flipper-ui 1.3.2 → 1.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d6bef28ffc3f333f954329fb96d70f3b67709357f3d0409f754dc29203516ce
-  data.tar.gz: d9c361816a630c01cb46fc3a8bfddd6ebacea70785a400a60e28df16aed7b2f7
+  metadata.gz: be9d4667f30e16f2d6f4ccb72bbb3e3f46b7c0261274bea9ec2e31fa0c403210
+  data.tar.gz: '09bb8b603b54d6c4161f312b4ba0be1ac92299d0b55c29f21b5fdd5961034a0d'
 SHA512:
-  metadata.gz: f161c4792bd93d5686ee2ee4d4ec1beaba76a6f01009c0d323a5b2d0128b02cc14924ed2a3b30c4997a1eb841fa9e9fb72e3470c63bbc958567a837e9e429d74
-  data.tar.gz: a6065032596e01620d8f249dc4434767e399ad7ed1ae582a70f11feab86dc21d0846c0b6d98313948485faf7303ee758c62de944de25998c5675e400f02c6b38
+  metadata.gz: a15b882c1e7a5248da12a71f7dd4c9df7f9d63a72cccad36efc7d64cd4b88280eaff9cf0999d3737eab2d7bd4745ee926fcc1cf59cd1f060944636264ff37202
+  data.tar.gz: baad050fea403866a36c3cba1520d0e1a9e8224a80f5d97c478bc098c583a66ce29cb35f99f6b21d2caebf48d84fa0e62629a36fafc2724d51dc5d5d7aa784b2

data/flipper-ui.gemspec

@@ -25,5 +25,5 @@ Gem::Specification.new do |gem|
   gem.add_dependency 'rack-session', '>= 1.0.2', '< 3.0.0'
   gem.add_dependency 'flipper', "~> #{Flipper::VERSION}"
   gem.add_dependency 'erubi', '>= 1.0.0', '< 2.0.0'
-  gem.add_dependency 'sanitize', '< 7'
+  gem.add_dependency 'sanitize', '< 8'
 end

data/lib/flipper/ui/action.rb

@@ -12,7 +12,7 @@ module Flipper
         def feature_name
           @feature_name ||= begin
             match = request.path_info.match(self.class.route_regex)
-            match ? Rack::Utils.unescape(match[:feature_name]) : nil
+            match ? Flipper::UI::Util.unescape(match[:feature_name]) : nil
           end
         end
         private :feature_name
@@ -164,7 +164,7 @@ module Flipper
       # location - The String location to set the Location header to.
       def redirect_to(location)
         status 302
-        header 'location', "#{script_name}#{Rack::Utils.escape_path(location)}"
+        header 'location', "#{script_name}#{location}"
         halt [@code, @headers, ['']]
       end
 

data/lib/flipper/ui/actions/actors_gate.rb

@@ -25,7 +25,7 @@ module Flipper
 
           if values.empty?
             error = "#{value.inspect} is not a valid actor value."
-            redirect_to("/features/#{feature.key}/actors?error=#{error}")
+            redirect_to("/features/#{Flipper::UI::Util.escape feature.key}/actors?error=#{Flipper::UI::Util.escape error}")
           end
 
           values.each do |value|
@@ -39,7 +39,7 @@ module Flipper
             end
           end
 
-          redirect_to("/features/#{feature.key}")
+          redirect_to("/features/#{Flipper::UI::Util.escape feature.key}")
         end
       end
     end

data/lib/flipper/ui/actions/boolean_gate.rb

@@ -21,7 +21,7 @@ module Flipper
             feature.disable
           end
 
-          redirect_to "/features/#{@feature.key}"
+          redirect_to "/features/#{Flipper::UI::Util.escape @feature.key}"
         end
       end
     end

data/lib/flipper/ui/actions/features.rb

@@ -45,13 +45,13 @@ module Flipper
 
           if Util.blank?(value)
             error = "#{value.inspect} is not a valid feature name."
-            redirect_to("/features/new?error=#{error}")
+            redirect_to("/features/new?error=#{Flipper::UI::Util.escape error}")
           end
 
           feature = flipper[value]
           feature.add
 
-          redirect_to "/features/#{value}"
+          redirect_to "/features/#{Flipper::UI::Util.escape value}"
         end
       end
     end

data/lib/flipper/ui/actions/groups_gate.rb

@@ -30,10 +30,10 @@ module Flipper
               feature.disable_group value
             end
 
-            redirect_to("/features/#{feature.key}")
+            redirect_to("/features/#{Flipper::UI::Util.escape feature.key}")
           else
             error = "The group named #{value.inspect} has not been registered."
-            redirect_to("/features/#{feature.key}/groups?error=#{error}")
+            redirect_to("/features/#{Flipper::UI::Util.escape feature.key}/groups?error=#{Flipper::UI::Util.escape error}")
           end
         end
       end

data/lib/flipper/ui/actions/percentage_of_actors_gate.rb

@@ -19,10 +19,10 @@ module Flipper
             feature.enable_percentage_of_actors params['value']
           rescue ArgumentError => exception
             error = "Invalid percentage of actors value: #{exception.message}"
-            redirect_to("/features/#{@feature.key}?error=#{error}")
+            redirect_to("/features/#{Flipper::UI::Util.escape @feature.key}?error=#{Flipper::UI::Util.escape error}")
           end
 
-          redirect_to "/features/#{@feature.key}"
+          redirect_to "/features/#{Flipper::UI::Util.escape @feature.key}"
         end
       end
     end

data/lib/flipper/ui/actions/percentage_of_time_gate.rb

@@ -19,10 +19,10 @@ module Flipper
             feature.enable_percentage_of_time params['value']
           rescue ArgumentError => exception
             error = "Invalid percentage of time value: #{exception.message}"
-            redirect_to("/features/#{@feature.key}?error=#{error}")
+            redirect_to("/features/#{Flipper::UI::Util.escape @feature.key}?error=#{Flipper::UI::Util.escape error}")
           end
 
-          redirect_to "/features/#{@feature.key}"
+          redirect_to "/features/#{Flipper::UI::Util.escape @feature.key}"
         end
       end
     end

data/lib/flipper/ui/configuration.rb

@@ -5,8 +5,8 @@ module Flipper
     class Configuration
       attr_reader :delete
 
-      attr_accessor :banner_text,
-                    :banner_class
+      attr_accessor :banner_text
+      attr_reader :banner_class
 
       # Public: Is the UI in read only mode or not. Default is false. This
       # supersedes all other write-related options such as

data/lib/flipper/ui/util.rb

@@ -1,9 +1,19 @@
+require "rack/utils"
+
 module Flipper
   module UI
     module Util
       # Private: 0x3000: fullwidth whitespace
       NON_WHITESPACE_REGEXP = /[^\s#{[0x3000].pack("U")}]/
 
+      def self.escape(str)
+        Rack::Utils.escape(str)
+      end
+
+      def self.unescape(str)
+        Rack::Utils.unescape(str)
+      end
+
       def self.blank?(str)
         str.to_s !~ NON_WHITESPACE_REGEXP
       end

data/lib/flipper/ui/views/add_actor.erb

@@ -6,7 +6,7 @@
 
 <div class="card">
   <h4 class="card-header">
-    <a class="link-dark" href="<%= script_name %>/features/<%= @feature.key %>"><%= @feature.key %></a>
+    <a class="link-dark" href="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>"><%= @feature.key %></a>
     /
     Enable Actor
   </h4>
@@ -14,7 +14,7 @@
     <p>
       Turn on this feature for actors.
     </p>
-    <form action="<%= script_name %>/features/<%= @feature.key %>/actors" method="post" class="row">
+    <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/actors" method="post" class="row">
       <%== csrf_input_tag %>
       <input type="hidden" name="operation" value="enable">
       <div class="col"><input type="text" name="value" placeholder="<%= Flipper::UI.configuration.add_actor_placeholder %>" class="form-control"></div>

data/lib/flipper/ui/views/add_group.erb

@@ -6,7 +6,7 @@
 
 <div class="card">
   <h4 class="card-header">
-    <a class="link-dark" href="<%= script_name %>/features/<%= @feature.key %>"><%= @feature.key %></a>
+    <a class="link-dark" href="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>"><%= @feature.key %></a>
     /
     Enable Group</h4>
   <div class="card-body">
@@ -16,7 +16,7 @@
       <p>
         Turn on this feature for an entire group of actors.
       </p>
-      <form action="<%= script_name %>/features/<%= @feature.key %>/groups" method="post" class="row">
+      <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/groups" method="post" class="row">
         <%== csrf_input_tag %>
         <input type="hidden" name="operation" value="enable">
         <div class="col">

data/lib/flipper/ui/views/feature.erb

@@ -50,7 +50,7 @@
                 <button class="btn btn-outline-secondary js-toggle-trigger" data-bs-toggle="collapse" data-bs-target="#add-actor">Add an actor</button>
               </div>
               <div class="col toggle-block-when-on">
-                <form action="<%= script_name %>/features/<%= @feature.key %>/actors" method="post" class="row">
+                <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/actors" method="post" class="row">
                   <%== csrf_input_tag %>
                   <input type="hidden" name="operation" value="enable">
                   <div class="col">
@@ -83,7 +83,7 @@
               </div>
               <div class="col col-auto">
                 <% if write_allowed? %>
-                  <form action="<%= script_name %>/features/<%= @feature.key %>/actors" method="post">
+                  <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/actors" method="post">
                     <%== csrf_input_tag %>
                     <input type="hidden" name="operation" value="disable">
                     <input type="hidden" name="value" value="<%= item %>">
@@ -119,7 +119,7 @@
                 <% if @feature.disabled_groups.empty? %>
                   All groups enabled.
                 <% else %>
-                  <form action="<%= script_name %>/features/<%= @feature.key %>/groups" method="post" class="row">
+                  <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/groups" method="post" class="row">
                     <%== csrf_input_tag %>
                     <input type="hidden" name="operation" value="enable">
                     <div class="col">
@@ -150,7 +150,7 @@
               </div>
               <div class="col col-auto">
                 <% if write_allowed? %>
-                  <form action="<%= script_name %>/features/<%= @feature.key %>/groups" method="post">
+                  <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/groups" method="post">
                     <%== csrf_input_tag %>
                     <input type="hidden" name="operation" value="disable">
                     <input type="hidden" name="value" value="<%= item %>">
@@ -185,7 +185,7 @@
           <% if write_allowed? %>
             <div class="card-body border-bottom toggle-block-when-on bg-lightest">
               <div class="row align-items-center">
-                <form action="<%= script_name %>/features/<%= @feature.key %>/percentage_of_actors" method="post" class="col">
+                <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/percentage_of_actors" method="post" class="col">
                   <%== csrf_input_tag %>
                   <div class="btn-group">
                     <% @percentages.each do |number| %>
@@ -193,7 +193,7 @@
                     <% end %>
                   </div>
                 </form>
-                <form action="<%= script_name %>/features/<%= @feature.key %>/percentage_of_actors" method="post" class="col-auto row">
+                <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/percentage_of_actors" method="post" class="col-auto row">
                   <%== csrf_input_tag %>
                   <div class="col-auto">
                     <input style="width:5em;" type="number" max="100" min="0" name="value" <% if @feature.percentage_of_actors_value > 0 %>value="<%= @feature.percentage_of_actors_value %>"<% end %> title="Custom percentage (26, 32, etc.)" placeholder="0" class="form-control">
@@ -226,7 +226,7 @@
           <% if write_allowed? %>
             <div class="card-body border-bottom toggle-block-when-on bg-lightest">
               <div class="row align-items-center">
-                <form action="<%= script_name %>/features/<%= @feature.key %>/percentage_of_time" method="post" class="col">
+                <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/percentage_of_time" method="post" class="col">
                   <%== csrf_input_tag %>
                   <div class="btn-group">
                     <% @percentages.each do |number| %>
@@ -234,7 +234,7 @@
                     <% end %>
                   </div>
                 </form>
-                <form action="<%= script_name %>/features/<%= @feature.key %>/percentage_of_time" method="post" class="col-auto row">
+                <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/percentage_of_time" method="post" class="col-auto row">
                   <%== csrf_input_tag %>
                   <div class="col-auto">
                     <input style="width:5em;" type="number" max="100" min="0" name="value" <% if @feature.percentage_of_time_value > 0 %>value="<%= @feature.percentage_of_time_value %>"<% end %> title="Custom percentage (26, 32, etc.)" placeholder="0" class="form-control">
@@ -249,7 +249,7 @@
 
       <% if write_allowed? %>
         <div class="card-body">
-          <form action="<%= script_name %>/features/<%= @feature.key %>/boolean" method="post">
+          <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>/boolean" method="post">
             <%== csrf_input_tag %>
 
             <div class="row">
@@ -301,7 +301,7 @@
           <p>
             <%= Flipper::UI.configuration.delete.description %>
           </p>
-          <form action="<%= script_name %>/features/<%= @feature.key %>" method="post">
+          <form action="<%= script_name %>/features/<%= Flipper::UI::Util.escape @feature.key %>" method="post">
             <%== csrf_input_tag %>
             <input type="hidden" id="feature_name" name="_feature" value="<%= feature_name %>">
             <input type="hidden" name="_method" value="DELETE">

data/lib/flipper/ui/views/features.erb

@@ -36,7 +36,7 @@
       </div>
     </div>
     <% @features.each do |feature| %>
-      <a href="<%= "#{script_name}/features/#{feature.key}" %>" class="list-group-item list-group-item-action">
+      <a href="<%= "#{script_name}/features/#{Flipper::UI::Util.escape(feature.key)}" %>" class="list-group-item list-group-item-action">
         <div class="row align-items-center">
           <div class="col-1 text-center">
             <span class="status <%= feature.color_class %>" data-bs-toggle="tooltip" title=<%= feature.state.to_s.capitalize %>></span>

data/lib/flipper/ui/views/layout.erb

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html lang="en">
   <head>
-    <title><%= @page_title ? "#{@page_title} // " : "" %>Flipper</title>
+    <title><%= defined?(@page_title) ? "#{@page_title} // " : "" %>Flipper</title>
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width, initial-scale=1">

data/lib/flipper/ui.rb

@@ -20,12 +20,17 @@ module Flipper
 
     def self.app(flipper = nil, options = {})
       env_key = options.fetch(:env_key, 'flipper')
-      rack_protection_options = options.fetch(:rack_protection, use: :authenticity_token)
+
+      if options.key?(:rack_protection)
+        warn "[DEPRECATION] `rack_protection` option is deprecated. " +
+          "Flipper::UI now only includes Rack::Protection::AuthenticityToken middleware. " +
+          "If you need additional protection, you can add it yourself."
+      end
 
       app = ->(_) { [200, { Rack::CONTENT_TYPE => 'text/html' }, ['']] }
       builder = Rack::Builder.new
       yield builder if block_given?
-      builder.use Rack::Protection, rack_protection_options
+      builder.use Rack::Protection::AuthenticityToken
       builder.use Rack::MethodOverride
       builder.use Flipper::Middleware::SetupEnv, flipper, env_key: env_key
       builder.use Flipper::UI::Middleware, flipper: flipper, env_key: env_key

data/lib/flipper/version.rb

@@ -1,5 +1,5 @@
 module Flipper
-  VERSION = '1.3.2'.freeze
+  VERSION = '1.3.3'.freeze
 
   REQUIRED_RUBY_VERSION = '2.6'.freeze
   NEXT_REQUIRED_RUBY_VERSION = '3.0'.freeze

data/spec/flipper/ui/actions/actors_gate_spec.rb

@@ -35,7 +35,7 @@ RSpec.describe Flipper::UI::Actions::ActorsGate do
     end
 
     it 'renders add new actor form' do
-      form = '<form action="/features/a/b/actors" method="post" class="row">'
+      form = '<form action="/features/a%2Fb/actors" method="post" class="row">'
       expect(last_response.body).to include(form)
     end
   end
@@ -73,7 +73,7 @@ RSpec.describe Flipper::UI::Actions::ActorsGate do
 
       context "when feature name contains space" do
         before do
-          post 'features/sp%20ace/actors',
+          post 'features/sp+ace/actors',
                { 'value' => value, 'operation' => 'enable', 'authenticity_token' => token },
                'rack.session' => session
         end
@@ -84,7 +84,7 @@ RSpec.describe Flipper::UI::Actions::ActorsGate do
 
         it "redirects back to feature" do
           expect(last_response.status).to be(302)
-          expect(last_response.headers['location']).to eq('/features/sp%20ace')
+          expect(last_response.headers['location']).to eq('/features/sp+ace')
         end
       end
 
@@ -114,7 +114,7 @@ RSpec.describe Flipper::UI::Actions::ActorsGate do
 
           it 'redirects back to feature' do
             expect(last_response.status).to be(302)
-            expect(last_response.headers['location']).to eq('/features/search/actors?error=%22%22%20is%20not%20a%20valid%20actor%20value.')
+            expect(last_response.headers['location']).to eq('/features/search/actors?error=%22%22+is+not+a+valid+actor+value.')
           end
         end
 
@@ -123,7 +123,7 @@ RSpec.describe Flipper::UI::Actions::ActorsGate do
 
           it 'redirects back to feature' do
             expect(last_response.status).to be(302)
-            expect(last_response.headers['location']).to eq('/features/search/actors?error=%22%22%20is%20not%20a%20valid%20actor%20value.')
+            expect(last_response.headers['location']).to eq('/features/search/actors?error=%22%22+is+not+a+valid+actor+value.')
           end
         end
       end

data/spec/flipper/ui/actions/boolean_gate_spec.rb

@@ -43,7 +43,7 @@ RSpec.describe Flipper::UI::Actions::BooleanGate do
 
       it 'redirects back to feature' do
         expect(last_response.status).to be(302)
-        expect(last_response.headers['location']).to eq('/features/sp%20ace')
+        expect(last_response.headers['location']).to eq('/features/sp+ace')
       end
     end
 

data/spec/flipper/ui/actions/feature_spec.rb

@@ -197,4 +197,18 @@ RSpec.describe Flipper::UI::Actions::Feature do
       expect(last_response.body).to include('a/b')
     end
   end
+
+  describe 'GET /features/:feature with dot dot slash repeated in feature name' do
+    before do
+      get '/features/..%2F..%2F..%2F..%2Fblah'
+    end
+
+    it 'responds with success' do
+      expect(last_response.status).to be(200)
+    end
+
+    it 'renders template' do
+      expect(last_response.body).to include('../../../../blah')
+    end
+  end
 end

data/spec/flipper/ui/actions/features_spec.rb

@@ -28,6 +28,16 @@ RSpec.describe Flipper::UI::Actions::Features do
       end
     end
 
+    it "escapes keys that are junky" do
+      flipper.add("../../../../blah")
+      flipper.add("this that")
+      flipper.add("foo/bar")
+      get '/features'
+      expect(last_response.body).to include("..%2F..%2F..%2F..%2Fblah")
+      expect(last_response.body).to include("this+that")
+      expect(last_response.body).to include("foo%2Fbar")
+    end
+
     context "when there are no features to list" do
       before do
         @original_fun_enabled = Flipper::UI.configuration.fun
@@ -124,7 +134,20 @@ RSpec.describe Flipper::UI::Actions::Features do
 
         it 'redirects to feature' do
           expect(last_response.status).to be(302)
-          expect(last_response.headers['location']).to eq('/features/notifications%20next')
+          expect(last_response.headers['location']).to eq('/features/notifications+next')
+        end
+      end
+
+      context 'feature name contains ../' do
+        let(:feature_name) { '../../../foo' }
+
+        it 'adds feature with space' do
+          expect(flipper.features.map(&:key)).to include(feature_name)
+        end
+
+        it 'redirects to feature' do
+          expect(last_response.status).to be(302)
+          expect(last_response.headers['location']).to eq('/features/..%2F..%2F..%2Ffoo')
         end
       end
 
@@ -138,7 +161,7 @@ RSpec.describe Flipper::UI::Actions::Features do
 
           it 'redirects back to feature' do
             expect(last_response.status).to be(302)
-            expect(last_response.headers['location']).to eq('/features/new?error=%22%22%20is%20not%20a%20valid%20feature%20name.')
+            expect(last_response.headers['location']).to eq('/features/new?error=%22%22+is+not+a+valid+feature+name.')
           end
         end
 
@@ -151,7 +174,7 @@ RSpec.describe Flipper::UI::Actions::Features do
 
           it 'redirects back to feature' do
             expect(last_response.status).to be(302)
-            expect(last_response.headers['location']).to eq('/features/new?error=%22%22%20is%20not%20a%20valid%20feature%20name.')
+            expect(last_response.headers['location']).to eq('/features/new?error=%22%22+is+not+a+valid+feature+name.')
           end
         end
       end

data/spec/flipper/ui/actions/groups_gate_spec.rb

@@ -60,7 +60,7 @@ RSpec.describe Flipper::UI::Actions::GroupsGate do
 
       context 'feature name contains space' do
         before do
-          post 'features/sp%20ace/groups',
+          post 'features/sp+ace/groups',
                { 'value' => group_name, 'operation' => 'enable', 'authenticity_token' => token },
                'rack.session' => session
         end
@@ -71,7 +71,7 @@ RSpec.describe Flipper::UI::Actions::GroupsGate do
 
         it 'redirects back to feature' do
           expect(last_response.status).to be(302)
-          expect(last_response.headers['location']).to eq('/features/sp%20ace')
+          expect(last_response.headers['location']).to eq('/features/sp+ace')
         end
       end
 
@@ -89,7 +89,7 @@ RSpec.describe Flipper::UI::Actions::GroupsGate do
 
           it 'redirects back to feature' do
             expect(last_response.status).to be(302)
-            expect(last_response.headers['location']).to eq('/features/search/groups?error=The%20group%20named%20%22not_here%22%20has%20not%20been%20registered.')
+            expect(last_response.headers['location']).to eq('/features/search/groups?error=The+group+named+%22not_here%22+has+not+been+registered.')
           end
         end
 
@@ -98,7 +98,7 @@ RSpec.describe Flipper::UI::Actions::GroupsGate do
 
           it 'redirects back to feature' do
             expect(last_response.status).to be(302)
-            expect(last_response.headers['location']).to eq('/features/search/groups?error=The%20group%20named%20%22%22%20has%20not%20been%20registered.')
+            expect(last_response.headers['location']).to eq('/features/search/groups?error=The+group+named+%22%22+has+not+been+registered.')
           end
         end
 
@@ -107,7 +107,7 @@ RSpec.describe Flipper::UI::Actions::GroupsGate do
 
           it 'redirects back to feature' do
             expect(last_response.status).to be(302)
-            expect(last_response.headers['location']).to eq('/features/search/groups?error=The%20group%20named%20%22%22%20has%20not%20been%20registered.')
+            expect(last_response.headers['location']).to eq('/features/search/groups?error=The+group+named+%22%22+has+not+been+registered.')
           end
         end
       end

data/spec/flipper/ui/actions/percentage_of_actors_gate_spec.rb

@@ -30,7 +30,7 @@ RSpec.describe Flipper::UI::Actions::PercentageOfActorsGate do
 
     context 'with space in feature name' do
       before do
-        post 'features/sp%20ace/percentage_of_actors',
+        post 'features/sp+ace/percentage_of_actors',
              { 'value' => '24', 'authenticity_token' => token },
              'rack.session' => session
       end
@@ -41,7 +41,7 @@ RSpec.describe Flipper::UI::Actions::PercentageOfActorsGate do
 
       it 'redirects back to feature' do
         expect(last_response.status).to be(302)
-        expect(last_response.headers['location']).to eq('/features/sp%20ace')
+        expect(last_response.headers['location']).to eq('/features/sp+ace')
       end
     end
 
@@ -58,7 +58,7 @@ RSpec.describe Flipper::UI::Actions::PercentageOfActorsGate do
 
       it 'redirects back to feature' do
         expect(last_response.status).to be(302)
-        expect(last_response.headers['location']).to eq('/features/search?error=Invalid%20percentage%20of%20actors%20value:%20value%20must%20be%20a%20positive%20number%20less%20than%20or%20equal%20to%20100,%20but%20was%20555')
+        expect(last_response.headers['location']).to eq('/features/search?error=Invalid+percentage+of+actors+value%3A+value+must+be+a+positive+number+less+than+or+equal+to+100%2C+but+was+555')
       end
     end
   end

data/spec/flipper/ui/actions/percentage_of_time_gate_spec.rb

@@ -30,7 +30,7 @@ RSpec.describe Flipper::UI::Actions::PercentageOfTimeGate do
 
     context 'with space in feature name' do
       before do
-        post 'features/sp%20ace/percentage_of_time',
+        post 'features/sp+ace/percentage_of_time',
              { 'value' => '24', 'authenticity_token' => token },
              'rack.session' => session
       end
@@ -41,7 +41,7 @@ RSpec.describe Flipper::UI::Actions::PercentageOfTimeGate do
 
       it 'redirects back to feature' do
         expect(last_response.status).to be(302)
-        expect(last_response.headers['location']).to eq('/features/sp%20ace')
+        expect(last_response.headers['location']).to eq('/features/sp+ace')
       end
     end
 
@@ -58,7 +58,7 @@ RSpec.describe Flipper::UI::Actions::PercentageOfTimeGate do
 
       it 'redirects back to feature' do
         expect(last_response.status).to be(302)
-        expect(last_response.headers['location']).to eq('/features/search?error=Invalid%20percentage%20of%20time%20value:%20value%20must%20be%20a%20positive%20number%20less%20than%20or%20equal%20to%20100,%20but%20was%20555')
+        expect(last_response.headers['location']).to eq('/features/search?error=Invalid+percentage+of+time+value%3A+value+must+be+a+positive+number+less+than+or+equal+to+100%2C+but+was+555')
       end
     end
   end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: flipper-ui
 version: !ruby/object:Gem::Version
-  version: 1.3.2
+  version: 1.3.3
 platform: ruby
 authors:
 - John Nunemaker
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-11-19 00:00:00.000000000 Z
+date: 2025-02-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -76,14 +75,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.2
+        version: 1.3.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.2
+        version: 1.3.3
 - !ruby/object:Gem::Dependency
   name: erubi
   requirement: !ruby/object:Gem::Requirement
@@ -110,15 +109,14 @@ dependencies:
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '7'
+        version: '8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "<"
       - !ruby/object:Gem::Version
-        version: '7'
-description:
+        version: '8'
 email: support@flippercloud.io
 executables: []
 extensions: []
@@ -200,8 +198,8 @@ metadata:
   homepage_uri: https://www.flippercloud.io
   source_code_uri: https://github.com/flippercloud/flipper
   bug_tracker_uri: https://github.com/flippercloud/flipper/issues
-  changelog_uri: https://github.com/flippercloud/flipper/releases/tag/v1.3.2
-post_install_message:
+  changelog_uri: https://github.com/flippercloud/flipper/releases/tag/v1.3.3
+  funding_uri: https://github.com/sponsors/flippercloud
 rdoc_options: []
 require_paths:
 - lib
@@ -216,8 +214,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.23
-signing_key:
+rubygems_version: 3.6.5
 specification_version: 4
 summary: Feature flag UI for the Flipper gem
 test_files: