event_tracker 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 52bc0fa90b12fce477d49af6289838fed0bf5d53
-  data.tar.gz: a7c4949bf4442d2ac03d6f1806cb8ca4dbf0b2e9
+  metadata.gz: 14869ca74719eb114deaf73ce4da6edd9685a7d8
+  data.tar.gz: 81d3f06adccf5a96fa3860382169c2cbd92db7d6
 SHA512:
-  metadata.gz: b9162174fa778c890e4ae9990c5f6bfce1f48f0d988674c2ebb75db9e6248f12ad8640ee9fbaa695d7efc21d3fc83c78ed77f01074b7c3695a4e933409ecc5bc
-  data.tar.gz: 55fc69bcaf73d92ebce53c9e10f61bac30845b84ebb3c5bbd8646b7e96286e918904a9701d327dabef96727df0eed4d620b565cac48a17779c6cd162e9d7883a
+  metadata.gz: 5882e8505b278c934871e46e55516a36d3fc5b05bc45248b7462c6911f2f61b6c35d3644af7db114014f59563c013f31dc28ec52b7f3886e9fd3d86e0b60e784
+  data.tar.gz: 9c496b64dc3aae6c73bdbd8e034f57ac1fdd5ba95a0161f3cd62ac042ef209e43ac02a73bf51ecc574cf9a4ee5c49d10810a4207d19c1d8bcaf8b76d243ed24f

data/CHANGELOG.md

@@ -0,0 +1,6 @@
+# CHANGELOG
+
+## v0.4.0
+
+- Prevent XSS when tracking user supplied properties
+- Minimize methods added to ActionController::Base

data/event_tracker.gemspec

@@ -16,6 +16,6 @@ Gem::Specification.new do |gem|
   gem.version       = EventTracker::VERSION
 
   gem.add_dependency 'rails', '>= 3.0'
-  gem.add_development_dependency 'steak'
-  gem.add_development_dependency 'capybara', '~> 2.0.3'
+  gem.add_development_dependency 'capybara', '>= 2.1'
+  gem.add_development_dependency 'rspec-rails'
 end

data/lib/event_tracker.rb

@@ -1,7 +1,9 @@
 require "event_tracker/version"
-require "event_tracker/mixpanel"
-require "event_tracker/kissmetrics"
-require "event_tracker/google_analytics"
+require "event_tracker/integration"
+require "event_tracker/integration/base"
+require "event_tracker/integration/mixpanel"
+require "event_tracker/integration/kissmetrics"
+require "event_tracker/integration/google_analytics"
 
 module EventTracker
   module HelperMethods
@@ -35,38 +37,8 @@ module EventTracker
   end
 
   module ActionControllerExtension
-    def mixpanel_tracker
-      @mixpanel_tracker ||= begin
-        mixpanel_key = Rails.application.config.event_tracker.mixpanel_key
-        EventTracker::Mixpanel.new(mixpanel_key) if mixpanel_key
-      end
-    end
-
-    def kissmetrics_tracker
-      @kissmetrics_tracker ||= begin
-        kissmetrics_key = Rails.application.config.event_tracker.kissmetrics_key
-        EventTracker::Kissmetrics.new(kissmetrics_key) if kissmetrics_key
-      end
-    end
-
-    def google_analytics_tracker
-      @google_analytics_tracker ||= begin
-        google_analytics_key = Rails.application.config.event_tracker.google_analytics_key
-        EventTracker::GoogleAnalytics.new(google_analytics_key) if google_analytics_key
-      end
-    end
-
-    def event_trackers
-      @event_trackers ||= begin
-        trackers = []
-        trackers << mixpanel_tracker if mixpanel_tracker
-        trackers << kissmetrics_tracker if kissmetrics_tracker
-        trackers << google_analytics_tracker if google_analytics_tracker
-        trackers
-      end
-    end
-
     def append_event_tracking_tags
+      event_trackers = EventTracker::Integration.configured
       yield
       return if event_trackers.empty?
 
@@ -79,40 +51,42 @@ module EventTracker
       return unless body_insert_at
 
       a = []
-      if mixpanel_alias = session.delete(:mixpanel_alias)
-        a << mixpanel_tracker.alias(mixpanel_alias)
-      elsif distinct_id = respond_to?(:mixpanel_distinct_id, true) && mixpanel_distinct_id
-        a << mixpanel_tracker.identify(distinct_id)
-      end
-
-      if name_tag = respond_to?(:mixpanel_name_tag, true) && mixpanel_name_tag
-        a << mixpanel_tracker.name_tag(name_tag)
-      end
+      registered_properties = session.delete(:registered_properties)
+      event_tracker_queue = session.delete(:event_tracker_queue)
 
-      if (config = session.delete(:mixpanel_set_config)).present?
-        a << mixpanel_tracker.set_config(config)
-      end
+      event_trackers.each do |tracker|
+        if tracker.is_a?(EventTracker::Integration::Mixpanel)
+          if mixpanel_alias = session.delete(:mixpanel_alias)
+            a << tracker.alias(mixpanel_alias)
+          elsif distinct_id = respond_to?(:mixpanel_distinct_id, true) && mixpanel_distinct_id
+            a << tracker.identify(distinct_id)
+          end
 
-      if (people = session.delete(:mixpanel_people_set)).present?
-        a << mixpanel_tracker.people_set(people)
-      end
+          if name_tag = respond_to?(:mixpanel_name_tag, true) && mixpanel_name_tag
+            a << tracker.name_tag(name_tag)
+          end
 
-      if (people = session.delete(:mixpanel_people_set_once)).present?
-        a << mixpanel_tracker.people_set_once(people)
-      end
+          if (config = session.delete(:mixpanel_set_config)).present?
+            a << tracker.set_config(config)
+          end
 
-      if (people = session.delete(:mixpanel_people_increment)).present?
-        a << mixpanel_tracker.people_increment(people)
-      end
+          if (people = session.delete(:mixpanel_people_set)).present?
+            a << tracker.people_set(people)
+          end
 
-      if identity = respond_to?(:kissmetrics_identity, true) && kissmetrics_identity
-        a << kissmetrics_tracker.identify(identity)
-      end
+          if (people = session.delete(:mixpanel_people_set_once)).present?
+            a << tracker.people_set_once(people)
+          end
 
-      registered_properties = session.delete(:registered_properties)
-      event_tracker_queue = session.delete(:event_tracker_queue)
+          if (people = session.delete(:mixpanel_people_increment)).present?
+            a << tracker.people_increment(people)
+          end
+        elsif tracker.is_a?(EventTracker::Integration::Kissmetrics)
+          if identity = respond_to?(:kissmetrics_identity, true) && kissmetrics_identity
+            a << tracker.identify(identity)
+          end
+        end
 
-      event_trackers.each do |tracker|
         a << tracker.register(registered_properties) if registered_properties.present? && tracker.respond_to?(:register)
 
         if event_tracker_queue.present?

data/lib/event_tracker/integration.rb

@@ -0,0 +1,16 @@
+module EventTracker::Integration
+  def self.configured
+    @configured ||= begin
+      trackers = []
+      integrations = [Mixpanel, Kissmetrics, GoogleAnalytics ]
+      integrations.each do |integration|
+        key_string = "#{integration.to_s.demodulize.underscore}_key"
+        key = Rails.application.config.event_tracker[key_string]
+        if key
+          trackers << integration.new(key)
+        end
+      end
+      trackers
+    end
+  end
+end

data/lib/event_tracker/integration/base.rb

@@ -0,0 +1,13 @@
+class EventTracker::Integration::Base
+  include ERB::Util
+
+  def initialize(key)
+    @key = key
+  end
+
+  private
+
+  def embeddable_json(properties)
+    json_escape(properties.to_json).html_safe
+  end
+end

data/lib/event_tracker/{google_analytics.rb → integration/google_analytics.rb}

@@ -1,8 +1,4 @@
-class EventTracker::GoogleAnalytics
-  def initialize(key)
-    @key = key
-  end
-
+class EventTracker::Integration::GoogleAnalytics < EventTracker::Integration::Base
   def init
     <<-EOD
       (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){

data/lib/event_tracker/{kissmetrics.rb → integration/kissmetrics.rb}

@@ -1,8 +1,4 @@
-class EventTracker::Kissmetrics
-  def initialize(key)
-    @key = key
-  end
-
+class EventTracker::Integration::Kissmetrics < EventTracker::Integration::Base
   def init
     <<-EOD
       var _kmq = _kmq || [];
@@ -21,11 +17,11 @@ class EventTracker::Kissmetrics
   end
 
   def register(registered_properties)
-    %Q{_kmq.push(['set', #{registered_properties.to_json}]);}
+    %Q{_kmq.push(['set', #{embeddable_json(registered_properties)}]);}
   end
 
   def track(event_name, properties)
-    p = properties.empty? ? "" : ", #{properties.to_json}"
+    p = properties.empty? ? "" : ", #{embeddable_json(properties)}"
     %Q{_kmq.push(['record', '#{event_name}'#{p}]);}
   end
 

data/lib/event_tracker/{mixpanel.rb → integration/mixpanel.rb}

@@ -1,8 +1,4 @@
-class EventTracker::Mixpanel
-  def initialize(key)
-    @key = key
-  end
-
+class EventTracker::Integration::Mixpanel < EventTracker::Integration::Base
   def init
     s = <<-EOD
       (function(e,b){if(!b.__SV){var a,f,i,g;window.mixpanel=b;a=e.createElement("script");
@@ -20,11 +16,11 @@ class EventTracker::Mixpanel
   end
 
   def register(registered_properties)
-    %Q{mixpanel.register(#{registered_properties.to_json});}
+    %Q{mixpanel.register(#{embeddable_json(registered_properties)});}
   end
 
   def track(event_name, properties)
-    p = properties.empty? ? "" : ", #{properties.to_json}"
+    p = properties.empty? ? "" : ", #{embeddable_json(properties)}"
     %Q{mixpanel.track("#{event_name}"#{p});}
   end
 
@@ -37,22 +33,22 @@ class EventTracker::Mixpanel
   end
 
   def people_set(properties)
-    %Q{mixpanel.people.set(#{properties.to_json});}
+    %Q{mixpanel.people.set(#{embeddable_json(properties)});}
   end
 
   def people_set_once(properties)
-    %Q{mixpanel.people.set_once(#{properties.to_json});}
+    %Q{mixpanel.people.set_once(#{embeddable_json(properties)});}
   end
 
   def people_increment(properties)
-    %Q{mixpanel.people.increment(#{properties.to_json});}
+    %Q{mixpanel.people.increment(#{embeddable_json(properties)});}
   end
 
   def set_config(properties)
-    %Q{mixpanel.set_config(#{properties.to_json});}
+    %Q{mixpanel.set_config(#{embeddable_json(properties)});}
   end
 
   def alias(identity)
-    %Q{mixpanel.alias(#{identity.to_json});}
+    %Q{mixpanel.alias(#{embeddable_json(identity)});}
   end
 end

data/lib/event_tracker/version.rb

@@ -1,3 +1,3 @@
 module EventTracker
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/spec/event_tracker_spec.rb

@@ -1,7 +1,7 @@
 require "spec_helper"
 
 shared_examples_for "init" do
-  subject { page.find("head script").native.content }
+  subject { page.find("head script", visible: false).native.content }
   it { should include('mixpanel.init("YOUR_TOKEN")') }
   it { should include(%q{var _kmk = _kmk || 'KISSMETRICS_KEY'}) }
   it { should include(%q{ga('create', 'GOOGLE_ANALYTICS_KEY', 'auto', {'name': 'event_tracker'});}) }
@@ -29,7 +29,7 @@ shared_examples_for "with event" do
 end
 
 feature 'basic integration' do
-  subject { page.find("body script").native.content }
+  subject { page.find("body script", visible: false).native.content }
 
   class BasicController < ApplicationController
     around_filter :append_event_tracking_tags
@@ -94,16 +94,16 @@ feature 'basic integration' do
     def index
       register_properties age: 19
       register_properties gender: "female"
-      track_event "Take an action", property1: "a", property2: 1
+      track_event "Take an action", property1: "a", property2: 1, xss: "</script>"
       render inline: "OK", layout: true
     end
   end
 
   context "track event with properties" do
     background { visit "/with_properties" }
-    it { should include %Q{mixpanel.track("Take an action", {"property1":"a","property2":1})} }
+    it { should include %q{mixpanel.track("Take an action", {"property1":"a","property2":1,"xss":"\u003c/script\u003e"})} }
     it { should include %Q{mixpanel.register({"age":19,"gender":"female"})} }
-    it { should include %Q{_kmq.push(['record', 'Take an action', {"property1":"a","property2":1}])} }
+    it { should include %q{_kmq.push(['record', 'Take an action', {"property1":"a","property2":1,"xss":"\u003c/script\u003e"}])} }
     it { should include %Q{_kmq.push(['set', {"age":19,"gender":"female"}])} }
   end
 

data/spec/spec_helper.rb

@@ -26,5 +26,4 @@ end
 class ApplicationController < ActionController::Base; end
 
 require 'rspec/rails'
-require "steak"
 

metadata

@@ -1,57 +1,57 @@
 --- !ruby/object:Gem::Specification
 name: event_tracker
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Paul McMahon
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-08 00:00:00.000000000 Z
+date: 2016-12-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '3.0'
 - !ruby/object:Gem::Dependency
-  name: steak
+  name: capybara
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.1'
 - !ruby/object:Gem::Dependency
-  name: capybara
+  name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.3
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.3
+        version: '0'
 description: Easy integration with Mixpanel, Kissmetrics, and Google Analytics for
   Rails
 email:
@@ -60,16 +60,19 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
+- ".gitignore"
+- CHANGELOG.md
 - Gemfile
 - LICENSE
 - README.md
 - Rakefile
 - event_tracker.gemspec
 - lib/event_tracker.rb
-- lib/event_tracker/google_analytics.rb
-- lib/event_tracker/kissmetrics.rb
-- lib/event_tracker/mixpanel.rb
+- lib/event_tracker/integration.rb
+- lib/event_tracker/integration/base.rb
+- lib/event_tracker/integration/google_analytics.rb
+- lib/event_tracker/integration/kissmetrics.rb
+- lib/event_tracker/integration/mixpanel.rb
 - lib/event_tracker/version.rb
 - spec/app/views/basic/in_views.html.erb
 - spec/app/views/layouts/application.html.erb
@@ -84,17 +87,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.11
+rubygems_version: 2.2.3
 signing_key: 
 specification_version: 4
 summary: Track using javascript from your controllers, even when redirecting
@@ -103,3 +106,4 @@ test_files:
 - spec/app/views/layouts/application.html.erb
 - spec/event_tracker_spec.rb
 - spec/spec_helper.rb
+has_rdoc: