escape_escape_escape 1.5.1 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b3f2670b659a6e2db5264b09fa0867aebb759c87
-  data.tar.gz: 7e6dcb8be999b12eca501b4a11ed9b07190cc7a6
+  metadata.gz: 251b396b4850add2712600d6167f429b59dc04cc
+  data.tar.gz: c17d22cac0059acd00dab01f64fccbe04daab0f7
 SHA512:
-  metadata.gz: 8dc29c74e9cbc84fd4d6675c254ddbc5cd1eb4a007d2c428670e504fa58235609879632ee6a4ca0b4646cda5ff18b846131dbeb52b900975ecdee5612710a3a3
-  data.tar.gz: 9beb6a73c47e598a09eeb421055ae31891a70588734ec9cf9a13723a28ca6b3d8a5743365e22f3e536ea15d65abfe878f49046f05152f0476cf82a0fc3e31fe8
+  metadata.gz: 9495213354e7ff51e47cad4ee3cbba65ebe65d847dd2058c340ff9af737a2503379b3dbd655878e39adf210353c28db7c09410b758b427486e535f81e9606141
+  data.tar.gz: 47e43582cc487ef12e0cf4f08c756e60b82eee0a7daf070b9c6858b210926b87cc1f63db7f36b63bb6b50011f5b01ad1c562c330fcf00747ae12a39c73da6176

data/VERSION

@@ -1 +1 @@
-1.5.1
+1.7.0

data/lib/escape_escape_escape.rb

@@ -50,10 +50,11 @@ class Escape_Escape_Escape
 
   TAG_PATTERN        = /\A[a-z]([a-z0-9\_]{0,}[a-z]{1,})?\z/i
 
-  VALID_CSS_VALUE      = /\A[a-z0-9\;\-\_\#\,\ ]+\z/i
+  VALID_CSS_VALUE      = /\A[a-z0-9\;\-\_\#\,\ \.]+\z/i
   VALID_CSS_SELECTOR   = /\A[a-z0-9\#\:\_\-\.\ ]+\z/i
   VALID_CSS_ATTR       = /\A[a-z0-9-]+\z/i
   VALID_CSS_CLASS_NAME = /\A[a-z0-9\_]+\z/i
+  VALID_CSS_WIDTH      = /\A[a-z0-9\ %\.]+\Z/
 
   VALID_HTML_ID  = /\A[a-z][0-9a-z_]*\z/;
   VALID_HTML_TAG = /\A[a-z][0-9a-z_]*\z/;
@@ -225,7 +226,7 @@ class Escape_Escape_Escape
 
     def decode_html raw
       fail("Not a string: #{raw.inspect}") unless raw.is_a?(String)
-      CODER.decode clean_utf8(raw)
+      CODER.decode clean_utf8(raw, :spaces)
     end
 
     %w{attr selector value}.each { |name|
@@ -239,6 +240,31 @@ class Escape_Escape_Escape
       EOF
     }
 
+    def css *args
+      case
+      when args.size == 1
+        raw_name = :unknown
+        raw = args.first
+      when args.size == 2
+        raw_name, raw = args
+      else
+        fail ArgumentError, "Unknown args: #{args.inspect}"
+      end
+
+      name = raw_name.to_s.strip
+      clean = html(raw)
+
+      passes = case
+               when name['width'.freeze]
+                 clean[VALID_CSS_WIDTH]
+               else
+                 clean[VALID_CSS_VALUE]
+               end
+
+      fail ArgumentError, "contains invalid chars: #{raw.inspect}" unless passes
+      clean
+    end
+
     def css_class_name val
       return val if val.is_a?(String) && val[VALID_CSS_CLASS_NAME]
       fail(Invalid, "CSS class name: #{val.inspect}")
@@ -297,6 +323,11 @@ class Escape_Escape_Escape
       fail Invalid, "Not a String, Number, Array, or Hash"
     end # === def
 
+    def num v
+      fail ArgumentError, "Not a Numeric: #{v.inspect}" unless v.is_a?(Numeric)
+      v
+    end
+
     def json_encode o
       case o
       when Hash

data/specs/as_ruby/0001-html.rb

@@ -43,7 +43,7 @@ raises RuntimeError, /Not a string: 1/
 
 it     'removes Unicode characters that do not belong in html'
 input  "b \u0340 \u0341 \u17a3 \u17d3 \u2028 \u2029 \u202a"
-output "b"
+output "b            "
 
 it     "removes unprintable characters"
 input  "end-\u2028-\u2029-"
@@ -58,3 +58,7 @@ input  "&soL; &SoL; /"
 output "&soL; &SoL; /"
 
 
+it     "does not strip text"
+input  "  test  "
+output "  test  "
+

data/specs/as_ruby/0001-num.rb

@@ -0,0 +1,8 @@
+
+it     "returns the original value"
+input  5.0
+output 5.0
+
+it     "fails w/ArgumentError if not a Numeric"
+input  :sym
+raises ArgumentError, /Not a Numeric: :sym/

data/specs/as_ruby/0003-css.rb

@@ -0,0 +1,63 @@
+
+it     'allows commas and spaces'
+input  :font, "Ubuntu, Segoe UI, Helvetica, sans-serif"
+output "Ubuntu, Segoe UI, Helvetica, sans-serif"
+
+it     'sanitizes :css :expression regardless of the case'
+input  :url, "eXprEssioN(alert('xss!'));"
+raises ArgumentError, /contains invalid chars/
+
+it    'sanitizes :css :expression when ( or ) is an html entity: ( )'
+input  'border', "eXprEssioN(alert('xss!'))"
+raises ArgumentError, /contains invalid chars/
+
+it     'sanitizes :css :expression when ( is html entity regardless of case: &rPaR;'
+input  'title', "eXprEssioN&rPaR;alert('xss!'))"
+raises ArgumentError, /contains invalid chars/
+
+it     'sanitizes css_href'
+input  'css_href', "smtp://file.com/img.png"
+raises ArgumentError, /contains invalid chars/
+
+it    'sanitizes css_href event if slash is html entity: /'
+input  :img_url, "smtp://file.com/img.png"
+raises ArgumentError, /contains invalid chars/
+
+it    'sanitizes css_href event if slash is html entity: /'
+input  'random', "smtp://file.com/img.png"
+raises ArgumentError, /contains invalid chars/
+
+
+it     'sanitizes css_href event if slash is html entity: /' 
+input  "smtp://file.com/img.png"
+raises ArgumentError, /contains invalid chars/
+
+it     'sanitizes css_href with encoded slashes' 
+input  "smtp://file.com/img.png"
+raises ArgumentError, /contains invalid chars/
+
+it    'sanitizes javascript: protocol w/js code'
+input 'jAvAscript://alert()'
+raises ArgumentError, /contains invalid chars/
+
+it    'sanitizes javascript: protocol with encoded colons:'
+input "javascript://alert()"
+raises ArgumentError, /contains invalid chars/
+
+it     'sanitizes javascript: protocol with encoded slashes'
+input  "javascript://alert()"
+raises ArgumentError, /contains invalid chars/
+
+it     'returns cleaned string'
+input  '1px solid #000'
+output '1px solid #000'
+
+it     'allows multiple border_width sizes: 0 0 0.5em 3px'
+input  'border_width', '0 0 0.5em 3px'
+output '0 0 0.5em 3px'
+
+it     'allows % sign in border_width sizes: 0 0 0.5% 3%'
+input  'border_width', '0 0 0.5% 3%'
+output '0 0 0.5% 3%'
+
+

data/specs/as_ruby/0040-escape.rb

@@ -14,8 +14,8 @@ raises Escape_Escape_Escape::Invalid, /Not a String, Number, Array, or Hash/i
 it 'escapes all String keys in nested objects'
 input({"   a >" => {" a >  " => "<b>test</b>"}})
 output({
-  "a &gt;" => {
-    "a &gt;" => "&lt;b&gt;test&lt;&#47;b&gt;"
+  "   a &gt;" => {
+    " a &gt;  " => "&lt;b&gt;test&lt;&#47;b&gt;"
   }
 })
 
@@ -23,8 +23,8 @@ output({
 it 'escapes all Symbol keys in nested objects'
 input({:"   a >   " => {:" a >" => "<b>test</b>"}})
 output({
-  :"a &gt;" => {
-    :"a &gt;" => "&lt;b&gt;test&lt;&#47;b&gt;"
+  :"   a &gt;   " => {
+    :" a &gt;" => "&lt;b&gt;test&lt;&#47;b&gt;"
   }
 })
 

data/specs/escape_escape_escape.rb

@@ -40,7 +40,7 @@ class It_Dsl
       args << str
     end
 
-    def input o
+    def input *o
       args << o
     end
 
@@ -99,21 +99,21 @@ It_Dsl.tests.each { |o|
         case
 
         when o[:describe] == :==
-          t[:input].should == t[:output]
+          t[:input].should == [t[:output]]
 
         when t.has_key?(:output)
-          Escape_Escape_Escape.send(o[:describe], t[:input])
+          Escape_Escape_Escape.send(o[:describe], *t[:input])
           .should == t[:output]
 
         when !t.has_key?(:output) && t[:raises]
           should.raise(t[:raises].first) {
-            Escape_Escape_Escape.send(o[:describe], t[:input])
+            Escape_Escape_Escape.send(o[:describe], *t[:input])
           }.message.should.match(t[:raises].last)
 
         when t.has_key?(:stack) && t[:stack].is_a?(Array)
 
           stack = t[:stack]
-          actual = Escape_Escape_Escape.send(o[:describe], t[:input])
+          actual = Escape_Escape_Escape.send(o[:describe], *t[:input])
           target = stack.pop
 
           begin

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: escape_escape_escape
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.7.0
 platform: ruby
 authors:
 - da99
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-27 00:00:00.000000000 Z
+date: 2015-05-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -193,11 +193,12 @@ files:
 - escape_escape_escape.gemspec
 - lib/escape_escape_escape.rb
 - specs/as_ruby/0001-html.rb
+- specs/as_ruby/0001-num.rb
 - specs/as_ruby/0002-decode_html.rb
+- specs/as_ruby/0003-css.rb
 - specs/as_ruby/0003-css_attr.rb
 - specs/as_ruby/0003-css_class_name.rb
 - specs/as_ruby/0003-css_selector.rb
-- specs/as_ruby/0003-css_value.rb
 - specs/as_ruby/0004-==.rb
 - specs/as_ruby/0005-html_id.rb
 - specs/as_ruby/0005-html_tag.rb
@@ -229,7 +230,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.4.6
 signing_key: 
 specification_version: 4
 summary: My way of escaping/encoding HTML.

data/specs/as_ruby/0003-css_value.rb

@@ -1,56 +0,0 @@
-
-it     'allows commas and spaces'
-input  "Ubuntu, Segoe UI, Helvetica, sans-serif"
-output "Ubuntu, Segoe UI, Helvetica, sans-serif"
-
-it     'sanitizes :css :expression regardless of the case'
-input  "eXprEssioN(alert('xss!'));"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it    'sanitizes :css :expression when ( or ) is an html entity: ( )'
-input "eXprEssioN(alert('xss!'))"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it     'sanitizes :css :expression when ( is html entity regardless of case: &rPaR;'
-input  "eXprEssioN&rPaR;alert('xss!'))"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it     'sanitizes css_href'
-input  "smtp://file.com/img.png"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it    'sanitizes css_href event if slash is html entity: /'
-input "smtp://file.com/img.png"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it    'sanitizes css_href event if slash is html entity: /'
-input "smtp://file.com/img.png"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-
-it     'sanitizes css_href event if slash is html entity: /' 
-input  "smtp://file.com/img.png"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it     'sanitizes css_href with encoded slashes' 
-input  "smtp://file.com/img.png"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it    'sanitizes javascript: protocol w/js code'
-input 'jAvAscript://alert()'
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it    'sanitizes javascript: protocol with encoded colons:'
-input "javascript://alert()"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it     'sanitizes javascript: protocol with encoded slashes'
-input  "javascript://alert()"
-raises Escape_Escape_Escape::Invalid, /contains invalid chars/
-
-it     'returns cleaned string'
-input  '1px solid #000'
-output '1px solid #000'
-
-
-