better_html 0.0.3

data/test/better_html/test_helper/safe_erb_tester_test.rb

@@ -0,0 +1,358 @@
+require 'test_helper'
+require 'better_html/test_helper/safe_erb_tester'
+
+module BetterHtml
+  module TestHelper
+    class SafeErbTesterTest < ActiveSupport::TestCase
+      setup do
+        BetterHtml.config
+          .stubs(:javascript_safe_methods)
+          .returns(['j', 'escape_javascript', 'to_json'])
+      end
+
+      test "string without interpolation is safe" do
+        errors = parse(<<-EOF).errors
+          <a onclick="alert('<%= "something" %>')">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= "something" %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript attribute must call '(...).to_json'", errors.first.message
+      end
+
+      test "string with interpolation" do
+        errors = parse(<<-EOF).errors
+          <a onclick="<%= "hello \#{name}" %>">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= "hello #{name}" %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript attribute must call '(...).to_json'", errors.first.message
+      end
+
+      test "string with interpolation and ternary" do
+        errors = parse(<<-EOF).errors
+          <a onclick="<%= "hello \#{foo ? bar : baz}" if bla? %>">
+        EOF
+
+        assert_equal 2, errors.size
+
+        assert_equal '<%= "hello #{foo ? bar : baz}" if bla? %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript attribute must call '(...).to_json'", errors.first.message
+
+        assert_equal '<%= "hello #{foo ? bar : baz}" if bla? %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript attribute must call '(...).to_json'", errors.first.message
+      end
+
+      test "plain erb tag in html attribute" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= unsafe %>)">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= unsafe %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript attribute must call '(...).to_json'", errors.first.message
+      end
+
+      test "to_json is safe in html attribute" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= unsafe.to_json %>)">
+        EOF
+        assert_predicate errors, :empty?
+      end
+
+      test "ternary with safe javascript escaping" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= foo ? bar.to_json : j(baz) %>)">
+        EOF
+        assert_predicate errors, :empty?
+      end
+
+      test "ternary with unsafe javascript escaping" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= foo ? bar : j(baz) %>)">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= foo ? bar : j(baz) %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript attribute must call '(...).to_json'", errors.first.message
+      end
+
+      test "j is safe in html attribute" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method('<%= j unsafe %>')">
+        EOF
+        assert_predicate errors, :empty?
+      end
+
+      test "j() is safe in html attribute" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method('<%= j(unsafe) %>')">
+        EOF
+        assert_predicate errors, :empty?
+      end
+
+      test "escape_javascript is safe in html attribute" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= escape_javascript unsafe %>)">
+        EOF
+        assert_predicate errors, :empty?
+      end
+
+      test "escape_javascript() is safe in html attribute" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= escape_javascript(unsafe) %>)">
+        EOF
+        assert_predicate errors, :empty?
+      end
+
+      test "html_safe is never safe in html attribute, even non javascript attributes like href" do
+        errors = parse(<<-EOF).errors
+          <a href="<%= unsafe.html_safe %>">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= unsafe.html_safe %>', errors.first.token.text
+        assert_equal "erb interpolation with '<%= (...).html_safe %>' inside html attribute is never safe", errors.first.message
+      end
+
+      test "html_safe is never safe in html attribute, even with to_json" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= unsafe.to_json.html_safe %>)">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= unsafe.to_json.html_safe %>', errors.first.token.text
+        assert_equal "erb interpolation with '<%= (...).html_safe %>' inside html attribute is never safe", errors.first.message
+      end
+
+      test "<%== is never safe in html attribute, even non javascript attributes like href" do
+        errors = parse(<<-EOF).errors
+          <a href="<%== unsafe %>">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%== unsafe %>', errors.first.token.text
+        assert_includes "erb interpolation with '<%==' inside html attribute is never safe", errors.first.message
+      end
+
+      test "<%== is never safe in html attribute, even with to_json" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%== unsafe.to_json %>)">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%== unsafe.to_json %>', errors.first.token.text
+        assert_includes "erb interpolation with '<%==' inside html attribute is never safe", errors.first.message
+      end
+
+      test "raw is never safe in html attribute, even non javascript attributes like href" do
+        errors = parse(<<-EOF).errors
+          <a href="<%= raw unsafe %>">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= raw unsafe %>', errors.first.token.text
+        assert_equal "erb interpolation with '<%= raw(...) %>' inside html attribute is never safe", errors.first.message
+      end
+
+      test "raw is never safe in html attribute, even with to_json" do
+        errors = parse(<<-EOF).errors
+          <a onclick="method(<%= raw unsafe.to_json %>)">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= raw unsafe.to_json %>', errors.first.token.text
+        assert_equal "erb interpolation with '<%= raw(...) %>' inside html attribute is never safe", errors.first.message
+      end
+
+      test "unsafe erb in <script> tag without type" do
+        errors = parse(<<-EOF).errors
+          <script>
+            if (a < 1) { <%= unsafe %> }
+          </script>
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= unsafe %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript tag must call '(...).to_json'", errors.first.message
+      end
+
+      test "unsafe erb in javascript template" do
+        errors = parse(<<-JS, template_language: :javascript).errors
+          if (a < 1) { <%= unsafe %> }
+        JS
+
+        assert_equal 1, errors.size
+        assert_equal '<%= unsafe %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript tag must call '(...).to_json'", errors.first.message
+      end
+
+      test "<script> tag without calls is unsafe" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript">
+            if (a < 1) { <%= "unsafe" %> }
+          </script>
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= "unsafe" %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript tag must call '(...).to_json'", errors.first.message
+      end
+
+      test "javascript template without calls is unsafe" do
+        errors = parse(<<-JS, template_language: :javascript).errors
+          if (a < 1) { <%= "unsafe" %> }
+        JS
+
+        assert_equal 1, errors.size
+        assert_equal '<%= "unsafe" %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript tag must call '(...).to_json'", errors.first.message
+      end
+
+      test "unsafe erb in javascript_tag" do
+        errors = parse(<<-EOF).errors
+          <%= javascript_tag do %>
+            if (a < 1) { <%= unsafe %> }
+          <% end %>
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= javascript_tag do %>', errors.first.token.text
+        assert_includes "'javascript_tag do' syntax is deprecated; use inline <script> instead", errors.first.message
+      end
+
+      test "unsafe erb in <script> tag with text/javascript content type" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript">
+            if (a < 1) { <%= unsafe %> }
+          </script>
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '<%= unsafe %>', errors.first.token.text
+        assert_equal "erb interpolation in javascript tag must call '(...).to_json'", errors.first.message
+      end
+
+      test "<script> tag with non executable content type is ignored" do
+        errors = parse(<<-EOF).errors
+          <script type="text/html">
+            <a onclick="<%= unsafe %>">
+          </script>
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "statements not allowed in script tags" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript">
+            <% if foo? %>
+              bla
+            <% end %>
+          </script>
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal "<%             if foo? \n%>", errors.first.token.text
+        assert_equal "erb statement not allowed here; did you mean '<%=' ?", errors.first.message
+      end
+
+      test "statements not allowed in javascript template" do
+        errors = parse(<<-JS, template_language: :javascript).errors
+          <% if foo %>
+            bla
+          <% end %>
+        JS
+
+        assert_equal 1, errors.size
+        assert_equal "<%           if foo \n%>", errors.first.token.text
+        assert_equal "erb statement not allowed here; did you mean '<%=' ?", errors.first.message
+      end
+
+      test "script tag without content" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript"></script>
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "statement after script regression" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript">
+            foo()
+          </script>
+          <% if condition? %>
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "<script> with to_json is safe" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript">
+            <%= unsafe.to_json %>
+          </script>
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "javascript template with to_json is safe" do
+        errors = parse(<<-JS, template_language: :javascript).errors
+          <%= unsafe.to_json %>
+        JS
+
+        assert_predicate errors, :empty?
+      end
+
+      test "<script> with raw and to_json is safe" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript">
+            <%= raw unsafe.to_json %>
+          </script>
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "javascript template with raw and to_json is safe" do
+        errors = parse(<<-JS, template_language: :javascript).errors
+          <%= raw unsafe.to_json %>
+        JS
+
+        assert_predicate errors, :empty?
+      end
+
+      test "end statements are allowed in script tags" do
+        errors = parse(<<-EOF).errors
+          <script type="text/template">
+            <%= ui_form do %>
+              <div></div>
+            <% end %>
+          </script>
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "statements are allowed in text/html tags" do
+        errors = parse(<<-EOF).errors
+          <script type="text/html">
+            <% if condition? %>
+              <div></div>
+            <% end %>
+          </script>
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      private
+      def parse(data, template_language: :html)
+        SafeErbTester::Tester.new(data, template_language: template_language)
+      end
+    end
+  end
+end

data/test/better_html/test_helper/safe_lodash_tester_test.rb

@@ -0,0 +1,80 @@
+require 'test_helper'
+require 'better_html/test_helper/safe_lodash_tester'
+
+module BetterHtml
+  module TestHelper
+    class SafeLodashTesterTest < ActiveSupport::TestCase
+      test "interpolate in attribute not allowed" do
+        errors = parse(<<-EOF).errors
+          <div class="[%! foo %]">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '[%! foo %]', errors.first.token.text
+        assert_equal "lodash interpolation with '[%!' inside html attribute is never safe", errors.first.message
+      end
+
+      test "escape in attribute is allowed" do
+        errors = parse(<<-EOF).errors
+          <div class="[%= foo %]">
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "escape in javascript attribute not allowed" do
+        errors = parse(<<-EOF).errors
+          <div onclick="[%= foo %]">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '[%= foo %]', errors.first.token.text
+        assert_equal "lodash interpolation in javascript attribute `onclick` must call `JSON.stringify(foo)`", errors.first.message
+      end
+
+      test "escape in javascript attribute with JSON.stringify is allowed" do
+        errors = parse(<<-EOF).errors
+          <div onclick="[%= JSON.stringify(foo) %]">
+        EOF
+
+        assert_predicate errors, :empty?
+      end
+
+      test "script tag is not allowed" do
+        errors = parse(<<-EOF).errors
+          <script type="text/javascript"></script>
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal 'script', errors.first.token.text
+        assert_equal "No script tags allowed nested in lodash templates", errors.first.message
+      end
+
+      test "statement not allowed in attribute name" do
+        errors = parse(<<-EOF).errors
+          <div class[% if (foo) %]="foo">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '[% if (foo) %]', errors.first.token.text
+        assert_equal "javascript statement not allowed here; did you mean '[%=' ?", errors.first.message
+      end
+
+      test "statement not allowed in attribute value" do
+        errors = parse(<<-EOF).errors
+          <div class="foo[% if (foo) %]">
+        EOF
+
+        assert_equal 1, errors.size
+        assert_equal '[% if (foo) %]', errors.first.token.text
+        assert_equal "javascript statement not allowed here; did you mean '[%=' ?", errors.first.message
+      end
+
+      private
+
+      def parse(data)
+        SafeLodashTester::Tester.new(data)
+      end
+    end
+  end
+end

data/test/better_html/tree_test.rb

@@ -0,0 +1,110 @@
+require 'test_helper'
+
+module BetterHtml
+  class TreeTest < ActiveSupport::TestCase
+    test "simple node" do
+      tree = Tree.new("<div></div>")
+      assert_predicate tree.errors, :empty?
+
+      assert_equal 1, tree.root.size
+      assert_equal 'div', tree.root[0].name
+      assert_equal true, tree.root[0].closed?
+      assert_equal false, tree.root[0].self_closing?
+    end
+
+    test "simple self-closing node" do
+      tree = Tree.new("<meta />")
+      assert_predicate tree.errors, :empty?
+
+      assert_equal 1, tree.root.size
+      assert_equal 'meta', tree.root[0].name
+      assert_equal true, tree.root[0].closed?
+      assert_equal true, tree.root[0].self_closing?
+    end
+
+    test "mismatched closing tag" do
+      tree = Tree.new("<div></p></div>")
+      assert_equal 1, tree.errors.size
+      assert_equal "mismatched </p> in <div> element", tree.errors[0].message
+
+      assert_equal 1, tree.root.size
+      assert_equal 'div', tree.root[0].name
+      assert_equal true, tree.root[0].closed?
+      assert_equal false, tree.root[0].self_closing?
+    end
+
+    test "mismatched closing tag at root" do
+      tree = Tree.new("</p>")
+      assert_equal 1, tree.errors.size
+      assert_equal "mismatched </p> at root of tree", tree.errors[0].message
+
+      assert_predicate tree.root, :empty?
+    end
+
+    test "node with text content" do
+      tree = Tree.new("<div>text</div>")
+      assert_predicate tree.errors, :empty?
+
+      assert_equal 1, tree.root.size
+      div = tree.root[0]
+      assert_equal 1, div.size
+      assert_equal 'text', div[0].content
+    end
+
+    test "extract erb from text node" do
+      tree = Tree.new("<div>before<%= foo %>after</div>")
+      assert_predicate tree.errors, :empty?
+
+      assert_equal 1, tree.root.size
+      div = tree.root[0]
+      assert_equal 1, div.size
+      text = div[0]
+      assert_equal 3, text.content_parts.size
+      assert_equal 'before', text.content_parts[0].text
+      assert_equal '<%= foo %>', text.content_parts[1].text
+      assert_equal ' foo ', text.content_parts[1].code
+      assert_equal 'after', text.content_parts[2].text
+    end
+
+    test "closing tag for void element" do
+      tree = Tree.new("<br></br>")
+      assert_equal 1, tree.errors.size
+      assert_equal "end of tag for void element: </br>", tree.errors[0].message
+
+      assert_equal 1, tree.root.size
+      assert_equal 'br', tree.root[0].name
+      assert_equal true, tree.root[0].closed?
+      assert_equal false, tree.root[0].self_closing?
+      assert_equal true, tree.root[0].void?
+    end
+
+    test "properly self-closed void element" do
+      tree = Tree.new("<br/>")
+      assert_predicate tree.errors, :empty?
+
+      assert_equal 1, tree.root.size
+      assert_equal 'br', tree.root[0].name
+      assert_equal true, tree.root[0].closed?
+      assert_equal true, tree.root[0].self_closing?
+      assert_equal true, tree.root[0].void?
+    end
+
+    test "void elements are nested properly" do
+      tree = Tree.new("<div><hr>test</hr></div>")
+      assert_equal 1, tree.errors.size
+      assert_equal "end of tag for void element: </hr>", tree.errors[0].message
+
+      assert_equal 1, tree.root.size
+      div = tree.root[0]
+      assert_equal 2, div.size
+      assert_equal true, div[0].element?
+      assert_equal true, div[1].text?
+    end
+
+    test "parser errors are bubbled up" do
+      tree = Tree.new("<>")
+      assert_equal 1, tree.errors.size
+      assert_equal "expected '/' or tag name", tree.errors[0].message
+    end
+  end
+end