chartkick 3.1.0 → 3.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a982e8c986d3bfdf50bc533ccd2f4530a364a6155362b1d5ffa7217831be045c
-  data.tar.gz: 97a4e2f859c84942009fd98995ccbcf26b8c28d5c56a88727599c51a07f36352
+  metadata.gz: 7b6eb4f5b6f498a122e58ca1dd4cf7e3e1f5d610e19faa5a702291e422549026
+  data.tar.gz: ec143cc0f819cdd1ccd955f43425d992daa87052aeede53f563beda9bace04a5
 SHA512:
-  metadata.gz: cb7b936da97bd3bef92748667af865c21944759d14b7d95ae8c0b03f576502b85107ff866f538166c159ca0f23ad33390f9583d574bb672d1d49385369422ae8
-  data.tar.gz: 5cb58d1991fb3ad47d8ac2b3a90b78d9292a1ad82dada7ad27ee112039b41de5427ae794e5ddcf7a7260af6aadcf0e80be60587b4b42883ca927cb7dabcbcdae
+  metadata.gz: 1a494948bc4eeb5c1567e82777601982d7f3f90bfeb5c8b8b29335620cc0eaac7659a8b91e72fe9672d29a3b580b2c512fd0524c553be2de9fb57b4dcfa27b7a
+  data.tar.gz: 9f2e116c8c529e744e078b368ece8aebd7235dec00aa297a0745f309a494e57a2e29b2243dd5873d159a4346be0ee331f1df474f2a4166133a8a9e6159a0e9d7

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 3.2.0
+
+- Fixed XSS vulnerability - see [#488](https://github.com/ankane/chartkick/issues/488)
+
 ## 3.1.0
 
 - Updated Chartkick.js to 3.1.0

data/README.md

@@ -29,8 +29,6 @@ require("chartkick")
 require("chart.js")
 ```
 
-> You can also use `import` instead of `require()`
-
 For Rails 5 / Sprockets, in `app/assets/javascripts/application.js`, add:
 
 ```js
@@ -148,7 +146,7 @@ Min and max values
 
 `min` defaults to 0 for charts with non-negative values. Use `nil` to let the charting library decide.
 
-Min and max for x-axis - *Chart.js* [master]
+Min and max for x-axis - *Chart.js*
 
 ```erb
 <%= line_chart data, xmin: "2018-01-01", xmax: "2019-01-01" %>

data/lib/chartkick/helper.rb

@@ -61,9 +61,29 @@ module Chartkick
       end
       nonce_html = nonce ? " nonce=\"#{ERB::Util.html_escape(nonce)}\"" : nil
 
-      html = (options.delete(:html) || %(<div id="%{id}" style="height: %{height}; width: %{width}; text-align: center; color: #999; line-height: %{height}; font-size: 14px; font-family: 'Lucida Grande', 'Lucida Sans Unicode', Verdana, Arial, Helvetica, sans-serif;">Loading...</div>)) % {id: ERB::Util.html_escape(element_id), height: ERB::Util.html_escape(height), width: ERB::Util.html_escape(width)}
+      # html vars
+      html_vars = {
+        id: element_id,
+        height: height,
+        width: width
+      }
+      html_vars.each_key do |k|
+        html_vars[k] = ERB::Util.html_escape(html_vars[k])
+      end
+      html = (options.delete(:html) || %(<div id="%{id}" style="height: %{height}; width: %{width}; text-align: center; color: #999; line-height: %{height}; font-size: 14px; font-family: 'Lucida Grande', 'Lucida Sans Unicode', Verdana, Arial, Helvetica, sans-serif;">Loading...</div>)) % html_vars
+
+      # js vars
+      js_vars = {
+        type: klass, # don't convert to JSON, but still escape
+        id: element_id.to_json,
+        data: data_source.respond_to?(:chart_json) ? data_source.chart_json : data_source.to_json,
+        options: options.to_json
+      }
+      js_vars.each_key do |k|
+        js_vars[k] = chartkick_json_escape(js_vars[k])
+      end
+      createjs = "new Chartkick.%{type}(%{id}, %{data}, %{options});" % js_vars
 
-      createjs = "new Chartkick.#{klass}(#{element_id.to_json}, #{data_source.respond_to?(:chart_json) ? data_source.chart_json : data_source.to_json}, #{options.to_json});"
       if defer
         js = <<JS
 <script type="text/javascript"#{nonce_html}>
@@ -105,5 +125,16 @@ JS
       end
       hash_a
     end
+
+    # from https://github.com/rails/rails/blob/master/activesupport/lib/active_support/core_ext/string/output_safety.rb
+    JSON_ESCAPE = { "&" => '\u0026', ">" => '\u003e', "<" => '\u003c', "\u2028" => '\u2028', "\u2029" => '\u2029' }
+    JSON_ESCAPE_REGEXP = /[\u2028\u2029&><]/u
+    def chartkick_json_escape(s)
+      if ERB::Util.respond_to?(:json_escape)
+        ERB::Util.json_escape(s)
+      else
+        s.to_s.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE)
+      end
+    end
   end
 end

data/lib/chartkick/version.rb

@@ -1,3 +1,3 @@
 module Chartkick
-  VERSION = "3.1.0"
+  VERSION = "3.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chartkick
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-05-26 00:00:00.000000000 Z
+date: 2019-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler