cama_contact_form 0.1.12 → 0.1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b3853b9d6da4e632d947929a801497c0ea6daa25eff3b08834adf1c1aa5d5b86
-  data.tar.gz: 2293350d6071301a7795322485e25402974f82ef2dfadd485833a3c7bf89c851
+  metadata.gz: 0773dea2d0ad03b4c0179fc634372ab5fe9a6111da16fe0c187118475df052f6
+  data.tar.gz: 7868caf0afb73a4f508855521a1c4a15660a7786dbea9876303096402f198844
 SHA512:
-  metadata.gz: d6aff50b5f8576691862b332848774945591b00600bae4f0c36bd69852ce15dc90c92f2869b1a21a4d6b2e6bab2a6d623b2c1cd5ef93f70ce7265314d8c96112
-  data.tar.gz: e4f5b5977c96e550e3960d07b2fd4c5ae84ed2dae74c4e21f71036815f447476557580ba59c85738bd74f479a4580931d14f67688bfe47067f12d0d83571dcc4
+  metadata.gz: 9435100f0afd723a911aa6efee2fc5ed30610b7eea1a5f640eeb45d6e5ff92a7199d4360d599b0ebffcfc279e79fb17dff80135fb4db69e9d88233d356001ea8
+  data.tar.gz: 563ba96b2539b554971caee757e47ed840ac48918c7564993197095876d3435b74ac86974023caead09ebcb6742f979f86d1ab58e651d87f7b47e134a5036c66

data/README.md

@@ -15,8 +15,7 @@ release needs, in this order:
 5. publishes the GitHub release, with notes taken from `CHANGELOG.md` and the `.gem` plus its
    checksums attached.
 
-No tests run here — the suite that covers this plugin lives in the
-[camaleon_cms](https://github.com/owen2345/camaleon-cms) repository.
+No tests run here — the release workflow only builds and publishes the gem.
 
 `lib/cama_contact_form/version.rb` is the single source of truth for the version. The tag, the
 published gem and the GitHub release all derive from it, so they cannot disagree.
@@ -46,7 +45,7 @@ Edit `lib/cama_contact_form/version.rb`:
 
 ```ruby
 module CamaContactForm
-  VERSION = "0.1.12"
+  VERSION = '0.1.12'
 end
 ```
 

data/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 begin
   require 'bundler/setup'
 rescue LoadError
@@ -14,24 +16,7 @@ RDoc::Task.new(:rdoc) do |rdoc|
   rdoc.rdoc_files.include('lib/**/*.rb')
 end
 
-APP_RAKEFILE = File.expand_path("../test/dummy/Rakefile", __FILE__)
-load 'rails/tasks/engine.rake'
-
-
-load 'rails/tasks/statistics.rake'
-
-
-
+# The plugin's behaviour is exercised host-side in the camaleon_cms repository (see README /
+# CHANGELOG); this repo ships no test suite, so the dummy-app engine tasks and the default `test`
+# task are intentionally absent. `Bundler::GemHelper.install_tasks` still provides build/install/release.
 Bundler::GemHelper.install_tasks
-
-require 'rake/testtask'
-
-Rake::TestTask.new(:test) do |t|
-  t.libs << 'lib'
-  t.libs << 'test'
-  t.pattern = 'test/**/*_test.rb'
-  t.verbose = false
-end
-
-
-task default: :test

data/app/controllers/concerns/plugins/cama_contact_form/contact_form_controller_concern.rb

@@ -1,3 +1,9 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+# Contact-form logic shared by the admin and front controllers: it gates authored markup at save
+# time, and validates, stores and mails a visitor's submission.
 module Plugins::CamaContactForm::ContactFormControllerConcern
   # The field types whose submitted value the renderer interpolates back into the page, and the
   # position each one lands in. Everything else -- radio, checkboxes, dropdown, file -- is only ever
@@ -5,57 +11,103 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
   ECHOED_ATTRIBUTE_FIELD_TYPES = %w[text website email].freeze
   ECHOED_TEXTAREA_FIELD_TYPES = %w[paragraph textarea].freeze
 
+  # Field types whose submitted value is a list of chosen option labels, joined for the mail summary.
+  MULTI_VALUE_FIELD_TYPES = %w[radio checkboxes].freeze
+
   # Elements that do something rather than say something, wherever they appear.
   ACTIVE_ELEMENTS = %w[script style iframe object embed applet frame frameset form input button
                        link meta base svg math template].freeze
-  ACTIVE_ELEMENT = /<\s*\/?\s*(?:#{ACTIVE_ELEMENTS.join('|')})\b/i
+  ACTIVE_ELEMENT = %r{<\s*/?\s*(?:#{ACTIVE_ELEMENTS.join('|')})\b}i
   EVENT_HANDLER_IN_TAG = /<[a-zA-Z][^>]*\son[a-zA-Z]+\s*=/im
   URL_SCHEME_IN_TAG =
-    %r{<[a-zA-Z][^>]*\b(?:href|src|action|formaction|data|poster|srcdoc|background)\s*=\s*
-       ["']?\s*(?:javascript|vbscript|data)\s*:}imx
+    /<[a-zA-Z][^>]*\b(?:href|src|action|formaction|data|poster|srcdoc|background)\s*=\s*
+       ["']?\s*(?:javascript|vbscript|data)\s*:/imx
 
   def perform_save_form(form, fields, success, errors)
     attachments = []
-    if validate_to_save_form(form, fields, errors)
-      form.fields.each do |f|
-        if f[:field_type] == 'file'
-          file_paths = []
-          fields[f[:cid].to_sym].to_a.each do |file|
-            res = cama_tmp_upload(file, {
-                maximum: current_site.get_option('filesystem_max_size', 100).megabytes,
-                path: Rails.public_path.join("contact_form", current_site.id.to_s),
-                name: file.original_filename
-              }
-            )
-            if res[:error].present?
-              errors << res[:error].to_s.translate
-            else
-              attachments << res[:file_path]
-              file_paths << res[:file_path].sub(Rails.public_path.to_s, cama_root_url)
-            end
-          end
-          fields[f[:cid].to_sym] = file_paths
+    return unless validate_to_save_form(form, fields, errors)
+
+    form.fields.each do |f|
+      next unless f[:field_type] == 'file'
+
+      file_paths = []
+      fields[f[:cid].to_sym].to_a.each do |file|
+        res = cama_tmp_upload(file, {
+                                maximum: current_site.get_option('filesystem_max_size', 100).megabytes,
+                                path: Rails.public_path.join('contact_form', current_site.id.to_s),
+                                name: file.original_filename
+                              })
+        if res[:error].present?
+          errors << res[:error].to_s.translate
+        else
+          attachments << res[:file_path]
+          file_paths << res[:file_path].sub(Rails.public_path.to_s, cama_root_url)
         end
       end
-      new_settings = {"fields" => fields, "created_at" => Time.current.strftime("%Y-%m-%d %H:%M:%S").to_s}.to_json
-      form_new = current_site.contact_forms.new(name: "response-#{Time.now}", description: form.description, settings: new_settings, site_id: form.site_id, parent_id: form.id)
-      if form_new.save
-        fields_data = convert_form_values(form, fields)
-        message_body = form.mail_settings[:body].to_s.translate.cama_replace_codes(fields)
-        content = render_to_string(partial: plugin_view('contact_form/email_content'), layout: false, formats: [:html], locals: {file_attachments: attachments, fields: fields_data, values: fields, message_body: message_body, form: form})
-        cama_send_email(form.mail_settings[:to], form.mail_settings[:subject].to_s.translate.cama_replace_codes(fields), {attachments: attachments, content: content, extra_data: {fields: fields_data}})
-        success << form.the_message('mail_sent_ok', t('.success_form_val', default: 'Your message has been sent successfully. Thank you very much!'))
-        args = {form: form, values: fields}; hooks_run("contact_form_after_submit", args)
-        if form.mail_settings[:to_answer].present? && (answer_to = fields[form.mail_settings[:to_answer].to_s.gsub(/(\[|\])/, '').to_sym]).present?
-          content = form.mail_settings[:body_answer].to_s.translate.cama_replace_codes(fields)
-          cama_send_email(answer_to, form.mail_settings[:subject_answer].to_s.translate.cama_replace_codes(fields), {content: content})
-        end
-      else
-        errors << form.the_message('mail_sent_ng', t('.error_form_val', default: 'An error occurred, please try again.'))
+      fields[f[:cid].to_sym] = file_paths
+    end
+    new_settings = { 'fields' => fields, 'created_at' => Time.now.utc.strftime('%Y-%m-%d %H:%M:%S').to_s }.to_json
+    form_new = current_site.contact_forms.new(name: "response-#{Time.now.utc}", description: form.description,
+                                              settings: new_settings, site_id: form.site_id, parent_id: form.id)
+    if form_new.save
+      fields_data = convert_form_values(form, fields)
+      message_body = form.mail_settings[:body].to_s.translate.cama_replace_codes(fields)
+      content = render_to_string(partial: plugin_view('contact_form/email_content'), layout: false, formats: [:html],
+                                 locals: { file_attachments: attachments, fields: fields_data, values: fields,
+                                           message_body: message_body, form: form })
+      cama_send_email(form.mail_settings[:to],
+                      form.mail_settings[:subject].to_s.translate.cama_replace_codes(fields),
+                      { attachments: attachments, content: content, extra_data: { fields: fields_data } })
+      success << form.the_message('mail_sent_ok',
+                                  t('.success_form_val',
+                                    default: 'Your message has been sent successfully. Thank you very much!'))
+      args = { form: form, values: fields }
+      hooks_run('contact_form_after_submit', args)
+      if (answer_to = auto_reply_recipient(form, fields))
+        content = form.mail_settings[:body_answer].to_s.translate.cama_replace_codes(fields)
+        cama_send_email(answer_to, form.mail_settings[:subject_answer].to_s.translate.cama_replace_codes(fields),
+                        { content: content })
       end
+    else
+      errors << form.the_message('mail_sent_ng',
+                                 t('.error_form_val', default: 'An error occurred, please try again.'))
     end
   end
 
+  # CF-1: the auto-reply ("confirmation e-mail") recipient is whatever the visitor typed into the field
+  # named by `to_answer`, so it is fully attacker-controlled -- unchecked, the feature sends mail from
+  # the site's own From address to anyone. The reply goes to the normalized address, or nowhere.
+  # Volume across submissions is a separate concern (CF-2, rate limiting).
+  #
+  # A refused present value is logged -- otherwise the response is indistinguishable from full
+  # success and a lost confirmation is undiagnosable. The line names the form, not the value: the
+  # value is hostile by hypothesis, and hostile bytes don't belong in the log stream. An absent or
+  # blank value stays silent, as it always has -- the visitor supplied nothing to refuse.
+  def auto_reply_recipient(form, fields)
+    return if form.mail_settings[:to_answer].blank?
+
+    value = fields[form.mail_settings[:to_answer].to_s.gsub(/(\[|\])/, '').to_sym]
+    address = normalized_email_address(value)
+    if address.nil? && value.present?
+      Rails.logger.warn("cama_contact_form: auto-reply for form #{form.id} skipped, recipient failed validation (CF-1)")
+    end
+    address
+  end
+
+  # The stripped value when it is a single, syntactically-valid address; nil otherwise. Surrounding
+  # whitespace is stripped -- a pasted or mobile-typed address often carries a stray space, and the
+  # mailer delivered those before this guard existed -- and what remains must match
+  # `URI::MailTo::EMAIL_REGEXP`, which is anchored and admits no CR/LF, inner whitespace or `,`/`;`,
+  # so one submission can neither header-inject a Bcc nor fan out to a recipient list. Refused with
+  # the attacks, deliberately: name-addr forms (`Jane <jane@example.com>` -- address lists share that
+  # grammar) and raw-unicode addresses (the regexp is ASCII-only; the punycode form passes). A
+  # non-String value (`fields[cid][]=…` arrives as an Array) is rejected through `to_s` rather than
+  # raising.
+  def normalized_email_address(value)
+    address = value.to_s.strip
+    address if address.match?(URI::MailTo::EMAIL_REGEXP)
+  end
+
   # A visitor's submission is rejected, not escaped, for the same reason an untrusted author's is:
   # what is stored and redisplayed then equals what was submitted, so rendering it verbatim adds
   # nothing.
@@ -161,31 +213,38 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
       cid = f[:cid].to_sym
       label = f[:label].to_sym
       case f[:field_type].to_s
-        when 'text', 'website', 'paragraph', 'textarea', 'email', 'radio', 'checkboxes', 'dropdown', 'file'
-          if f[:required].to_s.cama_true? && !fields[cid].present?
-            errors << "#{label.to_s.translate}: #{form.the_message('invalid_required', t('.error_validation_val', default: 'This value is required'))}"
-            validate = false
-          end
-          # `to_s` because the submitter chooses whether to send the key at all, and what shape to
-          # send it in: `nil.match` and `Hash#match` are both NoMethodError, on a public endpoint.
-          if f[:field_type].to_s == 'email'
-            unless fields[cid].to_s.match(/@/)
-              errors << "#{label.to_s.translate}: #{form.the_message('invalid_email', t('.email_invalid_val', default: 'The e-mail address appears invalid'))}"
-              validate = false
-            end
-          end
-        when 'captcha'
-          error_message = ->{
-            errors << "#{label.to_s.translate}: #{form.the_message('captcha_not_match', t('.captch_error_val', default: 'The entered code is incorrect'))}"
-            validate = false
-          }
-
-          if form.recaptcha_enabled?
-            form.set_captcha_settings!
-            error_message.call unless verify_recaptcha
-          else
-            error_message.call unless cama_captcha_verified?
-          end
+      when 'text', 'website', 'paragraph', 'textarea', 'email', 'radio', 'checkboxes', 'dropdown', 'file'
+        if f[:required].to_s.cama_true? && fields[cid].blank?
+          errors << "#{label.to_s.translate}: #{form.the_message('invalid_required',
+                                                                 t('.error_validation_val',
+                                                                   default: 'This value is required'))}"
+          validate = false
+        end
+        # Judged by the same rule as the auto-reply recipient (`normalized_email_address`, which is
+        # total on any submitted shape -- the submitter chooses whether to send the key at all, and
+        # in what shape), so the field validation and the send decision cannot disagree: a malformed
+        # address is an error the visitor can act on here, not a success message followed by a
+        # confirmation that silently never arrives.
+        if (f[:field_type].to_s == 'email') && normalized_email_address(fields[cid]).nil?
+          errors << "#{label.to_s.translate}: #{form.the_message('invalid_email',
+                                                                 t('.email_invalid_val',
+                                                                   default: 'The e-mail address appears invalid'))}"
+          validate = false
+        end
+      when 'captcha'
+        error_message = lambda {
+          errors << "#{label.to_s.translate}: #{form.the_message('captcha_not_match',
+                                                                 t('.captch_error_val',
+                                                                   default: 'The entered code is incorrect'))}"
+          validate = false
+        }
+
+        if form.recaptcha_enabled?
+          form.set_captcha_settings!
+          error_message.call unless verify_recaptcha
+        else
+          error_message.call unless cama_captcha_verified?
+        end
       end
     end
     validate
@@ -196,23 +255,24 @@ module Plugins::CamaContactForm::ContactFormControllerConcern
     values = {}
     form.fields.each do |field|
       next unless relevant_field?(field)
+
       ft = field[:field_type]
       cid = field[:cid].to_sym
-      label = values.keys.include?(field[:label]) ? "#{field[:label]} (#{cid})" : field[:label].to_s.translate
+      label = values.key?(field[:label]) ? "#{field[:label]} (#{cid})" : field[:label].to_s.translate
       values[label] = []
       if ft == 'file'
         nr_files = Array(fields[cid]).size
-        values[label] << "#{nr_files} #{"file".pluralize(nr_files)} (attached)" if fields[cid].present?
-      elsif ft == 'radio' || ft == 'checkboxes'
+        values[label] << "#{nr_files} #{'file'.pluralize(nr_files)} (attached)" if fields[cid].present?
+      elsif MULTI_VALUE_FIELD_TYPES.include?(ft)
         values[label] << Array(fields[cid]).map { |f| f.to_s.translate }.join(', ') if fields[cid].present?
-      else
-        values[label] << fields[cid] if fields[cid].present?
+      elsif fields[cid].present?
+        values[label] << fields[cid]
       end
     end
     values
   end
 
   def relevant_field?(field)
-    !%w(captcha submit button).include? field[:field_type]
+    %w[captcha submit button].exclude?(field[:field_type])
   end
 end