high_voltage 1.1.1 → 1.2.0

data/.gitignore

@@ -5,3 +5,5 @@ spec/dummy/db/*.sqlite3
 spec/dummy/log/*.log
 spec/dummy/tmp/
 *.swp
+gemfiles/*.lock
+*.gem

data/.travis.yml

@@ -1,3 +1,9 @@
+language: ruby
 rvm:
   - 1.8.7
   - 1.9.2
+  - 1.9.3
+gemfile:
+  - gemfiles/rails-3.0.12.gemfile
+  - gemfiles/rails-3.1.4.gemfile
+  - gemfiles/rails-3.2.3.gemfile

data/Appraisals

@@ -1,7 +1,5 @@
-appraise "rails-3.1.0" do
-  gem "rails", "3.1.0"
-end
-
-appraise "rails-3.0.10" do
-  gem "rails", "3.0.10"
+['3.2.6', '3.1.6', '3.0.15'].each do |rails_version|
+  appraise "rails-#{rails_version}" do
+    gem "rails", rails_version
+  end
 end

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    high_voltage (1.1.1)
+    high_voltage (1.2.0)
 
 GEM
   remote: http://rubygems.org/
@@ -22,7 +22,7 @@ GEM
       builder (~> 2.1.2)
       i18n (~> 0.5.0)
     activesupport (3.0.10)
-    appraisal (0.3.8)
+    appraisal (0.4.1)
       bundler
       rake
     builder (2.1.2)
@@ -55,7 +55,7 @@ GEM
       rake (>= 0.8.7)
       rdoc (~> 3.4)
       thor (~> 0.14.4)
-    rake (0.9.2)
+    rake (0.9.2.2)
     rdoc (3.9.4)
     rspec (2.6.0)
       rspec-core (~> 2.6.0)

data/Rakefile

@@ -1,14 +1,18 @@
 require 'bundler/setup'
 require 'bundler/gem_tasks'
 require 'appraisal'
-require 'rspec/core/rake_task'
 
+require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new(:spec)
 
-desc "Default: run the unit tests."
-task :default => [:all]
+task :default do |t|
+  if ENV['BUNDLE_GEMFILE'] =~ /gemfiles/
+    exec 'rake spec'
+  else
+    Rake::Task['appraise'].execute
+  end
+end
 
-desc 'Test the plugin under all supported Rails versions.'
-task :all => ["appraisal:install"] do |t|
-  exec('rake appraisal spec')
+task :appraise => ['appraisal:install'] do |t|
+  exec 'rake appraisal'
 end

data/app/controllers/high_voltage/pages_controller.rb

@@ -1,7 +1,8 @@
 class HighVoltage::PagesController < ApplicationController
+  VALID_CHARACTERS = "a-zA-Z0-9~!@$%^&*()#`_+-=<>\"{}|[];',?".freeze
 
   unloadable
-  layout Proc.new { |_| HighVoltage::layout }
+  layout Proc.new { |_| HighVoltage.layout }
 
   rescue_from ActionView::MissingTemplate do |exception|
     if exception.message =~ %r{Missing template #{content_path}}
@@ -22,12 +23,15 @@ class HighVoltage::PagesController < ApplicationController
     end
 
     def clean_path
-      path = Pathname.new "/#{params[:id]}"
+      path = Pathname.new("/#{clean_id}")
       path.cleanpath.to_s[1..-1]
     end
 
     def content_path
-      HighVoltage::content_path
+      HighVoltage.content_path
     end
 
+    def clean_id
+      params[:id].tr("^#{VALID_CHARACTERS}", '')
+    end
 end

data/config/routes.rb

@@ -1,4 +1,4 @@
 Rails.application.routes.draw do
-  match "/#{HighVoltage::content_path}*id" => 'high_voltage/pages#show', :as => :page, :format => false
+  match "/#{HighVoltage.content_path}*id" => 'high_voltage/pages#show', :as => :page, :format => false
 
 end

data/gemfiles/{rails-3.0.10.gemfile → rails-3.0.15.gemfile}

@@ -2,6 +2,6 @@
 
 source "http://rubygems.org"
 
-gem "rails", "3.0.10"
+gem "rails", "3.0.15"
 
 gemspec :path=>"../"

data/gemfiles/{rails-3.1.0.gemfile → rails-3.1.6.gemfile}

@@ -2,6 +2,6 @@
 
 source "http://rubygems.org"
 
-gem "rails", "3.1.0"
+gem "rails", "3.1.6"
 
 gemspec :path=>"../"

data/gemfiles/rails-3.2.6.gemfile

@@ -0,0 +1,7 @@
+# This file was generated by Appraisal
+
+source "http://rubygems.org"
+
+gem "rails", "3.2.6"
+
+gemspec :path=>"../"

data/lib/high_voltage/version.rb

@@ -1,3 +1,3 @@
 module HighVoltage
-  VERSION = '1.1.1'.freeze
+  VERSION = '1.2.0'.freeze
 end

data/spec/controllers/pages_controller_spec.rb

@@ -1,3 +1,5 @@
+# encoding: UTF-8
+
 require 'spec_helper'
 
 describe HighVoltage::PagesController do
@@ -43,12 +45,12 @@ describe HighVoltage::PagesController do
 
   context "using custom layout" do
     before(:all) do
-      @original_layout = HighVoltage::layout
-      HighVoltage::layout = "alternate"
+      @original_layout = HighVoltage.layout
+      HighVoltage.layout = "alternate"
     end
 
     after(:all) do
-      HighVoltage::layout = @original_layout
+      HighVoltage.layout = @original_layout
     end
 
     describe "on GET to /pages/exists" do
@@ -63,12 +65,12 @@ describe HighVoltage::PagesController do
 
   context "using custom content path" do
     before(:all) do
-      @original_content_path = HighVoltage::content_path
-      HighVoltage::content_path = "other_pages/"
+      @original_content_path = HighVoltage.content_path
+      HighVoltage.content_path = "other_pages/"
     end
 
     after(:all) do
-      HighVoltage::content_path = @original_content_path
+      HighVoltage.content_path = @original_content_path
     end
 
     describe "on GET to /other_pages/also_exists" do
@@ -97,6 +99,10 @@ describe HighVoltage::PagesController do
       lambda { get :show, :id => "../other/wrong" }.should raise_error(ActionController::RoutingError)
     end
 
+    it "should raise a routing error for a page in another directory when using a Unicode exploit" do
+      lambda { get :show, :id => "/\\../other/wrong" }.should raise_error(ActionController::RoutingError)
+    end
+
     it "should raise missing template error for valid page with invalid partial" do
       lambda { get :show, :id => "also_exists_but_references_nonexistent_partial" }.should raise_error(ActionView::MissingTemplate)
     end

data/spec/routing/routes_spec.rb

@@ -30,13 +30,13 @@ describe 'routes' do
   context "using a custom content_path" do
 
     before(:all) do
-      @original_content_path = HighVoltage::content_path
-      HighVoltage::content_path = "other_pages/"
+      @original_content_path = HighVoltage.content_path
+      HighVoltage.content_path = "other_pages/"
       Rails.application.reload_routes!
     end
 
     after(:all) do
-      HighVoltage::content_path = @original_content_path
+      HighVoltage.content_path = @original_content_path
       Rails.application.reload_routes!
     end
 

metadata

@@ -1,15 +1,10 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: high_voltage
-version: !ruby/object:Gem::Version 
-  hash: 17
+version: !ruby/object:Gem::Version
+  version: 1.2.0
   prerelease: 
-  segments: 
-  - 1
-  - 1
-  - 1
-  version: 1.1.1
 platform: ruby
-authors: 
+authors:
 - Matt Jankowski
 - Dan Croak
 - Nick Quaranto
@@ -22,77 +17,79 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2012-02-23 00:00:00 Z
-dependencies: 
-- !ruby/object:Gem::Dependency 
-  version_requirements: &id001 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
-  requirement: *id001
-  type: :development
-  prerelease: false
+date: 2012-08-27 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: appraisal
-- !ruby/object:Gem::Dependency 
-  version_requirements: &id002 !ruby/object:Gem::Requirement 
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
-  requirement: *id002
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
   type: :development
   prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
   name: rspec-rails
-- !ruby/object:Gem::Dependency 
-  version_requirements: &id003 !ruby/object:Gem::Requirement 
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 15
-        segments: 
-        - 0
-        - 4
-        - 0
-        version: 0.4.0
-  requirement: *id003
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
   type: :development
   prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
   name: capybara
-- !ruby/object:Gem::Dependency 
-  version_requirements: &id004 !ruby/object:Gem::Requirement 
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
-  requirement: *id004
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.4.0
   type: :development
   prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 0.4.0
+- !ruby/object:Gem::Dependency
   name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Fire in the disco.  Fire in the ... taco bell.
-email: 
+email:
 - support@thoughtbot.com
 executables: []
-
 extensions: []
-
 extra_rdoc_files: []
-
-files: 
+files:
 - .gitignore
 - .travis.yml
 - Appraisals
@@ -104,10 +101,9 @@ files:
 - Rakefile
 - app/controllers/high_voltage/pages_controller.rb
 - config/routes.rb
-- gemfiles/rails-3.0.10.gemfile
-- gemfiles/rails-3.0.10.gemfile.lock
-- gemfiles/rails-3.1.0.gemfile
-- gemfiles/rails-3.1.0.gemfile.lock
+- gemfiles/rails-3.0.15.gemfile
+- gemfiles/rails-3.1.6.gemfile
+- gemfiles/rails-3.2.6.gemfile
 - high_voltage.gemspec
 - lib/high_voltage.rb
 - lib/high_voltage/engine.rb
@@ -159,80 +155,32 @@ files:
 - spec/spec_helper.rb
 homepage: http://github.com/thoughtbot/high_voltage
 licenses: []
-
 post_install_message: 
 rdoc_options: []
-
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
+required_ruby_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+      segments:
       - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
+      hash: 2706060558663144713
+required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+      segments:
       - 0
-      version: "0"
+      hash: 2706060558663144713
 requirements: []
-
 rubyforge_project: 
-rubygems_version: 1.8.11
+rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: Simple static page rendering controller
-test_files: 
-- spec/controllers/pages_controller_spec.rb
-- spec/controllers/subclassed_pages_controller_spec.rb
-- spec/dummy/Rakefile
-- spec/dummy/app/controllers/application_controller.rb
-- spec/dummy/app/controllers/subclassed_pages_controller.rb
-- spec/dummy/app/helpers/application_helper.rb
-- spec/dummy/app/views/layouts/alternate.html.erb
-- spec/dummy/app/views/layouts/application.html.erb
-- spec/dummy/app/views/other/wrong.html.erb
-- spec/dummy/app/views/other_pages/also_dir/also_nested.html.erb
-- spec/dummy/app/views/other_pages/also_exists.html.erb
-- spec/dummy/app/views/other_pages/also_exists_but_references_nonexistent_partial.html.erb
-- spec/dummy/app/views/pages/dir/nested.html.erb
-- spec/dummy/app/views/pages/exists.html.erb
-- spec/dummy/app/views/pages/exists_but_references_nonexistent_partial.html.erb
-- spec/dummy/config.ru
-- spec/dummy/config/application.rb
-- spec/dummy/config/boot.rb
-- spec/dummy/config/environment.rb
-- spec/dummy/config/environments/development.rb
-- spec/dummy/config/environments/production.rb
-- spec/dummy/config/environments/test.rb
-- spec/dummy/config/initializers/backtrace_silencers.rb
-- spec/dummy/config/initializers/inflections.rb
-- spec/dummy/config/initializers/mime_types.rb
-- spec/dummy/config/initializers/secret_token.rb
-- spec/dummy/config/initializers/session_store.rb
-- spec/dummy/config/locales/en.yml
-- spec/dummy/config/routes.rb
-- spec/dummy/public/404.html
-- spec/dummy/public/422.html
-- spec/dummy/public/500.html
-- spec/dummy/public/favicon.ico
-- spec/dummy/public/javascripts/application.js
-- spec/dummy/public/javascripts/controls.js
-- spec/dummy/public/javascripts/dragdrop.js
-- spec/dummy/public/javascripts/effects.js
-- spec/dummy/public/javascripts/prototype.js
-- spec/dummy/public/javascripts/rails.js
-- spec/dummy/public/stylesheets/.gitkeep
-- spec/dummy/script/rails
-- spec/high_voltage_spec.rb
-- spec/integration/navigation_spec.rb
-- spec/routing/routes_spec.rb
-- spec/spec_helper.rb
+test_files: []

data/gemfiles/rails-3.0.10.gemfile.lock

@@ -1,124 +0,0 @@
-PATH
-  remote: /Users/jferris/Source/high_voltage
-  specs:
-    high_voltage (1.1.1)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    abstract (1.0.0)
-    actionmailer (3.0.10)
-      actionpack (= 3.0.10)
-      mail (~> 2.2.19)
-    actionpack (3.0.10)
-      activemodel (= 3.0.10)
-      activesupport (= 3.0.10)
-      builder (~> 2.1.2)
-      erubis (~> 2.6.6)
-      i18n (~> 0.5.0)
-      rack (~> 1.2.1)
-      rack-mount (~> 0.6.14)
-      rack-test (~> 0.5.7)
-      tzinfo (~> 0.3.23)
-    activemodel (3.0.10)
-      activesupport (= 3.0.10)
-      builder (~> 2.1.2)
-      i18n (~> 0.5.0)
-    activerecord (3.0.10)
-      activemodel (= 3.0.10)
-      activesupport (= 3.0.10)
-      arel (~> 2.0.10)
-      tzinfo (~> 0.3.23)
-    activeresource (3.0.10)
-      activemodel (= 3.0.10)
-      activesupport (= 3.0.10)
-    activesupport (3.0.10)
-    appraisal (0.3.8)
-      bundler
-      rake
-    arel (2.0.10)
-    builder (2.1.2)
-    capybara (1.1.0)
-      mime-types (>= 1.16)
-      nokogiri (>= 1.3.3)
-      rack (>= 1.0.0)
-      rack-test (>= 0.5.4)
-      selenium-webdriver (~> 2.0)
-      xpath (~> 0.1.4)
-    childprocess (0.2.2)
-      ffi (~> 1.0.6)
-    diff-lcs (1.1.3)
-    erubis (2.6.6)
-      abstract (>= 1.0.0)
-    ffi (1.0.9)
-    i18n (0.5.0)
-    json_pure (1.5.4)
-      spruz (~> 0.2.8)
-    mail (2.2.19)
-      activesupport (>= 2.3.6)
-      i18n (>= 0.4.0)
-      mime-types (~> 1.16)
-      treetop (~> 1.4.8)
-    mime-types (1.16)
-    nokogiri (1.5.0)
-    polyglot (0.3.2)
-    rack (1.2.3)
-    rack-mount (0.6.14)
-      rack (>= 1.0.0)
-    rack-test (0.5.7)
-      rack (>= 1.0)
-    rails (3.0.10)
-      actionmailer (= 3.0.10)
-      actionpack (= 3.0.10)
-      activerecord (= 3.0.10)
-      activeresource (= 3.0.10)
-      activesupport (= 3.0.10)
-      bundler (~> 1.0)
-      railties (= 3.0.10)
-    railties (3.0.10)
-      actionpack (= 3.0.10)
-      activesupport (= 3.0.10)
-      rake (>= 0.8.7)
-      rdoc (~> 3.4)
-      thor (~> 0.14.4)
-    rake (0.9.2)
-    rdoc (3.9.4)
-    rspec (2.6.0)
-      rspec-core (~> 2.6.0)
-      rspec-expectations (~> 2.6.0)
-      rspec-mocks (~> 2.6.0)
-    rspec-core (2.6.4)
-    rspec-expectations (2.6.0)
-      diff-lcs (~> 1.1.2)
-    rspec-mocks (2.6.0)
-    rspec-rails (2.6.1)
-      actionpack (~> 3.0)
-      activesupport (~> 3.0)
-      railties (~> 3.0)
-      rspec (~> 2.6.0)
-    rubyzip (0.9.4)
-    selenium-webdriver (2.5.0)
-      childprocess (>= 0.2.1)
-      ffi (>= 1.0.7)
-      json_pure
-      rubyzip
-    spruz (0.2.13)
-    sqlite3 (1.3.4)
-    thor (0.14.6)
-    treetop (1.4.10)
-      polyglot
-      polyglot (>= 0.3.1)
-    tzinfo (0.3.29)
-    xpath (0.1.4)
-      nokogiri (~> 1.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  appraisal
-  capybara (>= 0.4.0)
-  high_voltage!
-  rails (= 3.0.10)
-  rspec-rails
-  sqlite3

data/gemfiles/rails-3.1.0.gemfile.lock

@@ -1,137 +0,0 @@
-PATH
-  remote: /Users/jferris/Source/high_voltage
-  specs:
-    high_voltage (1.1.1)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    actionmailer (3.1.0)
-      actionpack (= 3.1.0)
-      mail (~> 2.3.0)
-    actionpack (3.1.0)
-      activemodel (= 3.1.0)
-      activesupport (= 3.1.0)
-      builder (~> 3.0.0)
-      erubis (~> 2.7.0)
-      i18n (~> 0.6)
-      rack (~> 1.3.2)
-      rack-cache (~> 1.0.3)
-      rack-mount (~> 0.8.2)
-      rack-test (~> 0.6.1)
-      sprockets (~> 2.0.0)
-    activemodel (3.1.0)
-      activesupport (= 3.1.0)
-      bcrypt-ruby (~> 3.0.0)
-      builder (~> 3.0.0)
-      i18n (~> 0.6)
-    activerecord (3.1.0)
-      activemodel (= 3.1.0)
-      activesupport (= 3.1.0)
-      arel (~> 2.2.1)
-      tzinfo (~> 0.3.29)
-    activeresource (3.1.0)
-      activemodel (= 3.1.0)
-      activesupport (= 3.1.0)
-    activesupport (3.1.0)
-      multi_json (~> 1.0)
-    appraisal (0.3.8)
-      bundler
-      rake
-    arel (2.2.1)
-    bcrypt-ruby (3.0.0)
-    builder (3.0.0)
-    capybara (1.1.0)
-      mime-types (>= 1.16)
-      nokogiri (>= 1.3.3)
-      rack (>= 1.0.0)
-      rack-test (>= 0.5.4)
-      selenium-webdriver (~> 2.0)
-      xpath (~> 0.1.4)
-    childprocess (0.2.2)
-      ffi (~> 1.0.6)
-    diff-lcs (1.1.3)
-    erubis (2.7.0)
-    ffi (1.0.9)
-    hike (1.2.1)
-    i18n (0.6.0)
-    json_pure (1.5.4)
-      spruz (~> 0.2.8)
-    mail (2.3.0)
-      i18n (>= 0.4.0)
-      mime-types (~> 1.16)
-      treetop (~> 1.4.8)
-    mime-types (1.16)
-    multi_json (1.0.3)
-    nokogiri (1.5.0)
-    polyglot (0.3.2)
-    rack (1.3.2)
-    rack-cache (1.0.3)
-      rack (>= 0.4)
-    rack-mount (0.8.3)
-      rack (>= 1.0.0)
-    rack-ssl (1.3.2)
-      rack
-    rack-test (0.6.1)
-      rack (>= 1.0)
-    rails (3.1.0)
-      actionmailer (= 3.1.0)
-      actionpack (= 3.1.0)
-      activerecord (= 3.1.0)
-      activeresource (= 3.1.0)
-      activesupport (= 3.1.0)
-      bundler (~> 1.0)
-      railties (= 3.1.0)
-    railties (3.1.0)
-      actionpack (= 3.1.0)
-      activesupport (= 3.1.0)
-      rack-ssl (~> 1.3.2)
-      rake (>= 0.8.7)
-      rdoc (~> 3.4)
-      thor (~> 0.14.6)
-    rake (0.9.2)
-    rdoc (3.9.4)
-    rspec (2.6.0)
-      rspec-core (~> 2.6.0)
-      rspec-expectations (~> 2.6.0)
-      rspec-mocks (~> 2.6.0)
-    rspec-core (2.6.4)
-    rspec-expectations (2.6.0)
-      diff-lcs (~> 1.1.2)
-    rspec-mocks (2.6.0)
-    rspec-rails (2.6.1)
-      actionpack (~> 3.0)
-      activesupport (~> 3.0)
-      railties (~> 3.0)
-      rspec (~> 2.6.0)
-    rubyzip (0.9.4)
-    selenium-webdriver (2.5.0)
-      childprocess (>= 0.2.1)
-      ffi (>= 1.0.7)
-      json_pure
-      rubyzip
-    sprockets (2.0.0)
-      hike (~> 1.2)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    spruz (0.2.13)
-    sqlite3 (1.3.4)
-    thor (0.14.6)
-    tilt (1.3.3)
-    treetop (1.4.10)
-      polyglot
-      polyglot (>= 0.3.1)
-    tzinfo (0.3.29)
-    xpath (0.1.4)
-      nokogiri (~> 1.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  appraisal
-  capybara (>= 0.4.0)
-  high_voltage!
-  rails (= 3.1.0)
-  rspec-rails
-  sqlite3