blazer 2.2.2 → 2.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10aff02b2f4ebe93012af611e329c3a0a0be23c208d89d46db940c1bd21a97ed
-  data.tar.gz: b629339fcc448a079ce4759623a8906c9e4977435419ec2109c86a34d354f70a
+  metadata.gz: e7335b71aeda44ad8482d8950a5539c1fbf1175d5b754be3efa3ebbe03fce736
+  data.tar.gz: 80bc04aecc1050cdbd35a37b9d1c52dc26aa3090ca329021859003853cce1af9
 SHA512:
-  metadata.gz: ac3263567e689625741e0fa03a46fff1c1e8100f184245e130ed2e7b9b301173d5e8e6472a1fe6d5d7fb4e9bbc162ae2f3b4eeab5a14efc9bc7b59b605d96735
-  data.tar.gz: 800fa336c7c998345e0f1d047496ae7c6d39095714953d65a3ef5286b376da029fe885ae997afccb7f4adc86a3371e6658565e8bdd80cfb7bd7cb352fe64df72
+  metadata.gz: 0c17945167d21ecf91b67074483678e856ff2fd875bd9b9e5c18b828f1b83e4bf4de253877c0a98e3c97e8bd9d2272372afb5363b55740d9a0b83c3deed141ed
+  data.tar.gz: d5690c90d76ac3a947e17e86b3c6da998ac986ea36bc63b1840dd6a0a92ce937539946563b696dfdd72ae903dd3a01974c7da76027c4dad9e34159f2b82990fd

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 2.2.3 (2020-05-30)
+
+- Improved query parameter handling
+
 ## 2.2.2 (2020-04-13)
 
 - Added experimental support for the Socrata Open Data API (SODA)

data/README.md

@@ -680,7 +680,7 @@ Supports [SOQL](https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta
 
 ### Socrata Open Data API (SODA)
 
-*Experimental [master]*
+*Experimental*
 
 Set:
 

data/app/controllers/blazer/base_controller.rb

@@ -86,8 +86,22 @@ module Blazer
         [smart_var, error]
       end
 
-      def variable_params
-        params.except(:controller, :action, :id, :host, :query, :dashboard, :query_id, :query_ids, :table_names, :authenticity_token, :utf8, :_method, :commit, :statement, :data_source, :name, :fork_query_id, :blazer, :run_id).permit!
+      # don't pass to url helpers
+      #
+      # some are dangerous when passed as symbols
+      # root_url({host: "evilsite.com"})
+      #
+      # certain ones (like host) only affect *_url and not *_path
+      #
+      # when permitted parameters are passed in Rails 6,
+      # they appear to be added as GET parameters
+      # root_url(params.permit(:host))
+      BLACKLISTED_KEYS = [:controller, :action, :id, :host, :query, :dashboard, :query_id, :query_ids, :table_names, :authenticity_token, :utf8, :_method, :commit, :statement, :data_source, :name, :fork_query_id, :blazer, :run_id, :script_name, :original_script_name]
+
+      # remove blacklisted keys from both params and permitted keys for better sleep
+      def variable_params(resource)
+        permitted_keys = resource.variables - BLACKLISTED_KEYS.map(&:to_s)
+        params.except(*BLACKLISTED_KEYS).permit(*permitted_keys)
       end
       helper_method :variable_params
 

data/app/controllers/blazer/dashboards_controller.rb

@@ -43,7 +43,7 @@ module Blazer
 
     def update
       if update_dashboard(@dashboard)
-        redirect_to dashboard_path(@dashboard, variable_params)
+        redirect_to dashboard_path(@dashboard, variable_params(@dashboard))
       else
         render_errors @dashboard
       end
@@ -62,7 +62,7 @@ module Blazer
         Blazer.transform_statement.call(data_source, statement) if Blazer.transform_statement
         data_source.clear_cache(statement)
       end
-      redirect_to dashboard_path(@dashboard, variable_params)
+      redirect_to dashboard_path(@dashboard, variable_params(@dashboard))
     end
 
     private

data/app/controllers/blazer/queries_controller.rb

@@ -45,7 +45,7 @@ module Blazer
       @query.creator = blazer_user if @query.respond_to?(:creator)
 
       if @query.save
-        redirect_to query_path(@query, variable_params)
+        redirect_to query_path(@query, variable_params(@query))
       else
         render_errors @query
       end
@@ -156,7 +156,7 @@ module Blazer
       process_vars(@statement, @query.data_source)
       Blazer.transform_statement.call(data_source, @statement) if Blazer.transform_statement
       data_source.clear_cache(@statement)
-      redirect_to query_path(@query, variable_params)
+      redirect_to query_path(@query, variable_params(@query))
     end
 
     def update
@@ -168,7 +168,7 @@ module Blazer
         @query.errors.add(:base, "Sorry, permission denied")
       end
       if @query.errors.empty? && @query.update(query_params)
-        redirect_to query_path(@query, variable_params)
+        redirect_to query_path(@query, variable_params(@query))
       else
         render_errors @query
       end
@@ -176,7 +176,7 @@ module Blazer
 
     def destroy
       @query.destroy if @query.editable?(blazer_user)
-      redirect_to root_url
+      redirect_to root_path
     end
 
     def tables

data/app/mailers/blazer/slack_notifier.rb

@@ -60,6 +60,9 @@ module Blazer
       ActionController::Base.helpers.pluralize(*args)
     end
 
+    # checks shouldn't have variables, but in any case,
+    # avoid passing variable params to url helpers
+    # (known unsafe parameters are removed, but blacklist isn't ideal)
     def self.query_url(id)
       Blazer::Engine.routes.url_helpers.query_url(id, ActionMailer::Base.default_url_options)
     end

data/app/models/blazer/dashboard.rb

@@ -6,6 +6,10 @@ module Blazer
 
     validates :name, presence: true
 
+    def variables
+      queries.flat_map { |q| q.variables }.uniq
+    end
+
     def to_param
       [id, name.gsub("'", "").parameterize].join("-")
     end

data/app/views/blazer/check_mailer/failing_checks.html.erb

@@ -1,5 +1,6 @@
 <ul>
   <% @checks.each do |check| %>
+    <%# check queries shouldn't have variables, but in any case, don't pass them to url helpers %>
     <li><%= link_to check.query.name, query_url(check.query_id) %> <%= check.state %></li>
   <% end %>
 </ul>

data/app/views/blazer/check_mailer/state_change.html.erb

@@ -2,6 +2,7 @@
   <head>
   </head>
   <body style="font-family: 'Helvetica Neue', Arial, Helvetica; font-size: 14px; color: #333;">
+    <%# check queries shouldn't have variables, but in any case, don't pass them to url helpers %>
     <p><%= link_to "View", query_url(@check.query_id) %></p>
     <% if @error %>
       <p><%= @error %></p>

data/app/views/blazer/dashboards/_form.html.erb

@@ -1,4 +1,4 @@
-<%= form_for @dashboard, url: (@dashboard.persisted? ? dashboard_path(@dashboard, variable_params) : dashboards_path(variable_params)), html: {id: "app", class: "small-form"} do |f| %>
+<%= form_for @dashboard, url: (@dashboard.persisted? ? dashboard_path(@dashboard, variable_params(@dashboard)) : dashboards_path(variable_params(@dashboard))), html: {id: "app", class: "small-form"} do |f| %>
   <% if @dashboard.errors.any? %>
     <div class="alert alert-danger"><%= @dashboard.errors.full_messages.first %></div>
   <% end %>

data/app/views/blazer/dashboards/show.html.erb

@@ -10,7 +10,7 @@
         </h3>
       </div>
       <div class="col-sm-3 text-right">
-        <%= link_to "Edit", edit_dashboard_path(@dashboard, variable_params), class: "btn btn-info" %>
+        <%= link_to "Edit", edit_dashboard_path(@dashboard, variable_params(@dashboard)), class: "btn btn-info" %>
       </div>
     </div>
   </div>
@@ -21,7 +21,7 @@
 <% if @data_sources.any? { |ds| ds.cache_mode != "off" } %>
   <p class="text-muted" style="float: right;">
     Some queries may be cached
-    <%= link_to "Refresh", refresh_dashboard_path(@dashboard, variable_params), method: :post %>
+    <%= link_to "Refresh", refresh_dashboard_path(@dashboard, variable_params(@dashboard)), method: :post %>
   </p>
 <% end %>
 
@@ -33,7 +33,7 @@
 
 <% @queries.each_with_index do |query, i| %>
   <div class="chart-container">
-    <h4><%= link_to query.friendly_name, query_path(query, variable_params), target: "_blank" %></h4>
+    <h4><%= link_to query.friendly_name, query_path(query, variable_params(query)), target: "_blank" %></h4>
     <div id="chart-<%= i %>" class="chart">
       <p class="text-muted">Loading...</p>
     </div>

data/app/views/blazer/queries/_form.html.erb

@@ -3,7 +3,7 @@
 <% end %>
 
 <div id="app" v-cloak>
-  <%= form_for @query, url: (@query.persisted? ? query_path(@query, variable_params) : queries_path(variable_params)), html: {autocomplete: "off"} do |f| %>
+  <%= form_for @query, url: (@query.persisted? ? query_path(@query, variable_params(@query)) : queries_path(variable_params(@query))), html: {autocomplete: "off"} do |f| %>
     <div class="row">
       <div id="statement-box" class="col-xs-8">
         <div class= "form-group">
@@ -67,7 +67,7 @@
 </div>
 
 <script>
-  <%= blazer_js_var "params", variable_params %>
+  <%= blazer_js_var "params", variable_params(@query) %>
   <%= blazer_js_var "previewStatement", Hash[Blazer.data_sources.map { |k, v| [k, (v.preview_statement rescue "")] }] %>
 
   var app = new Vue({

data/app/views/blazer/queries/run.html.erb

@@ -20,7 +20,7 @@
         <% end %>
 
         <% if @query && params[:query_id] %>
-          <%= link_to "Refresh", refresh_query_path(@query, variable_params), method: :post %>
+          <%= link_to "Refresh", refresh_query_path(@query, variable_params(@query)), method: :post %>
         <% end %>
       </p>
     <% end %>
@@ -36,7 +36,7 @@
 
       <% if @query && @result.forecastable? && !params[:forecast] %>
         &middot;
-        <%= link_to "Forecast", query_path(@query, {forecast: "t"}.merge(variable_params)) %>
+        <%= link_to "Forecast", query_path(@query, {forecast: "t"}.merge(variable_params(@query))) %>
       <% end %>
     </p>
   <% end %>

data/app/views/blazer/queries/show.html.erb

@@ -10,8 +10,8 @@
         </h3>
       </div>
       <div class="col-sm-3 text-right">
-        <%= link_to "Edit", edit_query_path(@query, variable_params), class: "btn btn-default", disabled: !@query.editable?(blazer_user) %>
-        <%= link_to "Fork", new_query_path(variable_params.merge(fork_query_id: @query.id, data_source: @query.data_source, name: @query.name)), class: "btn btn-info" %>
+        <%= link_to "Edit", edit_query_path(@query, variable_params(@query)), class: "btn btn-default", disabled: !@query.editable?(blazer_user) %>
+        <%= link_to "Fork", new_query_path(variable_params(@query).merge(fork_query_id: @query.id, data_source: @query.data_source, name: @query.name)), class: "btn btn-info" %>
 
         <% if !@error && @success %>
           <%= button_to "Download", run_queries_path(query_id: @query.id, format: "csv", forecast: params[:forecast]), params: {statement: @statement}, class: "btn btn-primary" %>
@@ -56,7 +56,7 @@
       $("#results").addClass("query-error").html(message)
     }
 
-    <%= blazer_js_var "data", variable_params.merge(statement: @statement, query_id: @query.id, data_source: @query.data_source) %>
+    <%= blazer_js_var "data", variable_params(@query).merge(statement: @statement, query_id: @query.id, data_source: @query.data_source) %>
 
     runQuery(data, showRun, showError)
   </script>

data/lib/blazer/version.rb

@@ -1,3 +1,3 @@
 module Blazer
-  VERSION = "2.2.2"
+  VERSION = "2.2.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: blazer
 version: !ruby/object:Gem::Version
-  version: 2.2.2
+  version: 2.2.3
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-04-14 00:00:00.000000000 Z
+date: 2020-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties