inline_forms 8.1.56 → 8.1.58

data/app/views/layouts/application.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html lang="<%= I18n.locale %>">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
@@ -11,6 +11,9 @@
     <%= stylesheet_link_tag "trix" %>
     <%= inline_forms_user_color_overrides_style %>
     <%= csrf_meta_tags %>
+    <%# Publishes the CSP nonce (nothing without a nonce generator) for the %>
+    <%# scripts Turbo inserts. %>
+    <%= csp_meta_tag %>
   </head>
 
   <body class="<%= inline_forms_body_theme_class %>">
@@ -19,10 +22,14 @@
     <%# Turbo (Hotwire) is loaded as an ES module so it does not collide with %>
     <%# the classic-script Sprockets bundle above. Drive uses the Turbo default %>
     <%# (enabled). %>
-    <script type="module">
+    <%# The nonce: hosts run a CSP with script-src 'nonce-…' (nil, so no %>
+    <%# attribute, without a nonce generator). data-turbo-eval="false": Turbo %>
+    <%# Drive must not re-run it on visits (Turbo is loaded; a re-inserted %>
+    <%# copy would carry a newer nonce the page's policy rejects). %>
+    <%= tag.script type: "module", nonce: content_security_policy_nonce, data: { turbo_eval: false } do %>
       import { Turbo } from "<%= asset_path('turbo.min.js') %>"
       window.Turbo = Turbo
-    </script>
+    <% end %>
     <%# Trix 2 (vendored; no CDN). Self-registers its custom elements on load. %>
     <%= javascript_include_tag "trix.min" %>
   </body>

data/app/views/layouts/devise.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html lang="<%= I18n.locale %>">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />

data/app/views/layouts/inline_forms.html.erb

@@ -14,6 +14,9 @@
     <%= stylesheet_link_tag "trix" %>
     <%= inline_forms_user_color_overrides_style %>
     <%= csrf_meta_tags %>
+    <%# Publishes the CSP nonce (nothing without a nonce generator) for the %>
+    <%# scripts Turbo inserts. %>
+    <%= csp_meta_tag %>
   </head>
 
   <body class="<%= inline_forms_body_theme_class %>">
@@ -40,10 +43,14 @@
     <%# Turbo (Hotwire) is loaded as an ES module so it does not collide with %>
     <%# the classic-script Sprockets bundle above. Drive stays at the default %>
     <%# (enabled); inline interactions use `<turbo-frame>` + HTML responses. %>
-    <script type="module">
+    <%# The nonce: hosts run a CSP with script-src 'nonce-…' (nil, so no %>
+    <%# attribute, without a nonce generator). data-turbo-eval="false": Turbo %>
+    <%# Drive must not re-run it on visits (Turbo is loaded; a re-inserted %>
+    <%# copy would carry a newer nonce the page's policy rejects). %>
+    <%= tag.script type: "module", nonce: content_security_policy_nonce, data: { turbo_eval: false } do %>
       import { Turbo } from "<%= asset_path('turbo.min.js') %>"
       window.Turbo = Turbo
-    </script>
+    <% end %>
     <%# Trix 2 (vendored; no CDN). Self-registers its custom elements on load. %>
     <%= javascript_include_tag "trix.min" %>
   </body>

data/lib/inline_forms/form_elements/dropdown_helper.rb

@@ -29,7 +29,7 @@ module InlineForms
       if klass.method_defined? :disabled_for_dropdown?
         options_disabled = values.map{|v| v.id if v.disabled_for_dropdown?}.compact
       end
-      values.sort_by {|v|v.send presentation}
+      values = values.sort_by {|v|v.send presentation}
       # the leading underscore is to avoid name conflicts, like 'email' and 'email_type' will result in 'email' and 'email[email_type_id]' in the form!
       collection_select( ('_' + object.class.to_s.underscore).to_sym,
                           attribute.to_s.foreign_key.to_sym,

data/lib/inline_forms/form_elements/file_field_helper.rb

@@ -9,7 +9,9 @@ module InlineForms
       o = object.send(attribute)
       msg = o.to_s
       if o.send(:present?)
-        msg = "replace | <a href='#{o.send(:url)}'>#{o.send(:path).gsub(/^.*\//,'')}</a>".html_safe
+        # The stored file name and url are data: escape them before the
+        # string is marked html_safe.
+        msg = "replace | <a href='#{ERB::Util.h(o.send(:url))}'>#{ERB::Util.h(o.send(:path).gsub(/^.*\//,''))}</a>".html_safe
       end
         link_to_inline_edit object, attribute, msg, from_callee: __callee__
     end

data/lib/inline_forms/form_elements/info_list_helper.rb

@@ -11,7 +11,9 @@ module InlineForms
       out = "<div class='row #{cycle('odd', 'even')}'>--</div>" if object.send(attribute).empty? 
       object.send(attribute).sort.each do | item |
         out << "<div class='row #{cycle('odd', 'even')}'>"
-        out << item._presentation
+        # _presentation is model data (e.g. a User's name listed on a Role):
+        # escape it, the whole string is marked html_safe below.
+        out << ERB::Util.h(item._presentation)
         out << '</div>'
       end
       out.html_safe

data/lib/inline_forms/version.rb

@@ -1,5 +1,5 @@
 # -*- encoding : utf-8 -*-
 
 module InlineForms
-  VERSION = "8.1.56"
+  VERSION = "8.1.58"
 end

data/lib/locales/inline_forms.en.yml

@@ -14,6 +14,7 @@ en:
       sign_up: sign up
       login_with_email_and_password: login with email and password
       sign_in: sign in
+      login: login
       links:
         no_unlock_instructions: did you not receive unlock instructions?
         sign_up: sign up
@@ -26,11 +27,26 @@ en:
     view:
       close: close
       add_new: make a new %{model}
+      create_failed: Could not create %{model}.
       undo: undo
       restore: restore
       trash: trash
       list_versions: List versions
       close_versions_list: Close versions list
+      undelete: undelete
+      versions: Versions (%{count})
+      versions_event: Event
+      versions_when: When
+      versions_done_by: Done by
+      versions_changeset: Changeset
+      versions_old_value: old value
+      versions_new_value: new value
+      versions_empty: empty
+      versions_rich_text: rich text
+      version_events:
+        create: create
+        update: update
+        destroy: destroy
     files:
       download: download
       replace: replace file
@@ -116,7 +132,13 @@ en:
           expired: expired
     pending_migration:
       notice: "pending migration \u2014 run rails db:migrate"
-  succes: success.
+  # The create flash (InlineFormsController#create). Was misspelled
+  # `succes`, so t("success") was missing in every app.
+  success: "%{message} created."
+  # The engine header (inline_forms/_header): the More menu and logout.
+  common:
+    more: more...
+    logout: logout
   activerecord:
     models:
       language: language

data/lib/locales/inline_forms.nl.yml

@@ -14,6 +14,7 @@ nl:
       sign_up: inschrijven
       login_with_email_and_password: aanmelden door email-adres en wachtwoord in te voeren.
       sign_in: aanmelden
+      login: inloggen
       links:
         no_unlock_instructions: geen instructies ontvangen om blokkade op te heffen?
         sign_up: inschrijven
@@ -26,8 +27,26 @@ nl:
     view:
       close: sluiten
       add_new: Maak een nieuw %{model}
+      create_failed: Kan %{model} niet aanmaken.
       undo: terughalen
+      restore: terugzetten
       trash: weggooien
+      undelete: terughalen
+      list_versions: versies tonen
+      close_versions_list: versies verbergen
+      versions: Versies (%{count})
+      versions_event: Gebeurtenis
+      versions_when: Wanneer
+      versions_done_by: Door
+      versions_changeset: Wijzigingen
+      versions_old_value: oude waarde
+      versions_new_value: nieuwe waarde
+      versions_empty: leeg
+      versions_rich_text: opgemaakte tekst
+      version_events:
+        create: aangemaakt
+        update: gewijzigd
+        destroy: verwijderd
     files:
       download: downloaden
       replace: bestand vervangen
@@ -113,7 +132,13 @@ nl:
           expired: verlopen
     pending_migration:
       notice: "migratie in afwachting \u2014 draai rails db:migrate"
-  succes: het ding is aangemaakt.
+  # The create flash (InlineFormsController#create). Was misspelled
+  # `succes`, so t("success") was missing in every app.
+  success: "%{message} is aangemaakt."
+  # The engine header (inline_forms/_header): the More menu and logout.
+  common:
+    more: meer...
+    logout: uitloggen
   activerecord:
     models:
       language: taal

data/test/dummy/config/application.rb

@@ -17,6 +17,9 @@ require "action_view/railtie"
 Bundler.require(*Rails.groups)
 
 require "inline_forms"
+# Host apps list rails-i18n in their Gemfile (the installer writes it): the
+# Rails strings for nl (time/date formats, ...) the gem's views localize with.
+require "rails-i18n"
 # The schema-GUI engine (separate gem, same repo; on the load path via the
 # Gemfile's test group). Its integration tests live in test/integration/.
 require "inline_forms_schema_edit"
@@ -34,5 +37,13 @@ module Dummy
     config.active_record.maintain_test_schema = false
     # Raise in-place so integration failures carry the real backtrace.
     config.action_dispatch.show_exceptions = :none
+    # A nonce-based CSP like StProject's (report-only): the layouts' inline
+    # script must carry the per-request nonce (test/integration/csp_nonce_test.rb).
+    config.content_security_policy do |policy|
+      policy.script_src :self
+    end
+    config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
+    config.content_security_policy_nonce_directives = %w[script-src]
+    config.content_security_policy_report_only = true
   end
 end

data/test/integration/csp_nonce_test.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Host apps run a CSP with script-src 'nonce-…' (StProject; the dummy app is
+# configured the same way, report-only). Every inline <script> the gem's
+# layouts render carries the request's nonce, and the nonce is published in
+# a csp-nonce meta tag for the scripts Turbo inserts. The unused
+# inline_forms/_flash partial (an inline jQuery <script>) is gone.
+class CspNonceTest < InlineFormsIntegrationTestCase
+  def header_nonce
+    policy = response.headers["Content-Security-Policy-Report-Only"].to_s
+    policy[/'nonce-([^']+)'/, 1]
+  end
+
+  def inline_scripts(html)
+    html.scan(/<script\b[^>]*>/).reject { |tag| tag.include?(" src=") }
+  end
+
+  def assert_inline_scripts_nonced(html, nonce)
+    scripts = inline_scripts(html)
+    assert_predicate scripts, :any?, "the layout's Turbo module script"
+    scripts.each { |tag| assert_includes tag, %(nonce="#{nonce}"), tag }
+  end
+
+  test "the inline_forms layout nonces its inline script and publishes the nonce" do
+    get widgets_path
+
+    assert_response :success
+    nonce = header_nonce
+    assert nonce, "precondition: the dummy sends a nonce-based CSP"
+    assert_inline_scripts_nonced(response.body, nonce)
+    assert_match %r{<script type="module" nonce="#{Regexp.escape(nonce)}" data-turbo-eval="false">\s*import \{ Turbo \}}, response.body
+    assert_includes response.body, %(<meta name="csp-nonce" content="#{nonce}" />)
+  end
+
+  test "the application layout nonces its inline script too" do
+    get widgets_path
+    nonce = header_nonce
+    html = controller.render_to_string(template: "stats/show", layout: "application")
+
+    assert_inline_scripts_nonced(html, nonce)
+    assert_includes html, %(<meta name="csp-nonce" content="#{nonce}" />)
+  end
+
+  test "the unused inline_forms/_flash partial with its inline script is gone" do
+    get widgets_path
+    refute controller.lookup_context.exists?("flash", [ "inline_forms" ], true)
+  end
+end

data/test/integration/dropdown_test.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# dropdown_edit sorts its options by presentation; the sort_by result used to
+# be discarded, so the options came out in id order.
+class DropdownTest < InlineFormsIntegrationTestCase
+  test "dropdown_edit lists the options sorted by presentation" do
+    %w[Zeta Alpha Mu].each { |name| Machine.create!(name: name) }
+    part = Part.create!(name: "Gear")
+
+    get machines_path
+    html = controller.view_context.dropdown_edit(part, :machine)
+
+    assert_equal %w[Alpha Mu Zeta], html.scan(%r{<option value="\d+">([^<]*)</option>}).flatten
+  end
+end

data/test/integration/file_slots_test.rb

@@ -299,6 +299,44 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_nil @doc.reload.data
   end
 
+  # The stored SHA-256 is checked before bytes go back into a slot: a
+  # tampered (or corrupted) trash row is refused, nothing is written, and the
+  # row stays in the trash.
+  test "restore refuses a trash row whose bytes do not match its checksum" do
+    with_file
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+    InlineForms::TrashedFile.where(id: entry.id).update_all(data: OTHER)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame),
+         headers: stream_headers(@frame)
+
+    assert_response :success
+    assert_includes response.body, "can no longer be restored"
+    @doc.reload
+    assert_nil @doc.filename
+    assert_nil @doc.data
+    assert entry.reload.trashed?, "not marked restored"
+    assert_equal OTHER, entry.file_data, "the row is left as it is, for a look"
+  end
+
+  test "restore! raises and logs on a checksum mismatch, writing nothing" do
+    with_file
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+    InlineForms::TrashedFile.where(id: entry.id).update_all(checksum: Digest::SHA256.hexdigest("something else"))
+    log = StringIO.new
+    original_logger = Rails.logger
+    Rails.logger = ActiveSupport::Logger.new(log)
+
+    assert_raises(InlineForms::TrashedFile::NotRestorable) { entry.reload.restore!(by: 1) }
+
+    assert_includes log.string, "checksum mismatch entry=#{entry.id}"
+    assert_nil @doc.reload.data
+    assert entry.reload.trashed?
+    assert_equal 0, trash.where(reason: "replaced").count
+  ensure
+    Rails.logger = original_logger
+  end
+
   test "a trash entry of another record is not found" do
     other = Document.create!(title: "Dossier B", filename: upload(PLAN))
     entry = other.inline_forms_remove_file!(:filename, by: 1)
@@ -414,6 +452,43 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_includes response.body, "restorable until"
   end
 
+  # FileSlotsConcern has no per-tab attribute list, so the field it
+  # re-renders used to build its links' slots= from the model's full list:
+  # after a restore on one tab, the next action's panel (and the versions
+  # panel) listed the other tabs' slots. The page's own slots param now
+  # carries through.
+  test "a file action re-renders with the page's slots only" do
+    with_file
+    @doc.update!(plan_filename: upload(OTHER, "other-tab.pdf"))
+    @doc.inline_forms_remove_file!(:plan_filename, by: 1)
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame,
+                                          slots: "filename", panel: "open"),
+         headers: stream_headers(@frame)
+
+    assert_response :success
+    assert_equal PLAN, @doc.reload.data
+    remove_link = response.body[%r{href="([^"]*/remove_file\?[^"]*)"}, 1]
+    assert remove_link, "the restored field offers remove"
+    assert_equal "filename", Rack::Utils.parse_query(URI.parse(CGI.unescapeHTML(remove_link)).query)["slots"]
+    refute_includes response.body, "other-tab.pdf", "neither the trash panel nor the versions panel lists the other slot"
+  end
+
+  test "a file action's slots param is reduced to declared, listed slots" do
+    with_file
+    @doc.update!(plan_filename: upload(OTHER, "other-tab.pdf"))
+    @doc.inline_forms_remove_file!(:plan_filename, by: 1)
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame,
+                                          slots: "filename,title,data", panel: "open"),
+         headers: stream_headers(@frame)
+
+    remove_link = response.body[%r{href="([^"]*/remove_file\?[^"]*)"}, 1]
+    assert_equal "filename", Rack::Utils.parse_query(URI.parse(CGI.unescapeHTML(remove_link)).query)["slots"]
+  end
+
   test "the panel needs :read_file_trash" do
     Ability.restrictions = -> { cannot :read_file_trash, Document }
     panel = "document_#{@doc.id}_file_trash"
@@ -456,6 +531,22 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_nil restored.data
   end
 
+  test "undoing a destroy refuses a tampered trash row: nothing is restored" do
+    with_file
+    row = "document_#{@doc.id}"
+    delete document_path(@doc, update: row), headers: frame_headers(row)
+    entry = trash.where(reason: "record_destroyed").sole
+    InlineForms::TrashedFile.where(id: entry.id).update_all(data: OTHER)
+
+    version = PaperTrail::Version.where(item_type: "Document", item_id: @doc.id, event: "destroy").last
+    post revert_document_path(version.id, update: "documents_list"), headers: stream_headers("documents_list")
+
+    assert_response :unprocessable_entity
+    refute Document.exists?(@doc.id), "the revert rolled back"
+    assert entry.reload.trashed?
+    assert_equal OTHER, entry.file_data
+  end
+
   test "reverting an update never touches a slot, even from an old version carrying a filename" do
     with_file
     @doc.update!(title: "Renamed")

data/test/integration/list_params_test.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Request params that end up in a list's markup.
+#
+# * parent_class / parent_id: _list built the nested frame as
+#   `raw "<turbo-frame id=\"#{update_span}\" …>"` with update_span made from
+#   params[:parent_id], and constantized params[:parent_class]; nothing found
+#   the parent before the render, so a crafted parent_id was reflected into
+#   the page. The controller now refuses malformed parent params (400) in
+#   index/new/create/show, and the frame is built with tag.turbo_frame.
+# * pagination: the page links carry every filter of the query string, not
+#   just `search`.
+#
+# Part and DailyReport belong to Machine; Widget is a top-level list
+# (per_page 7, see ApplicationRecord).
+class ListParamsTest < InlineFormsIntegrationTestCase
+  PAYLOAD = %("><img src=x onerror=alert(1)>)
+
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @part = Part.create!(name: "Gear", machine: @machine)
+    @list_frame = "machine_#{@machine.id}_parts_list"
+  end
+
+  def assert_refused_without_payload
+    assert_response :bad_request
+    assert controller.instance_variable_defined?(:@_authorized),
+      "the refusal runs after authorization (check_authorization stays satisfied)"
+    refute_includes response.body, "<img"
+  end
+
+  def nested(parent_id: @machine.id, parent_class: "Machine", update: @list_frame)
+    { parent_class: parent_class, parent_id: parent_id, update: update, ul_needed: 1 }
+  end
+
+  # ---- malformed parent params --------------------------------------------
+
+  test "a crafted parent_id on the nested list is a 400 and never rendered" do
+    get parts_path(nested(parent_id: PAYLOAD, update: "x")), headers: frame_headers("x")
+    assert_refused_without_payload
+  end
+
+  test "a crafted parent_id is refused on a full-page visit too" do
+    get parts_path(nested(parent_id: PAYLOAD, update: "x"))
+    assert_refused_without_payload
+  end
+
+  test "a parent_class that is not an association of the model is a 400" do
+    %w[Widget Kernel machine Machines ActiveRecord::Base].each do |parent_class|
+      get parts_path(nested(parent_class: parent_class)), headers: frame_headers(@list_frame)
+      assert_response :bad_request, "parent_class=#{parent_class}"
+    end
+  end
+
+  test "a non-integer parent_id is a 400, with or without parent_class" do
+    [ "1 OR 1=1", "-1", "1.5", "" ].each do |parent_id|
+      get parts_path(nested(parent_id: parent_id)), headers: frame_headers(@list_frame)
+      assert_response :bad_request, "parent_id=#{parent_id.inspect}"
+    end
+    get parts_path(parent_id: PAYLOAD, update: "x")
+    assert_refused_without_payload
+  end
+
+  test "new with crafted parent params is a 400" do
+    get new_part_path(nested(parent_id: PAYLOAD, update: "machine_#{@machine.id}_parts")),
+        headers: frame_headers("machine_#{@machine.id}_parts")
+    assert_refused_without_payload
+
+    get new_part_path(nested(parent_class: "Widget", update: "machine_#{@machine.id}_parts")),
+        headers: frame_headers("machine_#{@machine.id}_parts")
+    assert_response :bad_request
+  end
+
+  test "create with crafted parent params is a 400 and creates nothing" do
+    frame = "machine_#{@machine.id}_parts"
+    assert_no_difference -> { Part.count } do
+      post parts_path(nested(parent_id: PAYLOAD, update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+      assert_refused_without_payload
+      post parts_path(nested(parent_class: "Widget", update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+      assert_response :bad_request
+    end
+  end
+
+  test "show with a crafted parent_id is a 400" do
+    row = "machine_#{@machine.id}_part_#{@part.id}"
+    get part_path(@part, update: row, parent_class: "Machine", parent_id: PAYLOAD), headers: frame_headers(row)
+    assert_refused_without_payload
+  end
+
+  # ---- well-formed nested lists still work --------------------------------
+
+  test "a well-formed nested list renders its frame and rows" do
+    get parts_path(nested), headers: frame_headers(@list_frame)
+
+    assert_response :success
+    assert_includes response.body, %(<turbo-frame id="#{@list_frame}" class="list_container">)
+    assert_includes response.body, "Gear"
+  end
+
+  test "well-formed nested new and create still work" do
+    frame = "machine_#{@machine.id}_parts"
+    get new_part_path(nested(update: frame)), headers: frame_headers(frame)
+    assert_response :success
+
+    assert_difference -> { @machine.parts.count }, 1 do
+      post parts_path(nested(update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+    end
+    assert_response :success
+  end
+
+  test "the nested list of a not_accessible_through_html? child still renders" do
+    DailyReport.create!(name: "Monday", machine: @machine)
+    frame = "machine_#{@machine.id}_daily_reports_list"
+    get daily_reports_path(parent_class: "Machine", parent_id: @machine.id, update: frame, ul_needed: 1),
+        headers: frame_headers(frame)
+
+    assert_response :success
+    assert_includes response.body, "Monday"
+  end
+
+  test "the list frame id is attribute-escaped by the partial itself" do
+    html = PartsController.render(
+      partial: "inline_forms/list",
+      assigns: { Klass: Part, parent_class: "Machine", parent_id: PAYLOAD, ul_needed: "1",
+                 objects: Part.where(id: @part.id).paginate(page: 1) }
+    )
+
+    refute_includes html, "<img"
+    assert_includes html, %(<turbo-frame id="machine_&quot;&gt;&lt;img src=x onerror=alert(1)&gt;_parts_list" class="list_container">)
+  end
+
+  # ---- pagination keeps the filters ---------------------------------------
+
+  test "page links of a filtered list carry every filter" do
+    9.times { |i| Widget.create!(name: "Match #{i}") }
+    Widget.create!(name: "Other")
+
+    get widgets_path(search: "Match", sorteer: "name", first_name: "An", group: { id: 3 }, status: { id: 4 },
+                     update: "widgets_list"),
+        headers: frame_headers("widgets_list")
+
+    assert_response :success
+    page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+    assert page_link, "a link to page 2"
+    query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(page_link)).query)
+    assert_equal "Match", query["search"]
+    assert_equal "name", query["sorteer"]
+    assert_equal "An", query["first_name"]
+    assert_equal({ "id" => "3" }, query["group"])
+    assert_equal({ "id" => "4" }, query["status"])
+    assert_equal "widgets_list", query["update"]
+    assert_equal "2", query["page"]
+
+    get CGI.unescapeHTML(page_link), headers: frame_headers("widgets_list")
+    assert_response :success
+    back = response.body[/href="([^"]*page=1[^"]*)"/, 1]
+    assert back, "a link back to page 1"
+    back_query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(back)).query)
+    assert_equal "Match", back_query["search"]
+    assert_equal({ "id" => "3" }, back_query["group"])
+    refute_includes response.body, "Other"
+  end
+
+  test "page links of a list rendered after create keep the request's filters" do
+    9.times { |i| Machine.create!(name: "Match #{i}") }
+
+    post machines_path(update: "machines_list", search: "Match", sorteer: "name"),
+         params: { name: "Match 9" }, headers: frame_headers("machines_list")
+
+    assert_response :success
+    page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+    assert page_link, "a link to page 2"
+    query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(page_link)).query)
+    assert_equal "Match", query["search"]
+    assert_equal "name", query["sorteer"]
+  end
+
+  # url_for options in the query string must not shape the page links.
+  # will_paginate leaves out script_name / original_script_name; merging
+  # request.query_parameters into the links bypassed that, so the payload
+  # became the start of every page link's href, and controller= raised.
+  test "url options in the query string never reach the page links" do
+    9.times { |i| Widget.create!(name: "W #{i}") }
+
+    %w[script_name original_script_name].each do |option|
+      get "/widgets?update=widgets_list&#{option}=javascript:alert(1)//", headers: frame_headers("widgets_list")
+      assert_response :success
+      page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+      assert page_link, "a link to page 2"
+      assert page_link.start_with?("/widgets?"), "#{option} shaped the page link: #{page_link}"
+      refute_includes response.body, "javascript:alert"
+    end
+
+    get "/widgets?update=widgets_list&controller=widgets_x", headers: frame_headers("widgets_list")
+    assert_response :success
+    assert_match %r{href="/widgets\?[^"]*page=2}, response.body
+  end
+end