angular_xss 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cca3cff1d32777a0e9ae8857bc136981cb61c359
-  data.tar.gz: 520d0d7d7122a4d630fca1d5a09d1f98f9ca1ef3
+  metadata.gz: bd5001cfe150eb1c470f46cdabc75fa7c93c6eda
+  data.tar.gz: d3fa3b7a9ea77d3f47bb4ff3adec608427f8bb83
 SHA512:
-  metadata.gz: caf93d6ac6230f240914ba3bbed906c688435d7b4acd5ec925a55f5b13476c8b1fd4c1c9cf8b3641315ec8c3845cdff2b7c78c30f7ff7247d4f4b4f760b18601
-  data.tar.gz: 20b38f1cb2a45f52fb4083ada04e33c2c926ba62989e8f0651645e02ecd0da1df7d484e0eaaedc111ae18f866b1c179e43e9f2b9f5642181461b32ce89319268
+  metadata.gz: 770c23bad28c0c1f9e46495e292e3bce47741e423fdece2735c980c74c0ac9b202766e614153270179d8027424a0054267299b33bd7b6b0619a5d3ca1b737376
+  data.tar.gz: 84e8ab293070e44d74242692147e15e0b505c1c5bdd7ca1856893115160fba93fd04c650fe026589e3f583b170b7f12a0633c709522af70754ebafbdc0ec61b3

data/lib/angular_xss.rb

@@ -3,3 +3,4 @@
 require 'angular_xss/escaper'
 require 'angular_xss/erb'
 require 'angular_xss/haml'
+require 'angular_xss/action_view'

data/lib/angular_xss/action_view.rb

@@ -0,0 +1,13 @@
+ActionView::Template.class_eval do
+
+  protected
+
+  def compile_with_angular_xss(*args, &block)
+    AngularXss.disable do
+      compile_without_angular_xss(*args, &block)
+    end
+  end
+
+  alias_method_chain :compile, :angular_xss
+
+end

data/lib/angular_xss/version.rb

@@ -1,3 +1,3 @@
 module AngularXss
-  VERSION = '0.2.0'
+  VERSION = '0.2.1'
 end

data/spec/rails-2.3/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../..
   specs:
-    angular_xss (0.2.0)
+    angular_xss (0.2.1)
       activesupport
       haml (>= 3.1.5)
 

data/spec/rails-3.2/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ../..
   specs:
-    angular_xss (0.2.0)
+    angular_xss (0.2.1)
       activesupport
       haml (>= 3.1.5)
 

data/spec/shared/app_root/app/views/test/_test_haml.haml

@@ -4,13 +4,6 @@
 
 {{safe}}
 
-%div{:foo => '{{safe}}'.html_safe, :bar => '{{unsafe}}'}
-  {{safe}}
-
--# We can't support Angular interpolations in class and id attributes.
--# This is a limitation of Haml.
-%div{:class => '{{unsafe_id}}', :id => '{{unsafe_id}}'}
-
 = '{{unsafe}}'
 = '{{unsafe}}'
 = '{{unsafe}}'
@@ -21,3 +14,19 @@
 = '{{unsafe}}'
 = '{{unsafe}}'
 = '{{unsafe}}'
+
+-# HTML attributes in Haml work in different ways:
+-# 1. Under certain conditions, attributes are precompiled.
+-#    We never have to escape those because they can not contain user input.
+-# 2. Whenever there is a Ruby call on attributes, Haml will have to evaluate
+-#    them at runtime. Since they can contain user input, XSS logic applies.
+
+-# Precompiled:
+%div(foo='{{safe}}')
+%div{:class => '{{safe}}', :id => '{{safe}}'}
+
+-# Compiled at runtime:
+%div{:class => '{{unsafe}}', :id => '{{unsafe}}', :foo => rand}
+%div(bar="#{'{{unsafe}}'}")
+%div{:foo => '{{safe}}'.html_safe, :bar => '{{unsafe}}'}
+  {{safe}}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: angular_xss
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Henning Koch
@@ -52,6 +52,7 @@ files:
 - Rakefile
 - angular_xss.gemspec
 - lib/angular_xss.rb
+- lib/angular_xss/action_view.rb
 - lib/angular_xss/erb.rb
 - lib/angular_xss/escaper.rb
 - lib/angular_xss/haml.rb