govspeak 1.0.0 → 1.0.1

data/lib/govspeak.rb

@@ -1,5 +1,6 @@
 require 'kramdown'
 require 'govspeak/header_extractor'
+require 'govspeak/html_validator'
 require 'kramdown/parser/kramdown_with_automatic_external_links'
 require 'htmlentities'
 
@@ -23,7 +24,6 @@ module Govspeak
       Parser.document_domains = options.delete(:document_domains)
       @options = {input: PARSER_CLASS_NAME, entity_output: :symbolic}.merge(options)
       @images = []
-      super()
     end
 
     def kramdown_doc
@@ -39,6 +39,10 @@ module Govspeak
       HTMLEntities.new.decode(to_html.gsub(/(?:<[^>]+>|\s)+/, " ").strip)
     end
 
+    def valid?
+      Govspeak::HtmlValidator.new(@source).valid?
+    end
+
     def headers
       Govspeak::HeaderExtractor.convert(kramdown_doc).first
     end

data/lib/govspeak/html_validator.rb

@@ -0,0 +1,40 @@
+require 'sanitize'
+
+class Govspeak::HtmlValidator
+  attr_reader :string
+
+  def initialize(string)
+    @string = string
+  end
+
+  def invalid?
+    !valid?
+  end
+
+  def valid?
+    dirty_html = govspeak_to_html
+    clean_html = sanitize_html(dirty_html)
+    normalise_html(dirty_html) == normalise_html(clean_html)
+  end
+
+  # Make whitespace in html tags consistent
+  def normalise_html(html)
+    Nokogiri::HTML.parse(html).to_s
+  end
+
+  def govspeak_to_html
+    Govspeak::Document.new(string).to_html
+  end
+
+  def sanitize_html(dirty_html)
+    Sanitize.clean(dirty_html, sanitize_config)
+  end
+
+  def sanitize_config
+    config = Sanitize::Config::RELAXED.dup
+    config[:attributes][:all].push("id", "class")
+    config[:attributes]["a"].push("rel")
+    config[:elements].push("div", "hr")
+    config
+  end
+end

data/lib/govspeak/version.rb

@@ -1,3 +1,3 @@
 module Govspeak
-  VERSION = "1.0.0"
+  VERSION = "1.0.1"
 end

data/test/govspeak_test.rb

@@ -432,4 +432,13 @@ $CTA
     end
   end
 
+  test "identifies a Govspeak document containing malicious HTML as invalid" do
+    document = Govspeak::Document.new("<script>doBadThings();</script>")
+    refute document.valid?
+  end
+
+  test "identifies a Govspeak document containing acceptable HTML as valid" do
+    document = Govspeak::Document.new("<div>some content</div>")
+    assert document.valid?
+  end
 end

data/test/html_validator_test.rb

@@ -0,0 +1,87 @@
+require "test_helper"
+
+class HtmlValidatorTest < Test::Unit::TestCase
+  test "allow Govspeak Markdown" do
+    values = [
+      "## is H2",
+      "*bold text*",
+      "* bullet",
+      "- alternative bullet",
+      "+ another bullet",
+      "1. Numbered list",
+      "s2. Step",
+      """
+      Table | Header
+      - | -
+      Build | cells
+      """,
+      "This is [an example](/an-inline-link \"Title\") inline link.",
+      "<http://example.com/>",
+      "<address@example.com>",
+      "This is [an example](http://example.com/ \"Title\"){:rel=\"external\"} inline link to an external resource.",
+      "^Your text here^ - creates a callout with an info (i) icon.",
+      "%Your text here% - creates a callout with a warning or alert (!) icon",
+      "@Your text here@ - highlights the enclosed text in yellow",
+      "$CSome contact information here$C - contact information",
+      "$A Hercules House Hercules Road London SE1 7DU $A",
+      "$D [An example form download link](http://example.com/ \"Example form\") Something about this form download $D",
+      "$EAn example for the citizen$E - examples boxout",
+      "$!...$! - answer summary",
+      "{::highlight-answer}...{:/highlight-answer} - creates a large pink highlight box with optional preamble text and giant text denoted with **.",
+      "{::highlight-answer}",
+      "The VAT rate is *20%*",
+      "{:/highlight-answer}",
+      "---",
+      "*[GDS]: Government Digital Service",
+      """
+      $P
+
+      $I
+      $A
+      Hercules House
+      Hercules Road
+      London SE1 7DU
+      $A
+
+      $AI
+      There is access to the building from the street via a ramp.
+      $AI
+      $I
+      $P
+      """,
+      ":england:content goes here:england:",
+      ":scotland:content goes here:scotland:"
+    ]
+    values.each do |value|
+      assert Govspeak::HtmlValidator.new(value).valid?
+    end
+  end
+
+  test "disallow a script tags" do
+    assert Govspeak::HtmlValidator.new("<script>alert('XSS')</script>").invalid?
+  end
+
+  test "disallow a javascript protocol in an attribute" do
+    html = %q{<a href="javascript:alert(document.location);"
+              title="Title">an example</a>}
+    assert Govspeak::HtmlValidator.new(html).invalid?
+  end
+
+  test "disallow a javascript protocol in a Markdown link" do
+    html = %q{This is [an example](javascript:alert(""); "Title") inline link.}
+    assert Govspeak::HtmlValidator.new(html).invalid?
+  end
+
+  test "disallow on* attributes" do
+    html = %q{<a href="/" onclick="alert('xss');">Link</a>}
+    assert Govspeak::HtmlValidator.new(html).invalid?
+  end
+
+  test "allow non-JS HTML content" do
+    assert Govspeak::HtmlValidator.new("<a href='foo'>").valid?
+  end
+
+  test "allow things that will end up as HTML entities" do
+    assert Govspeak::HtmlValidator.new("Fortnum & Mason").valid?
+  end
+end

metadata

@@ -2,7 +2,7 @@
 name: govspeak
 version: !ruby/object:Gem::Version 
   prerelease: 
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors: 
 - Ben Griffiths
@@ -11,7 +11,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-08-30 00:00:00 Z
+date: 2012-09-06 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: kramdown
@@ -36,8 +36,19 @@ dependencies:
   prerelease: false
   version_requirements: *id002
 - !ruby/object:Gem::Dependency 
-  name: rake
+  name: sanitize
   requirement: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - "="
+      - !ruby/object:Gem::Version 
+        version: 2.0.3
+  type: :runtime
+  prerelease: false
+  version_requirements: *id003
+- !ruby/object:Gem::Dependency 
+  name: rake
+  requirement: &id004 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ~>
@@ -45,10 +56,10 @@ dependencies:
         version: 0.9.0
   type: :development
   prerelease: false
-  version_requirements: *id003
+  version_requirements: *id004
 - !ruby/object:Gem::Dependency 
   name: gem_publisher
-  requirement: &id004 !ruby/object:Gem::Requirement 
+  requirement: &id005 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ~>
@@ -56,10 +67,10 @@ dependencies:
         version: 1.1.1
   type: :development
   prerelease: false
-  version_requirements: *id004
+  version_requirements: *id005
 - !ruby/object:Gem::Dependency 
   name: simplecov
-  requirement: &id005 !ruby/object:Gem::Requirement 
+  requirement: &id006 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
@@ -67,10 +78,10 @@ dependencies:
         version: "0"
   type: :development
   prerelease: false
-  version_requirements: *id005
+  version_requirements: *id006
 - !ruby/object:Gem::Dependency 
   name: simplecov-rcov
-  requirement: &id006 !ruby/object:Gem::Requirement 
+  requirement: &id007 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
@@ -78,7 +89,7 @@ dependencies:
         version: "0"
   type: :development
   prerelease: false
-  version_requirements: *id006
+  version_requirements: *id007
 description: |-
   A set of extensions to markdown layered on top of the kramdown
   library for use in the UK Government Single Domain project
@@ -94,11 +105,13 @@ extra_rdoc_files: []
 files: 
 - lib/govspeak/version.rb
 - lib/govspeak/header_extractor.rb
+- lib/govspeak/html_validator.rb
 - lib/govspeak.rb
 - lib/kramdown/parser/kramdown_with_automatic_external_links.rb
 - README.md
 - Gemfile
 - Rakefile
+- test/html_validator_test.rb
 - test/govspeak_test_helper.rb
 - test/govspeak_test.rb
 - test/test_helper.rb
@@ -115,7 +128,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 2632148642113088526
+      hash: -3025037898440193908
       segments: 
       - 0
       version: "0"
@@ -124,7 +137,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 2632148642113088526
+      hash: -3025037898440193908
       segments: 
       - 0
       version: "0"
@@ -136,6 +149,7 @@ signing_key:
 specification_version: 3
 summary: Markup language for single domain
 test_files: 
+- test/html_validator_test.rb
 - test/govspeak_test_helper.rb
 - test/govspeak_test.rb
 - test/test_helper.rb