emk-safe_erb 0.1.1 → 0.1.2

data/Rakefile

@@ -6,7 +6,7 @@ require 'rake/rdoctask'
 require 'rake/gempackagetask'
 
 GEM = "safe_erb"
-GEM_VERSION = "0.1.1"
+GEM_VERSION = "0.1.2"
 SUMMARY = "Automatically detect improperty-escaped text in ERB templates"
 AUTHORS = ["Shinya Kasatani", "Matthew Bass", "Eric Kidd"]
 EMAIL = "git@randomhacks.net"

data/lib/safe_erb/action_view_extensions.rb

@@ -1,20 +1,18 @@
 module ActionView
-  module TemplateHandlers
-    class ERB < TemplateHandler
-      def compile_with_safe_erb(template)
-        # This helps make new-style ActionMailer text templates do the
-        # right thing automatically.  We will probably want to extend this
-        # to other kinds of templates eventually.
-        if template.filename.to_s =~ /\.text\.plain\.erb$/
-          ::ERB.without_checking_tainted do
-            compile_without_safe_erb template
-          end
-        else
-          compile_without_safe_erb template
+  Renderable.class_eval do
+    def compiled_source_with_safe_erb
+      # This helps make new-style ActionMailer text templates do the
+      # right thing automatically.  We will probably want to extend this
+      # to other kinds of templates eventually.
+      if filename.to_s =~ /\.text\.plain\.erb\z/
+        compiled_source_without_safe_erb
+      else
+        ::ERB.with_checking_tainted do
+          compiled_source_without_safe_erb
         end
       end
-
-      alias_method_chain :compile, :safe_erb
     end
+    
+    alias_method_chain :compiled_source, :safe_erb
   end
 end

data/lib/safe_erb/common.rb

@@ -4,6 +4,12 @@ require 'erb'
 require 'action_controller'
 require 'action_view'
 
+# TODO - RAILS_ROOT is improperly escaped in the standard error template
+# that you see in development mode.  We need to fix this in Edge Rails
+# if it hasn't been fixed already.  Since it isn't under the control of
+# remote users, we're just going to go ahead and untaint it for now.
+RAILS_ROOT.untaint if defined?(RAILS_ROOT)
+
 class ActionController::Base
   # Object#taint is set when the request comes from FastCGI or WEBrick,
   # but it is not set in Mongrel and also functional / integration testing

data/lib/safe_erb/erb_extensions.rb

@@ -2,7 +2,7 @@ class ERB
   # Should we check for tainted values when building ERB templates?
   def self.check_tainted?
     value = Thread.current[:safe_erb_check_tainted]
-    value.nil? ? true : value
+    value.nil? ? false : value
   end
 
   # Turn ERB taint-checking on and off.
@@ -10,6 +10,17 @@ class ERB
     Thread.current[:safe_erb_check_tainted] = value
   end
 
+  # Enable taint checks within the specified block.
+  def self.with_checking_tainted #:yield:
+    saved_value = ERB.check_tainted?
+    ERB.check_tainted = true
+    begin
+      yield
+    ensure
+      ERB.check_tainted = saved_value
+    end
+  end
+
   # Skip taint checks within the specified block.
   def self.without_checking_tainted #:yield:
     saved_value = ERB.check_tainted?

data/test/safe_erb_test.rb

@@ -2,19 +2,38 @@ require File.expand_path(File.dirname(__FILE__) + '/test_helper')
 
 class SafeERBTest < Test::Unit::TestCase
   def test_non_checking
-    ERB.without_checking_tainted do
-      src = ERB.new("<%= File.open('#{__FILE__}'){|f| f.read} %>", nil, '-').src
-      eval(src)
-    end
+    src = ERB.new("<%= File.open('#{__FILE__}'){|f| f.read} %>", nil, '-').src
+    eval(src)
   end
   
   def test_checking
-    src = ERB.new("<%= File.open('#{__FILE__}'){|f| f.read} %>", nil, '-').src
-    assert_raise(RuntimeError) { eval(src) }
+    ERB.with_checking_tainted do
+      src = ERB.new("<%= File.open('#{__FILE__}'){|f| f.read} %>", nil, '-').src
+      assert_raise(RuntimeError) { eval(src) }
+    end
   end
   
   def test_checking_non_tainted
     src = ERB.new("<%= 'This string is not tainted' %>", nil, '-').src
     eval(src)
   end
+
+  def use_template file
+    path = File.join(File.dirname(__FILE__), file)
+    @template = ActionView::Template.new(path)
+    @view = ActionView::Base.new
+  end
+
+  def test_should_protect_html_templates
+    use_template 'safe_erb_template.html.erb'
+    assert_raise ActionView::TemplateError do
+      @template.render_template(@view, :var => 'foo'.taint)
+    end
+  end
+
+  def test_should_not_protect_text_plain_templates
+    # This makes some ActionMailer templates work out of the box.
+    use_template 'safe_erb_template.text.plain.erb'
+    assert_equal "foo\n", @template.render_template(@view, :var => 'foo')
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: emk-safe_erb
 version: !ruby/object:Gem::Version 
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors: 
 - Shinya Kasatani
@@ -11,7 +11,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-12-17 00:00:00 -08:00
+date: 2008-12-20 00:00:00 -08:00
 default_executable: 
 dependencies: []