inline_forms 8.1.56 → 8.1.58

data/test/integration/locale_test.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# The gem's own strings resolve in en and nl, also under
+# raise_on_missing_translations (StProject switched to :nl with :strict):
+# the create flash (`success`, misspelled `succes` in both locale files), the
+# versions panel (was hard-coded English), the nl view keys that were missing
+# (restore, list_versions, close_versions_list, undelete), localized version
+# timestamps, the Devise layout's lang and the sign-in button.
+class LocaleTest < InlineFormsIntegrationTestCase
+  KEYS = %w[
+    success
+    inline_forms.view.restore inline_forms.view.list_versions inline_forms.view.close_versions_list
+    inline_forms.view.undelete inline_forms.view.versions inline_forms.view.versions_event
+    inline_forms.view.versions_when inline_forms.view.versions_done_by inline_forms.view.versions_changeset
+    inline_forms.view.versions_old_value inline_forms.view.versions_new_value inline_forms.view.versions_empty
+    inline_forms.view.versions_rich_text inline_forms.view.version_events.create
+    inline_forms.view.version_events.update inline_forms.view.version_events.destroy
+    inline_forms.devise.login common.more common.logout inline_forms.view.create_failed
+  ].freeze
+
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @machine.update!(name: "Press 2")
+  end
+
+  teardown do
+    I18n.backend.reload!
+  end
+
+  # Every translation the request looks up must exist: a missing one raises,
+  # in the views and in the controller (create's flash).
+  def strictly(locale)
+    original_view = ActionView::Helpers::TranslationHelper.raise_on_missing_translations
+    original_handler = I18n.exception_handler
+    original_default = I18n.default_locale
+    ActionView::Helpers::TranslationHelper.raise_on_missing_translations = true
+    I18n.exception_handler = ->(exception, *) { raise exception.respond_to?(:to_exception) ? exception.to_exception : exception }
+    # with_locale first: it restores the locale it found, so the thread's
+    # locale must not be read after default_locale changed (it would then
+    # restore :nl for every later test).
+    I18n.with_locale(locale) do
+      I18n.default_locale = locale
+      yield
+    end
+  ensure
+    I18n.default_locale = original_default
+    ActionView::Helpers::TranslationHelper.raise_on_missing_translations = original_view
+    I18n.exception_handler = original_handler
+  end
+
+  test "the gem's keys exist in en and nl, and the misspelled succes is gone" do
+    %i[en nl].each do |locale|
+      KEYS.each { |key| assert I18n.exists?(key, locale), "#{locale}.#{key}" }
+      refute I18n.exists?("succes", locale), "#{locale}.succes"
+    end
+    assert_equal "Machine created.", I18n.t("success", message: "Machine", locale: :en)
+    assert_equal "Machine is aangemaakt.", I18n.t("success", message: "Machine", locale: :nl)
+  end
+
+  test "create's success flash translates in nl" do
+    # The model top bar shows t(controller_name): host-supplied, like
+    # StProject's `clients: cliënten`.
+    I18n.backend.store_translations(:nl, machines: "machines")
+    strictly(:nl) do
+      post machines_path(update: "machines_list"), params: { name: "Lathe" }, headers: frame_headers("machines_list")
+    end
+
+    assert_response :success
+    assert_equal "Machine is aangemaakt.", controller.flash[:success]
+  end
+
+  # The failure header was hard-coded Dutch with the underscored class name
+  # ("Kan machine niet aanmaken.") in every locale.
+  test "create's failure flash header translates, with the human model name" do
+    I18n.backend.store_translations(:nl, machines: "machines",
+                                         activerecord: { models: { machine: "Werkbank" } })
+    strictly(:nl) do
+      post machines_path(update: "machines_list"), params: { name: "" }, headers: frame_headers("machines_list")
+    end
+    assert_equal [ "Kan Werkbank niet aanmaken." ], controller.flash[:header]
+
+    I18n.backend.store_translations(:en, machines: "machines")
+    strictly(:en) do
+      post machines_path(update: "machines_list"), params: { name: "" }, headers: frame_headers("machines_list")
+    end
+    assert_equal [ "Could not create Machine." ], controller.flash[:header]
+    assert_includes response.body, "Could not create Machine."
+  end
+
+  test "the versions panel and list are translated, with localized timestamps" do
+    row = "machine_#{@machine.id}"
+    strictly(:nl) do
+      get machine_path(@machine, update: row), headers: frame_headers(row)
+      assert_response :success
+      assert_includes response.body, "Versies (2)"
+
+      get list_versions_machine_path(@machine, update: row), headers: frame_headers(row)
+    end
+
+    assert_response :success
+    body = response.body
+    %w[Versies Gebeurtenis Wanneer Door Wijzigingen aangemaakt gewijzigd terugzetten].each do |text|
+      assert_includes body, text
+    end
+    refute_includes body, "<strong>Event</strong>"
+    version = @machine.versions.last
+    assert_includes body, ERB::Util.h(I18n.l(version.created_at, format: :short, locale: :nl))
+  end
+
+  test "the versions list in en keeps its English labels" do
+    row = "machine_#{@machine.id}"
+    strictly(:en) do
+      get list_versions_machine_path(@machine, update: row), headers: frame_headers(row)
+    end
+
+    assert_response :success
+    assert_includes response.body, "Versions (2)"
+    assert_includes response.body, "<strong>Event</strong>"
+    assert_includes response.body, "old value"
+  end
+
+  test "the devise and application layouts declare the page language" do
+    get widgets_path
+    I18n.with_locale(:nl) do
+      assert_includes controller.render_to_string(template: "stats/show", layout: "devise"), %(<html lang="nl">)
+      assert_includes controller.render_to_string(template: "stats/show", layout: "application"), %(<html lang="nl">)
+    end
+  end
+end

data/test/integration/presentation_escaping_test.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Model data that a helper concatenates into a string it marks html_safe must
+# be escaped first. info_list_show did `out << item._presentation`, so a
+# _presentation built from user input (StProject: User#name listed on a Role)
+# ran as markup on every page that showed the list (stored XSS). Same audit:
+# file_field_show (stored file name / url) and the rich-text changeset in the
+# versions list (was `raw`).
+class PresentationEscapingTest < InlineFormsIntegrationTestCase
+  MARKUP = "<img src=x onerror=alert(1)>"
+  ESCAPED = "&lt;img src=x onerror=alert(1)&gt;"
+
+  # A view context of a real request: helpers, can?, url helpers.
+  def view
+    @view ||= begin
+      get widgets_path
+      controller.view_context
+    end
+  end
+
+  test "info_list escapes each item's _presentation" do
+    machine = Machine.create!(name: "Press")
+    Part.create!(name: MARKUP, machine: machine)
+    Part.create!(name: "Gear", machine: machine)
+
+    html = view.info_list_show(machine, :parts)
+
+    refute_includes html, "<img"
+    assert_includes html, ESCAPED
+    assert_includes html, "Gear"
+    assert_includes html, "<div class='row", "the row markup itself is kept"
+  end
+
+  test "file_field escapes the stored file name and url" do
+    widget = Widget.create!(name: "Manual")
+    stored = Struct.new(:url, :path) do
+      def present? = true
+      def to_s = url
+    end.new(%(/uploads/x'><img src=x onerror=alert(1)>.pdf), %(/uploads/#{MARKUP}.pdf))
+    widget.define_singleton_method(:manual) { stored }
+
+    html = view.file_field_show(widget, :manual)
+
+    refute_includes html, "<img"
+    assert_includes html, ESCAPED
+  end
+
+  test "dropdown_with_other and the list rows escape _presentation" do
+    kind = Kind.create!(name: MARKUP)
+    widget = Widget.create!(name: MARKUP, kind: kind)
+
+    refute_includes view.dropdown_with_other_show(widget, :kind), "<img"
+
+    get widgets_path(update: "widgets_list"), headers: frame_headers("widgets_list")
+    assert_response :success
+    refute_includes response.body, "<img"
+    assert_includes response.body, ESCAPED
+  end
+
+  test "a rich-text changeset in the versions list is sanitized, not raw" do
+    machine = Machine.create!(name: "Press")
+    version = Struct.new(:id, :event, :changeset, :created_at, :whodunnit) do
+      def to_param = id.to_s
+    end.new(1, "update", { "body" => [ "<p>old</p><script>alert(1)</script>", "<p>new</p>#{MARKUP}" ] }, Time.current, nil)
+    context = view
+    context.instance_variable_set(:@object, machine)
+    context.define_singleton_method(:inline_forms_history_for) do |_object|
+      [ { version: version, kind: :rich_text, rich_text_name: "description", at: version.created_at } ]
+    end
+
+    html = context.render(partial: "inline_forms/versions_list")
+
+    refute_includes html, "<script"
+    refute_includes html, "onerror"
+    assert_includes html, "<p>old</p>"
+    assert_includes html, "<p>new</p>"
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inline_forms
 version: !ruby/object:Gem::Version
-  version: 8.1.56
+  version: 8.1.58
 platform: ruby
 authors:
 - Ace Suares
@@ -153,7 +153,6 @@ files:
 - app/views/inline_forms/_close.html.erb
 - app/views/inline_forms/_edit.html.erb
 - app/views/inline_forms/_file_slot.html.erb
-- app/views/inline_forms/_flash.html.erb
 - app/views/inline_forms/_generic_search.html.erb
 - app/views/inline_forms/_header.html.erb
 - app/views/inline_forms/_list.html.erb
@@ -314,16 +313,21 @@ files:
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
+- test/integration/csp_nonce_test.rb
+- test/integration/dropdown_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
 - test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
+- test/integration/list_params_test.rb
+- test/integration/locale_test.rb
 - test/integration/model_top_bar_test.rb
 - test/integration/native_inputs_test.rb
 - test/integration/open_after_create_test.rb
 - test/integration/pending_migration_gate_test.rb
+- test/integration/presentation_escaping_test.rb
 - test/integration/revert_skipped_columns_test.rb
 - test/integration/schema_batch_pipeline_test.rb
 - test/integration/schema_edit_test.rb
@@ -398,16 +402,21 @@ test_files:
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
+- test/integration/csp_nonce_test.rb
+- test/integration/dropdown_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
 - test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
+- test/integration/list_params_test.rb
+- test/integration/locale_test.rb
 - test/integration/model_top_bar_test.rb
 - test/integration/native_inputs_test.rb
 - test/integration/open_after_create_test.rb
 - test/integration/pending_migration_gate_test.rb
+- test/integration/presentation_escaping_test.rb
 - test/integration/revert_skipped_columns_test.rb
 - test/integration/schema_batch_pipeline_test.rb
 - test/integration/schema_edit_test.rb

data/app/views/inline_forms/_flash.html.erb

@@ -1,13 +0,0 @@
-<% unless flash.empty? %>
-  <% identifier = Time.now.to_i.to_s %>
-  <div class="row" id="flash_<%= identifier %>">
-  <% flash.each do |key, value| %>
-    <%= value %>
-  <% end %>
-  <script>
-    $("#<%= "#{update_span}_auto_header" %>").ScrollTo();
-    $("#flash_<%= identifier %>").delay(1000).fadeToggle('2000');
-  </script>
-  </div>
-<% end %>
-