easy_dl 0.0.3 → 0.0.4

data/Gemfile

@@ -4,7 +4,6 @@ source 'https://rubygems.org'
 gemspec
 
 gem 'railties', '~> 3.2.0'
-#gem 'activemodel', '~> 3.2.0'
 gem 'actionpack', '~> 3.2.0'
 
 gem 'mocha'

data/lib/easy_dl/definition_list_builder.rb

@@ -19,7 +19,7 @@ module EasyDl
         yield @obj
       else
         if val = @obj.send(name)
-          concat(val.to_s)
+          concat @template.html_escape( @obj.send(name) )
         end
       end
       concat '</dd>'

data/lib/easy_dl/version.rb

@@ -1,3 +1,3 @@
 module EasyDl
-  VERSION = "0.0.3"
+  VERSION = "0.0.4"
 end

data/test/dl_helper_test.rb

@@ -1,4 +1,4 @@
-require 'test_helper'
+require File.expand_path("../test_helper", __FILE__)
 
 class DlHelperTest < ActionView::TestCase
 
@@ -39,4 +39,18 @@ class DlHelperTest < ActionView::TestCase
     end
   end
 
+  context 'malicious definition list' do
+    setup do
+      @person = OpenStruct.new(name: '<script>alert("John")</alert>', surname: '<script>alert("Doe")</alert>')
+      concat(definition_list_for(@person, class: 'easy2') do |d|
+        d.item :name
+        d.item :surname
+      end)
+    end
+
+    should 'escape html tags' do
+      assert_select '.easy2 dd', "&lt;script&gt;alert(&quot;John&quot;)&lt;/alert&gt;"
+    end
+  end
+
 end

data/test/test_helper.rb

@@ -26,4 +26,8 @@ I18n.default_locale = :en
 class ActionView::TestCase
   include EasyDl::DlHelper
 
+  def html_escape(value)
+    value.to_s.gsub(/[&<>"]/) { |s| {'&' => '&amp;', '<' => '&lt;', '>' => '&gt;', '"' => '&quot;', "'" => '&#039;', }[s] }
+  end
+
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: easy_dl
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-11-05 00:00:00.000000000 Z
+date: 2012-12-07 00:00:00.000000000 Z
 dependencies: []
 description: Gem for generating html definition lists in Rails 3
 email: