adva 0.1.4 → 0.2.0

data/vendor/gems/xss_terminate/lib/rails_sanitize.rb

@@ -1,8 +0,0 @@
-# This class exists so including the Rails HTML sanitization helpers doesn't polute your models.
-class RailsSanitize
-  include ActionView::Helpers::SanitizeHelper
-  
-  class << self
-    include ActionView::Helpers::SanitizeHelper::ClassMethods
-  end
-end

data/vendor/gems/xss_terminate/lib/xss_terminate/version.rb

@@ -1,3 +0,0 @@
-module XssTerminate
-  VERSION = "0.0.1"
-end

data/vendor/gems/xss_terminate/lib/xss_terminate.rb

@@ -1,141 +0,0 @@
-# additions + refactorings: 
-# 
-# * allowed options to be passed as symbols (e.g. :sanitize => :body)
-# * added an escape_html filter that acts the same way as CGI::escapeHTML does
-#   but leaves the & character unchanged (because that behaviour is not 
-#   idempotent and results in & in & being escaped every time the filter
-#   is applied)
-# * added explicit options to access the strip_tags and escape_html filters
-# * added an option :none to completely turn off sanitizing for a class
-#   (useful e.g. for acts_as_versioned where versions don't need to be 
-#   refiltered)
-# * added an alias filters_attributes for xss_terminate (because this seems
-#   like a more descriptive method name and more in line with the Rails naming
-#   conventions)
-# * added a module level option :default_filter to allow users to select the
-#   default filter
-# * added a module level option :untaint_after_find and an after_find hook
-#   which untaints filtered attributes after the where retrieved from the
-#   database (in order to integrate nicely with SafeERB).
-# * made :xss_terminate_options an superclass_delegating_reader in order to
-#   fix things for cases where a model gets included before XssTerminate is
-#   loaded
-# * changed the filter process to now work with Arrays and Hashes (i.e. the
-#   ActiveRecord serializes feature)
-# * changed the filter process to directly access @attributes instead of
-#   self[] (i.e. read/write_attribute) to circumvent any third-party additions
-#   that hook in here
-# * renamed and refactored a bit more :)
-
-require "xss_terminate/version"
-require "rails_sanitize"
-
-module XssTerminate
-  mattr_accessor :default_filter
-  @@default_filter = :strip_tags
-    
-  mattr_accessor :untaint_after_find
-  @@untaint_after_find = false
-  
-  mattr_accessor :sanitize_filters
-  @@sanitize_filters = [:html5lib_sanitize, :sanitize, :strip_tags, :escape]
-    
-  def self.included(base)
-    base.extend(ClassMethods)
-    # sets up default of stripping tags for all fields
-    # base.send(:xss_terminate)
-  end
-
-  module ClassMethods
-    def xss_terminate(options = {})
-      before_save :sanitize_attributes!
-
-      class_attribute :xss_terminate_options
-      self.xss_terminate_options = {}
-      
-      keys = [:except, *XssTerminate.sanitize_filters]
-      options.assert_valid_keys :none, *keys
-      
-      keys.each do |key| 
-        option = options[key] || []
-        self.xss_terminate_options[key] = option.is_a?(Array) ? option : [option]
-      end
-      self.xss_terminate_options[:none] = options[:none]
-      
-      include XssTerminate::InstanceMethods
-    end
-    
-    alias :filters_attributes :xss_terminate
-  end
-  
-  module InstanceMethods
-    def after_find
-      @attributes.each do |name, value|
-        unless xss_terminate_options[:except].include?(name.to_sym)
-          @attributes[name].untaint
-        end
-      end
-    end
-        
-    def sanitize_attributes!
-      # puts "sanitize attributes #{self.inspect}"
-      return if xss_terminate_options[:none]
-      select_attributes_to_sanitize.each do |attribute|
-        filter = select_sanitize_filter(attribute)
-        sanitize_attribute! filter, @attributes[attribute]
-      end 
-    end
-    
-    def sanitize_attribute!(filter, value)
-      case value
-      when Array
-        value.map{|v| sanitize_attribute!(filter, v) }
-      when Hash
-        value.each{|k, v| sanitize_attribute!(filter, v) }
-        value
-      when String
-        # TODO is it safe to exclude frozen strings? this ran into an error
-        # when with a polymorphic object_type attribute (User#save_roles)
-        value.replace send(filter, value) unless value.frozen? 
-      when ActiveRecord::Base, Numeric, NilClass, TrueClass, FalseClass
-        # nothing to sanitize
-      else
-        Rails.logger.warn "can't sanitize #{value.class.name} #{value.inspect}"
-      end
-    end
-    
-    def select_attributes_to_sanitize
-      self.class.columns.select do |column| 
-        [:string, :text].include?(column.type) && 
-          !xss_terminate_options[:except].include?(column.name.to_sym)
-      end.map(&:name)
-    end
-    
-    def select_sanitize_filter(attribute)
-      XssTerminate.sanitize_filters.detect do |filter|
-        xss_terminate_options[filter].include?(attribute.to_sym)
-      end || XssTerminate.default_filter 
-    end
-    
-    def html5lib_sanitize(value)
-      HTML5libSanitize.new.sanitize_html(value)
-    end
-    
-    def sanitize(value)
-      RailsSanitize.white_list_sanitizer.sanitize(value)
-    end
-    
-    def strip_tags(value)
-      RailsSanitize.full_sanitizer.sanitize(value)
-    end
-    
-    # Can't use CGI::escapeHTML for this because it also escapes & to &
-    # which isn't idempotent (i.e. saving the same value multiple times would
-    # cause the & in & being escaped every time).
-    def escape(value)
-      replace = { '"' => '&quot;', '<' => '&lt;', '>' => '&gt;' }
-      value.gsub(/["<>]/){|char| replace[char] }
-    end
-  end
-end
-ActiveRecord::Base.send :include, XssTerminate

data/vendor/gems/xss_terminate/tasks/xss_terminate_tasks.rake

@@ -1,7 +0,0 @@
-desc "Given MODELS=Foo,Bar,Baz find all instances in the DB and save to sanitize existing records"
-task :xss_terminate => :environment do
-  models = ENV['MODELS'].split(',')
-  models.each do |model|
-    model.constantize.find(:all).map(&:save)
-  end
-end

data/vendor/gems/xss_terminate/test/models/comment.rb

@@ -1,5 +0,0 @@
-# Commet uses the default: stripping tags fro all fields.
-class Comment < ActiveRecord::Base
-  belongs_to :entry
-  belongs_to :person
-end

data/vendor/gems/xss_terminate/test/models/entry.rb

@@ -1,7 +0,0 @@
-# Rails HTML sanitization on some fields
-class Entry < ActiveRecord::Base
-  belongs_to :person
-  has_many :comments
-  
-  xss_terminate :sanitize => [:body, :extended]
-end

data/vendor/gems/xss_terminate/test/models/message.rb

@@ -1,3 +0,0 @@
-class Message < ActiveRecord::Base
-  belongs_to :person
-end

data/vendor/gems/xss_terminate/test/models/person.rb

@@ -1,5 +0,0 @@
-# This model excepts HTML sanitization on the name
-class Person < ActiveRecord::Base
-  has_many :entries
-  xss_terminate :except => [:name]
-end

data/vendor/gems/xss_terminate/test/models/review.rb

@@ -1,5 +0,0 @@
-class Review < ActiveRecord::Base
-  belongs_to :person
-  
-  xss_terminate :html5lib_sanitize => [:body, :extended]
-end

data/vendor/gems/xss_terminate/test/schema.rb

@@ -1,34 +0,0 @@
-ActiveRecord::Schema.define(:version => 0) do
-  create_table :people, :force => true do |t|
-    t.column :name, :string
-  end
-  
-  create_table :entries, :force => true do |t|
-    t.column :title, :string
-    t.column :body, :text
-    t.column :extended, :text
-    t.column :person_id, :integer
-    t.column :created_on, :datetime
-  end
-
-  create_table :comments, :force => true do |t|
-    t.column :person_id, :integer
-    t.column :title, :string
-    t.column :body, :text
-    t.column :created_on, :datetime
-  end
-  
-  create_table :messages, :force => true do |t|
-    t.column :person_id, :integer
-    t.column :recipient_id, :integer
-    t.column :body, :text
-  end
-  
-  create_table :reviews, :force => true do |t|
-    t.column :title, :string
-    t.column :body, :text
-    t.column :extended, :text
-    t.column :person_id, :integer
-    t.column :created_on, :datetime
-  end
-end

data/vendor/gems/xss_terminate/test/setup_test.rb

@@ -1,16 +0,0 @@
-# borrowed from err who borrowed from topfunky who borrowed from...
-
-# set up test environment
-RAILS_ENV = 'test'
-require File.expand_path(File.join(File.dirname(__FILE__), '../../../../config/environment.rb'))
-require 'test/unit'
-
-# load test schema
-load(File.dirname(__FILE__) + "/schema.rb")
-
-# load test models
-require File.join(File.dirname(__FILE__), 'models/person')
-require File.join(File.dirname(__FILE__), 'models/entry')
-require File.join(File.dirname(__FILE__), 'models/comment')
-require File.join(File.dirname(__FILE__), 'models/message')
-require File.join(File.dirname(__FILE__), 'models/review')

data/vendor/gems/xss_terminate/test/xss_terminate_test.rb

@@ -1,50 +0,0 @@
-require File.join(File.dirname(__FILE__), 'setup_test')
-
-class XssTerminateTest < Test::Unit::TestCase
-  def test_strip_tags_on_discovered_fields
-    c = Comment.create!(:title => "<script>alert('xss in title')</script>",
-                        :body => "<script>alert('xss in body')</script>")
-
-    assert_equal "alert('xss in title')", c.title
-    
-    assert_equal "alert('xss in body')", c.body
-  end
-  
-  def test_rails_sanitization_on_specified_fields
-    e = Entry.create!(:title => "<script>alert('xss in title')</script>",
-                      :body => "<script>alert('xss in body')</script>",
-                      :extended => "<script>alert('xss in extended')</script>",
-                      :person_id => 1)
-
-    assert_equal [:body, :extended], e.xss_terminate_options[:sanitize]
-    
-    assert_equal "alert('xss in title')", e.title
-
-    assert_equal "", e.body
-
-    assert_equal "", e.extended
-  end
-  
-  def test_excepting_specified_fields
-    p = Person.create!(:name => "<strong>Mallory</strong>")
-    
-    assert_equal [:name], p.xss_terminate_options[:except]
-    
-    assert_equal "<strong>Mallory</strong>", p.name
-  end
-  
-  def test_html5lib_sanitization_on_specified_fields
-    r = Review.create!(:title => "<script>alert('xss in title')</script>",
-                       :body => "<script>alert('xss in body')</script>",
-                       :extended => "<script>alert('xss in extended')</script>",
-                       :person_id => 1)
-                       
-    assert_equal [:body, :extended], r.xss_terminate_options[:html5lib_sanitize]
-
-    assert_equal "alert('xss in title')", r.title
-    
-    assert_equal "&lt;script&gt;alert('xss in body')&lt;/script&gt;", r.body
-    
-    assert_equal "&lt;script&gt;alert('xss in extended')&lt;/script&gt;", r.extended
-  end
-end

data/vendor/gems/xss_terminate/xss_terminate.gemspec

@@ -1,17 +0,0 @@
-# -*- encoding: utf-8 -*-
-require File.expand_path('../lib/xss_terminate/version', __FILE__)
-
-Gem::Specification.new do |gem|
-  gem.authors       = ["Micah Geisel"]
-  gem.email         = ["micah@botandrose.com"]
-  gem.description   = %q{TODO: Write a gem description}
-  gem.summary       = %q{TODO: Write a gem summary}
-  gem.homepage      = ""
-
-  gem.files         = `git ls-files`.split($\)
-  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
-  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
-  gem.name          = "xss_terminate"
-  gem.require_paths = ["lib"]
-  gem.version       = XssTerminate::VERSION
-end