      separator_was = $,
+      $, = "|"
+      begin
+        assert_equal "one and two", to_sentence(["one", "two"])
+        assert_equal "one, two, and three", to_sentence(["one", "two", "three"])
+      ensure
+        $, = separator_was
+      end
+    end
+  end
+end

data/spec/unit/pretty_format_spec.rb

@@ -8,20 +8,12 @@ RSpec.describe "#pretty_format" do
     mock_action_view.send *args, &block
   end
 
-  ['hello', 23, 5.67, 10**30, :foo].each do |obj|
+  ['hello', 23, 5.67, 10**30, :foo, Arbre::Element.new.br].each do |obj|
     it "should call `to_s` on #{obj.class}s" do
       expect(pretty_format(obj)).to eq obj.to_s
     end
   end
 
-  it "normalizes Arbre elements" do
-    expect(pretty_format(Arbre::Element.new.br)).to eq("<br>\n")
-  end
-
-  it "sanitizes Arbre elements" do
-    expect(pretty_format(Arbre::Element.new.script('alert("foo");'))).to eq("alert(&amp;quot;foo&amp;quot;);\n")
-  end
-
   shared_examples_for 'a time-ish object' do |t|
     it "formats it with the default long format" do
       expect(pretty_format(t)).to eq "February 28, 1985 20:15"

data/spec/unit/view_helpers/display_helper_spec.rb

@@ -10,7 +10,6 @@ RSpec.describe ActiveAdmin::ViewHelpers::DisplayHelper do
   include ActiveAdmin::ViewHelpers::DisplayHelper
   include MethodOrProcHelper
   include ActionView::Helpers::UrlHelper
-  include ActionView::Helpers::SanitizeHelper
   include ActionView::Helpers::TranslationHelper
   include ActionView::Helpers::SanitizeHelper
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Greg Bell
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-12-19 00:00:00.000000000 Z
+date: 2018-01-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: arbre
@@ -494,6 +494,7 @@ files:
 - lib/active_admin/helpers/collection.rb
 - lib/active_admin/helpers/i18n.rb
 - lib/active_admin/helpers/optional_display.rb
+- lib/active_admin/helpers/output_safety_helper.rb
 - lib/active_admin/helpers/routes/url_helpers.rb
 - lib/active_admin/helpers/scope_chain.rb
 - lib/active_admin/helpers/settings.rb
@@ -683,6 +684,7 @@ files:
 - spec/unit/form_builder_spec.rb
 - spec/unit/generators/install_spec.rb
 - spec/unit/helpers/collection_spec.rb
+- spec/unit/helpers/output_safety_helper_spec.rb
 - spec/unit/helpers/scope_chain_spec.rb
 - spec/unit/helpers/settings_spec.rb
 - spec/unit/i18n_spec.rb
@@ -799,7 +801,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.1
+rubygems_version: 2.4.8
 signing_key: 
 specification_version: 4
 summary: The administration framework for Ruby on Rails.
@@ -954,6 +956,7 @@ test_files:
 - spec/unit/form_builder_spec.rb
 - spec/unit/generators/install_spec.rb
 - spec/unit/helpers/collection_spec.rb
+- spec/unit/helpers/output_safety_helper_spec.rb
 - spec/unit/helpers/scope_chain_spec.rb
 - spec/unit/helpers/settings_spec.rb
 - spec/unit/i18n_spec.rb