go_to_param 1.1.3 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8742769791ea66237e5decb3e329ed1c2b6a127f072378487b134f45cd8b7a9
-  data.tar.gz: cf8134a2f905e96b8e143c67ccae9f931d109c6c6570a6d46b64d4a329275904
+  metadata.gz: 8ef3c76caad7dbf28335798a812644bfd00fc3609f6a59b601552e2d6f3f8915
+  data.tar.gz: eb54119400b07f9dd8bc1104aea81e0c08eed250461a4963f79d4c6e5c9ba113
 SHA512:
-  metadata.gz: 1366c2d13bb1cba9f3147eadaa3a092526f70da496a642162a4e0e54da880b095b99335f24a3214ef72dc1fea834a2d0208c801020fefa4218c889d9bfc791e8
-  data.tar.gz: c74471045b18e7f076df5eccd804d31e1198064aa8affdf89518af07b420955d96701bcb1469ef8709037e2d306d6589115ac16be9cfec66a054179527b355a9
+  metadata.gz: 8c00fa6dc82ce3b7f24802a16a726061e785da10e0b11fbb38acd66a230ae49261f73ef66ee06af926e7d38567408b3889bf8bd8ff2ba448f78b01cf3326ce94
+  data.tar.gz: 298750ed94c196b4b86368f889e41707223b2fd71e35f631b6b90c7cb7aac8ca615d3199b239380941aac191534c22be69d8244e259621df784bc7c844d08b4a

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 2.0.0
+
+- Remove `id` attribute for input tags generated by `hidden_go_to_tag` and `hidden_go_to_here_tag`, to avoid markup errors when using multiple on the same page.
+- Disallow protocol-relative "//evil.com".
+
+## 1.1.3
+
+- Force MFA for privileged Rubygems actions.
+
 ## 1.1.2
 
 - Fix keyword parameter warning. Thanks to @olleolleolle!

data/lib/go_to_param/version.rb

@@ -1,3 +1,3 @@
 module GoToParam
-  VERSION = "1.1.3"
+  VERSION = "2.0.0"
 end

data/lib/go_to_param.rb

@@ -23,11 +23,11 @@ module GoToParam
   end
 
   def hidden_go_to_tag
-    view_context.hidden_field_tag :go_to, go_to_path
+    view_context.hidden_field_tag :go_to, go_to_path, id: nil
   end
 
   def hidden_go_to_here_tag(additional_query_params = {})
-    view_context.hidden_field_tag :go_to, go_to_here_params(additional_query_params)[:go_to]
+    view_context.hidden_field_tag :go_to, go_to_here_params(additional_query_params)[:go_to], id: nil
   end
 
   def go_to_params(other_params = {})
@@ -62,7 +62,13 @@ module GoToParam
   private
 
   def matches_allowed_redirect_prefixes?
-    GoToParam.allowed_redirect_prefixes.any? { |prefix| go_to_param_value.start_with?(prefix) }
+    value = go_to_param_value
+
+    # Disallow protocol-relative "//evil.com".
+    # Also account for browsers normalizing `\` to `/`: https://github.com/advisories/GHSA-mqqf-5wvp-8fh8
+    return false if value.start_with?("//", "/\\", "\\/", "\\\\")
+
+    GoToParam.allowed_redirect_prefixes.any? { |prefix| value.start_with?(prefix) }
   end
 
   def go_to_here_path(anchor: nil, **additional_query_params)

metadata

@@ -1,58 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: go_to_param
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: 2.0.0
 platform: ruby
 authors:
 - Henrik N
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-11-19 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-description: 
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
 email:
 - henrik@nyh.se
 executables: []
@@ -68,7 +24,6 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -83,8 +38,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.31
-signing_key: 
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Rails "go_to" redirection param utilities.
 test_files: []