inline_forms 8.1.55 → 8.1.57

data/test/integration/list_params_test.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Request params that end up in a list's markup.
+#
+# * parent_class / parent_id: _list built the nested frame as
+#   `raw "<turbo-frame id=\"#{update_span}\" …>"` with update_span made from
+#   params[:parent_id], and constantized params[:parent_class]; nothing found
+#   the parent before the render, so a crafted parent_id was reflected into
+#   the page. The controller now refuses malformed parent params (400) in
+#   index/new/create/show, and the frame is built with tag.turbo_frame.
+# * pagination: the page links carry every filter of the query string, not
+#   just `search`.
+#
+# Part and DailyReport belong to Machine; Widget is a top-level list
+# (per_page 7, see ApplicationRecord).
+class ListParamsTest < InlineFormsIntegrationTestCase
+  PAYLOAD = %("><img src=x onerror=alert(1)>)
+
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @part = Part.create!(name: "Gear", machine: @machine)
+    @list_frame = "machine_#{@machine.id}_parts_list"
+  end
+
+  def assert_refused_without_payload
+    assert_response :bad_request
+    assert controller.instance_variable_defined?(:@_authorized),
+      "the refusal runs after authorization (check_authorization stays satisfied)"
+    refute_includes response.body, "<img"
+  end
+
+  def nested(parent_id: @machine.id, parent_class: "Machine", update: @list_frame)
+    { parent_class: parent_class, parent_id: parent_id, update: update, ul_needed: 1 }
+  end
+
+  # ---- malformed parent params --------------------------------------------
+
+  test "a crafted parent_id on the nested list is a 400 and never rendered" do
+    get parts_path(nested(parent_id: PAYLOAD, update: "x")), headers: frame_headers("x")
+    assert_refused_without_payload
+  end
+
+  test "a crafted parent_id is refused on a full-page visit too" do
+    get parts_path(nested(parent_id: PAYLOAD, update: "x"))
+    assert_refused_without_payload
+  end
+
+  test "a parent_class that is not an association of the model is a 400" do
+    %w[Widget Kernel machine Machines ActiveRecord::Base].each do |parent_class|
+      get parts_path(nested(parent_class: parent_class)), headers: frame_headers(@list_frame)
+      assert_response :bad_request, "parent_class=#{parent_class}"
+    end
+  end
+
+  test "a non-integer parent_id is a 400, with or without parent_class" do
+    [ "1 OR 1=1", "-1", "1.5", "" ].each do |parent_id|
+      get parts_path(nested(parent_id: parent_id)), headers: frame_headers(@list_frame)
+      assert_response :bad_request, "parent_id=#{parent_id.inspect}"
+    end
+    get parts_path(parent_id: PAYLOAD, update: "x")
+    assert_refused_without_payload
+  end
+
+  test "new with crafted parent params is a 400" do
+    get new_part_path(nested(parent_id: PAYLOAD, update: "machine_#{@machine.id}_parts")),
+        headers: frame_headers("machine_#{@machine.id}_parts")
+    assert_refused_without_payload
+
+    get new_part_path(nested(parent_class: "Widget", update: "machine_#{@machine.id}_parts")),
+        headers: frame_headers("machine_#{@machine.id}_parts")
+    assert_response :bad_request
+  end
+
+  test "create with crafted parent params is a 400 and creates nothing" do
+    frame = "machine_#{@machine.id}_parts"
+    assert_no_difference -> { Part.count } do
+      post parts_path(nested(parent_id: PAYLOAD, update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+      assert_refused_without_payload
+      post parts_path(nested(parent_class: "Widget", update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+      assert_response :bad_request
+    end
+  end
+
+  test "show with a crafted parent_id is a 400" do
+    row = "machine_#{@machine.id}_part_#{@part.id}"
+    get part_path(@part, update: row, parent_class: "Machine", parent_id: PAYLOAD), headers: frame_headers(row)
+    assert_refused_without_payload
+  end
+
+  # ---- well-formed nested lists still work --------------------------------
+
+  test "a well-formed nested list renders its frame and rows" do
+    get parts_path(nested), headers: frame_headers(@list_frame)
+
+    assert_response :success
+    assert_includes response.body, %(<turbo-frame id="#{@list_frame}" class="list_container">)
+    assert_includes response.body, "Gear"
+  end
+
+  test "well-formed nested new and create still work" do
+    frame = "machine_#{@machine.id}_parts"
+    get new_part_path(nested(update: frame)), headers: frame_headers(frame)
+    assert_response :success
+
+    assert_difference -> { @machine.parts.count }, 1 do
+      post parts_path(nested(update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+    end
+    assert_response :success
+  end
+
+  test "the nested list of a not_accessible_through_html? child still renders" do
+    DailyReport.create!(name: "Monday", machine: @machine)
+    frame = "machine_#{@machine.id}_daily_reports_list"
+    get daily_reports_path(parent_class: "Machine", parent_id: @machine.id, update: frame, ul_needed: 1),
+        headers: frame_headers(frame)
+
+    assert_response :success
+    assert_includes response.body, "Monday"
+  end
+
+  test "the list frame id is attribute-escaped by the partial itself" do
+    html = PartsController.render(
+      partial: "inline_forms/list",
+      assigns: { Klass: Part, parent_class: "Machine", parent_id: PAYLOAD, ul_needed: "1",
+                 objects: Part.where(id: @part.id).paginate(page: 1) }
+    )
+
+    refute_includes html, "<img"
+    assert_includes html, %(<turbo-frame id="machine_&quot;&gt;&lt;img src=x onerror=alert(1)&gt;_parts_list" class="list_container">)
+  end
+
+  # ---- pagination keeps the filters ---------------------------------------
+
+  test "page links of a filtered list carry every filter" do
+    9.times { |i| Widget.create!(name: "Match #{i}") }
+    Widget.create!(name: "Other")
+
+    get widgets_path(search: "Match", sorteer: "name", first_name: "An", group: { id: 3 }, status: { id: 4 },
+                     update: "widgets_list"),
+        headers: frame_headers("widgets_list")
+
+    assert_response :success
+    page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+    assert page_link, "a link to page 2"
+    query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(page_link)).query)
+    assert_equal "Match", query["search"]
+    assert_equal "name", query["sorteer"]
+    assert_equal "An", query["first_name"]
+    assert_equal({ "id" => "3" }, query["group"])
+    assert_equal({ "id" => "4" }, query["status"])
+    assert_equal "widgets_list", query["update"]
+    assert_equal "2", query["page"]
+
+    get CGI.unescapeHTML(page_link), headers: frame_headers("widgets_list")
+    assert_response :success
+    back = response.body[/href="([^"]*page=1[^"]*)"/, 1]
+    assert back, "a link back to page 1"
+    back_query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(back)).query)
+    assert_equal "Match", back_query["search"]
+    assert_equal({ "id" => "3" }, back_query["group"])
+    refute_includes response.body, "Other"
+  end
+
+  test "page links of a list rendered after create keep the request's filters" do
+    9.times { |i| Machine.create!(name: "Match #{i}") }
+
+    post machines_path(update: "machines_list", search: "Match", sorteer: "name"),
+         params: { name: "Match 9" }, headers: frame_headers("machines_list")
+
+    assert_response :success
+    page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+    assert page_link, "a link to page 2"
+    query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(page_link)).query)
+    assert_equal "Match", query["search"]
+    assert_equal "name", query["sorteer"]
+  end
+
+  # url_for options in the query string must not shape the page links.
+  # will_paginate leaves out script_name / original_script_name; merging
+  # request.query_parameters into the links bypassed that, so the payload
+  # became the start of every page link's href, and controller= raised.
+  test "url options in the query string never reach the page links" do
+    9.times { |i| Widget.create!(name: "W #{i}") }
+
+    %w[script_name original_script_name].each do |option|
+      get "/widgets?update=widgets_list&#{option}=javascript:alert(1)//", headers: frame_headers("widgets_list")
+      assert_response :success
+      page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+      assert page_link, "a link to page 2"
+      assert page_link.start_with?("/widgets?"), "#{option} shaped the page link: #{page_link}"
+      refute_includes response.body, "javascript:alert"
+    end
+
+    get "/widgets?update=widgets_list&controller=widgets_x", headers: frame_headers("widgets_list")
+    assert_response :success
+    assert_match %r{href="/widgets\?[^"]*page=2}, response.body
+  end
+end

data/test/integration/locale_test.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# The gem's own strings resolve in en and nl, also under
+# raise_on_missing_translations (StProject switched to :nl with :strict):
+# the create flash (`success`, misspelled `succes` in both locale files), the
+# versions panel (was hard-coded English), the nl view keys that were missing
+# (restore, list_versions, close_versions_list, undelete), localized version
+# timestamps, the Devise layout's lang and the sign-in button.
+class LocaleTest < InlineFormsIntegrationTestCase
+  KEYS = %w[
+    success
+    inline_forms.view.restore inline_forms.view.list_versions inline_forms.view.close_versions_list
+    inline_forms.view.undelete inline_forms.view.versions inline_forms.view.versions_event
+    inline_forms.view.versions_when inline_forms.view.versions_done_by inline_forms.view.versions_changeset
+    inline_forms.view.versions_old_value inline_forms.view.versions_new_value inline_forms.view.versions_empty
+    inline_forms.view.versions_rich_text inline_forms.view.version_events.create
+    inline_forms.view.version_events.update inline_forms.view.version_events.destroy
+    inline_forms.devise.login common.more common.logout
+  ].freeze
+
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @machine.update!(name: "Press 2")
+  end
+
+  teardown do
+    I18n.backend.reload!
+  end
+
+  # Every translation the request looks up must exist: a missing one raises,
+  # in the views and in the controller (create's flash).
+  def strictly(locale)
+    original_view = ActionView::Helpers::TranslationHelper.raise_on_missing_translations
+    original_handler = I18n.exception_handler
+    original_default = I18n.default_locale
+    ActionView::Helpers::TranslationHelper.raise_on_missing_translations = true
+    I18n.exception_handler = ->(exception, *) { raise exception.respond_to?(:to_exception) ? exception.to_exception : exception }
+    # with_locale first: it restores the locale it found, so the thread's
+    # locale must not be read after default_locale changed (it would then
+    # restore :nl for every later test).
+    I18n.with_locale(locale) do
+      I18n.default_locale = locale
+      yield
+    end
+  ensure
+    I18n.default_locale = original_default
+    ActionView::Helpers::TranslationHelper.raise_on_missing_translations = original_view
+    I18n.exception_handler = original_handler
+  end
+
+  test "the gem's keys exist in en and nl, and the misspelled succes is gone" do
+    %i[en nl].each do |locale|
+      KEYS.each { |key| assert I18n.exists?(key, locale), "#{locale}.#{key}" }
+      refute I18n.exists?("succes", locale), "#{locale}.succes"
+    end
+    assert_equal "Machine created.", I18n.t("success", message: "Machine", locale: :en)
+    assert_equal "Machine is aangemaakt.", I18n.t("success", message: "Machine", locale: :nl)
+  end
+
+  test "create's success flash translates in nl" do
+    # The model top bar shows t(controller_name): host-supplied, like
+    # StProject's `clients: cliënten`.
+    I18n.backend.store_translations(:nl, machines: "machines")
+    strictly(:nl) do
+      post machines_path(update: "machines_list"), params: { name: "Lathe" }, headers: frame_headers("machines_list")
+    end
+
+    assert_response :success
+    assert_equal "Machine is aangemaakt.", controller.flash[:success]
+  end
+
+  test "the versions panel and list are translated, with localized timestamps" do
+    row = "machine_#{@machine.id}"
+    strictly(:nl) do
+      get machine_path(@machine, update: row), headers: frame_headers(row)
+      assert_response :success
+      assert_includes response.body, "Versies (2)"
+
+      get list_versions_machine_path(@machine, update: row), headers: frame_headers(row)
+    end
+
+    assert_response :success
+    body = response.body
+    %w[Versies Gebeurtenis Wanneer Door Wijzigingen aangemaakt gewijzigd terugzetten].each do |text|
+      assert_includes body, text
+    end
+    refute_includes body, "<strong>Event</strong>"
+    version = @machine.versions.last
+    assert_includes body, ERB::Util.h(I18n.l(version.created_at, format: :short, locale: :nl))
+  end
+
+  test "the versions list in en keeps its English labels" do
+    row = "machine_#{@machine.id}"
+    strictly(:en) do
+      get list_versions_machine_path(@machine, update: row), headers: frame_headers(row)
+    end
+
+    assert_response :success
+    assert_includes response.body, "Versions (2)"
+    assert_includes response.body, "<strong>Event</strong>"
+    assert_includes response.body, "old value"
+  end
+
+  test "the devise and application layouts declare the page language" do
+    get widgets_path
+    I18n.with_locale(:nl) do
+      assert_includes controller.render_to_string(template: "stats/show", layout: "devise"), %(<html lang="nl">)
+      assert_includes controller.render_to_string(template: "stats/show", layout: "application"), %(<html lang="nl">)
+    end
+  end
+end

data/test/integration/presentation_escaping_test.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Model data that a helper concatenates into a string it marks html_safe must
+# be escaped first. info_list_show did `out << item._presentation`, so a
+# _presentation built from user input (StProject: User#name listed on a Role)
+# ran as markup on every page that showed the list (stored XSS). Same audit:
+# file_field_show (stored file name / url) and the rich-text changeset in the
+# versions list (was `raw`).
+class PresentationEscapingTest < InlineFormsIntegrationTestCase
+  MARKUP = "<img src=x onerror=alert(1)>"
+  ESCAPED = "&lt;img src=x onerror=alert(1)&gt;"
+
+  # A view context of a real request: helpers, can?, url helpers.
+  def view
+    @view ||= begin
+      get widgets_path
+      controller.view_context
+    end
+  end
+
+  test "info_list escapes each item's _presentation" do
+    machine = Machine.create!(name: "Press")
+    Part.create!(name: MARKUP, machine: machine)
+    Part.create!(name: "Gear", machine: machine)
+
+    html = view.info_list_show(machine, :parts)
+
+    refute_includes html, "<img"
+    assert_includes html, ESCAPED
+    assert_includes html, "Gear"
+    assert_includes html, "<div class='row", "the row markup itself is kept"
+  end
+
+  test "file_field escapes the stored file name and url" do
+    widget = Widget.create!(name: "Manual")
+    stored = Struct.new(:url, :path) do
+      def present? = true
+      def to_s = url
+    end.new(%(/uploads/x'><img src=x onerror=alert(1)>.pdf), %(/uploads/#{MARKUP}.pdf))
+    widget.define_singleton_method(:manual) { stored }
+
+    html = view.file_field_show(widget, :manual)
+
+    refute_includes html, "<img"
+    assert_includes html, ESCAPED
+  end
+
+  test "dropdown_with_other and the list rows escape _presentation" do
+    kind = Kind.create!(name: MARKUP)
+    widget = Widget.create!(name: MARKUP, kind: kind)
+
+    refute_includes view.dropdown_with_other_show(widget, :kind), "<img"
+
+    get widgets_path(update: "widgets_list"), headers: frame_headers("widgets_list")
+    assert_response :success
+    refute_includes response.body, "<img"
+    assert_includes response.body, ESCAPED
+  end
+
+  test "a rich-text changeset in the versions list is sanitized, not raw" do
+    machine = Machine.create!(name: "Press")
+    version = Struct.new(:id, :event, :changeset, :created_at, :whodunnit) do
+      def to_param = id.to_s
+    end.new(1, "update", { "body" => [ "<p>old</p><script>alert(1)</script>", "<p>new</p>#{MARKUP}" ] }, Time.current, nil)
+    context = view
+    context.instance_variable_set(:@object, machine)
+    context.define_singleton_method(:inline_forms_history_for) do |_object|
+      [ { version: version, kind: :rich_text, rich_text_name: "description", at: version.created_at } ]
+    end
+
+    html = context.render(partial: "inline_forms/versions_list")
+
+    refute_includes html, "<script"
+    refute_includes html, "onerror"
+    assert_includes html, "<p>old</p>"
+    assert_includes html, "<p>new</p>"
+  end
+end

data/test/integration_test_helper.rb

@@ -49,6 +49,15 @@ ActiveRecord::Schema.define do
   end
   add_index :parts, :machine_id
 
+  # DailyReport: a not_accessible_through_html? child of Machine (shaped like
+  # StProject's Dagrapportage). See test/integration/html_refusal_test.rb.
+  create_table :daily_reports, force: true do |t|
+    t.string  :name
+    t.integer :machine_id
+    t.timestamps
+  end
+  add_index :daily_reports, :machine_id
+
   # Gizmo intentionally has NO `pending_note` column: its attribute_list
   # references one, modeling the inline_forms_addto pre-migrate window that
   # InlineForms.attribute_pending_migration? gates. See
@@ -163,9 +172,11 @@ class InlineFormsIntegrationTestCase < ActionDispatch::IntegrationTest
 
   setup do
     Ability.restrictions = nil
+    ApplicationController.dummy_user_superadmin = true
     Widget.delete_all
     Kind.delete_all
     Part.delete_all
+    DailyReport.delete_all
     Machine.delete_all
     Gizmo.delete_all
     Dossier.delete_all

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inline_forms
 version: !ruby/object:Gem::Version
-  version: 8.1.55
+  version: 8.1.57
 platform: ruby
 authors:
 - Ace Suares
@@ -153,7 +153,6 @@ files:
 - app/views/inline_forms/_close.html.erb
 - app/views/inline_forms/_edit.html.erb
 - app/views/inline_forms/_file_slot.html.erb
-- app/views/inline_forms/_flash.html.erb
 - app/views/inline_forms/_generic_search.html.erb
 - app/views/inline_forms/_header.html.erb
 - app/views/inline_forms/_list.html.erb
@@ -282,6 +281,7 @@ files:
 - test/archived_form_elements_test.rb
 - test/attribute_list_test.rb
 - test/dummy/app/controllers/application_controller.rb
+- test/dummy/app/controllers/daily_reports_controller.rb
 - test/dummy/app/controllers/documents_controller.rb
 - test/dummy/app/controllers/dossiers_controller.rb
 - test/dummy/app/controllers/gizmos_controller.rb
@@ -292,6 +292,7 @@ files:
 - test/dummy/app/helpers/application_helper.rb
 - test/dummy/app/models/ability.rb
 - test/dummy/app/models/application_record.rb
+- test/dummy/app/models/daily_report.rb
 - test/dummy/app/models/document.rb
 - test/dummy/app/models/dossier.rb
 - test/dummy/app/models/gizmo.rb
@@ -312,15 +313,20 @@ files:
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
+- test/integration/csp_nonce_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
+- test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
+- test/integration/list_params_test.rb
+- test/integration/locale_test.rb
 - test/integration/model_top_bar_test.rb
 - test/integration/native_inputs_test.rb
 - test/integration/open_after_create_test.rb
 - test/integration/pending_migration_gate_test.rb
+- test/integration/presentation_escaping_test.rb
 - test/integration/revert_skipped_columns_test.rb
 - test/integration/schema_batch_pipeline_test.rb
 - test/integration/schema_edit_test.rb
@@ -363,6 +369,7 @@ test_files:
 - test/archived_form_elements_test.rb
 - test/attribute_list_test.rb
 - test/dummy/app/controllers/application_controller.rb
+- test/dummy/app/controllers/daily_reports_controller.rb
 - test/dummy/app/controllers/documents_controller.rb
 - test/dummy/app/controllers/dossiers_controller.rb
 - test/dummy/app/controllers/gizmos_controller.rb
@@ -373,6 +380,7 @@ test_files:
 - test/dummy/app/helpers/application_helper.rb
 - test/dummy/app/models/ability.rb
 - test/dummy/app/models/application_record.rb
+- test/dummy/app/models/daily_report.rb
 - test/dummy/app/models/document.rb
 - test/dummy/app/models/dossier.rb
 - test/dummy/app/models/gizmo.rb
@@ -393,15 +401,20 @@ test_files:
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
+- test/integration/csp_nonce_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
+- test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
+- test/integration/list_params_test.rb
+- test/integration/locale_test.rb
 - test/integration/model_top_bar_test.rb
 - test/integration/native_inputs_test.rb
 - test/integration/open_after_create_test.rb
 - test/integration/pending_migration_gate_test.rb
+- test/integration/presentation_escaping_test.rb
 - test/integration/revert_skipped_columns_test.rb
 - test/integration/schema_batch_pipeline_test.rb
 - test/integration/schema_edit_test.rb

data/app/views/inline_forms/_flash.html.erb

@@ -1,13 +0,0 @@
-<% unless flash.empty? %>
-  <% identifier = Time.now.to_i.to_s %>
-  <div class="row" id="flash_<%= identifier %>">
-  <% flash.each do |key, value| %>
-    <%= value %>
-  <% end %>
-  <script>
-    $("#<%= "#{update_span}_auto_header" %>").ScrollTo();
-    $("#flash_<%= identifier %>").delay(1000).fadeToggle('2000');
-  </script>
-  </div>
-<% end %>
-