escape_escape_escape 0.3.0 → 1.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +6 -11
- data/VERSION +1 -1
- data/escape_escape_escape.gemspec +5 -2
- data/lib/escape_escape_escape.rb +219 -47
- data/specs/as_ruby/0001-html.rb +60 -0
- data/specs/as_ruby/0002-decode_html.rb +13 -0
- data/specs/as_ruby/0003-css_attr.rb +10 -0
- data/specs/as_ruby/0003-css_selector.rb +12 -0
- data/specs/as_ruby/0003-css_value.rb +53 -0
- data/specs/as_ruby/0004-==.rb +5 -0
- data/specs/as_ruby/0020-href.rb +118 -0
- data/specs/as_ruby/0030-clean_utf8.rb +34 -0
- data/specs/as_ruby/0040-escape.rb +41 -0
- data/specs/escape_escape_escape.rb +133 -21
- data/specs/lib/helpers.rb +1 -0
- metadata +61 -23
- data/LICENSE.txt +0 -23
- data/lib/beta.rb +0 -270
- data/lib/e_e_e.js +0 -258
- data/package.json +0 -31
- data/specs/as_json/0001-html.json +0 -23
- data/specs/as_json/0002-inner_html.json +0 -16
- data/specs/as_json/0010-text.json +0 -29
- data/specs/helpers.rb +0 -4
- data/test/sanitize_attrs.js +0 -132
- data/test/sanitize_html.js +0 -57
- data/test/sanitize_un_escape.js +0 -41
data/package.json
DELETED
@@ -1,31 +0,0 @@
|
|
1
|
-
{
|
2
|
-
"name": "escape_escape_escape",
|
3
|
-
"version": "0.0.5",
|
4
|
-
"description": "My way of escaping HTML.",
|
5
|
-
"main": "lib/e_e_e.js",
|
6
|
-
"directories": {
|
7
|
-
"test": "test"
|
8
|
-
},
|
9
|
-
"scripts": {
|
10
|
-
"test": "mocha"
|
11
|
-
},
|
12
|
-
"repository": {
|
13
|
-
"type": "git",
|
14
|
-
"url": "git://github.com/da99/escape_escape_escape.git"
|
15
|
-
},
|
16
|
-
"keywords": [
|
17
|
-
"da99"
|
18
|
-
],
|
19
|
-
"dependencies": {
|
20
|
-
"underscore": "1.x.x",
|
21
|
-
"unhtml": "x.x.x",
|
22
|
-
"special-html": "x.x.x",
|
23
|
-
"underscore.string": "x.x.x",
|
24
|
-
"entities": "x.x.x",
|
25
|
-
"uri-js": "x.x.x"
|
26
|
-
},
|
27
|
-
"author": "da99",
|
28
|
-
"license": "MIT",
|
29
|
-
"readmeFilename": "README.md",
|
30
|
-
"gitHead": "d7addccc1aea361d29d060720a54e34ec6dac499"
|
31
|
-
}
|
@@ -1,23 +0,0 @@
|
|
1
|
-
|
2
|
-
[
|
3
|
-
|
4
|
-
{
|
5
|
-
"it" : "does not re-escape already escaped text",
|
6
|
-
"input" : "<p>Hello & GoodBye</p>",
|
7
|
-
"output" : "<p>Hello & GoodBye</p>"
|
8
|
-
},
|
9
|
-
|
10
|
-
{
|
11
|
-
"it" : "removes invalid attributes",
|
12
|
-
"input" : "<a ignoreme=\"blah\">Hello GoodBye</a>",
|
13
|
-
"output" : "<a>Hello GoodBye</a>"
|
14
|
-
},
|
15
|
-
|
16
|
-
{
|
17
|
-
"it" : "removes \"javascript:\" protocol in \"href\" attributes",
|
18
|
-
"input" : "<a href=\"javascript:alert()\">hello</a>",
|
19
|
-
"output" : "<a>hello</a>"
|
20
|
-
}
|
21
|
-
|
22
|
-
|
23
|
-
]
|
@@ -1,16 +0,0 @@
|
|
1
|
-
|
2
|
-
[
|
3
|
-
|
4
|
-
{
|
5
|
-
"it" : "does not re-encoded already encoded text",
|
6
|
-
"input" : "Hello & GoodBye",
|
7
|
-
"output" : "Hello & GoodBye"
|
8
|
-
},
|
9
|
-
|
10
|
-
{
|
11
|
-
"it" : "encodes special characters: ©",
|
12
|
-
"input" : "Chars: ©",
|
13
|
-
"output" : "Chars: ©"
|
14
|
-
}
|
15
|
-
|
16
|
-
]
|
@@ -1,29 +0,0 @@
|
|
1
|
-
|
2
|
-
[
|
3
|
-
|
4
|
-
{
|
5
|
-
"it" : "replaces tabs with 2 spaces",
|
6
|
-
"input" : "<p>hello\tagain</p>",
|
7
|
-
"output" : "<p>hello again</p>"
|
8
|
-
},
|
9
|
-
|
10
|
-
{
|
11
|
-
"it" : "removes \\r",
|
12
|
-
"input" : "hi \r\r again",
|
13
|
-
"output" : "hi again"
|
14
|
-
},
|
15
|
-
|
16
|
-
{
|
17
|
-
"it" : "does not remove \\n",
|
18
|
-
"input" : "<p>hello\nagain</p>",
|
19
|
-
"output" : "<p>hello\nagain</p>"
|
20
|
-
},
|
21
|
-
|
22
|
-
{
|
23
|
-
"it" : "does not remove multiple \\n",
|
24
|
-
"input" : "<p>hello\n \nagain</p>",
|
25
|
-
"output" : "<p>hello\n \nagain</p>"
|
26
|
-
}
|
27
|
-
|
28
|
-
|
29
|
-
]
|
data/specs/helpers.rb
DELETED
data/test/sanitize_attrs.js
DELETED
@@ -1,132 +0,0 @@
|
|
1
|
-
|
2
|
-
var _ = require('underscore')
|
3
|
-
, assert = require('assert')
|
4
|
-
, E = require('../lib/e_e_e').Sanitize
|
5
|
-
;
|
6
|
-
|
7
|
-
|
8
|
-
describe( 'Sanitize attrs:', function () {
|
9
|
-
|
10
|
-
// What if the value is null? undefined?
|
11
|
-
_.each(E.attr_funcs, function (name) {
|
12
|
-
|
13
|
-
describe( name, function () {
|
14
|
-
|
15
|
-
it( 'returns error if value is null', function () {
|
16
|
-
assert.equal(E[name](null).constructor, Error);
|
17
|
-
});
|
18
|
-
|
19
|
-
it( 'returns error if value is undefined', function () {
|
20
|
-
assert.equal(E[name](undefined).constructor, Error);
|
21
|
-
});
|
22
|
-
|
23
|
-
if ( !_.contains("name href action".split(' '), name ) )
|
24
|
-
it( 'adds specified name to error', function () {
|
25
|
-
var result = E[name](null, 'my_name').message;
|
26
|
-
if ( result.indexOf('my_name: ') !== 0)
|
27
|
-
assert.fail(result, 'my_name', 'E.' + name + ' is not adding name to error message.');
|
28
|
-
});
|
29
|
-
|
30
|
-
}); // === end desc
|
31
|
-
|
32
|
-
}); // end _.each
|
33
|
-
|
34
|
-
describe( 'string', function () {
|
35
|
-
it( 'returns value if string', function () {
|
36
|
-
assert.equal(E.string("s"), "s");
|
37
|
-
});
|
38
|
-
|
39
|
-
it( 'returns error if value is number', function () {
|
40
|
-
assert.equal(E.string(1).constructor, Error);
|
41
|
-
});
|
42
|
-
}); // === end desc
|
43
|
-
|
44
|
-
describe( 'string_in_array', function () {
|
45
|
-
it( 'returns value if string in array: [ my_string ]', function () {
|
46
|
-
var val = ["This is a string."];
|
47
|
-
assert.equal(E.string_in_array(val), val);
|
48
|
-
});
|
49
|
-
}); // === end desc
|
50
|
-
|
51
|
-
describe( 'tag', function () {
|
52
|
-
it( 'returns value if valid string', function () {
|
53
|
-
assert.equal(E.tag("button"), "button");
|
54
|
-
});
|
55
|
-
|
56
|
-
it( 'returns error if string contains invalid chars', function () {
|
57
|
-
assert.equal(E.tag("my-tag").message, "tag: invalid characters: \"my-tag\"");
|
58
|
-
});
|
59
|
-
}); // === end desc
|
60
|
-
|
61
|
-
describe( 'name', function () {
|
62
|
-
it( 'returns value if valid string', function () {
|
63
|
-
assert.equal(E.name("some_name"), "some_name");
|
64
|
-
});
|
65
|
-
}); // === end desc
|
66
|
-
|
67
|
-
_.each( ['href', 'action', 'uri'] , function (name) {
|
68
|
-
describe( 'url: ' + name, function () {
|
69
|
-
it( 'returns error if url is not valid', function () {
|
70
|
-
assert.equal(E[name]("http://wwwtome<").message, name + ": URI is not strictly valid.: http://wwwtome<");
|
71
|
-
});
|
72
|
-
}); // === end desc
|
73
|
-
});
|
74
|
-
|
75
|
-
describe( 'uri', function () {
|
76
|
-
|
77
|
-
it( 'normalizes address', function () {
|
78
|
-
var s = "hTTp://wWw.test.com/";
|
79
|
-
assert.equal(E.uri(s), s.toLowerCase());
|
80
|
-
});
|
81
|
-
|
82
|
-
it( 'returns an Error if path contains: <', function () {
|
83
|
-
var s = "http://www.test.com/<something/";
|
84
|
-
assert.equal(E.uri(s).constructor, Error);
|
85
|
-
});
|
86
|
-
|
87
|
-
it( 'returns an Error if path contains HTML entities', function () {
|
88
|
-
var s = "http://6	6.000146.0x7.147/";
|
89
|
-
assert.equal(E.uri(s).constructor, Error);
|
90
|
-
});
|
91
|
-
|
92
|
-
it( 'returns an Error if path contains HTML entities', function () {
|
93
|
-
var s = "http://www.test.com/ s/";
|
94
|
-
assert.equal(E.uri(s).constructor, Error);
|
95
|
-
});
|
96
|
-
|
97
|
-
it( 'returns an Error if query string contains HTML entities', function () {
|
98
|
-
var s = "http://www.test.com/s/test?t test";
|
99
|
-
assert.equal(E.uri(s).constructor, Error);
|
100
|
-
});
|
101
|
-
|
102
|
-
}); // === end desc
|
103
|
-
|
104
|
-
// ****************************************************************
|
105
|
-
// ****************** END of Sanitize Attrs ***********************
|
106
|
-
// ****************************************************************
|
107
|
-
|
108
|
-
describe( '.opt(func)', function () {
|
109
|
-
it( 'returns a function where null returns null', function () {
|
110
|
-
assert.equal(E.opt(E.string)(null), null);
|
111
|
-
});
|
112
|
-
|
113
|
-
it( 'returns a function where undefined returns null', function () {
|
114
|
-
assert.equal(E.opt(E.string)(undefined), null);
|
115
|
-
});
|
116
|
-
|
117
|
-
it( 'returns a function that passes false to underlying function', function () {
|
118
|
-
assert.equal(E.opt(E.string)(false).constructor, Error);
|
119
|
-
});
|
120
|
-
|
121
|
-
it( 'returns a function that passes any Number to underlying function', function () {
|
122
|
-
assert.equal(E.opt(E.string)(1).constructor, Error);
|
123
|
-
});
|
124
|
-
|
125
|
-
it( 'returns a function that passes any String to underlying function', function () {
|
126
|
-
assert.equal(E.opt(E.string)("a"), "a");
|
127
|
-
});
|
128
|
-
}); // === end desc
|
129
|
-
|
130
|
-
}); // === end desc
|
131
|
-
|
132
|
-
|
data/test/sanitize_html.js
DELETED
@@ -1,57 +0,0 @@
|
|
1
|
-
|
2
|
-
var _ = require('underscore')
|
3
|
-
, _s = require('underscore.string')
|
4
|
-
, unhtml = require('unhtml')
|
5
|
-
, special = require('special-html')
|
6
|
-
, assert = require('assert')
|
7
|
-
, Sanitize = require('../lib/e_e_e').Sanitize
|
8
|
-
, E = Sanitize.html
|
9
|
-
;
|
10
|
-
var BRACKET = " < %3C < < < < < < < \
|
11
|
-
< < < < < < < \
|
12
|
-
< < < < < < < \
|
13
|
-
< < < < < < \
|
14
|
-
< < < < < < < \
|
15
|
-
< < < < < < \
|
16
|
-
< < < < < < < < \
|
17
|
-
< < < < < < \
|
18
|
-
< < < < < < < < \
|
19
|
-
< < \x3c \x3C \u003c \u003C ";
|
20
|
-
|
21
|
-
|
22
|
-
describe( 'Sanitize', function () {
|
23
|
-
|
24
|
-
it( 'does not re-escape already escaped text mixed with HTML', function () {
|
25
|
-
var h = "<p>Hi</p>";
|
26
|
-
var e = _s.escapeHTML(h);
|
27
|
-
var o = e + h;
|
28
|
-
assert.equal(E(o), _s.escapeHTML(h + h));
|
29
|
-
});
|
30
|
-
|
31
|
-
it( 'escapes special chars: "Hello ©®∆"', function () {
|
32
|
-
var s = "Hello & World ©®∆";
|
33
|
-
var t = "Hello & World ©®∆";
|
34
|
-
assert.equal(E(s), t);
|
35
|
-
});
|
36
|
-
|
37
|
-
it( 'escapes all 70 different combos of "<"', function () {
|
38
|
-
assert.equal(_.uniq(E(BRACKET.trim()).split(/\s+/)).join(' '), "< %3C");
|
39
|
-
});
|
40
|
-
|
41
|
-
it( 'escapes all keys in nested objects', function () {
|
42
|
-
var HTML = "<b>test</b>";
|
43
|
-
assert.deepEqual(E({" a >":{" a >": HTML}}), {" a >": {" a >": _s.escapeHTML(HTML)}});
|
44
|
-
});
|
45
|
-
|
46
|
-
it( 'escapes all values in nested objects', function () {
|
47
|
-
var HTML = "<b>test</b>";
|
48
|
-
assert.deepEqual(E({name:{name: HTML}}), {name: {name: _s.escapeHTML(HTML)}});
|
49
|
-
});
|
50
|
-
|
51
|
-
it( 'escapes all values in nested arrays', function () {
|
52
|
-
var HTML = "<b>test</b>";
|
53
|
-
assert.deepEqual(E([{name:{name: HTML}}]), [{name: {name: _s.escapeHTML(HTML)}}]);
|
54
|
-
});
|
55
|
-
|
56
|
-
}); // === end desc
|
57
|
-
|
data/test/sanitize_un_escape.js
DELETED
@@ -1,41 +0,0 @@
|
|
1
|
-
|
2
|
-
var _ = require('underscore')
|
3
|
-
, _s = require('underscore.string')
|
4
|
-
, unhtml = require('unhtml')
|
5
|
-
, special = require('special-html')
|
6
|
-
, assert = require('assert')
|
7
|
-
, Sanitize = require('../lib/e_e_e').Sanitize
|
8
|
-
, E = Sanitize.html
|
9
|
-
, U = Sanitize.un_escape
|
10
|
-
;
|
11
|
-
var BRACKET = " < %3C < < < < < < < \
|
12
|
-
< < < < < < < \
|
13
|
-
< < < < < < < \
|
14
|
-
< < < < < < \
|
15
|
-
< < < < < < < \
|
16
|
-
< < < < < < \
|
17
|
-
< < < < < < < < \
|
18
|
-
< < < < < < \
|
19
|
-
< < < < < < < < \
|
20
|
-
< < \x3c \x3C \u003c \u003C ";
|
21
|
-
|
22
|
-
|
23
|
-
describe( 'Sanitize', function () {
|
24
|
-
|
25
|
-
it( 'un-escapes escaped text mixed with HTML', function () {
|
26
|
-
var s = "<p>Hi&</p>";
|
27
|
-
assert.equal(U(s), "<p>Hi&</p>");
|
28
|
-
});
|
29
|
-
|
30
|
-
it( 'un-escapes special chars: "Hello ©®∆"', function () {
|
31
|
-
var s = "Hello & World ©®∆";
|
32
|
-
var t = "Hello & World ©®∆";
|
33
|
-
assert.equal(U(s), t);
|
34
|
-
});
|
35
|
-
|
36
|
-
it( 'un-escapes all 70 different combos of "<"', function () {
|
37
|
-
assert.equal(_.uniq(U(BRACKET.trim()).split(/\s+/)).join(' '), "< %3C");
|
38
|
-
});
|
39
|
-
|
40
|
-
}); // === end desc
|
41
|
-
|