angular_xss 0.4.1 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/test.yml +9 -5
- data/.ruby-version +1 -1
- data/CHANGELOG.md +13 -0
- data/{Gemfile.rails-3.2 → Gemfile.rails-3.2.haml-4} +1 -1
- data/{Gemfile.rails-3.2.lock → Gemfile.rails-3.2.haml-4.lock} +4 -4
- data/Gemfile.rails-4.2.haml-4 +1 -1
- data/Gemfile.rails-4.2.haml-4.lock +4 -4
- data/Gemfile.rails-4.2.haml-5 +1 -1
- data/Gemfile.rails-4.2.haml-5.lock +4 -4
- data/Gemfile.rails-5.1.haml-4 +1 -1
- data/Gemfile.rails-5.1.haml-4.lock +8 -6
- data/Gemfile.rails-5.1.haml-5 +1 -1
- data/Gemfile.rails-5.1.haml-5.lock +9 -7
- data/Gemfile.rails-6.1.haml-5 +1 -1
- data/Gemfile.rails-6.1.haml-5.lock +3 -3
- data/Gemfile.rails-7.0.haml-5 +1 -1
- data/Gemfile.rails-7.0.haml-5.lock +7 -5
- data/Gemfile.rails-7.1.haml-5 +9 -0
- data/Gemfile.rails-7.1.haml-5.lock +105 -0
- data/Gemfile.rails-7.1.haml-6 +9 -0
- data/Gemfile.rails-7.1.haml-6.lock +122 -0
- data/README.md +11 -3
- data/lib/angular_xss/erb.rb +17 -27
- data/lib/angular_xss/escaper.rb +8 -0
- data/lib/angular_xss/haml.rb +25 -19
- data/lib/angular_xss/output_buffer.rb +25 -0
- data/lib/angular_xss/version.rb +1 -1
- data/lib/angular_xss.rb +1 -0
- data/spec/angular_xss/erb_spec.rb +46 -3
- data/spec/angular_xss/escaper_spec.rb +21 -0
- data/spec/angular_xss/haml_spec.rb +0 -2
- data/spec/angular_xss/output_buffer_spec.rb +45 -0
- data/spec/angular_xss/safe_buffer_spec.rb +16 -4
- data/spec/spec_helper.rb +5 -11
- data/spec/support/engine_preventing_angular_xss.rb +21 -17
- data/spec/templates/_test_erb.erb +14 -5
- data/spec/templates/_test_haml.haml +40 -23
- metadata +14 -5
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3b6ab389824dfbb7cb7fa43b90922924b71330f335de953f0a07c9034d8bccaa
|
|
4
|
+
data.tar.gz: 70d073c5c2377cd8065ace516f34bffac0e22f8ed321b784390b0d125a05ecf3
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 1a2f62a344faa4bda34bfdfce335058a5a4b58d6f9406ee9d22771494dc1a61fc102c922033ce54123dcb27514a76c035b5e176c87569bb2262ca5d36d8c8982
|
|
7
|
+
data.tar.gz: d33a56cc8c6e6d3d51feea115007ee8f731633880d07a11f21a2c0c4afb6f9325d5134d3b2565867d3304f8f5531bd0c0126c83656107d019a1e68421ad4e730
|
data/.github/workflows/test.yml
CHANGED
|
@@ -15,7 +15,7 @@ jobs:
|
|
|
15
15
|
matrix:
|
|
16
16
|
include:
|
|
17
17
|
- ruby: 2.5.9
|
|
18
|
-
gemfile: Gemfile.rails-3.2
|
|
18
|
+
gemfile: Gemfile.rails-3.2.haml-4
|
|
19
19
|
- ruby: 2.5.9
|
|
20
20
|
gemfile: Gemfile.rails-4.2.haml-4
|
|
21
21
|
- ruby: 2.5.9
|
|
@@ -34,14 +34,18 @@ jobs:
|
|
|
34
34
|
- ruby: 2.7.2
|
|
35
35
|
gemfile: Gemfile.rails-7.0.haml-5
|
|
36
36
|
|
|
37
|
-
- ruby: 3.
|
|
37
|
+
- ruby: 3.2.3
|
|
38
38
|
gemfile: Gemfile.rails-5.1.haml-4
|
|
39
|
-
- ruby: 3.
|
|
39
|
+
- ruby: 3.2.3
|
|
40
40
|
gemfile: Gemfile.rails-5.1.haml-5
|
|
41
|
-
- ruby: 3.
|
|
41
|
+
- ruby: 3.2.3
|
|
42
42
|
gemfile: Gemfile.rails-6.1.haml-5
|
|
43
|
-
- ruby: 3.
|
|
43
|
+
- ruby: 3.2.3
|
|
44
44
|
gemfile: Gemfile.rails-7.0.haml-5
|
|
45
|
+
- ruby: 3.2.3
|
|
46
|
+
gemfile: Gemfile.rails-7.1.haml-5
|
|
47
|
+
- ruby: 3.2.3
|
|
48
|
+
gemfile: Gemfile.rails-7.1.haml-6
|
|
45
49
|
env:
|
|
46
50
|
BUNDLE_GEMFILE: "${{ matrix.gemfile }}"
|
|
47
51
|
steps:
|
data/.ruby-version
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
2.
|
|
1
|
+
3.2.3
|
data/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,19 @@ This project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html
|
|
|
9
9
|
|
|
10
10
|
### Breaking changes
|
|
11
11
|
|
|
12
|
+
## 1.0 2024-07-02
|
|
13
|
+
|
|
14
|
+
### Compatible changes
|
|
15
|
+
* Bump version to 1.0 as this gem is production-ready for 10 years
|
|
16
|
+
* Declare the gem to be unmaintained
|
|
17
|
+
* Add compatibility with Rails 7.1
|
|
18
|
+
* Add compatibility with HAML 6
|
|
19
|
+
* NOTE: Don't use HAML 6.0.0. AngularXSS relies on a patch [introduced in 6.0.1](https://github.com/haml/haml/blob/main/CHANGELOG.md#601). Anything newer should be fine - the gem is currently tested against HAML 6.3
|
|
20
|
+
* Refactor our patches to use `Module#prepend` instead of `Module#module_eval`
|
|
21
|
+
* Refactor gem version comparisons to use `Gem::Version` instances
|
|
22
|
+
* Refactor specs to use the `expect` syntax
|
|
23
|
+
* Improve test coverage for more interpolation scenarios in ERB and HAML
|
|
24
|
+
* Add unit tests for patched methods
|
|
12
25
|
|
|
13
26
|
## 0.4.1 2022-03-16
|
|
14
27
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -28,7 +28,7 @@ GEM
|
|
|
28
28
|
concurrent-ruby (1.0.5)
|
|
29
29
|
diff-lcs (1.3)
|
|
30
30
|
erubis (2.7.0)
|
|
31
|
-
gemika (0.
|
|
31
|
+
gemika (0.8.3)
|
|
32
32
|
haml (4.0.2)
|
|
33
33
|
tilt
|
|
34
34
|
hike (1.2.3)
|
|
@@ -81,11 +81,11 @@ PLATFORMS
|
|
|
81
81
|
DEPENDENCIES
|
|
82
82
|
actionpack (~> 3.2)
|
|
83
83
|
angular_xss!
|
|
84
|
-
gemika
|
|
84
|
+
gemika (>= 0.8.3)
|
|
85
85
|
haml (= 4.0.2)
|
|
86
86
|
railties (~> 3.2)
|
|
87
87
|
rake
|
|
88
88
|
rspec
|
|
89
89
|
|
|
90
90
|
BUNDLED WITH
|
|
91
|
-
1.
|
|
91
|
+
2.1.4
|
data/Gemfile.rails-4.2.haml-4
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubis (2.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (4.0.7)
|
|
36
36
|
tilt
|
|
37
37
|
i18n (0.9.1)
|
|
@@ -79,10 +79,10 @@ PLATFORMS
|
|
|
79
79
|
DEPENDENCIES
|
|
80
80
|
actionpack (~> 4.2)
|
|
81
81
|
angular_xss!
|
|
82
|
-
gemika
|
|
82
|
+
gemika (>= 0.8.3)
|
|
83
83
|
haml (< 5)
|
|
84
84
|
rake
|
|
85
85
|
rspec
|
|
86
86
|
|
|
87
87
|
BUNDLED WITH
|
|
88
|
-
1.
|
|
88
|
+
2.1.4
|
data/Gemfile.rails-4.2.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubis (2.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (5.0.4)
|
|
36
36
|
temple (>= 0.8.0)
|
|
37
37
|
tilt
|
|
@@ -81,10 +81,10 @@ PLATFORMS
|
|
|
81
81
|
DEPENDENCIES
|
|
82
82
|
actionpack (~> 4.2)
|
|
83
83
|
angular_xss!
|
|
84
|
-
gemika
|
|
84
|
+
gemika (>= 0.8.3)
|
|
85
85
|
haml (~> 5)
|
|
86
86
|
rake
|
|
87
87
|
rspec
|
|
88
88
|
|
|
89
89
|
BUNDLED WITH
|
|
90
|
-
1.
|
|
90
|
+
2.1.4
|
data/Gemfile.rails-5.1.haml-4
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubi (1.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (4.0.7)
|
|
36
36
|
tilt
|
|
37
37
|
i18n (0.9.1)
|
|
@@ -39,10 +39,12 @@ GEM
|
|
|
39
39
|
loofah (2.1.1)
|
|
40
40
|
crass (~> 1.0.2)
|
|
41
41
|
nokogiri (>= 1.5.9)
|
|
42
|
-
mini_portile2 (2.3
|
|
42
|
+
mini_portile2 (2.5.3)
|
|
43
43
|
minitest (5.10.3)
|
|
44
|
-
nokogiri (1.
|
|
45
|
-
mini_portile2 (~> 2.
|
|
44
|
+
nokogiri (1.11.7)
|
|
45
|
+
mini_portile2 (~> 2.5.0)
|
|
46
|
+
racc (~> 1.4)
|
|
47
|
+
racc (1.7.3)
|
|
46
48
|
rack (2.0.3)
|
|
47
49
|
rack-test (0.8.2)
|
|
48
50
|
rack (>= 1.0, < 3)
|
|
@@ -76,7 +78,7 @@ PLATFORMS
|
|
|
76
78
|
DEPENDENCIES
|
|
77
79
|
actionpack (~> 5.1)
|
|
78
80
|
angular_xss!
|
|
79
|
-
gemika
|
|
81
|
+
gemika (>= 0.8.3)
|
|
80
82
|
haml (< 5)
|
|
81
83
|
rake
|
|
82
84
|
rspec
|
data/Gemfile.rails-5.1.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.3)
|
|
32
32
|
diff-lcs (1.3)
|
|
33
33
|
erubi (1.7.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (5.0.4)
|
|
36
36
|
temple (>= 0.8.0)
|
|
37
37
|
tilt
|
|
@@ -40,10 +40,12 @@ GEM
|
|
|
40
40
|
loofah (2.1.1)
|
|
41
41
|
crass (~> 1.0.2)
|
|
42
42
|
nokogiri (>= 1.5.9)
|
|
43
|
-
mini_portile2 (2.3
|
|
43
|
+
mini_portile2 (2.5.3)
|
|
44
44
|
minitest (5.10.3)
|
|
45
|
-
nokogiri (1.
|
|
46
|
-
mini_portile2 (~> 2.
|
|
45
|
+
nokogiri (1.11.7)
|
|
46
|
+
mini_portile2 (~> 2.5.0)
|
|
47
|
+
racc (~> 1.4)
|
|
48
|
+
racc (1.7.3)
|
|
47
49
|
rack (2.0.3)
|
|
48
50
|
rack-test (0.8.2)
|
|
49
51
|
rack (>= 1.0, < 3)
|
|
@@ -52,7 +54,7 @@ GEM
|
|
|
52
54
|
nokogiri (>= 1.6)
|
|
53
55
|
rails-html-sanitizer (1.0.3)
|
|
54
56
|
loofah (~> 2.0)
|
|
55
|
-
rake (
|
|
57
|
+
rake (13.2.1)
|
|
56
58
|
rspec (3.10.0)
|
|
57
59
|
rspec-core (~> 3.10.0)
|
|
58
60
|
rspec-expectations (~> 3.10.0)
|
|
@@ -78,7 +80,7 @@ PLATFORMS
|
|
|
78
80
|
DEPENDENCIES
|
|
79
81
|
actionpack (~> 5.1)
|
|
80
82
|
angular_xss!
|
|
81
|
-
gemika
|
|
83
|
+
gemika (>= 0.8.3)
|
|
82
84
|
haml (~> 5)
|
|
83
85
|
rake
|
|
84
86
|
rspec
|
data/Gemfile.rails-6.1.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -32,7 +32,7 @@ GEM
|
|
|
32
32
|
crass (1.0.6)
|
|
33
33
|
diff-lcs (1.4.4)
|
|
34
34
|
erubi (1.10.0)
|
|
35
|
-
gemika (0.
|
|
35
|
+
gemika (0.8.3)
|
|
36
36
|
haml (5.2.1)
|
|
37
37
|
temple (>= 0.8.0)
|
|
38
38
|
tilt
|
|
@@ -81,7 +81,7 @@ PLATFORMS
|
|
|
81
81
|
DEPENDENCIES
|
|
82
82
|
actionpack (~> 6.1)
|
|
83
83
|
angular_xss!
|
|
84
|
-
gemika
|
|
84
|
+
gemika (>= 0.8.3)
|
|
85
85
|
haml (~> 5)
|
|
86
86
|
rake
|
|
87
87
|
rspec
|
data/Gemfile.rails-7.0.haml-5
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
PATH
|
|
2
2
|
remote: .
|
|
3
3
|
specs:
|
|
4
|
-
angular_xss (0.
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
5
|
activesupport
|
|
6
6
|
haml (>= 3.1.5)
|
|
7
7
|
|
|
@@ -31,7 +31,7 @@ GEM
|
|
|
31
31
|
crass (1.0.6)
|
|
32
32
|
diff-lcs (1.4.4)
|
|
33
33
|
erubi (1.10.0)
|
|
34
|
-
gemika (0.
|
|
34
|
+
gemika (0.8.3)
|
|
35
35
|
haml (5.2.2)
|
|
36
36
|
temple (>= 0.8.0)
|
|
37
37
|
tilt
|
|
@@ -40,8 +40,10 @@ GEM
|
|
|
40
40
|
loofah (2.13.0)
|
|
41
41
|
crass (~> 1.0.2)
|
|
42
42
|
nokogiri (>= 1.5.9)
|
|
43
|
+
mini_portile2 (2.6.1)
|
|
43
44
|
minitest (5.15.0)
|
|
44
|
-
nokogiri (1.12.5
|
|
45
|
+
nokogiri (1.12.5)
|
|
46
|
+
mini_portile2 (~> 2.6.1)
|
|
45
47
|
racc (~> 1.4)
|
|
46
48
|
racc (1.6.0)
|
|
47
49
|
rack (2.2.3)
|
|
@@ -72,12 +74,12 @@ GEM
|
|
|
72
74
|
concurrent-ruby (~> 1.0)
|
|
73
75
|
|
|
74
76
|
PLATFORMS
|
|
75
|
-
|
|
77
|
+
ruby
|
|
76
78
|
|
|
77
79
|
DEPENDENCIES
|
|
78
80
|
actionpack (~> 7.0)
|
|
79
81
|
angular_xss!
|
|
80
|
-
gemika
|
|
82
|
+
gemika (>= 0.8.3)
|
|
81
83
|
haml (~> 5)
|
|
82
84
|
rake
|
|
83
85
|
rspec
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
PATH
|
|
2
|
+
remote: .
|
|
3
|
+
specs:
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
|
+
activesupport
|
|
6
|
+
haml (>= 3.1.5)
|
|
7
|
+
|
|
8
|
+
GEM
|
|
9
|
+
remote: http://rubygems.org/
|
|
10
|
+
specs:
|
|
11
|
+
actionpack (7.1.3.4)
|
|
12
|
+
actionview (= 7.1.3.4)
|
|
13
|
+
activesupport (= 7.1.3.4)
|
|
14
|
+
nokogiri (>= 1.8.5)
|
|
15
|
+
racc
|
|
16
|
+
rack (>= 2.2.4)
|
|
17
|
+
rack-session (>= 1.0.1)
|
|
18
|
+
rack-test (>= 0.6.3)
|
|
19
|
+
rails-dom-testing (~> 2.2)
|
|
20
|
+
rails-html-sanitizer (~> 1.6)
|
|
21
|
+
actionview (7.1.3.4)
|
|
22
|
+
activesupport (= 7.1.3.4)
|
|
23
|
+
builder (~> 3.1)
|
|
24
|
+
erubi (~> 1.11)
|
|
25
|
+
rails-dom-testing (~> 2.2)
|
|
26
|
+
rails-html-sanitizer (~> 1.6)
|
|
27
|
+
activesupport (7.1.3.4)
|
|
28
|
+
base64
|
|
29
|
+
bigdecimal
|
|
30
|
+
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
31
|
+
connection_pool (>= 2.2.5)
|
|
32
|
+
drb
|
|
33
|
+
i18n (>= 1.6, < 2)
|
|
34
|
+
minitest (>= 5.1)
|
|
35
|
+
mutex_m
|
|
36
|
+
tzinfo (~> 2.0)
|
|
37
|
+
base64 (0.2.0)
|
|
38
|
+
bigdecimal (3.1.8)
|
|
39
|
+
builder (3.3.0)
|
|
40
|
+
byebug (11.1.3)
|
|
41
|
+
concurrent-ruby (1.3.3)
|
|
42
|
+
connection_pool (2.4.1)
|
|
43
|
+
crass (1.0.6)
|
|
44
|
+
diff-lcs (1.5.1)
|
|
45
|
+
drb (2.2.1)
|
|
46
|
+
erubi (1.13.0)
|
|
47
|
+
gemika (0.8.3)
|
|
48
|
+
haml (5.2.2)
|
|
49
|
+
temple (>= 0.8.0)
|
|
50
|
+
tilt
|
|
51
|
+
i18n (1.14.5)
|
|
52
|
+
concurrent-ruby (~> 1.0)
|
|
53
|
+
loofah (2.22.0)
|
|
54
|
+
crass (~> 1.0.2)
|
|
55
|
+
nokogiri (>= 1.12.0)
|
|
56
|
+
minitest (5.23.1)
|
|
57
|
+
mutex_m (0.2.0)
|
|
58
|
+
nokogiri (1.16.6-x86_64-linux)
|
|
59
|
+
racc (~> 1.4)
|
|
60
|
+
racc (1.8.0)
|
|
61
|
+
rack (3.1.3)
|
|
62
|
+
rack-session (2.0.0)
|
|
63
|
+
rack (>= 3.0.0)
|
|
64
|
+
rack-test (2.1.0)
|
|
65
|
+
rack (>= 1.3)
|
|
66
|
+
rails-dom-testing (2.2.0)
|
|
67
|
+
activesupport (>= 5.0.0)
|
|
68
|
+
minitest
|
|
69
|
+
nokogiri (>= 1.6)
|
|
70
|
+
rails-html-sanitizer (1.6.0)
|
|
71
|
+
loofah (~> 2.21)
|
|
72
|
+
nokogiri (~> 1.14)
|
|
73
|
+
rake (13.2.1)
|
|
74
|
+
rspec (3.13.0)
|
|
75
|
+
rspec-core (~> 3.13.0)
|
|
76
|
+
rspec-expectations (~> 3.13.0)
|
|
77
|
+
rspec-mocks (~> 3.13.0)
|
|
78
|
+
rspec-core (3.13.0)
|
|
79
|
+
rspec-support (~> 3.13.0)
|
|
80
|
+
rspec-expectations (3.13.1)
|
|
81
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
82
|
+
rspec-support (~> 3.13.0)
|
|
83
|
+
rspec-mocks (3.13.1)
|
|
84
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
85
|
+
rspec-support (~> 3.13.0)
|
|
86
|
+
rspec-support (3.13.1)
|
|
87
|
+
temple (0.10.3)
|
|
88
|
+
tilt (2.3.0)
|
|
89
|
+
tzinfo (2.0.6)
|
|
90
|
+
concurrent-ruby (~> 1.0)
|
|
91
|
+
|
|
92
|
+
PLATFORMS
|
|
93
|
+
x86_64-linux
|
|
94
|
+
|
|
95
|
+
DEPENDENCIES
|
|
96
|
+
actionpack (~> 7.1)
|
|
97
|
+
angular_xss!
|
|
98
|
+
byebug
|
|
99
|
+
gemika (>= 0.8.3)
|
|
100
|
+
haml (~> 5)
|
|
101
|
+
rake
|
|
102
|
+
rspec
|
|
103
|
+
|
|
104
|
+
BUNDLED WITH
|
|
105
|
+
2.5.13
|
|
@@ -0,0 +1,122 @@
|
|
|
1
|
+
PATH
|
|
2
|
+
remote: .
|
|
3
|
+
specs:
|
|
4
|
+
angular_xss (1.0.0)
|
|
5
|
+
activesupport
|
|
6
|
+
haml (>= 3.1.5)
|
|
7
|
+
|
|
8
|
+
GEM
|
|
9
|
+
remote: http://rubygems.org/
|
|
10
|
+
specs:
|
|
11
|
+
actionpack (7.1.3.4)
|
|
12
|
+
actionview (= 7.1.3.4)
|
|
13
|
+
activesupport (= 7.1.3.4)
|
|
14
|
+
nokogiri (>= 1.8.5)
|
|
15
|
+
racc
|
|
16
|
+
rack (>= 2.2.4)
|
|
17
|
+
rack-session (>= 1.0.1)
|
|
18
|
+
rack-test (>= 0.6.3)
|
|
19
|
+
rails-dom-testing (~> 2.2)
|
|
20
|
+
rails-html-sanitizer (~> 1.6)
|
|
21
|
+
actionview (7.1.3.4)
|
|
22
|
+
activesupport (= 7.1.3.4)
|
|
23
|
+
builder (~> 3.1)
|
|
24
|
+
erubi (~> 1.11)
|
|
25
|
+
rails-dom-testing (~> 2.2)
|
|
26
|
+
rails-html-sanitizer (~> 1.6)
|
|
27
|
+
activesupport (7.1.3.4)
|
|
28
|
+
base64
|
|
29
|
+
bigdecimal
|
|
30
|
+
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
31
|
+
connection_pool (>= 2.2.5)
|
|
32
|
+
drb
|
|
33
|
+
i18n (>= 1.6, < 2)
|
|
34
|
+
minitest (>= 5.1)
|
|
35
|
+
mutex_m
|
|
36
|
+
tzinfo (~> 2.0)
|
|
37
|
+
base64 (0.2.0)
|
|
38
|
+
bigdecimal (3.1.8)
|
|
39
|
+
builder (3.3.0)
|
|
40
|
+
byebug (11.1.3)
|
|
41
|
+
concurrent-ruby (1.3.3)
|
|
42
|
+
connection_pool (2.4.1)
|
|
43
|
+
crass (1.0.6)
|
|
44
|
+
diff-lcs (1.5.1)
|
|
45
|
+
drb (2.2.1)
|
|
46
|
+
erubi (1.13.0)
|
|
47
|
+
gemika (0.8.3)
|
|
48
|
+
haml (6.3.0)
|
|
49
|
+
temple (>= 0.8.2)
|
|
50
|
+
thor
|
|
51
|
+
tilt
|
|
52
|
+
i18n (1.14.5)
|
|
53
|
+
concurrent-ruby (~> 1.0)
|
|
54
|
+
loofah (2.22.0)
|
|
55
|
+
crass (~> 1.0.2)
|
|
56
|
+
nokogiri (>= 1.12.0)
|
|
57
|
+
minitest (5.24.0)
|
|
58
|
+
mutex_m (0.2.0)
|
|
59
|
+
nokogiri (1.16.6-aarch64-linux)
|
|
60
|
+
racc (~> 1.4)
|
|
61
|
+
nokogiri (1.16.6-arm-linux)
|
|
62
|
+
racc (~> 1.4)
|
|
63
|
+
nokogiri (1.16.6-arm64-darwin)
|
|
64
|
+
racc (~> 1.4)
|
|
65
|
+
nokogiri (1.16.6-x86-linux)
|
|
66
|
+
racc (~> 1.4)
|
|
67
|
+
nokogiri (1.16.6-x86_64-darwin)
|
|
68
|
+
racc (~> 1.4)
|
|
69
|
+
nokogiri (1.16.6-x86_64-linux)
|
|
70
|
+
racc (~> 1.4)
|
|
71
|
+
racc (1.8.0)
|
|
72
|
+
rack (3.1.3)
|
|
73
|
+
rack-session (2.0.0)
|
|
74
|
+
rack (>= 3.0.0)
|
|
75
|
+
rack-test (2.1.0)
|
|
76
|
+
rack (>= 1.3)
|
|
77
|
+
rails-dom-testing (2.2.0)
|
|
78
|
+
activesupport (>= 5.0.0)
|
|
79
|
+
minitest
|
|
80
|
+
nokogiri (>= 1.6)
|
|
81
|
+
rails-html-sanitizer (1.6.0)
|
|
82
|
+
loofah (~> 2.21)
|
|
83
|
+
nokogiri (~> 1.14)
|
|
84
|
+
rake (13.2.1)
|
|
85
|
+
rspec (3.13.0)
|
|
86
|
+
rspec-core (~> 3.13.0)
|
|
87
|
+
rspec-expectations (~> 3.13.0)
|
|
88
|
+
rspec-mocks (~> 3.13.0)
|
|
89
|
+
rspec-core (3.13.0)
|
|
90
|
+
rspec-support (~> 3.13.0)
|
|
91
|
+
rspec-expectations (3.13.1)
|
|
92
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
93
|
+
rspec-support (~> 3.13.0)
|
|
94
|
+
rspec-mocks (3.13.1)
|
|
95
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
96
|
+
rspec-support (~> 3.13.0)
|
|
97
|
+
rspec-support (3.13.1)
|
|
98
|
+
temple (0.10.3)
|
|
99
|
+
thor (1.3.1)
|
|
100
|
+
tilt (2.3.0)
|
|
101
|
+
tzinfo (2.0.6)
|
|
102
|
+
concurrent-ruby (~> 1.0)
|
|
103
|
+
|
|
104
|
+
PLATFORMS
|
|
105
|
+
aarch64-linux
|
|
106
|
+
arm-linux
|
|
107
|
+
arm64-darwin
|
|
108
|
+
x86-linux
|
|
109
|
+
x86_64-darwin
|
|
110
|
+
x86_64-linux
|
|
111
|
+
|
|
112
|
+
DEPENDENCIES
|
|
113
|
+
actionpack (~> 7.1)
|
|
114
|
+
angular_xss!
|
|
115
|
+
byebug
|
|
116
|
+
gemika (>= 0.8.3)
|
|
117
|
+
haml (~> 6)
|
|
118
|
+
rake
|
|
119
|
+
rspec
|
|
120
|
+
|
|
121
|
+
BUNDLED WITH
|
|
122
|
+
2.5.13
|
data/README.md
CHANGED
|
@@ -7,6 +7,12 @@ This gem patches ERB/rails_xss and Haml so Angular interpolation symbols are aut
|
|
|
7
7
|
|
|
8
8
|
**This is an unsatisfactory hack.** A better solution is very much desired, but is not possible without some changes in AngularJS. See the [related AngularJS issue](https://github.com/angular/angular.js/issues/5601).
|
|
9
9
|
|
|
10
|
+
🚧 Notice: unmaintained gem
|
|
11
|
+
------------------
|
|
12
|
+
|
|
13
|
+
We are no longer actively maintaining this gem.
|
|
14
|
+
|
|
15
|
+
The `1.0` release added support for HAML 6 and Rails 7.1, so the gem will at least support Rails 3.2 - 7.1 and HAML 4 - 6. `angular_xss` might still work for future versions HAML and Rails, but we won't actively ensure it does.
|
|
10
16
|
|
|
11
17
|
Disable escaping locally
|
|
12
18
|
------------------------
|
|
@@ -56,11 +62,13 @@ Development
|
|
|
56
62
|
-----------
|
|
57
63
|
|
|
58
64
|
- Fork the repository.
|
|
59
|
-
-
|
|
60
|
-
-
|
|
65
|
+
- Prepare your changes, and ensure existing and new test are green:
|
|
66
|
+
- `bundle exec rake matrix:install` installs all dependencies for all Gemfiles
|
|
67
|
+
- `bundle exec rake matrix:spec` runs all specs in all configurations
|
|
68
|
+
- You may run single tests with a specified Rails version via `BUNDLE_GEMFILE=Gemfile.rails-7.0.haml-5 bundle exec rspec ./spec/angular_xss`
|
|
69
|
+
- Push your changes with specs. There is a test application in `spec/app_root` if you need to test integration with a live Rails app.
|
|
61
70
|
- Send a pull request.
|
|
62
71
|
|
|
63
|
-
|
|
64
72
|
Credits
|
|
65
73
|
-------
|
|
66
74
|
|
data/lib/angular_xss/erb.rb
CHANGED
|
@@ -1,33 +1,25 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
s = s.to_s
|
|
8
|
-
if s.html_safe?
|
|
9
|
-
s
|
|
10
|
-
else
|
|
11
|
-
unwrapped_html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
|
|
12
|
-
end
|
|
1
|
+
if ERB::Util.private_method_defined? :unwrapped_html_escape
|
|
2
|
+
# Rails 4.2+
|
|
3
|
+
# https://github.com/rails/rails/blob/main/activesupport/lib/active_support/core_ext/erb/util.rb
|
|
4
|
+
module ERBUtilExt
|
|
5
|
+
def html_escape_once(s)
|
|
6
|
+
super(AngularXss::Escaper.escape_if_unsafe(s))
|
|
13
7
|
end
|
|
14
8
|
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
9
|
+
def unwrapped_html_escape(s)
|
|
10
|
+
super(AngularXss::Escaper.escape_if_unsafe(s))
|
|
11
|
+
end
|
|
12
|
+
# Note that html_escape() and h() are passively fixed as they are calling the two methods above
|
|
13
|
+
end
|
|
14
|
+
ERB::Util.prepend ERBUtilExt
|
|
15
|
+
ERB::Util.singleton_class.prepend ERBUtilExt
|
|
21
16
|
|
|
22
|
-
|
|
17
|
+
else
|
|
18
|
+
ERB::Util.module_eval do
|
|
19
|
+
# Rails < 4.2
|
|
23
20
|
|
|
24
21
|
def html_escape_with_escaping_angular_expressions(s)
|
|
25
|
-
s
|
|
26
|
-
if s.html_safe?
|
|
27
|
-
s
|
|
28
|
-
else
|
|
29
|
-
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
|
|
30
|
-
end
|
|
22
|
+
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape_if_unsafe(s))
|
|
31
23
|
end
|
|
32
24
|
|
|
33
25
|
alias_method_chain :html_escape, :escaping_angular_expressions
|
|
@@ -41,7 +33,5 @@ ERB::Util.module_eval do
|
|
|
41
33
|
singleton_class.send(:remove_method, :html_escape)
|
|
42
34
|
module_function :html_escape
|
|
43
35
|
module_function :html_escape_without_escaping_angular_expressions
|
|
44
|
-
|
|
45
36
|
end
|
|
46
|
-
|
|
47
37
|
end
|
data/lib/angular_xss/escaper.rb
CHANGED
data/lib/angular_xss/haml.rb
CHANGED
|
@@ -1,32 +1,38 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
haml_version = Gem::Version.new(Haml::VERSION)
|
|
2
|
+
|
|
3
|
+
if haml_version < Gem::Version.new(5)
|
|
3
4
|
# Use module_eval so we crash when Haml::Helpers has not yet been loaded.
|
|
4
5
|
Haml::Helpers.module_eval do
|
|
5
|
-
|
|
6
6
|
def html_escape_with_escaping_angular_expressions(s)
|
|
7
|
-
s
|
|
8
|
-
if s.html_safe?
|
|
9
|
-
s
|
|
10
|
-
else
|
|
11
|
-
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape(s))
|
|
12
|
-
end
|
|
7
|
+
html_escape_without_escaping_angular_expressions(AngularXss::Escaper.escape_if_unsafe(s))
|
|
13
8
|
end
|
|
14
9
|
|
|
15
10
|
alias_method :html_escape_without_escaping_angular_expressions, :html_escape
|
|
16
11
|
alias_method :html_escape, :html_escape_with_escaping_angular_expressions
|
|
17
12
|
end
|
|
13
|
+
elsif haml_version < Gem::Version.new('5.2')
|
|
14
|
+
# Haml 5.0 and 5.1 fall back to erb
|
|
15
|
+
elsif haml_version < Gem::Version.new(6)
|
|
16
|
+
# HAML 5.2+
|
|
17
|
+
module HTMLEscapeWithoutHAMLWithAngularXSS
|
|
18
|
+
def html_escape_without_haml_xss(html)
|
|
19
|
+
super(AngularXss::Escaper.escape_if_unsafe(html))
|
|
20
|
+
end
|
|
21
|
+
end
|
|
18
22
|
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
Haml::Helpers.singleton_class.prepend HTMLEscapeWithoutHAMLWithAngularXSS
|
|
24
|
+
else
|
|
25
|
+
# Haml 6+
|
|
26
|
+
# It ditched most of is own helpers in favor of Haml::Util.escape_html
|
|
27
|
+
# https://github.com/haml/haml/blob/main/CHANGELOG.md#600
|
|
28
|
+
# https://github.com/haml/haml/compare/v5.2.2...v6.3.0
|
|
29
|
+
# https://github.com/haml/haml/blob/v6.3.0/lib/haml/util.rb
|
|
25
30
|
|
|
26
|
-
|
|
31
|
+
module EscapeHTMLWithAngularXSS
|
|
32
|
+
def escape_html(html)
|
|
33
|
+
super(AngularXss::Escaper.escape_if_unsafe(html))
|
|
27
34
|
end
|
|
28
|
-
|
|
29
|
-
alias_method :html_escape_without_haml_xss_without_escaping_angular_expressions, :html_escape_without_haml_xss
|
|
30
|
-
alias_method :html_escape_without_haml_xss, :html_escape_without_haml_xss_with_escaping_angular_expressions
|
|
31
35
|
end
|
|
36
|
+
|
|
37
|
+
Haml::Util.singleton_class.prepend EscapeHTMLWithAngularXSS
|
|
32
38
|
end
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
##
|
|
2
|
+
# Monkey patch ActionView::OutputBuffer to escape double braces from Angular
|
|
3
|
+
#
|
|
4
|
+
# Link to the original implementation without Angular XSS escaping:
|
|
5
|
+
# https://github.com/rails/rails/blob/v7.1.3.4/actionview/lib/action_view/buffers.rb
|
|
6
|
+
|
|
7
|
+
|
|
8
|
+
if defined?(ActionView::VERSION) && Gem::Version.new(ActionView::VERSION::STRING) >= Gem::Version.new('7.1')
|
|
9
|
+
# ActionView < 7.1 used our patched ERB::Util.h to escape, 7.1 switched to CGI.escapeHTML
|
|
10
|
+
module OutputBufferWithEscapedAngularXSS
|
|
11
|
+
def <<(value)
|
|
12
|
+
super(AngularXss::Escaper.escape_if_unsafe(value))
|
|
13
|
+
end
|
|
14
|
+
|
|
15
|
+
def concat(value)
|
|
16
|
+
super(AngularXss::Escaper.escape_if_unsafe(value))
|
|
17
|
+
end
|
|
18
|
+
|
|
19
|
+
def append=(value)
|
|
20
|
+
super(AngularXss::Escaper.escape_if_unsafe(value))
|
|
21
|
+
end
|
|
22
|
+
end
|
|
23
|
+
|
|
24
|
+
ActionView::OutputBuffer.prepend OutputBufferWithEscapedAngularXSS
|
|
25
|
+
end
|
data/lib/angular_xss/version.rb
CHANGED
data/lib/angular_xss.rb
CHANGED
|
@@ -1,7 +1,50 @@
|
|
|
1
|
-
require 'spec_helper'
|
|
2
|
-
|
|
3
1
|
describe 'Angular XSS prevention in ERB', :type => :view do
|
|
4
|
-
|
|
5
2
|
it_should_behave_like 'engine preventing Angular XSS', :partial => 'test_erb'
|
|
3
|
+
end
|
|
4
|
+
|
|
5
|
+
describe ERB::Util do
|
|
6
|
+
describe '#html_escape' do
|
|
7
|
+
it 'escapes angular braces' do
|
|
8
|
+
expect(described_class.html_escape("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
9
|
+
end
|
|
10
|
+
|
|
11
|
+
it 'does not modify already HTML safe strings' do
|
|
12
|
+
expect(described_class.html_escape("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
13
|
+
end
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
describe '#h' do
|
|
17
|
+
it 'escapes angular braces' do
|
|
18
|
+
expect(described_class.h("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
it 'does not modify already HTML safe strings' do
|
|
22
|
+
expect(described_class.h("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
23
|
+
end
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
# Rails < 4 does not implement unwrapped_html_escape and html_escape_once
|
|
27
|
+
if described_class.method_defined? :unwrapped_html_escape
|
|
28
|
+
describe '#unwrapped_html_escape' do
|
|
29
|
+
it 'escapes angular braces' do
|
|
30
|
+
expect(described_class.unwrapped_html_escape("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
31
|
+
end
|
|
32
|
+
|
|
33
|
+
it 'does not modify already HTML safe strings' do
|
|
34
|
+
expect(described_class.unwrapped_html_escape("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
35
|
+
end
|
|
36
|
+
end
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
if described_class.method_defined? :html_escape_once
|
|
40
|
+
describe '#html_escape_once' do
|
|
41
|
+
it 'escapes angular braces' do
|
|
42
|
+
expect(described_class.html_escape_once("{{unsafe}}")).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
43
|
+
end
|
|
6
44
|
|
|
45
|
+
it 'does not modify already HTML safe strings' do
|
|
46
|
+
expect(described_class.html_escape_once("{{safe}}".html_safe)).to eq("{{safe}}")
|
|
47
|
+
end
|
|
48
|
+
end
|
|
49
|
+
end
|
|
7
50
|
end
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
describe AngularXss::Escaper do
|
|
2
|
+
describe '.escape' do
|
|
3
|
+
it 'replaces double braces with a closed variant' do
|
|
4
|
+
expect(described_class.escape('{{')).to eq('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}')
|
|
5
|
+
end
|
|
6
|
+
|
|
7
|
+
it 'does not handle HTML safe strings differently' do
|
|
8
|
+
expect(described_class.escape('{{'.html_safe)).to eq('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}')
|
|
9
|
+
end
|
|
10
|
+
end
|
|
11
|
+
|
|
12
|
+
describe '.escape_if_unsafe' do
|
|
13
|
+
it 'replaces double braces with a closed variant' do
|
|
14
|
+
expect(described_class.escape_if_unsafe('{{')).to eq('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}')
|
|
15
|
+
end
|
|
16
|
+
|
|
17
|
+
it 'does not modify HTML safe strings' do
|
|
18
|
+
expect(described_class.escape_if_unsafe('{{'.html_safe)).to eq('{{')
|
|
19
|
+
end
|
|
20
|
+
end
|
|
21
|
+
end
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
describe ActionView::OutputBuffer do
|
|
2
|
+
describe '#<<' do
|
|
3
|
+
it 'escapes angular braces' do
|
|
4
|
+
expect((subject << "{{unsafe}}").to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
5
|
+
end
|
|
6
|
+
|
|
7
|
+
it 'does not change behavior for already HTML safe strings' do
|
|
8
|
+
expect((subject << "{{safe}}".html_safe).to_s).to eq("{{safe}}")
|
|
9
|
+
end
|
|
10
|
+
|
|
11
|
+
it 'allows concatting nil' do
|
|
12
|
+
expect { subject << nil }.to_not raise_error
|
|
13
|
+
end
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
describe '#concat' do
|
|
17
|
+
it 'escapes angular braces' do
|
|
18
|
+
expect((subject.concat "{{unsafe}}").to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
it 'does not change behavior for already HTML safe strings' do
|
|
22
|
+
expect((subject.concat "{{safe}}".html_safe).to_s).to eq("{{safe}}")
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
it 'allows concatting nil' do
|
|
26
|
+
expect { subject.concat nil }.to_not raise_error
|
|
27
|
+
end
|
|
28
|
+
end
|
|
29
|
+
|
|
30
|
+
describe '#append=' do
|
|
31
|
+
it 'escapes angular braces' do
|
|
32
|
+
subject.append = "{{unsafe}}"
|
|
33
|
+
expect(subject.to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
34
|
+
end
|
|
35
|
+
|
|
36
|
+
it 'does not change behavior for already HTML safe strings' do
|
|
37
|
+
subject.append = "{{safe}}".html_safe
|
|
38
|
+
expect(subject.to_s).to eq("{{safe}}")
|
|
39
|
+
end
|
|
40
|
+
|
|
41
|
+
it 'allows concatting nil' do
|
|
42
|
+
expect { subject.append = nil }.to_not raise_error
|
|
43
|
+
end
|
|
44
|
+
end
|
|
45
|
+
end
|
|
@@ -1,9 +1,21 @@
|
|
|
1
|
-
require 'spec_helper'
|
|
2
|
-
|
|
3
1
|
describe ActiveSupport::SafeBuffer do
|
|
4
2
|
|
|
5
|
-
|
|
6
|
-
|
|
3
|
+
describe '#<<' do
|
|
4
|
+
it 'escapes angular braces' do
|
|
5
|
+
subject << "{{unsafe}}"
|
|
6
|
+
expect(subject.to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
7
|
+
end
|
|
8
|
+
|
|
9
|
+
it 'allows concatting nil' do
|
|
10
|
+
expect { subject << nil }.to_not raise_error
|
|
11
|
+
end
|
|
12
|
+
end
|
|
13
|
+
|
|
14
|
+
describe '#+' do
|
|
15
|
+
it 'escapes angular braces' do
|
|
16
|
+
combined_string = subject + "{{unsafe}}"
|
|
17
|
+
expect(combined_string.to_s).to eq("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
18
|
+
end
|
|
7
19
|
end
|
|
8
20
|
|
|
9
21
|
end
|
data/spec/spec_helper.rb
CHANGED
|
@@ -17,7 +17,11 @@ module Rails
|
|
|
17
17
|
end
|
|
18
18
|
|
|
19
19
|
require 'haml'
|
|
20
|
-
|
|
20
|
+
if Gem::Version.new(Haml::VERSION) < Gem::Version.new(6)
|
|
21
|
+
require 'haml/template'
|
|
22
|
+
else
|
|
23
|
+
require 'haml/rails_template'
|
|
24
|
+
end
|
|
21
25
|
|
|
22
26
|
require 'angular_xss'
|
|
23
27
|
|
|
@@ -25,13 +29,3 @@ require 'angular_xss'
|
|
|
25
29
|
Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
|
|
26
30
|
|
|
27
31
|
TEMPLATE_ROOT = Pathname.new(__dir__).join('templates')
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
RSpec.configure do |config|
|
|
31
|
-
config.mock_with :rspec do |c|
|
|
32
|
-
c.syntax = [:should, :expect]
|
|
33
|
-
end
|
|
34
|
-
config.expect_with :rspec do |c|
|
|
35
|
-
c.syntax = [:should, :expect]
|
|
36
|
-
end
|
|
37
|
-
end
|
|
@@ -2,7 +2,7 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
2
2
|
|
|
3
3
|
let(:path_set) { ActionView::LookupContext.new([TEMPLATE_ROOT]) }
|
|
4
4
|
|
|
5
|
-
if defined?(ActionView::VERSION) && ActionView::VERSION::MAJOR >= 6
|
|
5
|
+
if defined?(ActionView::VERSION) && Gem::Version.new(ActionView::VERSION::MAJOR) >= Gem::Version.new(6)
|
|
6
6
|
let(:engine) { ActionView::Base.with_empty_template_cache.new(path_set, {}, nil) }
|
|
7
7
|
else
|
|
8
8
|
let(:engine) { ActionView::Base.new(path_set) }
|
|
@@ -11,14 +11,18 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
11
11
|
let(:html) { engine.render(partial) }
|
|
12
12
|
|
|
13
13
|
it 'escapes Angular interpolation marks in unsafe strings' do
|
|
14
|
-
html.
|
|
15
|
-
html.
|
|
14
|
+
expect(html).not_to include('{{unsafe}}')
|
|
15
|
+
expect(html).to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
16
16
|
end
|
|
17
17
|
|
|
18
18
|
it 'recognizes the many ways to express an opening curly brace in HTML' do
|
|
19
|
+
# Only unsafe strings are escaped
|
|
20
|
+
expect(html).to include("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}")
|
|
21
|
+
expect(html).not_to include("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}safe}}")
|
|
19
22
|
|
|
20
|
-
|
|
21
|
-
html.
|
|
23
|
+
# Only safe strings with braces are left untouched
|
|
24
|
+
expect(html).to include("{{safe}}")
|
|
25
|
+
expect(html).not_to include("{{unsafe}}")
|
|
22
26
|
|
|
23
27
|
braces = [
|
|
24
28
|
'{',
|
|
@@ -35,15 +39,15 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
35
39
|
|
|
36
40
|
braces.each do |brace1|
|
|
37
41
|
braces.each do |brace2|
|
|
38
|
-
html.
|
|
42
|
+
expect(html).not_to include("#{brace1}#{brace2}unsafe}}")
|
|
39
43
|
end
|
|
40
44
|
end
|
|
41
45
|
|
|
42
46
|
end
|
|
43
47
|
|
|
44
48
|
it 'does not escape Angular interpolation marks in safe strings' do
|
|
45
|
-
html.
|
|
46
|
-
html.
|
|
49
|
+
expect(html).to include("{{safe}}")
|
|
50
|
+
expect(html).not_to include("{{ $root.DOUBLE_LEFT_CURLY_BRACE }}safe}}")
|
|
47
51
|
end
|
|
48
52
|
|
|
49
53
|
it 'does not escape Angular interpolation marks in a block where AngularXSS is disabled' do
|
|
@@ -52,8 +56,8 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
52
56
|
result = html
|
|
53
57
|
end
|
|
54
58
|
|
|
55
|
-
result.
|
|
56
|
-
result.
|
|
59
|
+
expect(result).to include('{{unsafe}}')
|
|
60
|
+
expect(result).not_to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
57
61
|
end
|
|
58
62
|
|
|
59
63
|
it 'does escape Angular interpolation marks after the block where AngularXSS is disabled' do
|
|
@@ -61,27 +65,27 @@ shared_examples_for 'engine preventing Angular XSS' do |partial:|
|
|
|
61
65
|
end
|
|
62
66
|
result = html
|
|
63
67
|
|
|
64
|
-
result.
|
|
65
|
-
result.
|
|
68
|
+
expect(result).to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
69
|
+
expect(result).not_to include('{{unsafe}}')
|
|
66
70
|
end
|
|
67
71
|
|
|
68
72
|
it 'is not confused by exceptions in disable blocks' do
|
|
69
73
|
class SomeException < StandardError; end
|
|
70
74
|
|
|
71
|
-
|
|
75
|
+
expect do
|
|
72
76
|
AngularXss.disable do
|
|
73
77
|
raise SomeException
|
|
74
78
|
end
|
|
75
|
-
|
|
79
|
+
end.to raise_error(SomeException)
|
|
76
80
|
|
|
77
|
-
html.
|
|
78
|
-
html.
|
|
81
|
+
expect(html).to include('{{ $root.DOUBLE_LEFT_CURLY_BRACE }}unsafe}}')
|
|
82
|
+
expect(html).not_to include('{{unsafe}}')
|
|
79
83
|
end
|
|
80
84
|
|
|
81
85
|
it 'does not escape twice' do
|
|
82
86
|
escaped = AngularXss::Escaper.escape('{{')
|
|
83
87
|
double_escaped = AngularXss::Escaper.escape(escaped)
|
|
84
|
-
html.
|
|
88
|
+
expect(html).not_to include(double_escaped)
|
|
85
89
|
end
|
|
86
90
|
|
|
87
91
|
end
|
|
@@ -1,14 +1,23 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
<%- unsafe_string = '{{unsafe}}' %>
|
|
2
|
+
<%- safe_string = '{{safe}}'.html_safe %>
|
|
3
|
+
|
|
4
|
+
<%= unsafe_string %>
|
|
5
|
+
<%= safe_string %>
|
|
6
|
+
|
|
7
|
+
<%= ''.html_safe + unsafe_string %>
|
|
8
|
+
<%= ''.html_safe + safe_string %>
|
|
9
|
+
|
|
10
|
+
<%= ''.html_safe << unsafe_string %>
|
|
11
|
+
<%= ''.html_safe << safe_string %>
|
|
3
12
|
|
|
4
13
|
{{safe}}
|
|
5
14
|
|
|
6
|
-
<div foo="{{safe}}" bar="<%=
|
|
15
|
+
<div foo="{{safe}}" bar="<%= unsafe_string %>">
|
|
7
16
|
{{safe}}
|
|
8
17
|
</div>
|
|
9
18
|
|
|
10
|
-
<%= content_tag(:span,
|
|
11
|
-
<%= content_tag(:span,
|
|
19
|
+
<%= content_tag(:span, unsafe_string) %>
|
|
20
|
+
<%= content_tag(:span, safe_string) %>
|
|
12
21
|
|
|
13
22
|
<%= '{{unsafe}}' %>
|
|
14
23
|
<%= '{{unsafe}}' %>
|
|
@@ -1,11 +1,46 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
1
|
+
-# HTML attributes and static string interpolation in Haml work in different ways:
|
|
2
|
+
-# 1. Under certain conditions, attributes are precompiled.
|
|
3
|
+
-# We never have to escape those because they can not contain user input.
|
|
4
|
+
-# 2. Whenever there is a Ruby call on attributes, Haml will have to evaluate
|
|
5
|
+
-# them at runtime. Since they can contain user input, XSS logic applies.
|
|
6
|
+
|
|
7
|
+
-# precompiled (static)
|
|
8
|
+
- if Gem::Version.new(Haml::VERSION) >= Gem::Version.new(6)
|
|
9
|
+
-# HAML 6 is smart enough to recognize static strings and will not
|
|
10
|
+
-# escape it - so neither do we
|
|
11
|
+
#{'{{safe}}'}
|
|
12
|
+
= "{{safe}}"
|
|
13
|
+
- else
|
|
14
|
+
#{'{{unsafe}}'}
|
|
15
|
+
= "{{unsafe}}"
|
|
4
16
|
|
|
5
17
|
{{safe}}
|
|
18
|
+
%div(foo='{{safe}}')
|
|
19
|
+
%div{:class => '{{safe}}', :id => '{{safe}}'}
|
|
20
|
+
|
|
21
|
+
-# Compiled at runtime:
|
|
22
|
+
- unsafe_evaluated_variable = '{{unsafe}}'
|
|
23
|
+
- safe_evaluated_variable = '{{safe}}'.html_safe
|
|
24
|
+
|
|
25
|
+
= unsafe_evaluated_variable
|
|
26
|
+
= safe_evaluated_variable
|
|
27
|
+
|
|
28
|
+
#{unsafe_evaluated_variable}
|
|
29
|
+
#{safe_evaluated_variable}
|
|
30
|
+
|
|
31
|
+
= ''.html_safe + unsafe_evaluated_variable
|
|
32
|
+
= ''.html_safe + safe_evaluated_variable
|
|
33
|
+
|
|
34
|
+
= ''.html_safe << unsafe_evaluated_variable
|
|
35
|
+
= ''.html_safe << safe_evaluated_variable
|
|
6
36
|
|
|
7
|
-
= content_tag(:span,
|
|
8
|
-
= content_tag(:span,
|
|
37
|
+
= content_tag(:span, unsafe_evaluated_variable)
|
|
38
|
+
= content_tag(:span, safe_evaluated_variable)
|
|
39
|
+
|
|
40
|
+
%div{:class => unsafe_evaluated_variable, :id => unsafe_evaluated_variable}
|
|
41
|
+
%div(bar="#{unsafe_evaluated_variable}")
|
|
42
|
+
%div{:foo => safe_evaluated_variable, :bar => unsafe_evaluated_variable}
|
|
43
|
+
{{safe}}
|
|
9
44
|
|
|
10
45
|
= '{{unsafe}}'
|
|
11
46
|
= '{{unsafe}}'
|
|
@@ -17,21 +52,3 @@
|
|
|
17
52
|
= '{{unsafe}}'
|
|
18
53
|
= '{{unsafe}}'
|
|
19
54
|
= '{{unsafe}}'
|
|
20
|
-
|
|
21
|
-
-# HTML attributes in Haml work in different ways:
|
|
22
|
-
-# 1. Under certain conditions, attributes are precompiled.
|
|
23
|
-
-# We never have to escape those because they can not contain user input.
|
|
24
|
-
-# 2. Whenever there is a Ruby call on attributes, Haml will have to evaluate
|
|
25
|
-
-# them at runtime. Since they can contain user input, XSS logic applies.
|
|
26
|
-
|
|
27
|
-
-# Precompiled:
|
|
28
|
-
%div(foo='{{safe}}')
|
|
29
|
-
%div{:class => '{{safe}}', :id => '{{safe}}'}
|
|
30
|
-
|
|
31
|
-
-# Compiled at runtime:
|
|
32
|
-
- unsafe = '{{unsafe}}'
|
|
33
|
-
- safe = '{{safe}}'.html_safe
|
|
34
|
-
%div{:class => unsafe, :id => unsafe}
|
|
35
|
-
%div(bar="#{unsafe}")
|
|
36
|
-
%div{:foo => safe, :bar => unsafe}
|
|
37
|
-
{{safe}}
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: angular_xss
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 1.0.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Henning Koch
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2024-07-02 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: activesupport
|
|
@@ -52,8 +52,8 @@ files:
|
|
|
52
52
|
- CHANGELOG.md
|
|
53
53
|
- Gemfile
|
|
54
54
|
- Gemfile.lock
|
|
55
|
-
- Gemfile.rails-3.2
|
|
56
|
-
- Gemfile.rails-3.2.lock
|
|
55
|
+
- Gemfile.rails-3.2.haml-4
|
|
56
|
+
- Gemfile.rails-3.2.haml-4.lock
|
|
57
57
|
- Gemfile.rails-4.2.haml-4
|
|
58
58
|
- Gemfile.rails-4.2.haml-4.lock
|
|
59
59
|
- Gemfile.rails-4.2.haml-5
|
|
@@ -66,6 +66,10 @@ files:
|
|
|
66
66
|
- Gemfile.rails-6.1.haml-5.lock
|
|
67
67
|
- Gemfile.rails-7.0.haml-5
|
|
68
68
|
- Gemfile.rails-7.0.haml-5.lock
|
|
69
|
+
- Gemfile.rails-7.1.haml-5
|
|
70
|
+
- Gemfile.rails-7.1.haml-5.lock
|
|
71
|
+
- Gemfile.rails-7.1.haml-6
|
|
72
|
+
- Gemfile.rails-7.1.haml-6.lock
|
|
69
73
|
- LICENSE
|
|
70
74
|
- README.md
|
|
71
75
|
- Rakefile
|
|
@@ -75,10 +79,13 @@ files:
|
|
|
75
79
|
- lib/angular_xss/erb.rb
|
|
76
80
|
- lib/angular_xss/escaper.rb
|
|
77
81
|
- lib/angular_xss/haml.rb
|
|
82
|
+
- lib/angular_xss/output_buffer.rb
|
|
78
83
|
- lib/angular_xss/safe_buffer.rb
|
|
79
84
|
- lib/angular_xss/version.rb
|
|
80
85
|
- spec/angular_xss/erb_spec.rb
|
|
86
|
+
- spec/angular_xss/escaper_spec.rb
|
|
81
87
|
- spec/angular_xss/haml_spec.rb
|
|
88
|
+
- spec/angular_xss/output_buffer_spec.rb
|
|
82
89
|
- spec/angular_xss/safe_buffer_spec.rb
|
|
83
90
|
- spec/spec_helper.rb
|
|
84
91
|
- spec/support/engine_preventing_angular_xss.rb
|
|
@@ -104,14 +111,16 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
104
111
|
- !ruby/object:Gem::Version
|
|
105
112
|
version: '0'
|
|
106
113
|
requirements: []
|
|
107
|
-
rubygems_version: 3.
|
|
114
|
+
rubygems_version: 3.5.13
|
|
108
115
|
signing_key:
|
|
109
116
|
specification_version: 4
|
|
110
117
|
summary: Patches rails_xss and Haml so AngularJS interpolations are auto-escaped in
|
|
111
118
|
unsafe strings.
|
|
112
119
|
test_files:
|
|
113
120
|
- spec/angular_xss/erb_spec.rb
|
|
121
|
+
- spec/angular_xss/escaper_spec.rb
|
|
114
122
|
- spec/angular_xss/haml_spec.rb
|
|
123
|
+
- spec/angular_xss/output_buffer_spec.rb
|
|
115
124
|
- spec/angular_xss/safe_buffer_spec.rb
|
|
116
125
|
- spec/spec_helper.rb
|
|
117
126
|
- spec/support/engine_preventing_angular_xss.rb
|