binxtils 0.5.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8af9c778119b7f329d28122fcdaf2957914abe72ee7b43fde8a5b5e25a0e6294
-  data.tar.gz: 9573e86af8de64e62d98cb64c47c59040897fe3202d2b1167b740404301d270f
+  metadata.gz: 58786a3391a102bc9a6e08a9420088cf9796ae49f425af65bd40504bb350ea37
+  data.tar.gz: decb330bdb3ac5b78b24fdff8fa8431331a8933b4b5e6c06957850e7d5910de4
 SHA512:
-  metadata.gz: 3439600aa1a4add439671f2dcee1434f4627d9968645b05634f734d643d007fbec2a5eb40b93192b457edc0a14bcbab3b4ed4e64a05d5f560a0f1df924fe2fe0
-  data.tar.gz: 6e77b0e688d8c58b5d9bdc20d636ad743f95bd4b7218c49b97ad86c8011010aa8d116414ecd1206f6e2d6ecb855c7587bbbca46938485c820a004aba0edcd7e9
+  metadata.gz: 8ebdeccb552c059b0f4d6951cf6e5305656c97a0d5949d8536fa920e96bce5b211ced41f9eb0252d4420973c3ef853286a2be01ae25ed0a3e63c55feac03d2cc
+  data.tar.gz: 309384e08b2afb921202bd92fede339d559f29857a58b3ab23ed667652182a87252a4424c708d57e74345f6a4f523eb26426ce3c51cacacaaf835eb6efa7cb5f

data/README.md

@@ -9,6 +9,7 @@ gem "binxtils"
 ## Modules
 
 - **Binxtils::InputNormalizer** - Sanitize and normalize user input strings
+- **Binxtils::Secure** - Constant-time comparison of a value against an expected secret
 - **Binxtils::TimeParser** - Parse fuzzy time/date strings into `Time` objects
 - **Binxtils::TimeZoneParser** - Parse and resolve time zone strings
 
@@ -20,6 +21,7 @@ These modules use [Functionable](https://github.com/sethherr/functionable) and a
 Binxtils::TimeParser.parse("next thursday")
 Binxtils::InputNormalizer.string("  Some Input  ")
 Binxtils::TimeZoneParser.parse("Eastern Time")
+Binxtils::Secure.compare?(params[:token], ENV["WEBHOOK_TOKEN"])
 ```
 
 ### Rails concerns
@@ -59,9 +61,18 @@ end
 
 ## npm package
 
-This repo also publishes `@bikeindex/time-localizer`, an npm package for localizing time elements in the browser. Luxon is bundled into the published package, so consumers don't need to install it separately.
+This repo also publishes `@bikeindex/time-localizer`, an npm package for localizing time elements in the browser. It ships two builds of the same source:
 
-To publish a new version: update the version in `package.json`, then run `npm publish` from the repo root (requires npm login with access to the `@bikeindex` scope). The `prepublishOnly` script automatically builds `dist/index.js` before publishing.
+| Build | Luxon | Use when |
+| --- | --- | --- |
+| `dist/index.js` (default) | external — install it yourself | You have a bundler. Luxon stays deduped with your own copy, so `Settings.defaultLocale`, `Settings.now` etc. apply to both. |
+| `dist/index.bundle.js` | bundled in | You have no bundler (e.g. importmap-rails). One request, nothing to resolve. |
+
+Import the default as `@bikeindex/time-localizer` and the standalone as `@bikeindex/time-localizer/bundle`, or reference either file path directly over a CDN.
+
+Don't use the bundled build alongside your own Luxon: you'd ship two copies, and because Luxon's `Settings` are module-scoped, your global config would silently apply to only one of them.
+
+To publish a new version: update the version in `package.json`, then run `npm publish` from the repo root (requires npm login with access to the `@bikeindex` scope). The `prepublishOnly` script builds both artifacts before publishing.
 
 ## Releasing
 

data/lib/binxtils/input_normalizer.rb

@@ -20,6 +20,11 @@ module Binxtils
       val.to_s.present?
     end
 
+    def regex_escape(val)
+      # Lazy hack, good enough for current purposes. Improve if required!
+      string(val)&.gsub(/\W/, ".")
+    end
+
     def sanitize(str = nil)
       Rails::Html::Sanitizer.full_sanitizer.new.sanitize(str.to_s, encode_special_chars: true)
         .strip
@@ -27,9 +32,14 @@ module Binxtils
         .gsub(/\s+/, " ") # remove extra whitespace
     end
 
-    def regex_escape(val)
-      # Lazy hack, good enough for current purposes. Improve if required!
-      string(val)&.gsub(/\W/, ".")
+    # Plain text, so unlike sanitize: every entity is decoded and angle brackets stay literal
+    def plain_text(value = nil)
+      normalize_whitespace(CGI.unescapeHTML(Rails::Html::Sanitizer.full_sanitizer.new.sanitize(value.to_s)))
+    end
+
+    # An HTML email's "blank" lines are often a  , which String#strip doesn't count as whitespace
+    def normalize_whitespace(value = nil)
+      value.to_s.tr(" ", " ").lines.map(&:strip).join("\n").gsub(/\n{3,}/, "\n\n").strip
     end
   end
 end

data/lib/binxtils/secure.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Binxtils
+  module Secure
+    extend Functionable
+
+    def compare?(value, expected)
+      expected.present? && ActiveSupport::SecurityUtils.secure_compare(value.to_s, expected.to_s)
+    end
+  end
+end

data/lib/binxtils/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Binxtils
-  VERSION = "0.5.2"
+  VERSION = "0.7.0"
 end

data/lib/binxtils.rb

@@ -4,10 +4,12 @@ require "functionable"
 require "active_support"
 require "active_support/core_ext"
 require "active_record"
+require "active_support/security_utils"
 require "loofah"
 require "rails-html-sanitizer"
 
 require_relative "binxtils/input_normalizer"
+require_relative "binxtils/secure"
 require_relative "binxtils/time_zone_parser"
 require_relative "binxtils/time_parser"
 require "binxtils/set_period"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: binxtils
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Bike Index
@@ -81,6 +81,7 @@ files:
 - lib/binxtils.rb
 - lib/binxtils/engine.rb
 - lib/binxtils/input_normalizer.rb
+- lib/binxtils/secure.rb
 - lib/binxtils/time_parser.rb
 - lib/binxtils/time_zone_parser.rb
 - lib/binxtils/version.rb