dradis-html_export 3.9.0 → 3.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d6b5b6986bd7981e3077c68731420ed8f60f9ea4
-  data.tar.gz: 3d6f8d24cd43621fda4e978badba9fbaced9896b
+  metadata.gz: 49f262777bc734cf9c057c50841c44d8fcd73b65
+  data.tar.gz: f7350952a6d61b78928c97226bd4c29cc1963da4
 SHA512:
-  metadata.gz: 9eed6807256557eca8cf3b629710dd93fb936b32b4416d27dd37727591a6c0933583d1ebeacaa9c46145448541be36176900d5b01f36d8d22c9ec56d540388e3
-  data.tar.gz: a96255d0e075db5f828ccfcb9ca251870886afa5f8469a383f9bef278b4268503e2df97edfa2a77700615b55a3add3bed85c75ac093358c89403525d9acefda7
+  metadata.gz: 6debdf7f488314090a76eb70914fccd012ad2ecf00a778e30a8810a5ae4374a218c9e3a64d70cbf96181117551ea554f411eb5873311dcbde8e950444b202f24
+  data.tar.gz: 740e514e90f8c09197ece9b706f9471b47245d6a14341827625afd01f1f7617bac81864dc542e38052a220581fa7180e35110c4df95f7c269dbec1b519c5acce

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## Dradis Framework 3.10 (August, 2018) ##
+
+*   Security fix: update RedCloth to 4.3.2
+*   Fix issue sorting
+
 ## Dradis Framework 3.9 (January, 2018) ##
 
 *   Updated rendering html as in Rails 5.1 (`render html:`)

data/dradis-html_export.gemspec

@@ -25,7 +25,7 @@ Gem::Specification.new do |spec|
 
   # Note markup
   spec.add_dependency 'rails_autolink', '~> 1.1'
-  spec.add_dependency 'RedCloth', '4.3.1'
+  spec.add_dependency 'RedCloth', '~> 4.3.2'
 
   # gem.add_development_dependency 'capybara', '~> 1.1.3'
   # gem.add_development_dependency 'database_cleaner'

data/lib/dradis/plugins/html_export/exporter.rb

@@ -35,7 +35,7 @@ module Dradis
               logger.debug{ "Template properties define a sort field: #{sort_by}. Sorting..." }
 
               # FIXME: Assume the Field :type is :number, so cast .to_f and sort
-              issues.sort! do |a, b|
+              issues.to_a.sort! do |a, b|
                 b.fields.fetch(sort_by, '0').to_f <=> a.fields.fetch(sort_by, '0').to_f
               end
 
@@ -57,15 +57,21 @@ module Dradis
         end
 
         private
+
+        # FIXME This method is a behavioural duplicate of ApplicationHelper#markup
+        # from the main app, it would be better to re-use that code.
         def markup(text)
           return unless text.present?
 
-          output = text.dup
+          # escape HTML 'manually' instead of using RedCloth's "filter_html"
+          # for security reasons
+          output = ERB::Util.html_escape(text.dup)
+
           Hash[ *text.scan(/#\[(.+?)\]#[\r|\n](.*?)(?=#\[|\z)/m).flatten.collect{ |str| str.strip } ].keys.each do |field|
             output.gsub!(/#\[#{Regexp.escape(field)}\]#[\r|\n]/, "h4. #{field}\n\n")
           end
 
-          auto_link(RedCloth.new(output, [:filter_html, :no_span_caps]).to_html, sanitize: false ).html_safe
+          auto_link(RedCloth.new(output, [:no_span_caps]).to_html).html_safe
         end
       end
     end

data/lib/dradis/plugins/html_export/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 3
-        MINOR = 9
+        MINOR = 10
         TINY  = 0
         PRE   = nil
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-html_export
 version: !ruby/object:Gem::Version
-  version: 3.9.0
+  version: 3.10.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-08 00:00:00.000000000 Z
+date: 2018-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -42,16 +42,16 @@ dependencies:
   name: RedCloth
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.3.1
+        version: 4.3.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.3.1
+        version: 4.3.2
 description: Export to HTML plugin for the Dradis Framework
 email:
 - "<etd@nomejortu.com>"
@@ -101,7 +101,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.6.8
 signing_key: 
 specification_version: 4
 summary: Dradis HTML export plugin