angular_xss 0.4.1 → 1.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/test.yml +9 -5
- data/.ruby-version +1 -1
- data/CHANGELOG.md +13 -0
- data/{Gemfile.rails-3.2 → Gemfile.rails-3.2.haml-4} +1 -1
- data/{Gemfile.rails-3.2.lock → Gemfile.rails-3.2.haml-4.lock} +4 -4
- data/Gemfile.rails-4.2.haml-4 +1 -1
- data/Gemfile.rails-4.2.haml-4.lock +4 -4
- data/Gemfile.rails-4.2.haml-5 +1 -1
- data/Gemfile.rails-4.2.haml-5.lock +4 -4
- data/Gemfile.rails-5.1.haml-4 +1 -1
- data/Gemfile.rails-5.1.haml-4.lock +8 -6
- data/Gemfile.rails-5.1.haml-5 +1 -1
- data/Gemfile.rails-5.1.haml-5.lock +9 -7
- data/Gemfile.rails-6.1.haml-5 +1 -1
- data/Gemfile.rails-6.1.haml-5.lock +3 -3
- data/Gemfile.rails-7.0.haml-5 +1 -1
- data/Gemfile.rails-7.0.haml-5.lock +7 -5
- data/Gemfile.rails-7.1.haml-5 +9 -0
- data/Gemfile.rails-7.1.haml-5.lock +105 -0
- data/Gemfile.rails-7.1.haml-6 +9 -0
- data/Gemfile.rails-7.1.haml-6.lock +122 -0
- data/README.md +11 -3
- data/lib/angular_xss/erb.rb +17 -27
- data/lib/angular_xss/escaper.rb +8 -0
- data/lib/angular_xss/haml.rb +25 -19
- data/lib/angular_xss/output_buffer.rb +25 -0
- data/lib/angular_xss/version.rb +1 -1
- data/lib/angular_xss.rb +1 -0
- data/spec/angular_xss/erb_spec.rb +46 -3
- data/spec/angular_xss/escaper_spec.rb +21 -0
- data/spec/angular_xss/haml_spec.rb +0 -2
- data/spec/angular_xss/output_buffer_spec.rb +45 -0
- data/spec/angular_xss/safe_buffer_spec.rb +16 -4
- data/spec/spec_helper.rb +5 -11
- data/spec/support/engine_preventing_angular_xss.rb +21 -17
- data/spec/templates/_test_erb.erb +14 -5
- data/spec/templates/_test_haml.haml +40 -23
- metadata +14 -5
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3b6ab389824dfbb7cb7fa43b90922924b71330f335de953f0a07c9034d8bccaa
|
|
4
|
+
data.tar.gz: 70d073c5c2377cd8065ace516f34bffac0e22f8ed321b784390b0d125a05ecf3
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 1a2f62a344faa4bda34bfdfce335058a5a4b58d6f9406ee9d22771494dc1a61fc102c922033ce54123dcb27514a76c035b5e176c87569bb2262ca5d36d8c8982
|
|
7
|
+
data.tar.gz: d33a56cc8c6e6d3d51feea115007ee8f731633880d07a11f21a2c0c4afb6f9325d5134d3b2565867d3304f8f5531bd0c0126c83656107d019a1e68421ad4e730
|
data/.github/workflows/test.yml
CHANGED
|
@@ -15,7 +15,7 @@ jobs:
|
|
|
15
15
|
matrix:
|
|
16
16
|
include:
|
|
17
17
|
- ruby: 2.5.9
|
|
18
|
-
gemfile: Gemfile.rails-3.2
|
|
18
|
+
gemfile: Gemfile.rails-3.2.haml-4
|
|
19
19
|
- ruby: 2.5.9
|
|
20
20
|
gemfile: Gemfile.rails-4.2.haml-4
|
|
21
21
|
- ruby: 2.5.9
|
|
@@ -34,14 +34,18 @@ jobs:
|
|
|
34
34
|
- ruby: 2.7.2
|
|
35
35
|
gemfile: Gemfile.rails-7.0.haml-5
|
|
36
36
|
|
|
37
|
-
- ruby: 3.
|
|
37
|
+
- ruby: 3.2.3
|
|
38
38
|
gemfile: Gemfile.rails-5.1.haml-4
|
|
39
|
-
- ruby: 3.
|
|
39
|
+
- ruby: 3.2.3
|
|
40
40
|
gemfile: Gemfile.rails-5.1.haml-5
|
|
41
|
-
- ruby: 3.
|
|
41
|
+
- ruby: 3.2.3
|
|
42
42
|
gemfile: Gemfile.rails-6.1.haml-5
|
|
43
|
-
- ruby: 3.
|
|
43
|
+
- ruby: 3.2.3
|
|
44
44
|
gemfile: Gemfile.rails-7.0.haml-5
|
|
45
|
+
- ruby: 3.2.3
|
|
46
|
+
gemfile: Gemfile.rails-7.1.haml-5
|
|
47
|
+
- ruby: 3.2.3
|
|
48
|
+
gemfile: Gemfile.rails-7.1.haml-6
|
|
45
49
|
env:
|
|
46
50
|
BUNDLE_GEMFILE: "${{ matrix.gemfile }}"
|
|
47
51
|
steps:
|
data/.ruby-version
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
2.
|
|
1
|
+
3.2.3
|
data/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,19 @@ This project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html
|
|
|
9
9
|
|
|
10
10
|
### Breaking changes
|
|
11
11
|
|
|
12
|
+
## 1.0 2024-07-02
|
|
13
|
+
|
|
14
|
+
### Compatible changes
|
|
15
|
+
* Bump version to 1.0 as this gem is production-ready for 10 years
|
|
16
|
+
* Declare the gem to be unmaintained
|
|
17
|
+
* Add compatibility with Rails 7.1
|
|
18
|
+
* Add compatibility with HAML 6
|
|
19
|
+
* NOTE: Don't use HAML 6.0.0. AngularXSS relies on a patch [introduced in 6.0.1](https://github.com/haml/haml/blob/main/CHANGELOG.md#601). Anything newer should be fine - the gem is currently tested against HAML 6.3
|
|
20
|
+
* Refactor our patches to use `Module#prepend` instead of `Module#module_eval`
|
|
21
|
+
* Refactor gem version comparisons to use `Gem::Version` instances
|
|
22
|
+
* Refactor specs to use the `expect` syntax
|
|
23
|
+
* Improve test coverage for more interpolation scenarios in ERB and HAML
|
|
24
|
+
* Add unit tests for patched methods
|
|
12
25
|
|
|
13
26
|
## 0.4.1 2022-03-16
|
|
14
27
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -28,7 +28,7 @@ GEM
|
|
|
28
28
|
concurrent-ruby (1.0.5)
|
|
29
29
|
diff-lcs (1.3)
|
|
30
30
|
erubis (2.7.0)
|
|
31
|
-
gemika (0.
|
|
31
|
+
gemika (0.8.3)
|
|
32
32
|
haml (4.0.2)
|
|
33
33
|
tilt
|
|
34
34
|
hike (1.2.3)
|
|
@@ -81,11 +81,11 @@ PLATFORMS
|
|
|
81
81
|
DEPENDENCIES
|
|
82
82
|
actionpack (~> 3.2)
|
|
83
83
|
angular_xss!
|
|
84
|
-
gemika
|
|
84
|
+
gemika (>= 0.8.3)
|
|
85
85
|
haml (= 4.0.2)
|
|
86
86
|
railties (~> 3.2)
|
|
87
87
|
rake
|
|
88
88
|
rspec
|
|
89
89
|
|
|
90
90
|
BUNDLED WITH
|
|
91
|
-
1.
|
|
91
|
+
2.1.4
|
data/Gemfile.rails-4.2.haml-4
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubis (2.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (4.0.7)
|
|
36
36
|
tilt
|
|
37
37
|
i18n (0.9.1)
|
|
@@ -79,10 +79,10 @@ PLATFORMS
|
|
|
79
79
|
DEPENDENCIES
|
|
80
80
|
actionpack (~> 4.2)
|
|
81
81
|
angular_xss!
|
|
82
|
-
gemika
|
|
82
|
+
gemika (>= 0.8.3)
|
|
83
83
|
haml (< 5)
|
|
84
84
|
rake
|
|
85
85
|
rspec
|
|
86
86
|
|
|
87
87
|
BUNDLED WITH
|
|
88
|
-
1.
|
|
88
|
+
2.1.4
|
data/Gemfile.rails-4.2.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubis (2.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (5.0.4)
|
|
36
36
|
temple (>= 0.8.0)
|
|
37
37
|
tilt
|
|
@@ -81,10 +81,10 @@ PLATFORMS
|
|
|
81
81
|
DEPENDENCIES
|
|
82
82
|
actionpack (~> 4.2)
|
|
83
83
|
angular_xss!
|
|
84
|
-
gemika
|
|
84
|
+
gemika (>= 0.8.3)
|
|
85
85
|
haml (~> 5)
|
|
86
86
|
rake
|
|
87
87
|
rspec
|
|
88
88
|
|
|
89
89
|
BUNDLED WITH
|
|
90
|
-
1.
|
|
90
|
+
2.1.4
|
data/Gemfile.rails-5.1.haml-4
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubi (1.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (4.0.7)
|
|
36
36
|
tilt
|
|
37
37
|
i18n (0.9.1)
|
|
@@ -39,10 +39,12 @@ GEM
|
|
|
39
39
|
loofah (2.1.1)
|
|
40
40
|
crass (~> 1.0.2)
|
|
41
41
|
nokogiri (>= 1.5.9)
|
|
42
|
-
mini_portile2 (2.3
|
|
42
|
+
mini_portile2 (2.5.3)
|
|
43
43
|
minitest (5.10.3)
|
|
44
|
-
nokogiri (1.
|
|
45
|
-
mini_portile2 (~> 2.
|
|
44
|
+
nokogiri (1.11.7)
|
|
45
|
+
mini_portile2 (~> 2.5.0)
|
|
46
|
+
racc (~> 1.4)
|
|
47
|
+
racc (1.7.3)
|
|
46
48
|
rack (2.0.3)
|
|
47
49
|
rack-test (0.8.2)
|
|
48
50
|
rack (>= 1.0, < 3)
|
|
@@ -76,7 +78,7 @@ PLATFORMS
|
|
|
76
78
|
DEPENDENCIES
|
|
77
79
|
actionpack (~> 5.1)
|
|
78
80
|
angular_xss!
|
|
79
|
-
gemika
|
|
81
|
+
gemika (>= 0.8.3)
|
|
80
82
|
haml (< 5)
|
|
81
83
|
rake
|
|
82
84
|
rspec
|
data/Gemfile.rails-5.1.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubi (1.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (5.0.4)
|
|
36
36
|
temple (>= 0.8.0)
|
|
37
37
|
tilt
|
|
@@ -40,10 +40,12 @@ GEM
|
|
|
40
40
|
loofah (2.1.1)
|
|
41
41
|
crass (~> 1.0.2)
|
|
42
42
|
nokogiri (>= 1.5.9)
|
|
43
|
-
mini_portile2 (2.3
|
|
43
|
+
mini_portile2 (2.5.3)
|
|
44
44
|
minitest (5.10.3)
|
|
45
|
-
nokogiri (1.
|
|
46
|
-
mini_portile2 (~> 2.
|
|
45
|
+
nokogiri (1.11.7)
|
|
46
|
+
mini_portile2 (~> 2.5.0)
|
|
47
|
+
racc (~> 1.4)
|
|
48
|
+
racc (1.7.3)
|
|
47
49
|
rack (2.0.3)
|
|
48
50
|
rack-test (0.8.2)
|
|
49
51
|
rack (>= 1.0, < 3)
|
|
@@ -52,7 +54,7 @@ GEM
|
|
|
52
54
|
nokogiri (>= 1.6)
|
|
53
55
|
rails-html-sanitizer (1.0.3)
|
|
54
56
|
loofah (~> 2.0)
|
|
55
|
-
rake (
|
|
57
|
+
rake (13.2.1)
|
|
56
58
|
rspec (3.10.0)
|
|
57
59
|
rspec-core (~> 3.10.0)
|
|
58
60
|
rspec-expectations (~> 3.10.0)
|
|
@@ -78,7 +80,7 @@ PLATFORMS
|
|
|
78
80
|
DEPENDENCIES
|
|
79
81
|
actionpack (~> 5.1)
|
|
80
82
|
angular_xss!
|
|
81
|
-
gemika
|
|
83
|
+
gemika (>= 0.8.3)
|
|
82
84
|
haml (~> 5)
|
|
83
85
|
rake
|
|
84
86
|
rspec
|
data/Gemfile.rails-6.1.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -32,7 +32,7 @@ GEM
|
|
|
32
32
|
crass (1.0.6)
|
|
33
33
|
diff-lcs (1.4.4)
|
|
34
34
|
erubi (1.10.0)
|
|
35
|
-
gemika (0.
|
|
35
|
+
gemika (0.8.3)
|
|
36
36
|
haml (5.2.1)
|
|
37
37
|
temple (>= 0.8.0)
|
|
38
38
|
tilt
|
|
@@ -81,7 +81,7 @@ PLATFORMS
|
|
|
81
81
|
DEPENDENCIES
|
|
82
82
|
actionpack (~> 6.1)
|
|
83
83
|
angular_xss!
|
|
84
|
-
gemika
|
|
84
|
+
gemika (>= 0.8.3)
|
|
85
85
|
haml (~> 5)
|
|
86
86
|
rake
|
|
87
87
|
rspec
|
data/Gemfile.rails-7.0.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.6)
|
|
32
32
|
diff-lcs (1.4.4)
|
|
33
33
|
erubi (1.10.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (5.2.2)
|
|
36
36
|
temple (>= 0.8.0)
|
|
37
37
|
tilt
|
|
@@ -40,8 +40,10 @@ GEM
|
|
|
40
40
|
loofah (2.13.0)
|
|
41
41
|
crass (~> 1.0.2)
|
|
42
42
|
nokogiri (>= 1.5.9)
|
|
43
|
+
mini_portile2 (2.6.1)
|
|
43
44
|
minitest (5.15.0)
|
|
44
|
-
nokogiri (1.12.5
|
|
45
|
+
nokogiri (1.12.5)
|
|
46
|
+
mini_portile2 (~> 2.6.1)
|
|
45
47
|
racc (~> 1.4)
|
|
46
48
|
racc (1.6.0)
|
|
47
49
|
rack (2.2.3)
|
|
@@ -72,12 +74,12 @@ GEM
|
|
|
72
74
|
concurrent-ruby (~> 1.0)
|
|
73
75
|
|
|
74
76
|
PLATFORMS
|
|
75
|
-
|
|
77
|
+
ruby
|
|
76
78
|
|
|
77
79
|
DEPENDENCIES
|
|
78
80
|
actionpack (~> 7.0)
|
|
79
81
|
angular_xss!
|
|
80
|
-
gemika
|
|
82
|
+
gemika (>= 0.8.3)
|
|
81
83
|
haml (~> 5)
|
|
82
84
|
rake
|
|
83
85
|
rspec
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
PATH
|
|
2
|
+
remote: .
|
|
3
|
+
specs:
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
|
+
activesupport
|
|
6
|
+
haml (>= 3.1.5)
|
|
7
|
+
|
|
8
|
+
GEM
|
|
9
|
+
remote: http://rubygems.org/
|
|
10
|
+
specs:
|
|
11
|
+
actionpack (7.1.3.4)
|
|
12
|
+
actionview (= 7.1.3.4)
|
|
13
|
+
activesupport (= 7.1.3.4)
|
|
14
|
+
nokogiri (>= 1.8.5)
|
|
15
|
+
racc
|
|
16
|
+
rack (>= 2.2.4)
|
|
17
|
+
rack-session (>= 1.0.1)
|
|
18
|
+
rack-test (>= 0.6.3)
|
|
19
|
+
rails-dom-testing (~> 2.2)
|
|
20
|
+
rails-html-sanitizer (~> 1.6)
|
|
21
|
+
actionview (7.1.3.4)
|
|
22
|
+
activesupport (= 7.1.3.4)
|
|
23
|
+
builder (~> 3.1)
|
|
24
|
+
erubi (~> 1.11)
|
|
25
|
+
rails-dom-testing (~> 2.2)
|
|
26
|
+
rails-html-sanitizer (~> 1.6)
|
|
27
|
+
activesupport (7.1.3.4)
|
|
28
|
+
base64
|
|
29
|
+
bigdecimal
|
|
30
|
+
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
31
|
+
connection_pool (>= 2.2.5)
|
|
32
|
+
drb
|
|
33
|
+
i18n (>= 1.6, < 2)
|
|
34
|
+
minitest (>= 5.1)
|
|
35
|
+
mutex_m
|
|
36
|
+
tzinfo (~> 2.0)
|
|
37
|
+
base64 (0.2.0)
|
|
38
|
+
bigdecimal (3.1.8)
|
|
39
|
+
builder (3.3.0)
|
|
40
|
+
byebug (11.1.3)
|
|
41
|
+
concurrent-ruby (1.3.3)
|
|
42
|
+
connection_pool (2.4.1)
|
|
43
|
+
crass (1.0.6)
|
|
44
|
+
diff-lcs (1.5.1)
|
|
45
|
+
drb (2.2.1)
|
|
46
|
+
erubi (1.13.0)
|
|
47
|
+
gemika (0.8.3)
|
|
48
|
+
haml (5.2.2)
|
|
49
|
+
temple (>= 0.8.0)
|
|
50
|
+
tilt
|
|
51
|
+
i18n (1.14.5)
|
|
52
|
+
concurrent-ruby (~> 1.0)
|
|
53
|
+
loofah (2.22.0)
|
|
54
|
+
crass (~> 1.0.2)
|
|
55
|
+
nokogiri (>= 1.12.0)
|
|
56
|
+
minitest (5.23.1)
|
|
57
|
+
mutex_m (0.2.0)
|
|
58
|
+
nokogiri (1.16.6-x86_64-linux)
|
|
59
|
+
racc (~> 1.4)
|
|
60
|
+
racc (1.8.0)
|
|
61
|
+
rack (3.1.3)
|
|
62
|
+
rack-session (2.0.0)
|
|
63
|
+
rack (>= 3.0.0)
|
|
64
|
+
rack-test (2.1.0)
|
|
65
|
+
rack (>= 1.3)
|
|
66
|
+
rails-dom-testing (2.2.0)
|
|
67
|
+
activesupport (>= 5.0.0)
|
|
68
|
+
minitest
|
|
69
|
+
nokogiri (>= 1.6)
|
|
70
|
+
rails-html-sanitizer (1.6.0)
|
|
71
|
+
loofah (~> 2.21)
|
|
72
|
+
nokogiri (~> 1.14)
|
|
73
|
+
rake (13.2.1)
|
|
74
|
+
rspec (3.13.0)
|
|
75
|
+
rspec-core (~> 3.13.0)
|
|
76
|
+
rspec-expectations (~> 3.13.0)
|
|
77
|
+
rspec-mocks (~> 3.13.0)
|
|
78
|
+
rspec-core (3.13.0)
|
|
79
|
+
rspec-support (~> 3.13.0)
|
|
80
|
+
rspec-expectations (3.13.1)
|
|
81
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
82
|
+
rspec-support (~> 3.13.0)
|
|
83
|
+
rspec-mocks (3.13.1)
|
|
84
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
85
|
+
rspec-support (~> 3.13.0)
|
|
86
|
+
rspec-support (3.13.1)
|
|
87
|
+
temple (0.10.3)
|
|
88
|
+
tilt (2.3.0)
|
|
89
|
+
tzinfo (2.0.6)
|
|
90
|
+
concurrent-ruby (~> 1.0)
|
|
91
|
+
|
|
92
|
+
PLATFORMS
|
|
93
|
+
x86_64-linux
|
|
94
|
+
|
|
95
|
+
DEPENDENCIES
|
|
96
|
+
actionpack (~> 7.1)
|
|
97
|
+
angular_xss!
|
|
98
|
+
byebug
|
|
99
|
+
gemika (>= 0.8.3)
|
|
100
|
+
haml (~> 5)
|
|
101
|
+
rake
|
|
102
|
+
rspec
|
|
103
|
+
|
|
104
|
+
BUNDLED WITH
|
|
105
|
+
2.5.13
|
|
@@ -0,0 +1,122 @@
|
|
|
1
|
+
PATH
|
|
2
|
+
remote: .
|
|
3
|
+
specs:
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
|
+
activesupport
|
|
6
|
+
haml (>= 3.1.5)
|
|
7
|
+
|
|
8
|
+
GEM
|
|
9
|
+
remote: http://rubygems.org/
|
|
10
|
+
specs:
|
|
11
|
+
actionpack (7.1.3.4)
|
|
12
|
+
actionview (= 7.1.3.4)
|
|
13
|
+
activesupport (= 7.1.3.4)
|
|
14
|
+
nokogiri (>= 1.8.5)
|
|
15
|
+
racc
|
|
16
|
+
rack (>= 2.2.4)
|
|
17
|
+
rack-session (>= 1.0.1)
|
|
18
|
+
rack-test (>= 0.6.3)
|
|
19
|
+
rails-dom-testing (~> 2.2)
|
|
20
|
+
rails-html-sanitizer (~> 1.6)
|
|
21
|
+
actionview (7.1.3.4)
|
|
22
|
+
activesupport (= 7.1.3.4)
|
|
23
|
+
builder (~> 3.1)
|
|
24
|
+
erubi (~> 1.11)
|
|
25
|
+
rails-dom-testing (~> 2.2)
|
|
26
|
+
rails-html-sanitizer (~> 1.6)
|
|
27
|
+
activesupport (7.1.3.4)
|
|
28
|
+
base64
|
|
29
|
+
bigdecimal
|
|
30
|
+
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
31
|
+
connection_pool (>= 2.2.5)
|
|
32
|
+
drb
|
|
33
|
+
i18n (>= 1.6, < 2)
|
|
34
|
+
minitest (>= 5.1)
|
|
35
|
+
mutex_m
|
|
36
|
+
tzinfo (~> 2.0)
|
|
37
|
+
base64 (0.2.0)
|
|
38
|
+
bigdecimal (3.1.8)
|
|
39
|
+
builder (3.3.0)
|
|
40
|
+
byebug (11.1.3)
|
|
41
|
+
concurrent-ruby (1.3.3)
|
|
42
|
+
connection_pool (2.4.1)
|
|
43
|
+
crass (1.0.6)
|
|
44
|
+
diff-lcs (1.5.1)
|
|
45
|
+
drb (2.2.1)
|
|
46
|
+
erubi (1.13.0)
|
|
47
|
+
gemika (0.8.3)
|
|
48
|
+
haml (6.3.0)
|
|
49
|
+
temple (>= 0.8.2)
|
|
50
|
+
thor
|
|
51
|
+
tilt
|
|
52
|
+
i18n (1.14.5)
|
|
53
|
+
concurrent-ruby (~> 1.0)
|
|
54
|
+
loofah (2.22.0)
|
|
55
|
+
crass (~> 1.0.2)
|
|
56
|
+
nokogiri (>= 1.12.0)
|
|
57
|
+
minitest (5.24.0)
|
|
58
|
+
mutex_m (0.2.0)
|
|
59
|
+
nokogiri (1.16.6-aarch64-linux)
|
|
60
|
+
racc (~> 1.4)
|
|
61
|
+
nokogiri (1.16.6-arm-linux)
|
|
62
|
+
racc (~> 1.4)
|
|
63
|
+
nokogiri (1.16.6-arm64-darwin)
|
|
64
|
+
racc (~> 1.4)
|
|
65
|
+
nokogiri (1.16.6-x86-linux)
|
|
66
|
+
racc (~> 1.4)
|
|
67
|
+
nokogiri (1.16.6-x86_64-darwin)
|
|
68
|
+
racc (~> 1.4)
|
|
69
|
+
nokogiri (1.16.6-x86_64-linux)
|
|
70
|
+
racc (~> 1.4)
|
|
71
|
+
racc (1.8.0)
|
|
72
|
+
rack (3.1.3)
|
|
73
|
+
rack-session (2.0.0)
|
|
74
|
+
rack (>= 3.0.0)
|
|
75
|
+
rack-test (2.1.0)
|
|
76
|
+
rack (>= 1.3)
|
|
77
|
+
rails-dom-testing (2.2.0)
|
|
78
|
+
activesupport (>= 5.0.0)
|
|
79
|
+
minitest
|
|
80
|
+
nokogiri (>= 1.6)
|
|
81
|
+
rails-html-sanitizer (1.6.0)
|
|
82
|
+
loofah (~> 2.21)
|
|
83
|
+
nokogiri (~> 1.14)
|
|
84
|
+
rake (13.2.1)
|
|
85
|
+
rspec (3.13.0)
|
|
86
|
+
rspec-core (~> 3.13.0)
|
|
87
|
+
rspec-expectations (~> 3.13.0)
|
|
88
|
+
rspec-mocks (~> 3.13.0)
|
|
89
|
+
rspec-core (3.13.0)
|
|
90
|
+
rspec-support (~> 3.13.0)
|
|
91
|
+
rspec-expectations (3.13.1)
|
|
92
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
93
|
+
rspec-support (~> 3.13.0)
|
|
94
|
+
rspec-mocks (3.13.1)
|
|
95
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
96
|
+
rspec-support (~> 3.13.0)
|
|
97
|
+
rspec-support (3.13.1)
|
|
98
|
+
temple (0.10.3)
|
|
99
|
+
thor (1.3.1)
|
|
100
|
+
tilt (2.3.0)
|
|
101
|
+
tzinfo (2.0.6)
|
|
102
|
+
concurrent-ruby (~> 1.0)
|
|
103
|
+
|
|
104
|
+
PLATFORMS
|
|
105
|
+
aarch64-linux
|
|
106
|
+
arm-linux
|
|
107
|
+
arm64-darwin
|
|
108
|
+
x86-linux
|
|
109
|
+
x86_64-darwin
|
|
110
|
+
x86_64-linux
|
|
111
|
+
|
|
112
|
+
DEPENDENCIES
|
|
113
|
+
actionpack (~> 7.1)
|
|
114
|
+
angular_xss!
|
|
115
|
+
byebug
|
|
116
|
+
gemika (>= 0.8.3)
|
|
117
|
+
haml (~> 6)
|
|
118
|
+
rake
|
|
119
|
+
rspec
|
|
120
|
+
|
|
121
|
+
BUNDLED WITH
|
|
122
|
+
2.5.13
|
data/README.md
CHANGED
|
@@ -7,6 +7,12 @@ This gem patches ERB/rails_xss and Haml so Angular interpolation symbols are aut
|
|
|
7
7
|
|
|
8
8
|
**This is an unsatisfactory hack.** A better solution is very much desired, but is not possible without some changes in AngularJS. See the [related AngularJS issue](https://github.com/angular/angular.js/issues/5601).
|
|
9
9
|
|
|
10
|
+
🚧 Notice: unmaintained gem
|
|
11
|
+
------------------
|
|
12
|
+
|
|
13
|
+
We are no longer actively maintaining this gem.
|
|
14
|
+
|
|
15
|
+
The `1.0` release added support for HAML 6 and Rails 7.1, so the gem will at least support Rails 3.2 - 7.1 and HAML 4 - 6. `angular_xss` might still work for future versions HAML and Rails, but we won't actively ensure it does.
|
|
10
16
|
|
|
11
17
|
Disable escaping locally
|
|
12
18
|
------------------------
|
|
@@ -56,11 +62,13 @@ Development
|
|
|
56
62
|
-----------
|
|
57
63
|
|
|
58
64
|
- Fork the repository.
|
|
59
|
-
-
|
|
60
|
-
-
|
|
65
|
+
- Prepare your changes, and ensure existing and new test are green:
|
|
66
|
+
- `bundle exec rake matrix:install` installs all dependencies for all Gemfiles
|
|
67
|
+
- `bundle exec rake matrix:spec` runs all specs in all configurations
|
|
68
|
+
- You may run single tests with a specified Rails version via `BUNDLE_GEMFILE=Gemfile.rails-7.0.haml-5 bundle exec rspec ./spec/angular_xss`
|
|
69
|
+
- Push your changes with specs. There is a test application in `spec/app_root` if you need to test integration with a live Rails app.
|
|
61
70
|
- Send a pull request.
|
|
62
71
|
|
|
63
|
-
|
|
64
72
|
Credits
|
|
65
73
|
-------
|
|
66
74
|
|
data/lib/angular_xss/erb.rb
CHANGED
|
@@ -1,33 +1,25 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
s = s.to_s
|
|
8
|
-
if s.html_safe?
|
|
9
|
-
s
|
|
10
|
-
else
|
|
11
|
-
unwrapped_html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
|
|
12
|
-
end
|
|
1
|
+
if ERB::Util.private_method_defined? :unwrapped_html_escape
|
|
2
|
+
# Rails 4.2+
|
|
3
|
+
# https://github.com/rails/rails/blob/main/activesupport/lib/active_support/core_ext/erb/util.rb
|
|
4
|
+
module ERBUtilExt
|
|
5
|
+
def html_escape_once(s)
|
|
6
|
+
super(AngularXss::Escaper.escape_if_unsafe(s))
|
|
13
7
|
end
|
|
14
8
|
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
9
|
+
def unwrapped_html_escape(s)
|
|
10
|
+
super(AngularXss::Escaper.escape_if_unsafe(s))
|
|
11
|
+
end
|
|
12
|
+
# Note that html_escape() and h() are passively fixed as they are calling the two methods above
|
|
13
|
+
end
|
|
14
|
+
ERB::Util.prepend ERBUtilExt
|
|
15
|
+
ERB::Util.singleton_class.prepend ERBUtilExt
|
|
21
16
|
|
|
22
|
-
|
|
17
|
+
else
|
|
18
|
+
ERB::Util.module_eval do
|
|
19
|
+
# Rails < 4.2
|
|
23
20
|
|
|
24
21
|
def html_escape_with_escaping_angular_expressions(s)
|
|
25
|
-
s
|
|
26
|
-
if s.html_safe?
|
|
27
|
-
s
|
|
28
|
-
else
|
|
29
|
-
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
|
|
30
|
-
end
|
|
22
|
+
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape_if_unsafe(s))
|
|
31
23
|
end
|
|
32
24
|
|
|
33
25
|
alias_method_chain :html_escape, :escaping_angular_expressions
|
|
@@ -41,7 +33,5 @@ ERB::Util.module_eval do
|
|
|
41
33
|
singleton_class.send(:remove_method, :html_escape)
|
|
42
34
|
module_function :html_escape
|
|
43
35
|
module_function :html_escape_without_escaping_angular_expressions
|
|
44
|
-
|
|
45
36
|
end
|
|
46
|
-
|
|
47
37
|
end
|
data/lib/angular_xss/escaper.rb
CHANGED
data/lib/angular_xss/haml.rb
CHANGED
|
@@ -1,32 +1,38 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
haml_version = Gem::Version.new(Haml::VERSION)
|
|
2
|
+
|
|
3
|
+
if haml_version < Gem::Version.new(5)
|
|
3
4
|
# Use module_eval so we crash when Haml::Helpers has not yet been loaded.
|
|
4
5
|
Haml::Helpers.module_eval do
|
|
5
|
-
|
|
6
6
|
def html_escape_with_escaping_angular_expressions(s)
|
|
7
|
-
s
|
|
8
|
-
if s.html_safe?
|
|
9
|
-
s
|
|
10
|
-
else
|
|
11
|
-
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
|
|
12
|
-
end
|
|
7
|
+
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape_if_unsafe(s))
|
|
13
8
|
end
|
|
14
9
|
|
|
15
10
|
alias_method :html_escape_without_escaping_angular_expressions, :html_escape
|
|
16
11
|
alias_method :html_escape, :html_escape_with_escaping_angular_expressions
|
|
17
12
|
end
|
|
13
|
+
elsif haml_version < Gem::Version.new('5.2')
|
|
14
|
+
# Haml 5.0 and 5.1 fall back to erb
|
|
15
|
+
elsif haml_version < Gem::Version.new(6)
|
|
16
|
+
# HAML 5.2+
|
|
17
|
+
module HTMLEscapeWithoutHAMLWithAngularXSS
|
|
18
|
+
def html_escape_without_haml_xss(html)
|
|
19
|
+
super(AngularXss::Escaper.escape_if_unsafe(html))
|
|
20
|
+
end
|
|
21
|
+
end
|
|
18
22
|
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
Haml::Helpers.singleton_class.prepend HTMLEscapeWithoutHAMLWithAngularXSS
|
|
24
|
+
else
|
|
25
|
+
# Haml 6+
|
|
26
|
+
# It ditched most of is own helpers in favor of Haml::Util.escape_html
|
|
27
|
+
# https://github.com/haml/haml/blob/main/CHANGELOG.md#600
|
|
28
|
+
# https://github.com/haml/haml/compare/v5.2.2...v6.3.0
|
|
29
|
+
# https://github.com/haml/haml/blob/v6.3.0/lib/haml/util.rb
|
|
25
30
|
|
|
26
|
-
|
|
31
|
+
module EscapeHTMLWithAngularXSS
|
|
32
|
+
def escape_html(html)
|
|
33
|
+
super(AngularXss::Escaper.escape_if_unsafe(html))
|
|
27
34
|
end
|
|
28
|
-
|
|
29
|
-
alias_method :html_escape_without_haml_xss_without_escaping_angular_expressions, :html_escape_without_haml_xss
|
|
30
|
-
alias_method :html_escape_without_haml_xss, :html_escape_without_haml_xss_with_escaping_angular_expressions
|
|
31
35
|
end
|
|
36
|
+
|
|
37
|
+
Haml::Util.singleton_class.prepend EscapeHTMLWithAngularXSS
|
|
32
38
|
end
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
##
|
|
2
|
+
# Monkey patch ActionView::OutputBuffer to escape double braces from Angular
|
|
3
|
+
#
|
|
4
|
+
# Link to the original implementation without Angular XSS escaping:
|
|
5
|
+
# https://github.com/rails/rails/blob/v7.1.3.4/actionview/lib/action_view/buffers.rb
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
if defined?(ActionView::VERSION) && Gem::Version.new(ActionView::VERSION::STRING) >= Gem::Version.new('7.1')
|
|
9
|
+
# ActionView < 7.1 used our patched ERB::Util.h to escape, 7.1 switched to CGI.escapeHTML
|
|
10
|
+
module OutputBufferWithEscapedAngularXSS
|
|
11
|
+
def <<(value)
|
|
12
|
+
super(AngularXss::Escaper.escape_if_unsafe(value))
|
|
13
|
+
end
|
|
14
|
+
|
|
15
|
+
def concat(value)
|
|
16
|
+
super(AngularXss::Escaper.escape_if_unsafe(value))
|
|
17
|
+
end
|
|
18
|
+
|
|
19
|
+
def append=(value)
|
|
20
|
+
super(AngularXss::Escaper.escape_if_unsafe(value))
|
|
21
|
+
end
|
|
22
|
+
end
|
|
23
|
+
|
|
24
|
+
ActionView::OutputBuffer.prepend OutputBufferWithEscapedAngularXSS
|
|
25
|
+
end
|
data/lib/angular_xss/version.rb
CHANGED
data/lib/angular_xss.rb
CHANGED
|
@@ -1,7 +1,50 @@
|
|
|
1
|
-
require 'spec_helper'
|
|
2
|
-
|
|
3
1
|
describe 'Angular XSS prevention in ERB', :type => :view do
|
|
4
|
-
|
|
5
2
|
it_should_behave_like 'engine preventing Angular XSS', :partial => 'test_erb'
|
|
3
|
+
end
|
|
4
|
+
|
|
5
|
+
describe ERB::Util do
|
|
6
|
+
describe '#html_escape' do
|
|
7
|
+
it 'escapes angular braces' do
|
|
8
|
+
expect(described_class.html_escape("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
9
|
+
end
|
|
10
|
+
|
|
11
|
+
it 'does not modify already HTML safe strings' do
|
|
12
|
+
expect(described_class.html_escape("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
13
|
+
end
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
describe '#h' do
|
|
17
|
+
it 'escapes angular braces' do
|
|
18
|
+
expect(described_class.h("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
it 'does not modify already HTML safe strings' do
|
|
22
|
+
expect(described_class.h("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
23
|
+
end
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
# Rails < 4 does not implement unwrapped_html_escape and html_escape_once
|
|
27
|
+
if described_class.method_defined? :unwrapped_html_escape
|
|
28
|
+
describe '#unwrapped_html_escape' do
|
|
29
|
+
it 'escapes angular braces' do
|
|
30
|
+
expect(described_class.unwrapped_html_escape("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
31
|
+
end
|
|
32
|
+
|
|
33
|
+
it 'does not modify already HTML safe strings' do
|
|
34
|
+
expect(described_class.unwrapped_html_escape("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
35
|
+
end
|
|
36
|
+
end
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
if described_class.method_defined? :html_escape_once
|
|
40
|
+
describe '#html_escape_once' do
|
|
41
|
+
it 'escapes angular braces' do
|
|
42
|
+
expect(described_class.html_escape_once("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
43
|
+
end
|
|
6
44
|
|
|
45
|
+
it 'does not modify already HTML safe strings' do
|
|
46
|
+
expect(described_class.html_escape_once("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
47
|
+
end
|
|
48
|
+
end
|
|
49
|
+
end
|
|
7
50
|
end
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
describe AngularXss::Escaper do
|
|
2
|
+
describe '.escape' do
|
|
3
|
+
it 'replaces double braces with a closed variant' do
|
|
4
|
+
expect(described_class.escape('{{')).to eq('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}')
|
|
5
|
+
end
|
|
6
|
+
|
|
7
|
+
it 'does not handle HTML safe strings differently' do
|
|
8
|
+
expect(described_class.escape('{{'.html_safe)).to eq('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}')
|
|
9
|
+
end
|
|
10
|
+
end
|
|
11
|
+
|
|
12
|
+
describe '.escape_if_unsafe' do
|
|
13
|
+
it 'replaces double braces with a closed variant' do
|
|
14
|
+
expect(described_class.escape_if_unsafe('{{')).to eq('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}')
|
|
15
|
+
end
|
|
16
|
+
|
|
17
|
+
it 'does not modify HTML safe strings' do
|
|
18
|
+
expect(described_class.escape_if_unsafe('{{'.html_safe)).to eq('{{')
|
|
19
|
+
end
|
|
20
|
+
end
|
|
21
|
+
end
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
describe ActionView::OutputBuffer do
|
|
2
|
+
describe '#<<' do
|
|
3
|
+
it 'escapes angular braces' do
|
|
4
|
+
expect((subject << "{{unsafe}}").to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
5
|
+
end
|
|
6
|
+
|
|
7
|
+
it 'does not change behavior for already HTML safe strings' do
|
|
8
|
+
expect((subject << "{{safe}}".html_safe).to_s).to eq("{{safe}}")
|
|
9
|
+
end
|
|
10
|
+
|
|
11
|
+
it 'allows concatting nil' do
|
|
12
|
+
expect { subject << nil }.to_not raise_error
|
|
13
|
+
end
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
describe '#concat' do
|
|
17
|
+
it 'escapes angular braces' do
|
|
18
|
+
expect((subject.concat "{{unsafe}}").to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
it 'does not change behavior for already HTML safe strings' do
|
|
22
|
+
expect((subject.concat "{{safe}}".html_safe).to_s).to eq("{{safe}}")
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
it 'allows concatting nil' do
|
|
26
|
+
expect { subject.concat nil }.to_not raise_error
|
|
27
|
+
end
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
describe '#append=' do
|
|
31
|
+
it 'escapes angular braces' do
|
|
32
|
+
subject.append = "{{unsafe}}"
|
|
33
|
+
expect(subject.to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
34
|
+
end
|
|
35
|
+
|
|
36
|
+
it 'does not change behavior for already HTML safe strings' do
|
|
37
|
+
subject.append = "{{safe}}".html_safe
|
|
38
|
+
expect(subject.to_s).to eq("{{safe}}")
|
|
39
|
+
end
|
|
40
|
+
|
|
41
|
+
it 'allows concatting nil' do
|
|
42
|
+
expect { subject.append = nil }.to_not raise_error
|
|
43
|
+
end
|
|
44
|
+
end
|
|
45
|
+
end
|
|
@@ -1,9 +1,21 @@
|
|
|
1
|
-
require 'spec_helper'
|
|
2
|
-
|
|
3
1
|
describe ActiveSupport::SafeBuffer do
|
|
4
2
|
|
|
5
|
-
|
|
6
|
-
|
|
3
|
+
describe '#<<' do
|
|
4
|
+
it 'escapes angular braces' do
|
|
5
|
+
subject << "{{unsafe}}"
|
|
6
|
+
expect(subject.to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
7
|
+
end
|
|
8
|
+
|
|
9
|
+
it 'allows concatting nil' do
|
|
10
|
+
expect { subject << nil }.to_not raise_error
|
|
11
|
+
end
|
|
12
|
+
end
|
|
13
|
+
|
|
14
|
+
describe '#+' do
|
|
15
|
+
it 'escapes angular braces' do
|
|
16
|
+
combined_string = subject + "{{unsafe}}"
|
|
17
|
+
expect(combined_string.to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
18
|
+
end
|
|
7
19
|
end
|
|
8
20
|
|
|
9
21
|
end
|
data/spec/spec_helper.rb
CHANGED
|
@@ -17,7 +17,11 @@ module Rails
|
|
|
17
17
|
end
|
|
18
18
|
|
|
19
19
|
require 'haml'
|
|
20
|
-
|
|
20
|
+
if Gem::Version.new(Haml::VERSION) < Gem::Version.new(6)
|
|
21
|
+
require 'haml/template'
|
|
22
|
+
else
|
|
23
|
+
require 'haml/rails_template'
|
|
24
|
+
end
|
|
21
25
|
|
|
22
26
|
require 'angular_xss'
|
|
23
27
|
|
|
@@ -25,13 +29,3 @@ require 'angular_xss'
|
|
|
25
29
|
Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
|
|
26
30
|
|
|
27
31
|
TEMPLATE_ROOT = Pathname.new(__dir__).join('templates')
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
RSpec.configure do |config|
|
|
31
|
-
config.mock_with :rspec do |c|
|
|
32
|
-
c.syntax = [:should, :expect]
|
|
33
|
-
end
|
|
34
|
-
config.expect_with :rspec do |c|
|
|
35
|
-
c.syntax = [:should, :expect]
|
|
36
|
-
end
|
|
37
|
-
end
|
|
@@ -2,7 +2,7 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
2
2
|
|
|
3
3
|
let(:path_set) { ActionView::LookupContext.new([TEMPLATE_ROOT]) }
|
|
4
4
|
|
|
5
|
-
if defined?(ActionView::VERSION) && ActionView::VERSION::MAJOR >= 6
|
|
5
|
+
if defined?(ActionView::VERSION) && Gem::Version.new(ActionView::VERSION::MAJOR) >= Gem::Version.new(6)
|
|
6
6
|
let(:engine) { ActionView::Base.with_empty_template_cache.new(path_set, {}, nil) }
|
|
7
7
|
else
|
|
8
8
|
let(:engine) { ActionView::Base.new(path_set) }
|
|
@@ -11,14 +11,18 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
11
11
|
let(:html) { engine.render(partial) }
|
|
12
12
|
|
|
13
13
|
it 'escapes Angular interpolation marks in unsafe strings' do
|
|
14
|
-
html.
|
|
15
|
-
html.
|
|
14
|
+
expect(html).not_to include('{{unsafe}}')
|
|
15
|
+
expect(html).to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
16
16
|
end
|
|
17
17
|
|
|
18
18
|
it 'recognizes the many ways to express an opening curly brace in HTML' do
|
|
19
|
+
# Only unsafe strings are escaped
|
|
20
|
+
expect(html).to include("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
21
|
+
expect(html).not_to include("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}safe}}")
|
|
19
22
|
|
|
20
|
-
|
|
21
|
-
html.
|
|
23
|
+
# Only safe strings with braces are left untouched
|
|
24
|
+
expect(html).to include("{{safe}}")
|
|
25
|
+
expect(html).not_to include("{{unsafe}}")
|
|
22
26
|
|
|
23
27
|
braces = [
|
|
24
28
|
'{',
|
|
@@ -35,15 +39,15 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
35
39
|
|
|
36
40
|
braces.each do |brace1|
|
|
37
41
|
braces.each do |brace2|
|
|
38
|
-
html.
|
|
42
|
+
expect(html).not_to include("#{brace1}#{brace2}unsafe}}")
|
|
39
43
|
end
|
|
40
44
|
end
|
|
41
45
|
|
|
42
46
|
end
|
|
43
47
|
|
|
44
48
|
it 'does not escape Angular interpolation marks in safe strings' do
|
|
45
|
-
html.
|
|
46
|
-
html.
|
|
49
|
+
expect(html).to include("{{safe}}")
|
|
50
|
+
expect(html).not_to include("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}safe}}")
|
|
47
51
|
end
|
|
48
52
|
|
|
49
53
|
it 'does not escape Angular interpolation marks in a block where AngularXSS is disabled' do
|
|
@@ -52,8 +56,8 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
52
56
|
result = html
|
|
53
57
|
end
|
|
54
58
|
|
|
55
|
-
result.
|
|
56
|
-
result.
|
|
59
|
+
expect(result).to include('{{unsafe}}')
|
|
60
|
+
expect(result).not_to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
57
61
|
end
|
|
58
62
|
|
|
59
63
|
it 'does escape Angular interpolation marks after the block where AngularXSS is disabled' do
|
|
@@ -61,27 +65,27 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
61
65
|
end
|
|
62
66
|
result = html
|
|
63
67
|
|
|
64
|
-
result.
|
|
65
|
-
result.
|
|
68
|
+
expect(result).to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
69
|
+
expect(result).not_to include('{{unsafe}}')
|
|
66
70
|
end
|
|
67
71
|
|
|
68
72
|
it 'is not confused by exceptions in disable blocks' do
|
|
69
73
|
class SomeException < StandardError; end
|
|
70
74
|
|
|
71
|
-
|
|
75
|
+
expect do
|
|
72
76
|
AngularXss.disable do
|
|
73
77
|
raise SomeException
|
|
74
78
|
end
|
|
75
|
-
|
|
79
|
+
end.to raise_error(SomeException)
|
|
76
80
|
|
|
77
|
-
html.
|
|
78
|
-
html.
|
|
81
|
+
expect(html).to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
82
|
+
expect(html).not_to include('{{unsafe}}')
|
|
79
83
|
end
|
|
80
84
|
|
|
81
85
|
it 'does not escape twice' do
|
|
82
86
|
escaped = AngularXss::Escaper.escape('{{')
|
|
83
87
|
double_escaped = AngularXss::Escaper.escape(escaped)
|
|
84
|
-
html.
|
|
88
|
+
expect(html).not_to include(double_escaped)
|
|
85
89
|
end
|
|
86
90
|
|
|
87
91
|
end
|
|
@@ -1,14 +1,23 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
<%- unsafe_string = '{{unsafe}}' %>
|
|
2
|
+
<%- safe_string = '{{safe}}'.html_safe %>
|
|
3
|
+
|
|
4
|
+
<%= unsafe_string %>
|
|
5
|
+
<%= safe_string %>
|
|
6
|
+
|
|
7
|
+
<%= ''.html_safe + unsafe_string %>
|
|
8
|
+
<%= ''.html_safe + safe_string %>
|
|
9
|
+
|
|
10
|
+
<%= ''.html_safe << unsafe_string %>
|
|
11
|
+
<%= ''.html_safe << safe_string %>
|
|
3
12
|
|
|
4
13
|
{{safe}}
|
|
5
14
|
|
|
6
|
-
<div foo="{{safe}}" bar="<%=
|
|
15
|
+
<div foo="{{safe}}" bar="<%= unsafe_string %>">
|
|
7
16
|
{{safe}}
|
|
8
17
|
</div>
|
|
9
18
|
|
|
10
|
-
<%= content_tag(:span,
|
|
11
|
-
<%= content_tag(:span,
|
|
19
|
+
<%= content_tag(:span, unsafe_string) %>
|
|
20
|
+
<%= content_tag(:span, safe_string) %>
|
|
12
21
|
|
|
13
22
|
<%= '{{unsafe}}' %>
|
|
14
23
|
<%= '{{unsafe}}' %>
|
|
@@ -1,11 +1,46 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
1
|
+
-# HTML attributes and static string interpolation in Haml work in different ways:
|
|
2
|
+
-# 1. Under certain conditions, attributes are precompiled.
|
|
3
|
+
-# We never have to escape those because they can not contain user input.
|
|
4
|
+
-# 2. Whenever there is a Ruby call on attributes, Haml will have to evaluate
|
|
5
|
+
-# them at runtime. Since they can contain user input, XSS logic applies.
|
|
6
|
+
|
|
7
|
+
-# precompiled (static)
|
|
8
|
+
- if Gem::Version.new(Haml::VERSION) >= Gem::Version.new(6)
|
|
9
|
+
-# HAML 6 is smart enough to recognize static strings and will not
|
|
10
|
+
-# escape it - so neither do we
|
|
11
|
+
#{'{{safe}}'}
|
|
12
|
+
= "{{safe}}"
|
|
13
|
+
- else
|
|
14
|
+
#{'{{unsafe}}'}
|
|
15
|
+
= "{{unsafe}}"
|
|
4
16
|
|
|
5
17
|
{{safe}}
|
|
18
|
+
%div(foo='{{safe}}')
|
|
19
|
+
%div{:class => '{{safe}}', :id => '{{safe}}'}
|
|
20
|
+
|
|
21
|
+
-# Compiled at runtime:
|
|
22
|
+
- unsafe_evaluated_variable = '{{unsafe}}'
|
|
23
|
+
- safe_evaluated_variable = '{{safe}}'.html_safe
|
|
24
|
+
|
|
25
|
+
= unsafe_evaluated_variable
|
|
26
|
+
= safe_evaluated_variable
|
|
27
|
+
|
|
28
|
+
#{unsafe_evaluated_variable}
|
|
29
|
+
#{safe_evaluated_variable}
|
|
30
|
+
|
|
31
|
+
= ''.html_safe + unsafe_evaluated_variable
|
|
32
|
+
= ''.html_safe + safe_evaluated_variable
|
|
33
|
+
|
|
34
|
+
= ''.html_safe << unsafe_evaluated_variable
|
|
35
|
+
= ''.html_safe << safe_evaluated_variable
|
|
6
36
|
|
|
7
|
-
= content_tag(:span,
|
|
8
|
-
= content_tag(:span,
|
|
37
|
+
= content_tag(:span, unsafe_evaluated_variable)
|
|
38
|
+
= content_tag(:span, safe_evaluated_variable)
|
|
39
|
+
|
|
40
|
+
%div{:class => unsafe_evaluated_variable, :id => unsafe_evaluated_variable}
|
|
41
|
+
%div(bar="#{unsafe_evaluated_variable}")
|
|
42
|
+
%div{:foo => safe_evaluated_variable, :bar => unsafe_evaluated_variable}
|
|
43
|
+
{{safe}}
|
|
9
44
|
|
|
10
45
|
= '{{unsafe}}'
|
|
11
46
|
= '{{unsafe}}'
|
|
@@ -17,21 +52,3 @@
|
|
|
17
52
|
= '{{unsafe}}'
|
|
18
53
|
= '{{unsafe}}'
|
|
19
54
|
= '{{unsafe}}'
|
|
20
|
-
|
|
21
|
-
-# HTML attributes in Haml work in different ways:
|
|
22
|
-
-# 1. Under certain conditions, attributes are precompiled.
|
|
23
|
-
-# We never have to escape those because they can not contain user input.
|
|
24
|
-
-# 2. Whenever there is a Ruby call on attributes, Haml will have to evaluate
|
|
25
|
-
-# them at runtime. Since they can contain user input, XSS logic applies.
|
|
26
|
-
|
|
27
|
-
-# Precompiled:
|
|
28
|
-
%div(foo='{{safe}}')
|
|
29
|
-
%div{:class => '{{safe}}', :id => '{{safe}}'}
|
|
30
|
-
|
|
31
|
-
-# Compiled at runtime:
|
|
32
|
-
- unsafe = '{{unsafe}}'
|
|
33
|
-
- safe = '{{safe}}'.html_safe
|
|
34
|
-
%div{:class => unsafe, :id => unsafe}
|
|
35
|
-
%div(bar="#{unsafe}")
|
|
36
|
-
%div{:foo => safe, :bar => unsafe}
|
|
37
|
-
{{safe}}
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: angular_xss
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 1.0.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Henning Koch
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2024-07-02 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: activesupport
|
|
@@ -52,8 +52,8 @@ files:
|
|
|
52
52
|
- CHANGELOG.md
|
|
53
53
|
- Gemfile
|
|
54
54
|
- Gemfile.lock
|
|
55
|
-
- Gemfile.rails-3.2
|
|
56
|
-
- Gemfile.rails-3.2.lock
|
|
55
|
+
- Gemfile.rails-3.2.haml-4
|
|
56
|
+
- Gemfile.rails-3.2.haml-4.lock
|
|
57
57
|
- Gemfile.rails-4.2.haml-4
|
|
58
58
|
- Gemfile.rails-4.2.haml-4.lock
|
|
59
59
|
- Gemfile.rails-4.2.haml-5
|
|
@@ -66,6 +66,10 @@ files:
|
|
|
66
66
|
- Gemfile.rails-6.1.haml-5.lock
|
|
67
67
|
- Gemfile.rails-7.0.haml-5
|
|
68
68
|
- Gemfile.rails-7.0.haml-5.lock
|
|
69
|
+
- Gemfile.rails-7.1.haml-5
|
|
70
|
+
- Gemfile.rails-7.1.haml-5.lock
|
|
71
|
+
- Gemfile.rails-7.1.haml-6
|
|
72
|
+
- Gemfile.rails-7.1.haml-6.lock
|
|
69
73
|
- LICENSE
|
|
70
74
|
- README.md
|
|
71
75
|
- Rakefile
|
|
@@ -75,10 +79,13 @@ files:
|
|
|
75
79
|
- lib/angular_xss/erb.rb
|
|
76
80
|
- lib/angular_xss/escaper.rb
|
|
77
81
|
- lib/angular_xss/haml.rb
|
|
82
|
+
- lib/angular_xss/output_buffer.rb
|
|
78
83
|
- lib/angular_xss/safe_buffer.rb
|
|
79
84
|
- lib/angular_xss/version.rb
|
|
80
85
|
- spec/angular_xss/erb_spec.rb
|
|
86
|
+
- spec/angular_xss/escaper_spec.rb
|
|
81
87
|
- spec/angular_xss/haml_spec.rb
|
|
88
|
+
- spec/angular_xss/output_buffer_spec.rb
|
|
82
89
|
- spec/angular_xss/safe_buffer_spec.rb
|
|
83
90
|
- spec/spec_helper.rb
|
|
84
91
|
- spec/support/engine_preventing_angular_xss.rb
|
|
@@ -104,14 +111,16 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
104
111
|
- !ruby/object:Gem::Version
|
|
105
112
|
version: '0'
|
|
106
113
|
requirements: []
|
|
107
|
-
rubygems_version: 3.
|
|
114
|
+
rubygems_version: 3.5.13
|
|
108
115
|
signing_key:
|
|
109
116
|
specification_version: 4
|
|
110
117
|
summary: Patches rails_xss and Haml so AngularJS interpolations are auto-escaped in
|
|
111
118
|
unsafe strings.
|
|
112
119
|
test_files:
|
|
113
120
|
- spec/angular_xss/erb_spec.rb
|
|
121
|
+
- spec/angular_xss/escaper_spec.rb
|
|
114
122
|
- spec/angular_xss/haml_spec.rb
|
|
123
|
+
- spec/angular_xss/output_buffer_spec.rb
|
|
115
124
|
- spec/angular_xss/safe_buffer_spec.rb
|
|
116
125
|
- spec/spec_helper.rb
|
|
117
126
|
- spec/support/engine_preventing_angular_xss.rb
|