angular_xss 0.3.0 → 0.3.1

data/gemfiles/Gemfile.rails-5.1.haml-5

@@ -0,0 +1,8 @@
+source 'http://rubygems.org'
+
+gem 'actionpack', '~>5.1'
+gem 'rspec'
+gem 'haml', '~> 5'
+gem 'angular_xss', :path => '..'
+gem 'gemika'
+gem 'rake'

data/gemfiles/Gemfile.rails-5.1.haml-5.lock

@@ -0,0 +1,87 @@
+PATH
+  remote: ..
+  specs:
+    angular_xss (0.3.1)
+      activesupport
+      haml (>= 3.1.5)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    actionpack (5.1.4)
+      actionview (= 5.1.4)
+      activesupport (= 5.1.4)
+      rack (~> 2.0)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.1.4)
+      activesupport (= 5.1.4)
+      builder (~> 3.1)
+      erubi (~> 1.4)
+      rails-dom-testing (~> 2.0)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
+    activesupport (5.1.4)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (~> 0.7)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    builder (3.2.3)
+    concurrent-ruby (1.0.5)
+    crass (1.0.3)
+    diff-lcs (1.3)
+    erubi (1.7.0)
+    gemika (0.3.2)
+    haml (5.0.4)
+      temple (>= 0.8.0)
+      tilt
+    i18n (0.9.1)
+      concurrent-ruby (~> 1.0)
+    loofah (2.1.1)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.5.9)
+    mini_portile2 (2.3.0)
+    minitest (5.10.3)
+    nokogiri (1.8.1)
+      mini_portile2 (~> 2.3.0)
+    rack (2.0.3)
+    rack-test (0.8.2)
+      rack (>= 1.0, < 3)
+    rails-dom-testing (2.0.3)
+      activesupport (>= 4.2.0)
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.0.3)
+      loofah (~> 2.0)
+    rake (12.3.0)
+    rspec (3.7.0)
+      rspec-core (~> 3.7.0)
+      rspec-expectations (~> 3.7.0)
+      rspec-mocks (~> 3.7.0)
+    rspec-core (3.7.0)
+      rspec-support (~> 3.7.0)
+    rspec-expectations (3.7.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.7.0)
+    rspec-mocks (3.7.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.7.0)
+    rspec-support (3.7.0)
+    temple (0.8.0)
+    thread_safe (0.3.6)
+    tilt (2.0.8)
+    tzinfo (1.2.4)
+      thread_safe (~> 0.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  actionpack (~> 5.1)
+  angular_xss!
+  gemika
+  haml (~> 5)
+  rake
+  rspec
+
+BUNDLED WITH
+   1.15.4

data/lib/angular_xss/action_view.rb

@@ -8,6 +8,7 @@ ActionView::Template.class_eval do
     end
   end
 
-  alias_method_chain :compile, :angular_xss
+  alias_method :compile_without_angular_xss, :compile
+  alias_method :compile, :compile_with_angular_xss
 
 end

data/lib/angular_xss/erb.rb

@@ -12,7 +12,8 @@ ERB::Util.module_eval do
       end
     end
 
-    alias_method_chain :unwrapped_html_escape, :escaping_angular_expressions
+    alias_method :unwrapped_html_escape_without_escaping_angular_expressions, :unwrapped_html_escape
+    alias_method :unwrapped_html_escape, :unwrapped_html_escape_with_escaping_angular_expressions
 
     singleton_class.send(:remove_method, :unwrapped_html_escape)
     module_function :unwrapped_html_escape

data/lib/angular_xss/haml.rb

@@ -1,15 +1,19 @@
-# Use module_eval so we crash when Haml::Helpers has not yet been loaded.
-Haml::Helpers.module_eval do
+# Haml > 5 falls back to erb
+if Haml::VERSION < '5'
+  # Use module_eval so we crash when Haml::Helpers has not yet been loaded.
+  Haml::Helpers.module_eval do
 
-  def html_escape_with_escaping_angular_expressions(s)
-    s = s.to_s
-    if s.html_safe?
-      s
-    else
-      html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
+    def html_escape_with_escaping_angular_expressions(s)
+      s = s.to_s
+      if s.html_safe?
+        s
+      else
+        html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
+      end
     end
-  end
 
-  alias_method_chain :html_escape, :escaping_angular_expressions
+    alias_method :html_escape_without_escaping_angular_expressions, :html_escape
+    alias_method :html_escape, :html_escape_with_escaping_angular_expressions
 
+  end
 end

data/lib/angular_xss/safe_buffer.rb

@@ -4,15 +4,16 @@ ActiveSupport::SafeBuffer.class_eval do
 
     private
 
-    def html_escape_interpolated_argument_with_rails_xss(arg)
+    def html_escape_interpolated_argument_with_angular_xss(arg)
       if arg.html_safe?
         arg
       else
-        html_escape_interpolated_argument_without_rails_xss(AngularXss::Escaper.escape(arg))
+        html_escape_interpolated_argument_without_angular_xss(AngularXss::Escaper.escape(arg))
       end
     end
 
-    alias_method_chain :html_escape_interpolated_argument, :rails_xss
+    alias_method :html_escape_interpolated_argument_without_angular_xss, :html_escape_interpolated_argument
+    alias_method :html_escape_interpolated_argument, :html_escape_interpolated_argument_with_angular_xss
 
   end
 

data/lib/angular_xss/version.rb

@@ -1,3 +1,3 @@
 module AngularXss
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 end

data/spec/{shared/tests → angular_xss}/erb_spec.rb

@@ -2,6 +2,6 @@ require 'spec_helper'
 
 describe 'Angular XSS prevention in ERB', :type => :view do
 
-  it_should_act_like 'engine preventing Angular XSS', :partial => 'test/test_erb'
+  it_should_behave_like 'engine preventing Angular XSS', :partial => 'test_erb'
 
 end

data/spec/{shared/tests → angular_xss}/haml_spec.rb

@@ -2,6 +2,6 @@ require 'spec_helper'
 
 describe 'Angular XSS prevention in Haml', :type => :view do
 
-  it_should_act_like 'engine preventing Angular XSS', :partial => 'test/test_haml'
+  it_should_behave_like 'engine preventing Angular XSS', :partial => 'test_haml'
 
 end

data/spec/spec_helper.rb

@@ -0,0 +1,37 @@
+require 'pathname'
+require 'active_support/all'
+require 'action_dispatch'
+require 'action_view'
+
+begin
+  # Rails 3.2
+  require 'rails'
+rescue LoadError
+  # Rails 4+
+end
+
+module Rails
+  def self.env
+    'test'.inquiry
+  end
+end
+
+require 'haml'
+require 'haml/template'
+
+require 'angular_xss'
+
+
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
+
+TEMPLATE_ROOT = Pathname.new(__dir__).join('templates')
+
+
+RSpec.configure do |config|
+  config.mock_with :rspec do |c|
+    c.syntax = [:should, :expect]
+  end
+  config.expect_with :rspec do |c|
+    c.syntax = [:should, :expect]
+  end
+end

data/spec/{shared/support → support}/engine_preventing_angular_xss.rb

@@ -1,6 +1,8 @@
-shared_examples_for 'engine preventing Angular XSS' do
+shared_examples_for 'engine preventing Angular XSS' do |partial:|
 
-  let(:engine) { respond_to?(:view) ? view : template }
+  let(:path_set) { ActionView::PathSet.new([TEMPLATE_ROOT]) }
+
+  let(:engine) { ActionView::Base.new(path_set) }
 
   let(:html) { engine.render(partial) }
 
@@ -72,4 +74,10 @@ shared_examples_for 'engine preventing Angular XSS' do
     html.should_not include('{{unsafe}}')
   end
 
+  it 'does not escape twice' do
+    escaped = AngularXss::Escaper.escape('{{')
+    double_escaped = AngularXss::Escaper.escape(escaped)
+    html.should_not include(double_escaped)
+  end
+
 end

data/spec/{shared/app_root/app/views/test → templates}/_test_haml.haml

@@ -29,7 +29,9 @@
 %div{:class => '{{safe}}', :id => '{{safe}}'}
 
 -# Compiled at runtime:
-%div{:class => '{{unsafe}}', :id => '{{unsafe}}', :foo => rand}
-%div(bar="#{'{{unsafe}}'}")
-%div{:foo => '{{safe}}'.html_safe, :bar => '{{unsafe}}'}
+- unsafe = '{{unsafe}}'
+- safe = '{{safe}}'.html_safe
+%div{:class => unsafe, :id => unsafe}
+%div(bar="#{unsafe}")
+  %div{:foo => safe, :bar => unsafe}
   {{safe}}

metadata

@@ -1,67 +1,70 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: angular_xss
-version: !ruby/object:Gem::Version 
-  hash: 19
-  prerelease: 
-  segments: 
-  - 0
-  - 3
-  - 0
-  version: 0.3.0
+version: !ruby/object:Gem::Version
+  version: 0.3.1
 platform: ruby
-authors: 
+authors:
 - Henning Koch
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2017-07-31 00:00:00 Z
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 2017-11-21 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: activesupport
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
     - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
+      - !ruby/object:Gem::Version
+        version: '0'
   type: :runtime
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: haml
   prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: haml
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
     - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 9
-        segments: 
-        - 3
-        - 1
-        - 5
+      - !ruby/object:Gem::Version
         version: 3.1.5
   type: :runtime
-  version_requirements: *id002
-description: Patches rails_xss and Haml so AngularJS interpolations are auto-escaped in unsafe strings.
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.1.5
+description: Patches rails_xss and Haml so AngularJS interpolations are auto-escaped
+  in unsafe strings.
 email: henning.koch@makandra.de
 executables: []
-
 extensions: []
-
 extra_rdoc_files: []
-
-files: 
-- .gitignore
-- .travis.yml
+files:
+- ".gitignore"
+- ".rspec"
+- ".ruby-version"
+- ".travis.yml"
+- Gemfile
+- Gemfile.lock
 - LICENSE
 - README.md
 - Rakefile
 - angular_xss.gemspec
+- gemfiles/Gemfile.rails-3.2
+- gemfiles/Gemfile.rails-3.2.lock
+- gemfiles/Gemfile.rails-4.2.haml-4
+- gemfiles/Gemfile.rails-4.2.haml-4.lock
+- gemfiles/Gemfile.rails-4.2.haml-5
+- gemfiles/Gemfile.rails-4.2.haml-5.lock
+- gemfiles/Gemfile.rails-5.1.haml-4
+- gemfiles/Gemfile.rails-5.1.haml-4.lock
+- gemfiles/Gemfile.rails-5.1.haml-5
+- gemfiles/Gemfile.rails-5.1.haml-5.lock
 - lib/angular_xss.rb
 - lib/angular_xss/action_view.rb
 - lib/angular_xss/erb.rb
@@ -69,174 +72,43 @@ files:
 - lib/angular_xss/haml.rb
 - lib/angular_xss/safe_buffer.rb
 - lib/angular_xss/version.rb
-- spec/rails-2.3/Gemfile
-- spec/rails-2.3/Gemfile.lock
-- spec/rails-2.3/Rakefile
-- spec/rails-2.3/app_root/config/boot.rb
-- spec/rails-2.3/app_root/config/database.yml
-- spec/rails-2.3/app_root/config/environment.rb
-- spec/rails-2.3/app_root/config/environments/test.rb
-- spec/rails-2.3/app_root/config/preinitializer.rb
-- spec/rails-2.3/app_root/config/routes.rb
-- spec/rails-2.3/app_root/lib/console_with_fixtures.rb
-- spec/rails-2.3/app_root/log/.gitignore
-- spec/rails-2.3/app_root/script/console
-- spec/rails-2.3/rcov.opts
-- spec/rails-2.3/spec.opts
-- spec/rails-2.3/spec/spec_helper.rb
-- spec/rails-3.2/.rspec
-- spec/rails-3.2/Gemfile
-- spec/rails-3.2/Gemfile.lock
-- spec/rails-3.2/Rakefile
-- spec/rails-3.2/app_root/.gitignore
-- spec/rails-3.2/app_root/config/application.rb
-- spec/rails-3.2/app_root/config/boot.rb
-- spec/rails-3.2/app_root/config/database.yml
-- spec/rails-3.2/app_root/config/environment.rb
-- spec/rails-3.2/app_root/config/environments/test.rb
-- spec/rails-3.2/app_root/config/initializers/backtrace_silencers.rb
-- spec/rails-3.2/app_root/config/initializers/inflections.rb
-- spec/rails-3.2/app_root/config/initializers/mime_types.rb
-- spec/rails-3.2/app_root/config/initializers/secret_token.rb
-- spec/rails-3.2/app_root/config/initializers/session_store.rb
-- spec/rails-3.2/app_root/config/routes.rb
-- spec/rails-3.2/app_root/lib/tasks/.gitkeep
-- spec/rails-3.2/app_root/log/.gitkeep
-- spec/rails-3.2/app_root/script/rails
-- spec/rails-3.2/rcov.opts
-- spec/rails-3.2/spec/spec_helper.rb
-- spec/rails-4.2/.rspec
-- spec/rails-4.2/Gemfile
-- spec/rails-4.2/Gemfile.lock
-- spec/rails-4.2/Rakefile
-- spec/rails-4.2/app_root/.gitignore
-- spec/rails-4.2/app_root/config/application.rb
-- spec/rails-4.2/app_root/config/boot.rb
-- spec/rails-4.2/app_root/config/database.yml
-- spec/rails-4.2/app_root/config/environment.rb
-- spec/rails-4.2/app_root/config/environments/test.rb
-- spec/rails-4.2/app_root/config/initializers/backtrace_silencers.rb
-- spec/rails-4.2/app_root/config/initializers/inflections.rb
-- spec/rails-4.2/app_root/config/initializers/mime_types.rb
-- spec/rails-4.2/app_root/config/initializers/secret_token.rb
-- spec/rails-4.2/app_root/config/initializers/session_store.rb
-- spec/rails-4.2/app_root/config/routes.rb
-- spec/rails-4.2/app_root/lib/tasks/.gitkeep
-- spec/rails-4.2/app_root/log/.gitkeep
-- spec/rails-4.2/app_root/script/rails
-- spec/rails-4.2/rcov.opts
-- spec/rails-4.2/spec/spec_helper.rb
-- spec/shared/app_root/app/controllers/application_controller.rb
-- spec/shared/app_root/app/helpers/application_helper.rb
-- spec/shared/app_root/app/models/.gitkeep
-- spec/shared/app_root/app/views/test/_test_erb.erb
-- spec/shared/app_root/app/views/test/_test_haml.haml
-- spec/shared/app_root/config/database.yml
-- spec/shared/app_root/db/migrate/.gitkeep
-- spec/shared/support/engine_preventing_angular_xss.rb
-- spec/shared/tests/erb_spec.rb
-- spec/shared/tests/haml_spec.rb
-- spec/shared/tests/safe_buffer_spec.rb
+- spec/angular_xss/erb_spec.rb
+- spec/angular_xss/haml_spec.rb
+- spec/angular_xss/safe_buffer_spec.rb
+- spec/spec_helper.rb
+- spec/support/engine_preventing_angular_xss.rb
+- spec/templates/_test_erb.erb
+- spec/templates/_test_haml.haml
 homepage: https://github.com/makandra/angular_xss
-licenses: 
+licenses:
 - MIT
+metadata: {}
 post_install_message: 
 rdoc_options: []
-
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
   - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
   - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
+    - !ruby/object:Gem::Version
+      version: '0'
 requirements: []
-
 rubyforge_project: 
-rubygems_version: 1.8.30
+rubygems_version: 2.5.2.1
 signing_key: 
-specification_version: 3
-summary: Patches rails_xss and Haml so AngularJS interpolations are auto-escaped in unsafe strings.
-test_files: 
-- spec/rails-2.3/Gemfile
-- spec/rails-2.3/Gemfile.lock
-- spec/rails-2.3/Rakefile
-- spec/rails-2.3/app_root/config/boot.rb
-- spec/rails-2.3/app_root/config/database.yml
-- spec/rails-2.3/app_root/config/environment.rb
-- spec/rails-2.3/app_root/config/environments/test.rb
-- spec/rails-2.3/app_root/config/preinitializer.rb
-- spec/rails-2.3/app_root/config/routes.rb
-- spec/rails-2.3/app_root/lib/console_with_fixtures.rb
-- spec/rails-2.3/app_root/log/.gitignore
-- spec/rails-2.3/app_root/script/console
-- spec/rails-2.3/rcov.opts
-- spec/rails-2.3/spec.opts
-- spec/rails-2.3/spec/spec_helper.rb
-- spec/rails-3.2/.rspec
-- spec/rails-3.2/Gemfile
-- spec/rails-3.2/Gemfile.lock
-- spec/rails-3.2/Rakefile
-- spec/rails-3.2/app_root/.gitignore
-- spec/rails-3.2/app_root/config/application.rb
-- spec/rails-3.2/app_root/config/boot.rb
-- spec/rails-3.2/app_root/config/database.yml
-- spec/rails-3.2/app_root/config/environment.rb
-- spec/rails-3.2/app_root/config/environments/test.rb
-- spec/rails-3.2/app_root/config/initializers/backtrace_silencers.rb
-- spec/rails-3.2/app_root/config/initializers/inflections.rb
-- spec/rails-3.2/app_root/config/initializers/mime_types.rb
-- spec/rails-3.2/app_root/config/initializers/secret_token.rb
-- spec/rails-3.2/app_root/config/initializers/session_store.rb
-- spec/rails-3.2/app_root/config/routes.rb
-- spec/rails-3.2/app_root/lib/tasks/.gitkeep
-- spec/rails-3.2/app_root/log/.gitkeep
-- spec/rails-3.2/app_root/script/rails
-- spec/rails-3.2/rcov.opts
-- spec/rails-3.2/spec/spec_helper.rb
-- spec/rails-4.2/.rspec
-- spec/rails-4.2/Gemfile
-- spec/rails-4.2/Gemfile.lock
-- spec/rails-4.2/Rakefile
-- spec/rails-4.2/app_root/.gitignore
-- spec/rails-4.2/app_root/config/application.rb
-- spec/rails-4.2/app_root/config/boot.rb
-- spec/rails-4.2/app_root/config/database.yml
-- spec/rails-4.2/app_root/config/environment.rb
-- spec/rails-4.2/app_root/config/environments/test.rb
-- spec/rails-4.2/app_root/config/initializers/backtrace_silencers.rb
-- spec/rails-4.2/app_root/config/initializers/inflections.rb
-- spec/rails-4.2/app_root/config/initializers/mime_types.rb
-- spec/rails-4.2/app_root/config/initializers/secret_token.rb
-- spec/rails-4.2/app_root/config/initializers/session_store.rb
-- spec/rails-4.2/app_root/config/routes.rb
-- spec/rails-4.2/app_root/lib/tasks/.gitkeep
-- spec/rails-4.2/app_root/log/.gitkeep
-- spec/rails-4.2/app_root/script/rails
-- spec/rails-4.2/rcov.opts
-- spec/rails-4.2/spec/spec_helper.rb
-- spec/shared/app_root/app/controllers/application_controller.rb
-- spec/shared/app_root/app/helpers/application_helper.rb
-- spec/shared/app_root/app/models/.gitkeep
-- spec/shared/app_root/app/views/test/_test_erb.erb
-- spec/shared/app_root/app/views/test/_test_haml.haml
-- spec/shared/app_root/config/database.yml
-- spec/shared/app_root/db/migrate/.gitkeep
-- spec/shared/support/engine_preventing_angular_xss.rb
-- spec/shared/tests/erb_spec.rb
-- spec/shared/tests/haml_spec.rb
-- spec/shared/tests/safe_buffer_spec.rb
-has_rdoc: 
+specification_version: 4
+summary: Patches rails_xss and Haml so AngularJS interpolations are auto-escaped in
+  unsafe strings.
+test_files:
+- spec/angular_xss/erb_spec.rb
+- spec/angular_xss/haml_spec.rb
+- spec/angular_xss/safe_buffer_spec.rb
+- spec/spec_helper.rb
+- spec/support/engine_preventing_angular_xss.rb
+- spec/templates/_test_erb.erb
+- spec/templates/_test_haml.haml