activevalidators 2.0.0 → 2.0.1

data/activevalidators.gemspec

@@ -1,7 +1,7 @@
 # -*- encoding: utf-8 -*-
 Gem::Specification.new do |s|
   s.name        = 'activevalidators'
-  s.version     = '2.0.0'
+  s.version     = '2.0.1'
   s.platform    = Gem::Platform::RUBY
   s.authors     = ['Franck Verrot', 'Paco Guzmán', 'Oriol Gual', 'Garrett Bjerkhoel', 'Renato Riccieri Santos Zannon', 'Brian Moseley']
   s.email       = ['franck@verrot.fr']

data/lib/active_model/validations/postal_code_validator.rb

@@ -84,7 +84,7 @@ module ActiveModel
       private
 
       def self.regexp_from(format)
-        Regexp.new "^"+(Regexp.escape format).gsub(/[@#]/, '@' => '[[:alpha:]]', '#' => 'd')+"$"
+        Regexp.new '\A' + (Regexp.escape format).gsub(/[@#]/, '@' => '[[:alpha:]]', '#' => 'd') + '\z'
       end
     end
   end

data/lib/active_model/validations/tracking_number_validator.rb

@@ -6,13 +6,13 @@ module ActiveModel
         raise "Carrier option required" unless carrier
         method = "valid_#{carrier.to_s}?"
         raise "Tracking number validation not supported for carrier #{carrier}" unless self.respond_to?(method)
-        record.errors.add(attribute) if value.blank? || !self.send(method, value) 
+        record.errors.add(attribute) if value.blank? || !self.send(method, value)
       end
 
       # UPS:
       # ups tracking codes are validated solely on their format
       # see https://www.ups.com/content/us/en/tracking/help/tracking/tnh.html
-      UPS_REGEXES = [ /^1Z[a-zA-Z0-9]{16}$/, /^[a-zA-Z0-9]{12}$/, /^[a-zA-Z0-9]{9}$/, /^T[a-zA-Z0-9]{10}$/ ]
+      UPS_REGEXES = [ /\A1Z[a-zA-Z0-9]{16}\z/, /\A[a-zA-Z0-9]{12}\z/, /\A[a-zA-Z0-9]{9}\z/, /\AT[a-zA-Z0-9]{10}\z/ ]
       def valid_ups?(value)
         !!UPS_REGEXES.detect { |fmt| value.match(fmt) }
       end
@@ -28,13 +28,13 @@ module ActiveModel
         uss228?(value) || uss39?(value)
       end
 
-      USS128_REGEX = /^(\d{19,21})(\d)$/
+      USS128_REGEX = /\A(\d{19,21})(\d)\z/
       def uss228?(value)
         m = value.match(USS128_REGEX)
         m.present? && (m[2].to_i == usps_mod10(m[1]))
       end
 
-      USS39_REGEX = /^[a-zA-Z0-9]{2}(\d{8})(\d)US$/
+      USS39_REGEX = /\A[a-zA-Z0-9]{2}(\d{8})(\d)US\z/
       def uss39?(value)
         m = value.match(USS39_REGEX)
         # it appears to be valid for a USS39 barcode's checkdigit to be calculated with either the usps mod 10

data/lib/active_model/validations/twitter_validator.rb

@@ -2,18 +2,31 @@ module ActiveModel
   module Validations
 
     class TwitterValidator < EachValidator
+
+      # Basic username regexp
+      TWITTER_USERNAME_REGEXP = /([A-Za-z0-9_]{1,15})/i
+
+      # Regexp used to detect twitter username within the URL.
+      TWITTER_URL_REGEXP = %r{\Ahttps?://(?:www\.)?twitter.com/#{TWITTER_USERNAME_REGEXP}\z}i
+
+      # Regexp to test using twitter username as @sign.
+      TWITTER_ATSIGN_REGEXP = /\A@#{TWITTER_USERNAME_REGEXP}\z/i
+
+      # Regexp to test against usernames without the @sign
+      TWITTER_NOATSIGN_REGEXP = /\A#{TWITTER_USERNAME_REGEXP}\z/i
+
       def validate_each(record, attribute, value)
         format = options[:format].to_sym if options[:format]
-        
+
         if value.nil?
           record.errors.add_on_blank(attribute)
         elsif format == :url
-          match = value.match(/^https?:\/\/(www\.)?twitter.com\/([A-Za-z0-9_]{1,15})$/i)
-          record.errors.add(attribute) unless match && !match[2].nil? # www. is first capture
+          match = value.match(TWITTER_URL_REGEXP)
+          record.errors.add(attribute) unless match && !match[1].nil?
         elsif format == :username_with_at
-          record.errors.add(attribute) unless value.match(/^@([A-Za-z0-9_]{1,15})$/i)
+          record.errors.add(attribute) unless value =~ TWITTER_ATSIGN_REGEXP
         else
-          record.errors.add(attribute) unless value.match(/^([A-Za-z0-9_]{1,15})$/i)
+          record.errors.add(attribute) unless value =~ TWITTER_NOATSIGN_REGEXP
         end
       end
     end

data/lib/active_model/validations/url_validator.rb

@@ -62,7 +62,7 @@ module ActiveModel
       #
       # Returns the Regexp.
       def uri_regexp
-        @uri_regexp ||= URI.regexp(protocols)
+        @uri_regexp ||= /\A#{URI.regexp(protocols)}\z/
       end
 
       # Internal: Tries to convert supplied string into URI,

data/test/validations/postal_code_test.rb

@@ -49,5 +49,11 @@ describe "Postal Code Validation" do
       subject.valid?.must_equal false
       subject.errors[:postal_code].include?(subject.errors.generate_message(:postal_code, :invalid)).must_equal true
     end
+
+    it "rejects injected content" do
+      subject = build_postal_code_record true, :postal_code => "injected\n11211"
+      subject.valid?.must_equal false
+      subject.errors.size.must_equal 1
+    end
   end
 end

data/test/validations/tracking_number_test.rb

@@ -51,6 +51,10 @@ describe "Tracking Number Validation" do
       it "rejects invalid formats and generates an error message of type invalid" do
         assert_invalid_tracking_number({:carrier => :ups}, '1Z12345E020_271688')
       end
+
+      it "rejects injected content" do
+        assert_invalid_tracking_number({:carrier => :ups}, "injected\n1Z12345E0205271688")
+      end
     end
   end
 
@@ -109,6 +113,10 @@ describe "Tracking Number Validation" do
       it 'USS128 tracking number with invalid chars' do
         assert_invalid_tracking_number({:carrier => :usps}, 'U11234567891234567879')
       end
+
+      it 'rejects injected chars in USS39 and others' do
+        assert_invalid_tracking_number({:carrier => :usps}, "injected\nEA123456784US")
+      end
     end
   end
 

data/test/validations/twitter_test.rb

@@ -80,6 +80,13 @@ describe "Twitter Validation" do
       subject.valid?.must_equal false
       subject.errors.size.must_equal 1
     end
+
+    it "generates error with injected content" do
+      subject = build_twitter_record :format => :url
+      subject.twitter_username = "javascript:alert('xss');\nhttp://twitter.com/garrettbjerkhoelwashere"
+      subject.valid?.must_equal false
+      subject.errors.size.must_equal 1
+    end
   end
 
   describe "for twitter at sign validator" do
@@ -115,6 +122,13 @@ describe "Twitter Validation" do
       subject.valid?.must_equal false
       subject.errors.size.must_equal 1
     end
+
+    it "generate error with injected content" do
+      subject = build_twitter_record :format => :username_with_at
+      subject.twitter_username = "injected\n@erik"
+      subject.valid?.must_equal false
+      subject.errors.size.must_equal 1
+    end
   end
 
   describe "for twitter without at sign validator" do
@@ -157,5 +171,12 @@ describe "Twitter Validation" do
       subject.valid?.must_equal false
       subject.errors.size.must_equal 1
     end
+
+    it "generate error with at injected data" do
+      subject = build_twitter_record true
+      subject.twitter_username = "something\ngarrettb\nelse"
+      subject.valid?.must_equal false
+      subject.errors.size.must_equal 1
+    end
   end
 end

data/test/validations/url_test.rb

@@ -58,6 +58,13 @@ describe "Url Validation" do
       subject.errors.size.must_equal 1
     end
 
+    it "rejects injected urls" do
+      subject = build_url_record
+      subject.url = "javascript:alert('xss');\nhttp://google.com"
+      subject.valid?.must_equal false
+      subject.errors.size.must_equal 1
+    end
+
     it "generates an error message of type invalid" do
       subject = build_url_record
       subject.url = 'http://^^^^.fr'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activevalidators
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
   prerelease: 
 platform: ruby
 authors:
@@ -14,11 +14,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-07-06 00:00:00.000000000 Z
+date: 2012-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &70278581021300 !ruby/object:Gem::Requirement
+  requirement: &70131187685580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -26,10 +26,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70278581021300
+  version_requirements: *70131187685580
 - !ruby/object:Gem::Dependency
   name: minitest
-  requirement: &70278581019760 !ruby/object:Gem::Requirement
+  requirement: &70131187684280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -37,10 +37,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70278581019760
+  version_requirements: *70131187684280
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &70278581018660 !ruby/object:Gem::Requirement
+  requirement: &70131187683500 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -48,10 +48,10 @@ dependencies:
         version: 0.8.7
   type: :runtime
   prerelease: false
-  version_requirements: *70278581018660
+  version_requirements: *70131187683500
 - !ruby/object:Gem::Dependency
   name: activemodel
-  requirement: &70278581017920 !ruby/object:Gem::Requirement
+  requirement: &70131187682840 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -59,10 +59,10 @@ dependencies:
         version: 3.0.0
   type: :runtime
   prerelease: false
-  version_requirements: *70278581017920
+  version_requirements: *70131187682840
 - !ruby/object:Gem::Dependency
   name: phony
-  requirement: &70278581017380 !ruby/object:Gem::Requirement
+  requirement: &70131187682280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -70,10 +70,10 @@ dependencies:
         version: 1.7.4
   type: :runtime
   prerelease: false
-  version_requirements: *70278581017380
+  version_requirements: *70131187682280
 - !ruby/object:Gem::Dependency
   name: countries
-  requirement: &70278581016540 !ruby/object:Gem::Requirement
+  requirement: &70131187681620 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -81,10 +81,10 @@ dependencies:
         version: 0.8.2
   type: :runtime
   prerelease: false
-  version_requirements: *70278581016540
+  version_requirements: *70131187681620
 - !ruby/object:Gem::Dependency
   name: mail
-  requirement: &70278581010060 !ruby/object:Gem::Requirement
+  requirement: &70131187681060 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -92,10 +92,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70278581010060
+  version_requirements: *70131187681060
 - !ruby/object:Gem::Dependency
   name: date_validator
-  requirement: &70278581008820 !ruby/object:Gem::Requirement
+  requirement: &70131187680120 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -103,7 +103,7 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *70278581008820
+  version_requirements: *70131187680120
 description: ActiveValidators is a collection of ActiveModel/ActiveRecord validations
 email:
 - franck@verrot.fr