govspeak 1.1.0 → 1.2.0

data/lib/govspeak.rb

@@ -36,6 +36,10 @@ module Govspeak
       kramdown_doc.to_html
     end
 
+    def to_sanitized_html
+      HtmlSanitizer.new(to_html).sanitize
+    end
+
     def to_text
       HTMLEntities.new.decode(to_html.gsub(/(?:<[^>]+>|\s)+/, " ").strip)
     end

data/lib/govspeak/version.rb

@@ -1,3 +1,3 @@
 module Govspeak
-  VERSION = "1.1.0"
+  VERSION = "1.2.0"
 end

data/test/govspeak_test.rb

@@ -432,6 +432,11 @@ $CTA
     end
   end
 
+  test "can sanitize a document" do
+    document = Govspeak::Document.new("<script>doBadThings();</script>")
+    assert_equal "doBadThings();", document.to_sanitized_html
+  end
+
   test "identifies a Govspeak document containing malicious HTML as invalid" do
     document = Govspeak::Document.new("<script>doBadThings();</script>")
     refute document.valid?

data/test/html_sanitizer_test.rb

@@ -0,0 +1,30 @@
+require "test_helper"
+
+class HtmlSanitizerTest < Test::Unit::TestCase
+
+  test "disallow a script tag" do
+    html = "<script>alert('XSS')</script>"
+    assert_equal "alert('XSS')", Govspeak::HtmlSanitizer.new(html).sanitize
+  end
+
+  test "disallow a javascript protocol in an attribute" do
+    html = %q{<a href="javascript:alert(document.location);"
+              title="Title">an example</a>}
+    assert_equal "<a title=\"Title\">an example</a>", Govspeak::HtmlSanitizer.new(html).sanitize
+  end
+
+  test "disallow on* attributes" do
+    html = %q{<a href="/" onclick="alert('xss');">Link</a>}
+    assert_equal "<a href=\"/\">Link</a>", Govspeak::HtmlSanitizer.new(html).sanitize
+  end
+
+  test "allow non-JS HTML content" do
+    html = "<a href='foo'>"
+    assert_equal "<a href=\"foo\"></a>", Govspeak::HtmlSanitizer.new(html).sanitize
+  end
+
+  test "keep things that should be HTML entities" do
+    html = "Fortnum & Mason"
+    assert_equal "Fortnum &amp; Mason", Govspeak::HtmlSanitizer.new(html).sanitize
+  end
+end

data/test/html_validator_test.rb

@@ -57,7 +57,7 @@ class HtmlValidatorTest < Test::Unit::TestCase
     end
   end
 
-  test "disallow a script tags" do
+  test "disallow a script tag" do
     assert Govspeak::HtmlValidator.new("<script>alert('XSS')</script>").invalid?
   end
 

metadata

@@ -2,7 +2,7 @@
 name: govspeak
 version: !ruby/object:Gem::Version 
   prerelease: 
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors: 
 - Ben Griffiths
@@ -112,6 +112,7 @@ files:
 - README.md
 - Gemfile
 - Rakefile
+- test/html_sanitizer_test.rb
 - test/html_validator_test.rb
 - test/govspeak_test_helper.rb
 - test/govspeak_test.rb
@@ -129,7 +130,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 2687403366774857492
+      hash: 2266013611251793811
       segments: 
       - 0
       version: "0"
@@ -138,7 +139,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 2687403366774857492
+      hash: 2266013611251793811
       segments: 
       - 0
       version: "0"
@@ -150,6 +151,7 @@ signing_key:
 specification_version: 3
 summary: Markup language for single domain
 test_files: 
+- test/html_sanitizer_test.rb
 - test/html_validator_test.rb
 - test/govspeak_test_helper.rb
 - test/govspeak_test.rb