hanami-utils 2.0.3 → 2.1.0.beta1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +6 -0
- data/LICENSE.md +1 -1
- data/README.md +1 -9
- data/lib/hanami/utils/version.rb +1 -1
- metadata +5 -6
- data/lib/hanami/utils/escape.rb +0 -583
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 7d8408f6dcbf5d2b7a701c70130fe840c313114ce78f73ff5591f624b0fec635
|
4
|
+
data.tar.gz: 46423746a2dc76982974f54cd7c542f705aaf9ae36c3549056ec92136acb4f50
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 5110f56db1184e39c4e741bb313f7aaff5ab8ff6a703b8bd8e3eaaf8608663ca88eec0ffa83054ac9ffbb961c9f4158b0ee56e1eea20031f539d74bf5470c30f
|
7
|
+
data.tar.gz: 58ce8d880d76a662f47e9ee19e96eaec06e02242b90ac456716c76aac7089a4b73db7a7630095227a08037ab26a040a05b7711554c471293c98d5b30ebb5c261
|
data/CHANGELOG.md
CHANGED
data/LICENSE.md
CHANGED
data/README.md
CHANGED
@@ -50,10 +50,6 @@ Or install it yourself as:
|
|
50
50
|
|
51
51
|
## Features
|
52
52
|
|
53
|
-
### Hanami::Logger
|
54
|
-
|
55
|
-
Enhanced version of Ruby's `Logger`. [[API doc](http://www.rubydoc.info/gems/hanami-utils/Hanami/Logger)]
|
56
|
-
|
57
53
|
### Hanami::Utils::Blank
|
58
54
|
|
59
55
|
Checks for blank. [[API doc](http://www.rubydoc.info/gems/hanami-utils/Hanami/Utils/Blank)]
|
@@ -74,10 +70,6 @@ Inheritable class attributes. [[API doc](http://www.rubydoc.info/gems/hanami-uti
|
|
74
70
|
|
75
71
|
Deprecate Hanami features. [[API doc](http://www.rubydoc.info/gems/hanami-utils/Hanami/Utils/Deprecation)]
|
76
72
|
|
77
|
-
### Hanami::Utils::Escape
|
78
|
-
|
79
|
-
Safe and fast escape for URLs, HTML content and attributes. Based on OWASP/ESAPI code. [[API doc](http://www.rubydoc.info/gems/hanami-utils/Hanami/Utils/Escape)]
|
80
|
-
|
81
73
|
### Hanami::Utils::FileList
|
82
74
|
|
83
75
|
Recursive, cross-platform ordered list of files. [[API doc](http://www.rubydoc.info/gems/hanami-utils/Hanami/Utils/FileList)]
|
@@ -136,4 +128,4 @@ Enhanced version of Ruby's `String`. [[API doc](http://www.rubydoc.info/gems/han
|
|
136
128
|
|
137
129
|
## Copyright
|
138
130
|
|
139
|
-
Copyright © 2014
|
131
|
+
Copyright © 2014 Hanami Team – Released under MIT License
|
data/lib/hanami/utils/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: hanami-utils
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0.
|
4
|
+
version: 2.1.0.beta1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Luca Guidi
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2023-
|
11
|
+
date: 2023-06-29 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: dry-core
|
@@ -146,7 +146,6 @@ files:
|
|
146
146
|
- lib/hanami/utils/class_attribute.rb
|
147
147
|
- lib/hanami/utils/class_attribute/attributes.rb
|
148
148
|
- lib/hanami/utils/deprecation.rb
|
149
|
-
- lib/hanami/utils/escape.rb
|
150
149
|
- lib/hanami/utils/file_list.rb
|
151
150
|
- lib/hanami/utils/files.rb
|
152
151
|
- lib/hanami/utils/hash.rb
|
@@ -175,11 +174,11 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
175
174
|
version: '3.0'
|
176
175
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
177
176
|
requirements:
|
178
|
-
- - "
|
177
|
+
- - ">"
|
179
178
|
- !ruby/object:Gem::Version
|
180
|
-
version:
|
179
|
+
version: 1.3.1
|
181
180
|
requirements: []
|
182
|
-
rubygems_version: 3.4.
|
181
|
+
rubygems_version: 3.4.13
|
183
182
|
signing_key:
|
184
183
|
specification_version: 4
|
185
184
|
summary: Ruby core extentions and Hanami utilities
|
data/lib/hanami/utils/escape.rb
DELETED
@@ -1,583 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Hanami
|
4
|
-
module Utils
|
5
|
-
# HTML escape utilities
|
6
|
-
#
|
7
|
-
# Based on OWASP research and OWASP ESAPI code
|
8
|
-
#
|
9
|
-
# @since 0.4.0
|
10
|
-
#
|
11
|
-
# @see https://www.owasp.org
|
12
|
-
# @see https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
|
13
|
-
# @see https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
|
14
|
-
# @see https://www.owasp.org/index.php/ESAPI
|
15
|
-
# @see https://github.com/ESAPI/esapi-java-legacy
|
16
|
-
module Escape # rubocop:disable Metrics/ModuleLength
|
17
|
-
# Hex base for base 10 integer conversion
|
18
|
-
#
|
19
|
-
# @since 0.4.0
|
20
|
-
# @api private
|
21
|
-
#
|
22
|
-
# @see http://www.ruby-doc.org/core/Fixnum.html#method-i-to_s
|
23
|
-
HEX_BASE = 16
|
24
|
-
|
25
|
-
# Limit for non printable chars
|
26
|
-
#
|
27
|
-
# @since 0.4.0
|
28
|
-
# @api private
|
29
|
-
LOW_HEX_CODE_LIMIT = 0xff
|
30
|
-
|
31
|
-
# Replacement hex for non printable characters
|
32
|
-
#
|
33
|
-
# @since 0.4.0
|
34
|
-
# @api private
|
35
|
-
REPLACEMENT_HEX = "fffd"
|
36
|
-
|
37
|
-
# Low hex codes lookup table
|
38
|
-
#
|
39
|
-
# @since 0.4.0
|
40
|
-
# @api private
|
41
|
-
HEX_CODES = (0..255).each_with_object({}) do |c, codes|
|
42
|
-
if (c >= 0x30 && c <= 0x39) || (c >= 0x41 && c <= 0x5A) || (c >= 0x61 && c <= 0x7A)
|
43
|
-
codes[c] = nil
|
44
|
-
else
|
45
|
-
codes[c] = c.to_s(HEX_BASE)
|
46
|
-
end
|
47
|
-
end.freeze
|
48
|
-
|
49
|
-
# Non printable chars
|
50
|
-
#
|
51
|
-
# This is a Hash instead of a Set, to make lookup faster.
|
52
|
-
#
|
53
|
-
# @since 0.4.0
|
54
|
-
# @api private
|
55
|
-
#
|
56
|
-
# @see https://gist.github.com/jodosha/ac5dd54416de744b9600
|
57
|
-
NON_PRINTABLE_CHARS = {
|
58
|
-
0x0 => true, 0x1 => true, 0x2 => true, 0x3 => true, 0x4 => true,
|
59
|
-
0x5 => true, 0x6 => true, 0x7 => true, 0x8 => true, 0x11 => true,
|
60
|
-
0x12 => true, 0x14 => true, 0x15 => true, 0x16 => true, 0x17 => true,
|
61
|
-
0x18 => true, 0x19 => true, 0x1a => true, 0x1b => true, 0x1c => true,
|
62
|
-
0x1d => true, 0x1e => true, 0x1f => true, 0x7f => true, 0x80 => true,
|
63
|
-
0x81 => true, 0x82 => true, 0x83 => true, 0x84 => true, 0x85 => true,
|
64
|
-
0x86 => true, 0x87 => true, 0x88 => true, 0x89 => true, 0x8a => true,
|
65
|
-
0x8b => true, 0x8c => true, 0x8d => true, 0x8e => true, 0x8f => true,
|
66
|
-
0x90 => true, 0x91 => true, 0x92 => true, 0x93 => true, 0x94 => true,
|
67
|
-
0x95 => true, 0x96 => true, 0x97 => true, 0x98 => true, 0x99 => true,
|
68
|
-
0x9a => true, 0x9b => true, 0x9c => true, 0x9d => true, 0x9e => true,
|
69
|
-
0x9f => true
|
70
|
-
}.freeze
|
71
|
-
|
72
|
-
# Lookup table for HTML escape
|
73
|
-
#
|
74
|
-
# @since 0.4.0
|
75
|
-
# @api private
|
76
|
-
#
|
77
|
-
# @see Hanami::Utils::Escape.html
|
78
|
-
HTML_CHARS = {
|
79
|
-
"&" => "&",
|
80
|
-
"<" => "<",
|
81
|
-
">" => ">",
|
82
|
-
'"' => """,
|
83
|
-
"'" => "'",
|
84
|
-
"/" => "/"
|
85
|
-
}.freeze
|
86
|
-
|
87
|
-
# Lookup table for safe chars for HTML attributes.
|
88
|
-
#
|
89
|
-
# This is a Hash instead of a Set, to make lookup faster.
|
90
|
-
#
|
91
|
-
# @since 0.4.0
|
92
|
-
# @api private
|
93
|
-
#
|
94
|
-
# @see Lookup::Utils::Escape.html_attribute
|
95
|
-
# @see https://gist.github.com/jodosha/ac5dd54416de744b9600
|
96
|
-
HTML_ATTRIBUTE_SAFE_CHARS = {
|
97
|
-
"," => true, "." => true, "-" => true, "_" => true
|
98
|
-
}.freeze
|
99
|
-
|
100
|
-
# Lookup table for HTML attribute escape
|
101
|
-
#
|
102
|
-
# @since 0.4.0
|
103
|
-
# @api private
|
104
|
-
#
|
105
|
-
# @see Hanami::Utils::Escape.html_attribute
|
106
|
-
HTML_ENTITIES = {
|
107
|
-
34 => "quot", # quotation mark
|
108
|
-
38 => "amp", # ampersand
|
109
|
-
60 => "lt", # less-than sign
|
110
|
-
62 => "gt", # greater-than sign
|
111
|
-
160 => "nbsp", # no-break space
|
112
|
-
161 => "iexcl", # inverted exclamation mark
|
113
|
-
162 => "cent", # cent sign
|
114
|
-
163 => "pound", # pound sign
|
115
|
-
164 => "curren", # currency sign
|
116
|
-
165 => "yen", # yen sign
|
117
|
-
166 => "brvbar", # broken bar
|
118
|
-
167 => "sect", # section sign
|
119
|
-
168 => "uml", # diaeresis
|
120
|
-
169 => "copy", # copyright sign
|
121
|
-
170 => "ordf", # feminine ordinal indicator
|
122
|
-
171 => "laquo", # left-pointing double angle quotation mark
|
123
|
-
172 => "not", # not sign
|
124
|
-
173 => "shy", # soft hyphen
|
125
|
-
174 => "reg", # registered sign
|
126
|
-
175 => "macr", # macron
|
127
|
-
176 => "deg", # degree sign
|
128
|
-
177 => "plusmn", # plus-minus sign
|
129
|
-
178 => "sup2", # superscript two
|
130
|
-
179 => "sup3", # superscript three
|
131
|
-
180 => "acute", # acute accent
|
132
|
-
181 => "micro", # micro sign
|
133
|
-
182 => "para", # pilcrow sign
|
134
|
-
183 => "middot", # middle dot
|
135
|
-
184 => "cedil", # cedilla
|
136
|
-
185 => "sup1", # superscript one
|
137
|
-
186 => "ordm", # masculine ordinal indicator
|
138
|
-
187 => "raquo", # right-pointing double angle quotation mark
|
139
|
-
188 => "frac14", # vulgar fraction one quarter
|
140
|
-
189 => "frac12", # vulgar fraction one half
|
141
|
-
190 => "frac34", # vulgar fraction three quarters
|
142
|
-
191 => "iquest", # inverted question mark
|
143
|
-
192 => "Agrave", # Latin capital letter a with grave
|
144
|
-
193 => "Aacute", # Latin capital letter a with acute
|
145
|
-
194 => "Acirc", # Latin capital letter a with circumflex
|
146
|
-
195 => "Atilde", # Latin capital letter a with tilde
|
147
|
-
196 => "Auml", # Latin capital letter a with diaeresis
|
148
|
-
197 => "Aring", # Latin capital letter a with ring above
|
149
|
-
198 => "AElig", # Latin capital letter ae
|
150
|
-
199 => "Ccedil", # Latin capital letter c with cedilla
|
151
|
-
200 => "Egrave", # Latin capital letter e with grave
|
152
|
-
201 => "Eacute", # Latin capital letter e with acute
|
153
|
-
202 => "Ecirc", # Latin capital letter e with circumflex
|
154
|
-
203 => "Euml", # Latin capital letter e with diaeresis
|
155
|
-
204 => "Igrave", # Latin capital letter i with grave
|
156
|
-
205 => "Iacute", # Latin capital letter i with acute
|
157
|
-
206 => "Icirc", # Latin capital letter i with circumflex
|
158
|
-
207 => "Iuml", # Latin capital letter i with diaeresis
|
159
|
-
208 => "ETH", # Latin capital letter eth
|
160
|
-
209 => "Ntilde", # Latin capital letter n with tilde
|
161
|
-
210 => "Ograve", # Latin capital letter o with grave
|
162
|
-
211 => "Oacute", # Latin capital letter o with acute
|
163
|
-
212 => "Ocirc", # Latin capital letter o with circumflex
|
164
|
-
213 => "Otilde", # Latin capital letter o with tilde
|
165
|
-
214 => "Ouml", # Latin capital letter o with diaeresis
|
166
|
-
215 => "times", # multiplication sign
|
167
|
-
216 => "Oslash", # Latin capital letter o with stroke
|
168
|
-
217 => "Ugrave", # Latin capital letter u with grave
|
169
|
-
218 => "Uacute", # Latin capital letter u with acute
|
170
|
-
219 => "Ucirc", # Latin capital letter u with circumflex
|
171
|
-
220 => "Uuml", # Latin capital letter u with diaeresis
|
172
|
-
221 => "Yacute", # Latin capital letter y with acute
|
173
|
-
222 => "THORN", # Latin capital letter thorn
|
174
|
-
223 => "szlig", # Latin small letter sharp sXCOMMAX German Eszett
|
175
|
-
224 => "agrave", # Latin small letter a with grave
|
176
|
-
225 => "aacute", # Latin small letter a with acute
|
177
|
-
226 => "acirc", # Latin small letter a with circumflex
|
178
|
-
227 => "atilde", # Latin small letter a with tilde
|
179
|
-
228 => "auml", # Latin small letter a with diaeresis
|
180
|
-
229 => "aring", # Latin small letter a with ring above
|
181
|
-
230 => "aelig", # Latin lowercase ligature ae
|
182
|
-
231 => "ccedil", # Latin small letter c with cedilla
|
183
|
-
232 => "egrave", # Latin small letter e with grave
|
184
|
-
233 => "eacute", # Latin small letter e with acute
|
185
|
-
234 => "ecirc", # Latin small letter e with circumflex
|
186
|
-
235 => "euml", # Latin small letter e with diaeresis
|
187
|
-
236 => "igrave", # Latin small letter i with grave
|
188
|
-
237 => "iacute", # Latin small letter i with acute
|
189
|
-
238 => "icirc", # Latin small letter i with circumflex
|
190
|
-
239 => "iuml", # Latin small letter i with diaeresis
|
191
|
-
240 => "eth", # Latin small letter eth
|
192
|
-
241 => "ntilde", # Latin small letter n with tilde
|
193
|
-
242 => "ograve", # Latin small letter o with grave
|
194
|
-
243 => "oacute", # Latin small letter o with acute
|
195
|
-
244 => "ocirc", # Latin small letter o with circumflex
|
196
|
-
245 => "otilde", # Latin small letter o with tilde
|
197
|
-
246 => "ouml", # Latin small letter o with diaeresis
|
198
|
-
247 => "divide", # division sign
|
199
|
-
248 => "oslash", # Latin small letter o with stroke
|
200
|
-
249 => "ugrave", # Latin small letter u with grave
|
201
|
-
250 => "uacute", # Latin small letter u with acute
|
202
|
-
251 => "ucirc", # Latin small letter u with circumflex
|
203
|
-
252 => "uuml", # Latin small letter u with diaeresis
|
204
|
-
253 => "yacute", # Latin small letter y with acute
|
205
|
-
254 => "thorn", # Latin small letter thorn
|
206
|
-
255 => "yuml", # Latin small letter y with diaeresis
|
207
|
-
338 => "OElig", # Latin capital ligature oe
|
208
|
-
339 => "oelig", # Latin small ligature oe
|
209
|
-
352 => "Scaron", # Latin capital letter s with caron
|
210
|
-
353 => "scaron", # Latin small letter s with caron
|
211
|
-
376 => "Yuml", # Latin capital letter y with diaeresis
|
212
|
-
402 => "fnof", # Latin small letter f with hook
|
213
|
-
710 => "circ", # modifier letter circumflex accent
|
214
|
-
732 => "tilde", # small tilde
|
215
|
-
913 => "Alpha", # Greek capital letter alpha
|
216
|
-
914 => "Beta", # Greek capital letter beta
|
217
|
-
915 => "Gamma", # Greek capital letter gamma
|
218
|
-
916 => "Delta", # Greek capital letter delta
|
219
|
-
917 => "Epsilon", # Greek capital letter epsilon
|
220
|
-
918 => "Zeta", # Greek capital letter zeta
|
221
|
-
919 => "Eta", # Greek capital letter eta
|
222
|
-
920 => "Theta", # Greek capital letter theta
|
223
|
-
921 => "Iota", # Greek capital letter iota
|
224
|
-
922 => "Kappa", # Greek capital letter kappa
|
225
|
-
923 => "Lambda", # Greek capital letter lambda
|
226
|
-
924 => "Mu", # Greek capital letter mu
|
227
|
-
925 => "Nu", # Greek capital letter nu
|
228
|
-
926 => "Xi", # Greek capital letter xi
|
229
|
-
927 => "Omicron", # Greek capital letter omicron
|
230
|
-
928 => "Pi", # Greek capital letter pi
|
231
|
-
929 => "Rho", # Greek capital letter rho
|
232
|
-
931 => "Sigma", # Greek capital letter sigma
|
233
|
-
932 => "Tau", # Greek capital letter tau
|
234
|
-
933 => "Upsilon", # Greek capital letter upsilon
|
235
|
-
934 => "Phi", # Greek capital letter phi
|
236
|
-
935 => "Chi", # Greek capital letter chi
|
237
|
-
936 => "Psi", # Greek capital letter psi
|
238
|
-
937 => "Omega", # Greek capital letter omega
|
239
|
-
945 => "alpha", # Greek small letter alpha
|
240
|
-
946 => "beta", # Greek small letter beta
|
241
|
-
947 => "gamma", # Greek small letter gamma
|
242
|
-
948 => "delta", # Greek small letter delta
|
243
|
-
949 => "epsilon", # Greek small letter epsilon
|
244
|
-
950 => "zeta", # Greek small letter zeta
|
245
|
-
951 => "eta", # Greek small letter eta
|
246
|
-
952 => "theta", # Greek small letter theta
|
247
|
-
953 => "iota", # Greek small letter iota
|
248
|
-
954 => "kappa", # Greek small letter kappa
|
249
|
-
955 => "lambda", # Greek small letter lambda
|
250
|
-
956 => "mu", # Greek small letter mu
|
251
|
-
957 => "nu", # Greek small letter nu
|
252
|
-
958 => "xi", # Greek small letter xi
|
253
|
-
959 => "omicron", # Greek small letter omicron
|
254
|
-
960 => "pi", # Greek small letter pi
|
255
|
-
961 => "rho", # Greek small letter rho
|
256
|
-
962 => "sigmaf", # Greek small letter final sigma
|
257
|
-
963 => "sigma", # Greek small letter sigma
|
258
|
-
964 => "tau", # Greek small letter tau
|
259
|
-
965 => "upsilon", # Greek small letter upsilon
|
260
|
-
966 => "phi", # Greek small letter phi
|
261
|
-
967 => "chi", # Greek small letter chi
|
262
|
-
968 => "psi", # Greek small letter psi
|
263
|
-
969 => "omega", # Greek small letter omega
|
264
|
-
977 => "thetasym", # Greek theta symbol
|
265
|
-
978 => "upsih", # Greek upsilon with hook symbol
|
266
|
-
982 => "piv", # Greek pi symbol
|
267
|
-
8194 => "ensp", # en space
|
268
|
-
8195 => "emsp", # em space
|
269
|
-
8201 => "thinsp", # thin space
|
270
|
-
8204 => "zwnj", # zero width non-joiner
|
271
|
-
8205 => "zwj", # zero width joiner
|
272
|
-
8206 => "lrm", # left-to-right mark
|
273
|
-
8207 => "rlm", # right-to-left mark
|
274
|
-
8211 => "ndash", # en dash
|
275
|
-
8212 => "mdash", # em dash
|
276
|
-
8216 => "lsquo", # left single quotation mark
|
277
|
-
8217 => "rsquo", # right single quotation mark
|
278
|
-
8218 => "sbquo", # single low-9 quotation mark
|
279
|
-
8220 => "ldquo", # left double quotation mark
|
280
|
-
8221 => "rdquo", # right double quotation mark
|
281
|
-
8222 => "bdquo", # double low-9 quotation mark
|
282
|
-
8224 => "dagger", # dagger
|
283
|
-
8225 => "Dagger", # double dagger
|
284
|
-
8226 => "bull", # bullet
|
285
|
-
8230 => "hellip", # horizontal ellipsis
|
286
|
-
8240 => "permil", # per mille sign
|
287
|
-
8242 => "prime", # prime
|
288
|
-
8243 => "Prime", # double prime
|
289
|
-
8249 => "lsaquo", # single left-pointing angle quotation mark
|
290
|
-
8250 => "rsaquo", # single right-pointing angle quotation mark
|
291
|
-
8254 => "oline", # overline
|
292
|
-
8260 => "frasl", # fraction slash
|
293
|
-
8364 => "euro", # euro sign
|
294
|
-
8465 => "image", # black-letter capital i
|
295
|
-
8472 => "weierp", # script capital pXCOMMAX Weierstrass p
|
296
|
-
8476 => "real", # black-letter capital r
|
297
|
-
8482 => "trade", # trademark sign
|
298
|
-
8501 => "alefsym", # alef symbol
|
299
|
-
8592 => "larr", # leftwards arrow
|
300
|
-
8593 => "uarr", # upwards arrow
|
301
|
-
8594 => "rarr", # rightwards arrow
|
302
|
-
8595 => "darr", # downwards arrow
|
303
|
-
8596 => "harr", # left right arrow
|
304
|
-
8629 => "crarr", # downwards arrow with corner leftwards
|
305
|
-
8656 => "lArr", # leftwards double arrow
|
306
|
-
8657 => "uArr", # upwards double arrow
|
307
|
-
8658 => "rArr", # rightwards double arrow
|
308
|
-
8659 => "dArr", # downwards double arrow
|
309
|
-
8660 => "hArr", # left right double arrow
|
310
|
-
8704 => "forall", # for all
|
311
|
-
8706 => "part", # partial differential
|
312
|
-
8707 => "exist", # there exists
|
313
|
-
8709 => "empty", # empty set
|
314
|
-
8711 => "nabla", # nabla
|
315
|
-
8712 => "isin", # element of
|
316
|
-
8713 => "notin", # not an element of
|
317
|
-
8715 => "ni", # contains as member
|
318
|
-
8719 => "prod", # n-ary product
|
319
|
-
8721 => "sum", # n-ary summation
|
320
|
-
8722 => "minus", # minus sign
|
321
|
-
8727 => "lowast", # asterisk operator
|
322
|
-
8730 => "radic", # square root
|
323
|
-
8733 => "prop", # proportional to
|
324
|
-
8734 => "infin", # infinity
|
325
|
-
8736 => "ang", # angle
|
326
|
-
8743 => "and", # logical and
|
327
|
-
8744 => "or", # logical or
|
328
|
-
8745 => "cap", # intersection
|
329
|
-
8746 => "cup", # union
|
330
|
-
8747 => "int", # integral
|
331
|
-
8756 => "there4", # therefore
|
332
|
-
8764 => "sim", # tilde operator
|
333
|
-
8773 => "cong", # congruent to
|
334
|
-
8776 => "asymp", # almost equal to
|
335
|
-
8800 => "ne", # not equal to
|
336
|
-
8801 => "equiv", # identical toXCOMMAX equivalent to
|
337
|
-
8804 => "le", # less-than or equal to
|
338
|
-
8805 => "ge", # greater-than or equal to
|
339
|
-
8834 => "sub", # subset of
|
340
|
-
8835 => "sup", # superset of
|
341
|
-
8836 => "nsub", # not a subset of
|
342
|
-
8838 => "sube", # subset of or equal to
|
343
|
-
8839 => "supe", # superset of or equal to
|
344
|
-
8853 => "oplus", # circled plus
|
345
|
-
8855 => "otimes", # circled times
|
346
|
-
8869 => "perp", # up tack
|
347
|
-
8901 => "sdot", # dot operator
|
348
|
-
8968 => "lceil", # left ceiling
|
349
|
-
8969 => "rceil", # right ceiling
|
350
|
-
8970 => "lfloor", # left floor
|
351
|
-
8971 => "rfloor", # right floor
|
352
|
-
9001 => "lang", # left-pointing angle bracket
|
353
|
-
9002 => "rang", # right-pointing angle bracket
|
354
|
-
9674 => "loz", # lozenge
|
355
|
-
9824 => "spades", # black spade suit
|
356
|
-
9827 => "clubs", # black club suit
|
357
|
-
9829 => "hearts", # black heart suit
|
358
|
-
9830 => "diams" # black diamond suit
|
359
|
-
}.freeze
|
360
|
-
|
361
|
-
# Allowed URL schemes
|
362
|
-
#
|
363
|
-
# @since 0.4.0
|
364
|
-
# @api private
|
365
|
-
#
|
366
|
-
# @see Hanami::Utils::Escape.url
|
367
|
-
DEFAULT_URL_SCHEMES = %w[http https mailto].freeze
|
368
|
-
|
369
|
-
# The output of an escape.
|
370
|
-
#
|
371
|
-
# It's marked with this special class for two reasons:
|
372
|
-
#
|
373
|
-
# * Don't double escape the same string (this is for `Hanami::Helpers`
|
374
|
-
# compatibility)
|
375
|
-
# * Leave open the possibility to developers to mark a string as safe
|
376
|
-
# with an higher API (eg. `#raw` in `Hanami::View` or `Hanami::Helpers`)
|
377
|
-
#
|
378
|
-
# @since 0.4.0
|
379
|
-
# @api private
|
380
|
-
class SafeString < ::String
|
381
|
-
# @return [SafeString] the duped string
|
382
|
-
#
|
383
|
-
# @since 0.4.0
|
384
|
-
# @api private
|
385
|
-
#
|
386
|
-
# @see http://www.ruby-doc.org/core/String.html#method-i-to_s
|
387
|
-
def to_s
|
388
|
-
dup
|
389
|
-
end
|
390
|
-
|
391
|
-
# Encode the string the given encoding
|
392
|
-
#
|
393
|
-
# @return [SafeString] an encoded SafeString
|
394
|
-
#
|
395
|
-
# @since 0.4.0
|
396
|
-
# @api private
|
397
|
-
#
|
398
|
-
# @see http://www.ruby-doc.org/core/String.html#method-i-encode
|
399
|
-
def encode(*args)
|
400
|
-
self.class.new super
|
401
|
-
end
|
402
|
-
end
|
403
|
-
|
404
|
-
# Escapes HTML contents
|
405
|
-
#
|
406
|
-
# This MUST be used only for tag contents.
|
407
|
-
# Please use `html_attribute` for escaping HTML attributes.
|
408
|
-
#
|
409
|
-
# @param input [String] the input
|
410
|
-
#
|
411
|
-
# @return [String] the escaped string
|
412
|
-
#
|
413
|
-
# @since 0.4.0
|
414
|
-
#
|
415
|
-
# @see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet OWASP XSS Cheat Sheet Rule #1
|
416
|
-
#
|
417
|
-
# @example Good practice
|
418
|
-
# <div><%= Hanami::Utils::Escape.html('<script>alert(1);</script>') %></div>
|
419
|
-
# <div><script>alert(1);</script></div>
|
420
|
-
#
|
421
|
-
# @example Bad practice
|
422
|
-
# # WRONG Use Escape.html_attribute instead
|
423
|
-
# <a title="<%= Hanami::Utils::Escape.html('...') %>">link</a>
|
424
|
-
def self.html(input)
|
425
|
-
input = encode(input)
|
426
|
-
return input if input.is_a?(SafeString)
|
427
|
-
|
428
|
-
result = SafeString.new
|
429
|
-
|
430
|
-
input.each_char do |chr|
|
431
|
-
result << HTML_CHARS.fetch(chr, chr)
|
432
|
-
end
|
433
|
-
|
434
|
-
result
|
435
|
-
end
|
436
|
-
|
437
|
-
# Escapes HTML attributes
|
438
|
-
#
|
439
|
-
# This can be used both for HTML attributes and contents.
|
440
|
-
# Please note that this is more computational expensive.
|
441
|
-
# If you need to escape only HTML contents, please use `.html`.
|
442
|
-
#
|
443
|
-
# @param input [String] the input
|
444
|
-
#
|
445
|
-
# @return [String] the escaped string
|
446
|
-
#
|
447
|
-
# @since 0.4.0
|
448
|
-
#
|
449
|
-
# @see https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet OWASP XSS Cheat Sheet Rule #2
|
450
|
-
#
|
451
|
-
# @example Good practice
|
452
|
-
# <a title="<%= Hanami::Utils::Escape.html_attribute('...') %>">link</a>
|
453
|
-
#
|
454
|
-
# @example Good but expensive practice
|
455
|
-
# # Alternatively you can use Escape.html
|
456
|
-
# <p><%= Hanami::Utils::Escape.html_attribute('...') %></p>
|
457
|
-
def self.html_attribute(input)
|
458
|
-
input = encode(input)
|
459
|
-
return input if input.is_a?(SafeString)
|
460
|
-
|
461
|
-
result = SafeString.new
|
462
|
-
|
463
|
-
input.each_char do |chr|
|
464
|
-
result << encode_char(chr, HTML_ATTRIBUTE_SAFE_CHARS)
|
465
|
-
end
|
466
|
-
|
467
|
-
result
|
468
|
-
end
|
469
|
-
|
470
|
-
# Escapes URL for HTML attributes (href, src, etc..).
|
471
|
-
#
|
472
|
-
# It extracts from the given input the first valid URL that matches the
|
473
|
-
# whitelisted schemes (default: http, https and mailto).
|
474
|
-
#
|
475
|
-
# It's possible to pass a second optional argument to specify different
|
476
|
-
# schemes.
|
477
|
-
#
|
478
|
-
# @param input [String] the input
|
479
|
-
# @param schemes [Array<String>] an array of whitelisted schemes
|
480
|
-
#
|
481
|
-
# @return [String] the escaped string
|
482
|
-
#
|
483
|
-
# @since 0.4.0
|
484
|
-
#
|
485
|
-
# @see Hanami::Utils::Escape::DEFAULT_URL_SCHEMES
|
486
|
-
# @see http://www.ruby-doc.org/stdlib/libdoc/uri/rdoc/URI.html#method-c-extract
|
487
|
-
#
|
488
|
-
# @example Basic usage
|
489
|
-
# <%
|
490
|
-
# good_input = "http://hanamirb.org"
|
491
|
-
# evil_input = "javascript:alert('xss')"
|
492
|
-
#
|
493
|
-
# escaped_good_input = Hanami::Utils::Escape.url(good_input) # => "http://hanamirb.org"
|
494
|
-
# escaped_evil_input = Hanami::Utils::Escape.url(evil_input) # => ""
|
495
|
-
# %>
|
496
|
-
#
|
497
|
-
# <a href="<%= escaped_good_input %>">personal website</a>
|
498
|
-
# <a href="<%= escaped_evil_input %>">personal website</a>
|
499
|
-
#
|
500
|
-
# @example Custom scheme
|
501
|
-
# <%
|
502
|
-
# schemes = ['ftp', 'ftps']
|
503
|
-
#
|
504
|
-
# accepted = "ftps://ftp.example.org"
|
505
|
-
# rejected = "http://www.example.org"
|
506
|
-
#
|
507
|
-
# escaped_accepted = Hanami::Utils::Escape.url(accepted) # => "ftps://ftp.example.org"
|
508
|
-
# escaped_rejected = Hanami::Utils::Escape.url(rejected) # => ""
|
509
|
-
# %>
|
510
|
-
#
|
511
|
-
# <a href="<%= escaped_accepted %>">FTP</a>
|
512
|
-
# <a href="<%= escaped_rejected %>">FTP</a>
|
513
|
-
def self.url(input, schemes = DEFAULT_URL_SCHEMES)
|
514
|
-
input = encode(input)
|
515
|
-
return input if input.is_a?(SafeString)
|
516
|
-
|
517
|
-
SafeString.new(
|
518
|
-
URI::DEFAULT_PARSER.extract(
|
519
|
-
URI.decode_www_form_component(input),
|
520
|
-
schemes
|
521
|
-
).first.to_s
|
522
|
-
)
|
523
|
-
end
|
524
|
-
|
525
|
-
class << self
|
526
|
-
private
|
527
|
-
|
528
|
-
# Encodes the given string into UTF-8
|
529
|
-
#
|
530
|
-
# @param input [String] the input
|
531
|
-
#
|
532
|
-
# @return [String] an UTF-8 encoded string
|
533
|
-
#
|
534
|
-
# @since 0.4.0
|
535
|
-
# @api private
|
536
|
-
def encode(input)
|
537
|
-
return "" if input.nil?
|
538
|
-
|
539
|
-
input.to_s.encode(Encoding::UTF_8)
|
540
|
-
rescue Encoding::UndefinedConversionError
|
541
|
-
input.dup.force_encoding(Encoding::UTF_8)
|
542
|
-
end
|
543
|
-
|
544
|
-
# Encode the given UTF-8 char.
|
545
|
-
#
|
546
|
-
# @param char [String] an UTF-8 char
|
547
|
-
# @param safe_chars [Hash] a table of safe chars
|
548
|
-
#
|
549
|
-
# @return [String] an HTML encoded string
|
550
|
-
#
|
551
|
-
# @since 0.4.0
|
552
|
-
# @api private
|
553
|
-
def encode_char(char, safe_chars = {})
|
554
|
-
return char if safe_chars[char]
|
555
|
-
|
556
|
-
code = char.ord
|
557
|
-
hex = hex_for_non_alphanumeric_code(code)
|
558
|
-
return char if hex.nil?
|
559
|
-
|
560
|
-
hex = REPLACEMENT_HEX if NON_PRINTABLE_CHARS[code]
|
561
|
-
|
562
|
-
if entity = HTML_ENTITIES[code]
|
563
|
-
"&#{entity};"
|
564
|
-
else
|
565
|
-
"&#x#{hex};"
|
566
|
-
end
|
567
|
-
end
|
568
|
-
|
569
|
-
# Transforms the given char code
|
570
|
-
#
|
571
|
-
# @since 0.4.0
|
572
|
-
# @api private
|
573
|
-
def hex_for_non_alphanumeric_code(input)
|
574
|
-
if input < LOW_HEX_CODE_LIMIT
|
575
|
-
HEX_CODES[input]
|
576
|
-
else
|
577
|
-
input.to_s(HEX_BASE)
|
578
|
-
end
|
579
|
-
end
|
580
|
-
end
|
581
|
-
end
|
582
|
-
end
|
583
|
-
end
|