escape_escape_escape 1.4.1 → 1.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/VERSION +1 -1
- data/lib/escape_escape_escape.rb +2 -2
- data/specs/as_ruby/0003-css_value.rb +7 -4
- data/specs/as_ruby/0020-href.rb +4 -4
- metadata +3 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA1:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: f2a5d5a848cf1a178a86f45870811a4a534475e9
|
|
4
|
+
data.tar.gz: 7912ea4b395f8b1ba8e63370dec8a9b528848051
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 404be22bef004e7ee70286229a43d1fa167dd8d1f475be0c9da05398b42d8b21fb304fe130d192151ee5988dd9c87d2b85de8a26645d5fd5e8c5d71cb30e95b8
|
|
7
|
+
data.tar.gz: 7c4652e9c6343603207a64d168f5fce319f1c09cd10bc85cef06c4b78217a4fa37f5bfbcc66846597af3bf1041b3f7b9c73f517f12f723d5446c409d1f1a27cf
|
data/VERSION
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
1.4.
|
|
1
|
+
1.4.2
|
data/lib/escape_escape_escape.rb
CHANGED
|
@@ -50,7 +50,7 @@ class Escape_Escape_Escape
|
|
|
50
50
|
|
|
51
51
|
TAG_PATTERN = /\A[a-z]([a-z0-9\_]{0,}[a-z]{1,})?\z/i
|
|
52
52
|
|
|
53
|
-
VALID_CSS_VALUE = /\A[a-z0-9\;\-\_
|
|
53
|
+
VALID_CSS_VALUE = /\A[a-z0-9\;\-\_\#\,\ ]+\z/i
|
|
54
54
|
VALID_CSS_SELECTOR = /\A[a-z0-9\#\:\_\-\.\ ]+\z/i
|
|
55
55
|
VALID_CSS_ATTR = /\A[a-z0-9-]+\z/i
|
|
56
56
|
VALID_CSS_CLASS_NAME = /\A[a-z0-9\_]+\z/i
|
|
@@ -200,7 +200,7 @@ class Escape_Escape_Escape
|
|
|
200
200
|
fail( Invalid_HREF, "javascript:// is not allowed" ) if (uri.scheme || ''.freeze)['javascript'.freeze]
|
|
201
201
|
fail( Invalid_HREF, "address is invalid") if !uri.host && !uri.relative?
|
|
202
202
|
|
|
203
|
-
html(EscapeUtils.escape_uri uri.to_s)
|
|
203
|
+
html(EscapeUtils.escape_uri(EscapeUtils.unescape_uri uri.to_s))
|
|
204
204
|
rescue URI::InvalidURIError => e
|
|
205
205
|
raise Invalid_HREF, e.message
|
|
206
206
|
end
|
|
@@ -1,4 +1,8 @@
|
|
|
1
1
|
|
|
2
|
+
it 'allows commas and spaces'
|
|
3
|
+
input "Ubuntu, Segoe UI, Helvetica, sans-serif"
|
|
4
|
+
output "Ubuntu, Segoe UI, Helvetica, sans-serif"
|
|
5
|
+
|
|
2
6
|
it 'sanitizes :css :expression regardless of the case'
|
|
3
7
|
input "eXprEssioN(alert('xss!'));"
|
|
4
8
|
raises Escape_Escape_Escape::Invalid, /contains invalid chars/
|
|
@@ -7,7 +11,6 @@ it 'sanitizes :css :expression when ( or ) is an html entity: ( )'
|
|
|
7
11
|
input "eXprEssioN(alert('xss!'))"
|
|
8
12
|
raises Escape_Escape_Escape::Invalid, /contains invalid chars/
|
|
9
13
|
|
|
10
|
-
|
|
11
14
|
it 'sanitizes :css :expression when ( is html entity regardless of case: &rPaR;'
|
|
12
15
|
input "eXprEssioN&rPaR;alert('xss!'))"
|
|
13
16
|
raises Escape_Escape_Escape::Invalid, /contains invalid chars/
|
|
@@ -33,15 +36,15 @@ it 'sanitizes css_href with encoded slashes'
|
|
|
33
36
|
input "smtp://file.com/img.png"
|
|
34
37
|
raises Escape_Escape_Escape::Invalid, /contains invalid chars/
|
|
35
38
|
|
|
36
|
-
it 'sanitizes javascript:
|
|
39
|
+
it 'sanitizes javascript: protocol w/js code'
|
|
37
40
|
input 'jAvAscript://alert()'
|
|
38
41
|
raises Escape_Escape_Escape::Invalid, /contains invalid chars/
|
|
39
42
|
|
|
40
|
-
it 'sanitizes javascript:
|
|
43
|
+
it 'sanitizes javascript: protocol with encoded colons:'
|
|
41
44
|
input "javascript://alert()"
|
|
42
45
|
raises Escape_Escape_Escape::Invalid, /contains invalid chars/
|
|
43
46
|
|
|
44
|
-
it 'sanitizes javascript:
|
|
47
|
+
it 'sanitizes javascript: protocol with encoded slashes'
|
|
45
48
|
input "javascript://alert()"
|
|
46
49
|
raises Escape_Escape_Escape::Invalid, /contains invalid chars/
|
|
47
50
|
|
data/specs/as_ruby/0020-href.rb
CHANGED
|
@@ -65,7 +65,7 @@ output "/path/mine/&"
|
|
|
65
65
|
|
|
66
66
|
it "raises Invalid_HREF if it contains unicode:"
|
|
67
67
|
input "http://кц.рф"
|
|
68
|
-
raises Escape_Escape_Escape::Invalid_HREF, /
|
|
68
|
+
raises Escape_Escape_Escape::Invalid_HREF, /URI must be ascii only/
|
|
69
69
|
|
|
70
70
|
|
|
71
71
|
it 'normalizes address:'
|
|
@@ -85,17 +85,17 @@ output "http://www.test.com/?test='something/"
|
|
|
85
85
|
|
|
86
86
|
it 'fails w/ Invalid_HREF if HTML entities in uri:'
|
|
87
87
|
input "http://6	6.000146.0x7.147/"
|
|
88
|
-
raises Escape_Escape_Escape::Invalid_HREF, /bad URI/
|
|
88
|
+
raises Escape_Escape_Escape::Invalid_HREF, /bad URI\(is not URI\?\)/
|
|
89
89
|
|
|
90
90
|
|
|
91
91
|
it 'fails w/ Invalid_HREF if path contains html entities:'
|
|
92
92
|
input "http://www.test.com/ s/"
|
|
93
|
-
raises Escape_Escape_Escape::Invalid_HREF, /
|
|
93
|
+
raises Escape_Escape_Escape::Invalid_HREF, /URI must be ascii only/
|
|
94
94
|
|
|
95
95
|
|
|
96
96
|
it 'fails w/ Invalid_HREF if query string contains HTML entities:'
|
|
97
97
|
input "http://www.test.com/s/test?t test"
|
|
98
|
-
raises Escape_Escape_Escape::Invalid_HREF, /
|
|
98
|
+
raises Escape_Escape_Escape::Invalid_HREF, /URI must be ascii only/
|
|
99
99
|
|
|
100
100
|
|
|
101
101
|
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: escape_escape_escape
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.4.
|
|
4
|
+
version: 1.4.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- da99
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2015-03-02 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: addressable
|
|
@@ -229,7 +229,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
229
229
|
version: '0'
|
|
230
230
|
requirements: []
|
|
231
231
|
rubyforge_project:
|
|
232
|
-
rubygems_version: 2.4.
|
|
232
|
+
rubygems_version: 2.4.5
|
|
233
233
|
signing_key:
|
|
234
234
|
specification_version: 4
|
|
235
235
|
summary: My way of escaping/encoding HTML.
|