activity_notification 2.7.0 → 2.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bafe2d6977f08838087612f2d58947783a2e6add85633d85abe024cbe3a8041b
-  data.tar.gz: '095b581d3e475f27bfd186265083ea42f953b9b7c992c963fbb5fdd40cedd96e'
+  metadata.gz: 56122565c61de552c48285f449429a7d64616f5c13f04f0e023a68b33273db6f
+  data.tar.gz: 6462762a8f2d8b7b68b82be0632c1dd3d89379aa7fe904c6f4492053be2633fb
 SHA512:
-  metadata.gz: f6c687e0c9df39d2950bd2f2b2f2da4e10b95404315e09a9c91b8002cbaf98140a33877700c5c5b8a36b46f3387658caba039c722a91664b52d56ec29eac47d8
-  data.tar.gz: a9ebe7817f6c78fceb53e5ce0adee2b20e7b964e97c5ad812933a2d097d42f3d1617a29d26b0b07225309d56ebb2168fdcf64bd26c4d3478523ed6d1354de0ff
+  metadata.gz: fd7b507f00663ebcf26694a0c8c98a0051f51f7bf35e67687a77e668fb61f500f1cf84e2fa433ecbc39bf59357449fcd0cfd0303b107b7e16ea9838d39e3848f
+  data.tar.gz: 12cd4b4e589aa66e4ccb6108beb5624d5b13f3d327234491520551c5d9134afabe718367ee3d5193a92e9a1fd2491c9bf5d59250e8e2bb8588c3bcdfaf8565b7

data/app/channels/activity_notification/notification_api_channel.rb

@@ -4,6 +4,8 @@ class ActivityNotification::NotificationApiChannel < ActivityNotification::Notif
   # ActionCable::Channel::Base#subscribed
   # @see https://api.rubyonrails.org/classes/ActionCable/Channel/Base.html#method-i-subscribed
     def subscribed
+      # before_subscribe callbacks do not halt the chain on reject
+      return if subscription_rejected?
       stream_from "#{ActivityNotification.config.notification_api_channel_prefix}_#{@target.to_class_name}#{ActivityNotification.config.composite_key_delimiter}#{@target.id}"
     rescue
       reject

data/app/channels/activity_notification/notification_channel.rb

@@ -7,6 +7,8 @@ if defined?(ActionCable)
     # ActionCable::Channel::Base#subscribed
     # @see https://api.rubyonrails.org/classes/ActionCable/Channel/Base.html#method-i-subscribed
     def subscribed
+      # before_subscribe callbacks do not halt the chain on reject
+      return if subscription_rejected?
       stream_from "#{ActivityNotification.config.notification_channel_prefix}_#{@target.to_class_name}#{ActivityNotification.config.composite_key_delimiter}#{@target.id}"
     rescue
       reject

data/app/controllers/activity_notification/notifications_api_controller.rb

@@ -5,7 +5,6 @@ module ActivityNotification
     include Swagger::NotificationsApi
     # Include CommonApiController to select target and define common methods
     include CommonApiController
-    protect_from_forgery except: [:open_all]
     rescue_from ActivityNotification::NotifiableNotFoundError, with: :render_notifiable_not_found
 
     # Returns notification index of the target.

data/app/controllers/activity_notification/subscriptions_api_controller.rb

@@ -5,7 +5,6 @@ module ActivityNotification
     include Swagger::SubscriptionsApi
     # Include CommonApiController to select target and define common methods
     include CommonApiController
-    protect_from_forgery except: [:create]
     before_action :set_subscription, except: [:index, :create, :find, :optional_target_names]
     before_action ->{ validate_param(:key) }, only: [:find, :optional_target_names]
 

data/app/views/activity_notification/notifications/default/index.html.erb

@@ -40,7 +40,7 @@
 </style>
 
 <% if @target.notification_action_cable_allowed? %>
-  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js"></script>
+  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js" integrity="sha512-eiqtDDb4GUVCSqOSOTz/s/eiU4B31GrdSb17aPAA4Lv/Cjc8o+hnDvuNkgXhSI5yHuDvYkuojMaQmrB5JB31XQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   <script>
     App.activity_notification = App.cable.subscriptions.create(
       {

data/docs/Functions.md

@@ -336,6 +336,8 @@ You can also add conditions to filter notifications, like this:
 User.send_batch_unopened_notification_email(batch_key: 'batch.comment.post', filtered_by_key: 'comment.post', custom_filter: ["created_at >= ?", time.hour.ago])
 ```
 
+*custom_filter* accepts an array of a SQL fragment with bind parameters or a hash of conditions. Write it in your application code and never build it from request parameters, since it is passed to the ORM query layer as is. A raw SQL string, an array without bind parameters and MongoDB JavaScript operators (`$where`, `$function` and `$accumulator`) are rejected with `ArgumentError`.
+
 #### Batch sender configuration
 
 *activity_notification* uses same sender configuration of real-time email notification as batch email sender.
@@ -1007,7 +1009,7 @@ Then, *activity_notification* will broadcast configured notifications to target
 You can simply create subscriptions for the specified target in your view like this:
 
 ```js
-<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js"></script>
+<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/push.js/1.0.9/push.min.js" integrity="sha512-eiqtDDb4GUVCSqOSOTz/s/eiU4B31GrdSb17aPAA4Lv/Cjc8o+hnDvuNkgXhSI5yHuDvYkuojMaQmrB5JB31XQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
 <script>
   App.activity_notification = App.cable.subscriptions.create(
     {
@@ -1045,7 +1047,7 @@ You can simply create subscriptions for the specified target in your view like t
 or create subscriptions in your single page application with API channels like this:
 
 ```js
-// Vue.js implementation with actioncable-vue
+// Vue.js implementation with a small Action Cable plugin (see spec/rails_app/app/javascript/plugins/action-cable.js)
 export default {
   // ...
   mounted () {

data/lib/activity_notification/common.rb

@@ -47,24 +47,51 @@ module ActivityNotification
     end
   end
 
+  # MongoDB query operators which execute JavaScript on the database server.
+  JAVASCRIPT_QUERY_OPERATORS = %w[$where $function $accumulator].freeze
+
   # Validates a :custom_filter value before it is passed to the ORM query layer.
-  # A String is rejected because ActiveRecord's where treats a String as a raw
-  # SQL fragment, which allows SQL injection when the value originates from
-  # untrusted input. The documented and supported forms are an Array of a SQL
-  # fragment with bind parameters (e.g. ["created_at >= ?", time]) or a Hash of
-  # conditions, both of which are safe.
+  # custom_filter is a trusted input written by the application developer and
+  # must not be built from request parameters. This validation rejects the forms
+  # that run raw SQL or server-side JavaScript:
+  # - A String, since ActiveRecord's where treats it as a raw SQL fragment
+  # - An Array without bind parameters (e.g. ["1=1"]), which is also a raw SQL fragment
+  # - A Hash containing MongoDB JavaScript operators ($where, $function and $accumulator)
+  # The supported forms are an Array of a SQL fragment with bind parameters
+  # (e.g. ["created_at >= ?", time]) or a Hash of conditions.
   # @param [Array, Hash] custom_filter Custom filter value
   # @return [Array, Hash] The same value when it is safe to use
-  # @raise [ArgumentError] When custom_filter is a raw SQL String
+  # @raise [ArgumentError] When custom_filter is not in the supported forms
   def self.validate_custom_filter(custom_filter)
-    if custom_filter.is_a?(String)
+    valid =
+      case custom_filter
+      when Array then custom_filter.size >= 2 && custom_filter.first.is_a?(String)
+      when Hash  then !contains_javascript_query_operator?(custom_filter)
+      else false
+      end
+    unless valid
       raise ArgumentError,
         ":custom_filter must be an array of a SQL fragment and bind parameters " \
-        "(e.g. [\"created_at >= ?\", time]) or a hash of conditions, not a raw SQL string"
+        "(e.g. [\"created_at >= ?\", time]) or a hash of conditions without JavaScript operators"
     end
     custom_filter
   end
 
+  # Returns whether the value contains MongoDB query operators which execute JavaScript.
+  # @param [Object] value Value to check
+  # @return [Boolean] Whether the value contains JavaScript query operators
+  def self.contains_javascript_query_operator?(value)
+    case value
+    when Hash
+      value.any? { |k, v| JAVASCRIPT_QUERY_OPERATORS.include?(k.to_s) || contains_javascript_query_operator?(v) }
+    when Array
+      value.any? { |v| contains_javascript_query_operator?(v) }
+    else
+      false
+    end
+  end
+  private_class_method :contains_javascript_query_operator?
+
   # Casts to indifferent hash
   # @param [ActionController::Parameters, Hash] hash
   # @return [HashWithIndifferentAccess] Converted indifferent hash

data/lib/activity_notification/helpers/view_helpers.rb

@@ -21,7 +21,7 @@ module ActivityNotification
         notifications.render self, options
       elsif notifications.respond_to?(:map)
         return nil if (notifications.respond_to?(:empty?) ? notifications.empty? : notifications.to_a.empty?)
-        notifications.map {|notification| notification.render self, options.dup }.join.html_safe
+        safe_join(notifications.map {|notification| notification.render self, options.dup })
       end
     end
     alias_method :render_notifications, :render_notification

data/lib/activity_notification/version.rb

@@ -1,3 +1,3 @@
 module ActivityNotification
-  VERSION = "2.7.0"
+  VERSION = "2.7.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activity_notification
 version: !ruby/object:Gem::Version
-  version: 2.7.0
+  version: 2.7.1
 platform: ruby
 authors:
 - Shota Yamazaki