camaleon_cms 2.9.2 → 2.9.3

data/app/models/camaleon_cms/custom_field_group.rb

@@ -5,16 +5,22 @@ module CamaleonCms
     alias_attribute :site_id, :parent_id
 
     default_scope do
-      where("object_class != '_fields'")
-        .reorder("#{CamaleonCms::CustomField.table_name}.field_order ASC")
+      where("object_class != '_fields'").reorder("#{CamaleonCms::CustomField.table_name}.field_order ASC")
     end
 
+    # Scope metas by object_class so a group's numeric id colliding with another model's id does
+    # not read the wrong meta rows (meta rows are keyed by both objectid and object_class).
+    # rubocop:disable Rails/InverseOf
     has_many :metas, -> { where(object_class: 'CustomFieldGroup') }, foreign_key: :objectid, dependent: :destroy
+    # rubocop:enable Rails/InverseOf
+
     has_many :fields, -> { where(object_class: '_fields') }, class_name: 'CamaleonCms::CustomField',
-                                                             foreign_key: :parent_id, dependent: :destroy
-    belongs_to :site, foreign_key: :parent_id, required: false
+                                                             foreign_key: :parent_id, dependent: :destroy,
+                                                             inverse_of: :custom_field_group
+    belongs_to :site, foreign_key: :parent_id, optional: true, inverse_of: :custom_field_groups
+    belongs_to :owner, polymorphic: true, foreign_key: :objectid, foreign_type: :object_class, optional: true
 
-    validates_uniqueness_of :slug, scope: %i[object_class objectid parent_id]
+    validates :slug, uniqueness: { scope: %i[object_class objectid parent_id] }
 
     before_validation :before_validating
 
@@ -52,9 +58,9 @@ module CamaleonCms
     end
     alias add_field add_manual_field
 
-    # return a field with slug = slug from current group
+    # return a field with slug = slug from the current group
     def get_field(slug)
-      fields.find_by(slug: slug)
+      fields.find_by_slug(slug) # rubocop:disable Rails/DynamicFindBy
     end
 
     # only used by form on admin panel (protected)
@@ -76,7 +82,7 @@ module CamaleonCms
           if id_val.present? && (field_item = fields.find_by(id: id_val)).present?
             # If this is an existing select_eval field (or the incoming data would
             # make it a select_eval) ensure the current actor has explicit
-            # permission. For updates we preserve the form-like behavior by
+            # permission. For updates, we preserve the form-like behaviour by
             # collecting an error-like non-persisted field in errors_saved and
             # skipping the update when unauthorized.
             existing_key = (field_item.options || {})[:field_key].to_s
@@ -94,7 +100,7 @@ module CamaleonCms
             # Check if the incoming options request creation of select_eval
             incoming_key = (options[:field_key] || item[:field_key]).to_s
             if incoming_key == 'select_eval' && !can?(:manage, :select_eval)
-              # Add an error-like non-persisted field to errors_saved to preserve behavior
+              # Add an error-like non-persisted field to errors_saved to preserve behaviour
               field_item = fields.new(item)
               field_item.errors.add(:base, 'Not authorized to create select_eval field')
               errors_saved << field_item
@@ -116,6 +122,11 @@ module CamaleonCms
     end
 
     # generate the caption for this group
+    # The caption is rendered with `raw` by admin/settings/custom_fields/index.html.erb, so every
+    # interpolated value is escaped here, at the source: `the_title` already returns an escaped
+    # SafeBuffer, and the plain attributes below are escaped explicitly. `object_class` is included
+    # because the placement check admits any class name paired with the current site's id, so it is
+    # attacker-settable text like the model names are.
     def get_caption
       caption = ''
       begin
@@ -126,16 +137,19 @@ module CamaleonCms
           caption = "Fields for Categories in <b>#{site.post_types.find(objectid).decorate.the_title}</b>"
         when 'PostType_PostTag'
           caption = "Fields for Post tags in <b>#{site.post_types.find(objectid).decorate.the_title}</b>"
-        when 'Widget::Main'
-          caption = "Fields for Widget <b>(#{CamaleonCms::Widget::Main.find(objectid).name.translate})</b>"
+        when 'Main'
+          widget_name = CamaleonCms::Widget::Main.find(objectid).name.translate
+          caption = "Fields for Widget <b>(#{ERB::Util.html_escape(widget_name)})</b>"
         when 'Theme'
-          caption = "Field settings for Theme <b>(#{begin
+          theme_name = begin
             site.themes.find(objectid).name
           rescue StandardError
             objectid
-          end})</b>"
+          end
+          caption = "Field settings for Theme <b>(#{ERB::Util.html_escape(theme_name)})</b>"
         when 'NavMenu'
-          caption = "Field settings for Menus <b>(#{CamaleonCms::NavMenu.find(objectid).name})</b>"
+          menu_name = CamaleonCms::NavMenu.find(objectid).name
+          caption = "Field settings for Menus <b>(#{ERB::Util.html_escape(menu_name)})</b>"
         when 'Site'
           caption = 'Field settings the site'
         when 'PostType'
@@ -144,25 +158,28 @@ module CamaleonCms
           p = CamaleonCms::Post.find(objectid).decorate
           caption = "Fields for content <b>(#{p.the_title})</b>"
         else # 'Plugin' or other class
-          caption = "Fields for <b>#{object_class}</b>"
+          caption = "Fields for <b>#{ERB::Util.html_escape(object_class)}</b>"
         end
       rescue StandardError => e
         Rails.logger.debug "Camaleon CMS - Menu Item Error: #{e.message} ==> Attrs: #{attributes}"
       end
-      caption
+      # rubocop:disable Rails/OutputSafety -- every interpolated value above is escaped at the source
+      caption.html_safe
+      # rubocop:enable Rails/OutputSafety
     end
 
     private
 
     def before_validating
-      self.slug = "_group-#{name.to_s.parameterize}" unless slug.present?
+      self.slug = "_group-#{name.to_s.parameterize}" if slug.blank?
     end
 
     # auto save the default field values
     def auto_save_default_values(field, options)
       class_name = object_class.split('_').first
-      return unless %w[Post Category Plugin
-                       Theme].include?(class_name) && objectid && (options[:default_value].present? || options[:default_values].present?)
+      return unless %w[Post Category Plugin Theme].include?(class_name) &&
+                    objectid &&
+                    (options[:default_value].present? || options[:default_values].present?)
 
       owner = if class_name == 'Theme'
                 "CamaleonCms::#{class_name}".constantize.find(objectid) # owner model
@@ -170,13 +187,13 @@ module CamaleonCms
                 begin
                   "CamaleonCms::#{class_name}".constantize.find(objectid)
                 rescue StandardError
-                  "CamaleonCms::#{class_name}".constantize.find_by(slug: objectid)
+                  "CamaleonCms::#{class_name}".constantize.find_by_slug(objectid) # rubocop:disable Rails/DynamicFindBy
                 end
               end
       (options[:default_values] || [options[:default_value]] || []).each do |value|
         if owner.present?
-          owner.custom_field_values.create!(custom_field_id: field.id, custom_field_slug: field.slug,
-                                            value: fix_meta_value(value))
+          owner.custom_field_values
+               .create!(custom_field_id: field.id, custom_field_slug: field.slug, value: fix_meta_value(value))
         end
       end
     end

data/app/models/camaleon_cms/custom_fields_relationship.rb

@@ -7,23 +7,154 @@ module CamaleonCms
     default_scope { order("#{CamaleonCms::CustomFieldsRelationship.table_name}.term_order ASC") }
 
     # relations
-    belongs_to :custom_field, class_name: 'CamaleonCms::CustomField', required: false
+    belongs_to :custom_field, class_name: 'CamaleonCms::CustomField', optional: true
+    belongs_to :owner, polymorphic: true, foreign_key: :objectid, foreign_type: :object_class, optional: true
 
     # validates :objectid, :custom_field_id, presence: true
     validates :custom_field_id, presence: true # error on clone model
 
+    # Rendered positions that need a save-time gate (audit M17, scan-and-reject policy). An
+    # `editor` value is emitted as markup (`raw`); a `field_attrs` value is a JSON pair whose
+    # members are emitted as markup; the URI field types are emitted into href/src. Every other
+    # field type's value renders through escaping ERB as element content, where markup cannot
+    # execute, so it needs no gate.
+    MARKUP_FIELD_KEYS = %w[editor].freeze
+    JSON_MARKUP_FIELD_KEYS = %w[field_attrs].freeze
+    URI_FIELD_KEYS = %w[url image audio video file].freeze
+    GATED_FIELD_KEYS = (MARKUP_FIELD_KEYS + JSON_MARKUP_FIELD_KEYS + URI_FIELD_KEYS).freeze
+
+    validate :reject_untrusted_dangerous_value
+
     after_save :set_parent_slug
     after_save :update_model_owner # TODO: convert this model into polymorphic
 
+    # Opt-out for trusted server-side pipelines (imports, seeds, plugin code), mirroring
+    # Post#unfiltered_content!: a reader plus a bang enabler and NO writer, so mass assignment
+    # cannot reach it. Sticky for the lifetime of the instance.
+    attr_reader :unfiltered_value
+
+    def unfiltered_value!
+      @unfiltered_value = true
+      self
+    end
+
+    class << self
+      # Whether this field type's value is emitted into a markup or URL position (so it is gated).
+      def gated_field_key?(field_key)
+        GATED_FIELD_KEYS.include?(field_key.to_s)
+      end
+
+      # Why the save-time gate would refuse this value for the field type, or nil if it passes:
+      # :too_large (over the parse ceiling), :html (disallowed markup), :uri (script-capable URL).
+      # Ignores author trust, so the validation (trust-gated) and the scan_content rake task (which
+      # reports every stored row) share one dispatch and cannot drift.
+      def gate_rejection_reason(field_key, value)
+        return if value.blank?
+
+        key = field_key.to_s
+        if MARKUP_FIELD_KEYS.include?(key)
+          markup_rejection_reason(value)
+        elsif JSON_MARKUP_FIELD_KEYS.include?(key)
+          return :too_large if CamaleonCms::UnsafeMarkup.too_large?(value)
+
+          :html if json_member_values(value).any? { |member| markup_unsafe?(member) }
+        elsif URI_FIELD_KEYS.include?(key)
+          :uri if CamaleonCms::UnsafeMarkup.dangerous_uri?(value)
+        end
+      end
+
+      private
+
+      def markup_rejection_reason(value)
+        return :too_large if CamaleonCms::UnsafeMarkup.too_large?(value)
+
+        :html if markup_unsafe?(value)
+      end
+
+      def markup_unsafe?(value)
+        CamaleonCms::UnsafeMarkup.unsafe_html?(
+          value, tags: CamaleonCms::Post::CONTENT_ALLOWED_TAGS,
+                 attributes: CamaleonCms::Post::CONTENT_ALLOWED_ATTRIBUTES
+        )
+      end
+
+      # A field_attrs value stores JSON whose string members render verbatim. Scan every DECODED
+      # member (Hash, Array or nested), not the stored bytes: the Rails JSON encoder unicode-escapes
+      # angle brackets (storing the escape instead of a literal bracket), so a byte-level scan of the
+      # stored string would pass markup that JSON.parse restores at render. Unparseable values are
+      # scanned as-is (fail closed on whatever the renderer would fall back to).
+      def json_member_values(value)
+        flatten_json_strings(JSON.parse(value))
+      rescue JSON::ParserError
+        [value.to_s]
+      end
+
+      def flatten_json_strings(node)
+        case node
+        when Hash then node.values.flat_map { |member| flatten_json_strings(member) }
+        when Array then node.flat_map { |member| flatten_json_strings(member) }
+        else [node.to_s]
+        end
+      end
+    end
+
     private
 
+    # Security (audit M17): the frontend renders an `editor`/`field_attrs` value verbatim and
+    # URI-type values into URL positions, so a value an untrusted author may not write is refused --
+    # never rewritten. Stored values therefore always equal authored values. The scan/dispatch lives
+    # in the class-level gate_rejection_reason so the scan_content rake task reuses it verbatim.
+    def reject_untrusted_dangerous_value
+      return if value.blank? || unfiltered_value
+
+      field_key = custom_field&.options&.[](:field_key).to_s
+      return unless self.class.gated_field_key?(field_key)
+      return if author_trusted_for_unfiltered_value?
+
+      reason = self.class.gate_rejection_reason(field_key, value)
+      return unless reason
+
+      errors.add(:base, cama_rejection_message(rejection_message_key(reason)))
+    end
+
+    def rejection_message_key(reason)
+      case reason
+      when :too_large then 'value_too_large'
+      when :uri then 'value_rejected_uri'
+      else 'value_rejected_html'
+      end
+    end
+
+    # The message must never be swallowed by a missing translation: only en.yml carries these keys,
+    # while the process locale follows the current admin/site language — fall back to English.
+    def cama_rejection_message(key)
+      full_key = "camaleon_cms.admin.custom_field.message.#{key}"
+      I18n.t(full_key, slug: custom_field_slug,
+                       default: I18n.t(full_key, slug: custom_field_slug, locale: :en))
+    end
+
+    # Trust follows the post-content model: an admin may write anything; a post's field values may
+    # skip the gate when the saver holds post_content_unfiltered_html for the post type. Fails
+    # closed (the gate applies) without a request context — benign values still pass the scan.
+    def author_trusted_for_unfiltered_value?
+      user = CurrentRequest.user
+      site = CurrentRequest.site
+      return false if user.blank? || site.blank?
+      return true if user.admin?
+
+      parent = owner
+      return false unless parent.is_a?(CamaleonCms::Post) && parent.post_type.present?
+
+      CamaleonCms::Ability.new(user, site).can?(:post_content_unfiltered_html, parent.post_type)
+    end
+
     def set_parent_slug
       # self.update_column('custom_field_slug', self.custom_fields.slug)
     end
 
     # touch owner model
     def update_model_owner
-      "CamaleonCms::#{object_class}".constantize.find(objectid).touch
+      "CamaleonCms::#{object_class}".constantize.find(objectid).touch # rubocop:disable Rails/SkipsModelValidations
     rescue StandardError
       nil
     end

data/app/models/camaleon_cms/media.rb

@@ -2,7 +2,7 @@ module CamaleonCms
   class Media < CamaleonRecord
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}media"
 
-    belongs_to :site, required: false
+    belongs_to :site, optional: true
     validates :name, uniqueness: {
       scope: %i[site_id is_folder folder_path is_public],
       message: 'Duplicates not allowed'
@@ -23,7 +23,7 @@ module CamaleonCms
     end
 
     # search file or folder by key
-    def self.find_by_key(key)
+    def self.by_key(key)
       key = key.cama_fix_media_key
       if key == '/'
         where(folder_path: File.dirname(key))
@@ -32,6 +32,12 @@ module CamaleonCms
       end
     end
 
+    # legacy public name (pre-rename callers); the media table has no `key` column, so
+    # without the alias this falls through to Rails' dynamic finder and raises
+    class << self
+      alias find_by_key by_key
+    end
+
     # return all items of current folder
     def items
       coll = is_public ? site.public_media : site.private_media

data/app/models/camaleon_cms/meta.rb

@@ -3,8 +3,8 @@ module CamaleonCms
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}metas"
     # attr_accessible :objectid, :key, :value, :object_class
 
-    extend CamaleonCms::NormalizeAttrs
+    belongs_to :owner, polymorphic: true, foreign_key: :objectid, foreign_type: :object_class, optional: true
 
-    normalize_attrs(:value)
+    extend CamaleonCms::NormalizeAttrs
   end
 end

data/app/models/camaleon_cms/nav_menu.rb

@@ -1,13 +1,15 @@
 module CamaleonCms
   class NavMenu < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
+
+    # deterministic external iteration order (2.9.2 parity); render paths reorder(:term_order)
+    default_scope { order(id: :asc) }
 
-    default_scope { where(taxonomy: :nav_menu).order(id: :asc) }
     alias_attribute :site_id, :parent_id
 
     has_many :children, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :parent_id, dependent: :destroy,
                         inverse_of: :parent
-    belongs_to :site, foreign_key: :parent_id, inverse_of: :nav_menus, required: false
+    belongs_to :site, foreign_key: :parent_id, inverse_of: :nav_menus, optional: true
 
     # add menu item for current menu
     # value: (Hash) is a hash object that contains label, type, link

data/app/models/camaleon_cms/nav_menu_item.rb

@@ -1,19 +1,25 @@
 module CamaleonCms
   class NavMenuItem < CamaleonCms::TermTaxonomy
+    # NavMenuItem#name (the menu label) is the one "name" field that is rendered as raw/trusted HTML
+    # (see CamaleonCms::Frontend::NavMenuHelper#cama_menu_draw_items), unlike other model names which are
+    # ERB-auto-escaped. It therefore keeps save-time sanitization: safe formatting (icons, spans) is preserved
+    # while scripts and event handlers are stripped, preventing stored XSS from menu managers.
     normalize_attrs(:name, :description)
 
+    # deterministic external iteration order (2.9.2 parity); render paths reorder(:term_order)
+    default_scope { order(id: :asc) }
+
     alias_attribute :site_id, :term_group
     alias_attribute :label, :name
     alias_attribute :url, :description
     alias_attribute :kind, :slug
     alias_attribute :target, :status
+
     # attr_accessible :label, :url, :kind
-    #
-    default_scope { where(taxonomy: :nav_menu_item).order(id: :asc) }
 
-    belongs_to :parent, class_name: 'CamaleonCms::NavMenu', inverse_of: :children, required: false
+    belongs_to :parent, class_name: 'CamaleonCms::NavMenu', inverse_of: :children, optional: true
     belongs_to :parent_item, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :parent_id, inverse_of: :children,
-                             required: false
+                             optional: true
     has_many :children, class_name: 'CamaleonCms::NavMenuItem', foreign_key: :parent_id, dependent: :destroy,
                         inverse_of: :parent_item
 
@@ -56,10 +62,12 @@ module CamaleonCms
     private
 
     def update_count
-      parent&.update_column('count', parent.children.size)
-      parent_item&.update_column('count', parent_item.children.size)
-      update_column(:term_group, main_menu.parent_id)
-      update_column(:term_order, CamaleonCms::NavMenuItem.where(parent_id: parent_id).count) # update position
+      parent&.update_column(:count, parent.children.size) # rubocop:disable Rails/SkipsModelValidations
+      parent_item&.update_column(:count, parent_item.children.size) # rubocop:disable Rails/SkipsModelValidations
+      # update group and position
+      update_columns( # rubocop:disable Rails/SkipsModelValidations
+        term_group: main_menu.parent_id, term_order: CamaleonCms::NavMenuItem.where(parent_id: parent_id).count
+      )
     end
 
     # fast access from site to menu items

data/app/models/camaleon_cms/plugin.rb

@@ -1,6 +1,6 @@
 module CamaleonCms
   class Plugin < CamaleonCms::TermTaxonomy
-    normalize_attrs(:name, :description)
+    normalize_attrs(:description)
 
     # attrs:
     #   term_group => status active (1, nil)
@@ -9,9 +9,8 @@ module CamaleonCms
 
     attr_accessor :error
 
-    belongs_to :site, foreign_key: :parent_id, required: false
+    belongs_to :site, foreign_key: :parent_id, optional: true, inverse_of: :plugins
 
-    default_scope { where(taxonomy: :plugin) }
     scope :active, -> { where(term_group: 1) }
 
     before_validation :set_default
@@ -71,7 +70,7 @@ module CamaleonCms
     private
 
     def set_default
-      self.name = slug unless name.present?
+      self.name = slug if name.blank?
     end
 
     def destroy_custom_fields