inline_forms 8.1.56 → 8.1.57

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ecd64e62be7265a5989cc6012533cdac80dbd62f82ab8b009c17bd4c12343dd
-  data.tar.gz: fb677f7996a52a2a8d571f65264f22225a9ff9ed8c451657a2ac59c268d396d5
+  metadata.gz: 93e0cd0c2bc09c666bd81cf76779b780ab345f4a7e80f8a6535177d7921b150d
+  data.tar.gz: 02e8abc26971fe105a65b8bae7380d171e2635e1e51385c0849917e1a5365c16
 SHA512:
-  metadata.gz: a5d4ed8bbb6569904df70ebbbd30b57c4847bb478088dfe70419363c58caf11d19dc6dfb5c67da2fbdaad8a85555c5b74b68847d19484f272d7c5fcbebcc30cf
-  data.tar.gz: a5b41fd5b309e7fd73bec6c652609f775493c1b3efdf977d3aed1503c6e6656d4e8d7e695bac99ca751b914bb2a47be64bdb244233820253d2426e87240515ee
+  metadata.gz: ecdf5c3b1c43851b0cd0d6b05fdac85a51b227c30584a52bb395c9786c1dffdb9378e549b6d99a1faf5ff11aa8bfc7ecda01ae1b92e494cf2dfdf9750fc3fae4
+  data.tar.gz: df8a5b2b0cd7a9f21a9b14e58a086ed7ace99f9ce6380bd1e8284cae6b65183b4db72e15de2c8ffa332e9366d85780dc6ccb125e12bfa7afa4a24ed204383a7a

data/CHANGELOG.md

@@ -4,6 +4,72 @@ All notable changes to this project are documented in this file.
 
 ## [Unreleased]
 
+## [8.1.57] - 2026-10-05
+
+Fixes from a security/UI review of a host app (StProject), plus missing and hard-coded translations found when StProject switched to `:nl` with `raise_on_missing_translations = :strict`.
+
+### Security
+
+- **Reflected XSS through the nested list's frame id.** `_list` built the list frame as `raw "<turbo-frame id=\"#{update_span}\" …>"`, with `update_span` made from `params[:parent_id]`, and nothing looked the parent up before rendering. So `/incidents?parent_class=Client&ul_needed=1&update=x&parent_id="><img src=x onerror=…>` rendered the payload. Two fixes:
+  - The list body is now captured and wrapped with `tag.turbo_frame(id:, class: "list_container")`, so the id is attribute-escaped. No other view or helper puts a request param into `raw` / `html_safe` markup.
+  - `InlineFormsController` refuses malformed parent params with **400** in `index`, `new`, `create` and `show` (new `before_action :refuse_malformed_parent_params`). `parent_id` must match `/\A\d+\z/`. `parent_class` must name the class of a non-polymorphic `belongs_to` of `@Klass` that is named after it (`Photo#apartment` for `parent_class=Apartment`), which is exactly what the gem's own links send. The check runs before `_list`'s `constantize` and before `new`/`create` write the foreign key, and after `load_and_authorize_resource`, so a host's `check_authorization` stays satisfied.
+- **Stored XSS in `info_list`.** `info_list_show` appended `item._presentation` unescaped and then marked the string `html_safe`. A `_presentation` built from user data (StProject: `User#name` listed on a Role) therefore ran as markup. It is now escaped with `ERB::Util.h`. Audit of the other helpers that mark strings `html_safe`:
+  - `file_field_show` now escapes the stored file name and URL.
+  - The versions list rendered a rich-text changeset with `raw`. It is now passed through `sanitize`, so a body posted outside Trix cannot carry script.
+  - `dropdown`, `dropdown_with_other`, `check_list`, `radio_button`, the list rows, `_close`, `_show` and the trash pages already escaped `_presentation` (via `link_to` / `link_to_inline_edit` / `h` / ERB) and are unchanged.
+  - **Hosts with their own `inline_forms/_versions_list.html.erb` (StProject has one) keep the `raw`** until they apply the same change.
+- **Restoring a trashed file verifies its bytes.** `InlineForms::TrashedFile#restore!` and `InlineForms::StoredFiles.prepare_revert!` (undo of a destroy) now compare the SHA-256 of `data` with the stored `checksum` before writing bytes back into the slot (new `TrashedFile.verify_checksum!`). On a mismatch they log an error (`inline_forms file_trash checksum mismatch entry=<id>`) and raise `NotRestorable`: the transaction rolls back, nothing is written and the row stays in the trash. The field shows "can no longer be restored". The revert answers **422** instead of a 500; this also covers a `NotRestorable` from a concurrent purge.
+- **Inline scripts carry the CSP nonce.** The Turbo module `<script>` in `layouts/inline_forms` and `layouts/application` is now rendered with `nonce: content_security_policy_nonce`, which adds no attribute without a nonce generator. It is also marked `data-turbo-eval="false"`, and both layouts emit `csp_meta_tag`. This is the same as StProject's own layout, so a `script-src 'nonce-…'` policy accepts the gem's layouts.
+
+### Removed
+
+- **`inline_forms/_flash.html.erb`.** It had an inline jQuery `<script>` (no nonce), and neither the gem, the installer, the example app nor StProject rendered it. The layouts show flash themselves, and Devise pages use `devise/sessions/_flash`. A host that still does `render "inline_forms/flash"` must provide its own partial.
+
+### Fixed
+
+- **File-slot actions keep the page's slots.** `FileSlotsConcern` has no per-tab `@inline_forms_attribute_list`. After a remove, restore or undo, the re-rendered field (`_file_slot`) and the versions panel built `slots=` from the model's full attribute list. On a tabbed host (StProject's Client), the next action's trash panel then listed files from other tabs' slots. `inline_forms_file_trash_slots` now uses the action's `@file_trash_slots` for its record. That value comes from the page's own `slots` param and is reduced to declared, listed, readable slots, as before.
+- **Pagination of the top-level list keeps a host's filters, now under test.** A host's own filters (`first_name`, `sorteer`, `group[id]`, `status[id]`, …) stay on page 2. will_paginate already did that: it puts the request's params into every page link (all params on GET, the query string otherwise). The only change is that the redundant explicit `search` param is dropped. The page links deliberately do **not** merge `request.query_parameters` themselves. That skips will_paginate's exclusion of `script_name` / `original_script_name`, so `?script_name=javascript:alert(1)//` would become the start of every page link's `href` (XSS), and `?controller=x` would raise a 500.
+
+- **The create flash was never translated.** `InlineFormsController#create` calls `t("success", message: …)`, but both locale files defined the key as `succes`, so every create looked up a missing translation (and raised under `raise_on_missing_translations`). The key is now `success` (en "%{message} created.", nl "%{message} is aangemaakt."). The misspelled `succes` is dropped: it never received the message, and nothing else used it.
+- **The versions panel is translated.** `_versions` and `_versions_list` hard-coded English: "Versions (n)", Event, When, Done by, Changeset, old value / new value, empty, "(rich text)" and the raw event names. They now use `inline_forms.view.versions` (with `count`), `versions_event`, `versions_when`, `versions_done_by`, `versions_changeset`, `versions_old_value`, `versions_new_value`, `versions_empty`, `versions_rich_text` and `version_events.{create,update,destroy}`. Unknown events fall back to the raw name. en and nl are included, with the same key names as StProject's overrides, so those overrides can be dropped.
+- **Missing view keys:**
+  - nl now has `inline_forms.view.restore`, `list_versions`, `close_versions_list` and `undelete`.
+  - en now has `undelete`, used by the soft-restore link (`link_to_soft_delete`).
+  - Both locales now have `common.more` and `common.logout`, which the engine header uses and which only hosts defined before.
+- **Version timestamps are localized.** The versions list and its file events printed `created_at` / the event time raw (`2026-10-05 15:10:24 UTC`). They now use `l(…, format: :short)`.
+- **`<html lang>`.** `layouts/devise` and `layouts/application` now declare `lang="<%= I18n.locale %>"`, like the `inline_forms` layout.
+- **The sign-in button is translated.** `devise/sessions/_form` used `f.submit :login` (always "login"). It now uses `t("inline_forms.devise.login", default: "login")`: en "login", nl "inloggen".
+
+### Tests
+
+- `test/integration/list_params_test.rb`:
+  - a crafted `parent_id` (frame request and full page) → 400 with the payload never in the body;
+  - a non-association or wrongly cased `parent_class` → 400, and a non-integer `parent_id` → 400;
+  - crafted `new` / `create` / `show` → 400, and `create` creates nothing;
+  - every refusal counts as authorized;
+  - well-formed nested list, new and create still work, including the `not_accessible_through_html?` child;
+  - `_list` escapes the frame id by itself;
+  - page 2 of a filtered list (and back to page 1) carries every filter, and so does the list rendered after a create;
+  - a crafted `script_name` / `original_script_name` / `controller` in the query string never reaches the page links.
+- `test/integration/presentation_escaping_test.rb`: `info_list`, `file_field`, `dropdown_with_other` and the list rows escape `<img src=x onerror=…>`; the versions list sanitizes a rich-text changeset.
+- `test/integration/file_slots_test.rb`:
+  - a restore re-renders with the page's `slots` only, so neither panel lists the other slot's file, and `slots` is reduced to declared slots;
+  - a tampered trash row (bytes or checksum) is refused by `restore_file` and by `restore!` (logged, nothing written);
+  - undo of a destroy with a tampered row → 422 with nothing restored.
+- `test/integration/csp_nonce_test.rb`: the dummy app now runs a nonce CSP (report-only, like StProject). Both layouts' inline scripts carry the request's nonce and publish it in `csp-nonce`, and `inline_forms/_flash` is gone.
+- `test/integration/locale_test.rb`. The dummy app now loads `rails-i18n`, as host Gemfiles do. Tests:
+  - every key above exists in en and nl, and `succes` is gone;
+  - create's flash is translated in nl;
+  - the versions panel and list render in nl with translated labels, event names and a localized timestamp, and in en with the English labels. Both render with missing translations raising, in views and controllers;
+  - the devise and application layouts declare `lang`.
+- Example app:
+  - `example_app_turbo_layout_test.rb` accepts the Turbo module script with its new attributes;
+  - new `example_app_devise_sign_in_test.rb`: the sign-in page has `<html lang>` and the translated submit button.
+
+### Lockstep
+
+- validation_hints 8.1.57 (now ships an nl locale, and `message: :required` hints, i.e. every `belongs_to`, resolve in en and nl), inline_forms_installer 8.1.57, inline_forms_schema_edit 8.1.57.
+
 ## [8.1.56] - 2026-10-05
 
 ### Fixed

data/app/controllers/inline_forms_controller.rb

@@ -32,6 +32,9 @@ class InlineFormsController < ApplicationController
 
   # +revert+ and the file-slot actions authorize themselves (attribute-level).
   load_and_authorize_resource except: [ :revert, *FileSlotsConcern::FILE_SLOT_ACTIONS ], no_params: true if cancan_enabled?
+  # After the authorization above, so a refusal still satisfies a host's
+  # check_authorization (see refuse_malformed_parent_params).
+  before_action :refuse_malformed_parent_params, only: [ :index, :new, :create, :show ]
   # :index shows a list of all objects from class @Klass, using will_paginate,
   # including a link to 'new', that allows you to create a new record.
   def index
@@ -380,11 +383,18 @@ class InlineFormsController < ApplicationController
     else
       # One transaction: the record, its files coming back out of the trash
       # (undo of a destroy) and its rich texts are restored together or not.
-      @object.class.transaction do
-        file_entries = InlineForms::StoredFiles.prepare_revert!(@object)
-        @parent = persist_reverted_primary!(@object, @version)
-        InlineForms::StoredFiles.finish_revert!(file_entries, by: inline_forms_current_user_id)
-        restore_rich_texts_for_reverted_parent!(@parent)
+      begin
+        @object.class.transaction do
+          file_entries = InlineForms::StoredFiles.prepare_revert!(@object)
+          @parent = persist_reverted_primary!(@object, @version)
+          InlineForms::StoredFiles.finish_revert!(file_entries, by: inline_forms_current_user_id)
+          restore_rich_texts_for_reverted_parent!(@parent)
+        end
+      rescue InlineForms::TrashedFile::NotRestorable
+        # A trashed file failed its checksum, or was purged/restored
+        # concurrently: the transaction rolled back and nothing was restored.
+        # An explicit answer instead of a 500.
+        return head :unprocessable_entity
       end
       @parent.reload
     end
@@ -393,6 +403,40 @@ class InlineFormsController < ApplicationController
 
   private
 
+  # +parent_class+ / +parent_id+ come from the nested-list links and are
+  # client-controlled, yet +_list+ constantizes +parent_class+, +new+ and
+  # +create+ write +parent_id+ into the foreign key, and both land in the
+  # list's frame ids. Nothing +find+s the parent before the list renders, so a
+  # crafted +parent_id+ (markup) reached the page (reflected XSS), and any
+  # +parent_class+ string reached +constantize+. Refuse (400) unless
+  # +parent_id+ is a plain integer id and +parent_class+ names the class of a
+  # belongs_to association of @Klass named after it (Photo#apartment for
+  # +parent_class=Apartment+): exactly what the gem's own links send.
+  def refuse_malformed_parent_params
+    parent_class = params[:parent_class]
+    parent_id = params[:parent_id]
+    return if parent_class.blank? && parent_id.blank?
+    return if parent_id_param?(parent_id) && (parent_class.blank? || parent_class_param?(parent_class))
+
+    head :bad_request
+  end
+
+  def parent_id_param?(parent_id)
+    parent_id.is_a?(String) && parent_id.match?(/\A\d+\z/)
+  end
+
+  # Compared against the reflections (no +to_sym+ / +constantize+ of the
+  # param): a non-polymorphic belongs_to whose name is the underscored class.
+  def parent_class_param?(parent_class)
+    return false unless parent_class.is_a?(String)
+
+    @Klass.reflect_on_all_associations(:belongs_to).any? do |reflection|
+      !reflection.polymorphic? &&
+        reflection.class_name == parent_class &&
+        reflection.name.to_s == parent_class.underscore
+    end
+  end
+
   # Single-field requests (edit, update, show with an attribute) name the
   # field and its form element in params, and both are client-controlled.
   # +load_and_authorize_resource+ only authorizes the record: CanCanCan's

data/app/helpers/inline_forms_file_trash_helper.rb

@@ -24,7 +24,17 @@ module InlineFormsFileTrashHelper
 
   # Declared, routed slots among the rows of the attribute list being shown
   # (a Client tab shows only its own slots).
+  #
+  # The file-slot actions (FileSlotsConcern) re-render the field, the trash
+  # panel and the versions panel as streams, and that controller has no
+  # per-tab @inline_forms_attribute_list: falling back to the model's full
+  # list put every tab's slots into the re-rendered links (slots=…), so the
+  # next action's panel listed other tabs' files. Those actions set
+  # @file_trash_slots from the page's own +slots+ param (validated against
+  # the declared, listed, readable slots); use it for their record.
   def inline_forms_file_trash_slots(object, attributes = nil)
+    return Array(@file_trash_slots) if attributes.nil? && !@file_trash_slots.nil? && object == @object
+
     attributes ||= @inline_forms_attribute_list || object.inline_forms_attribute_list
     attributes.filter_map do |attribute, form_element, *|
       next unless form_element.to_s == "simple_file_field"

data/app/models/concerns/inline_forms/stored_files.rb

@@ -56,7 +56,8 @@ module InlineForms::StoredFiles
   # * undo of a destroy (row gone): copy each slot's newest restorable
   #   record_destroyed entry onto the record BEFORE the save, so presence
   #   validations on the filename pass; a slot whose file was purged in the
-  #   meantime comes back empty (never a name without bytes).
+  #   meantime comes back empty (never a name without bytes). An entry whose
+  #   bytes fail their SHA-256 check raises NotRestorable (nothing restored).
   # * row exists already (replayed undo): nothing; persist_reverted_primary!
   #   leaves the slot columns alone.
   def self.prepare_revert!(record)
@@ -73,6 +74,9 @@ module InlineForms::StoredFiles
       entry = InlineForms::TrashedFile.lock.for_slot(record, attribute)
                 .where(reason: "record_destroyed").restorable.newest_first.first
       if entry
+        # Same integrity check as TrashedFile#restore!: a mismatch raises
+        # NotRestorable and the whole revert rolls back.
+        InlineForms::TrashedFile.verify_checksum!(id: entry.id, data: entry.data, checksum: entry.checksum)
         record.send(:write_attribute, slot[:data], entry.data)
         record.send(:write_attribute, attribute.to_s, entry.filename)
         record.send(:write_attribute, slot[:content_type], entry.content_type)

data/app/models/inline_forms/trashed_file.rb

@@ -85,6 +85,18 @@ class InlineForms::TrashedFile < ActiveRecord::Base
     )
   end
 
+  # Restoring writes the stored bytes back into a live slot, so they must be
+  # the bytes that were trashed: compares the SHA-256 recorded by trash!
+  # (nil data has a nil checksum). Raises NotRestorable on a mismatch, before
+  # anything is written, so the caller's transaction rolls back; the mismatch
+  # is logged (a tampered or corrupted trash row needs a look).
+  def self.verify_checksum!(id:, data:, checksum:)
+    return if checksum == (data && Digest::SHA256.hexdigest(data))
+
+    Rails.logger.error("inline_forms file_trash checksum mismatch entry=#{id}: not restored")
+    raise NotRestorable, "this file failed its integrity check and cannot be restored"
+  end
+
   # Purges every trash row whose retention has passed. Returns the number
   # purged. Idempotent; safe to run while users work.
   def self.purge_expired!
@@ -189,14 +201,16 @@ class InlineForms::TrashedFile < ActiveRecord::Base
       record = record_class.unscoped.lock.find_by(record_class.primary_key => record_id)
       raise RecordGone, "the record was deleted" unless record
 
-      payload = self.class.lock.where(id: id).restorable.pick(:data, :filename, :content_type)
+      payload = self.class.lock.where(id: id).restorable.pick(:data, :filename, :content_type, :checksum)
       raise NotRestorable, "this file can no longer be restored" unless payload
 
+      data, filename, content_type, checksum = payload
+      self.class.verify_checksum!(id: id, data: data, checksum: checksum)
+
       now = Time.current
       count = self.class.where(id: id).restorable.update_all(data: nil, restored_at: now, restored_by_id: by, updated_at: now)
       raise NotRestorable, "this file can no longer be restored" unless count == 1
 
-      data, filename, content_type = payload
       record.inline_forms_put_file!(attribute_name, data: data, filename: filename, content_type: content_type, by: by)
       reload
       record

data/app/views/devise/sessions/_form.html.erb

@@ -26,13 +26,13 @@
         <%= f.check_box :remember_me %><label><%= t :remember_me %></label>
       </div>
       <div class="small-7 columns text-right">
-        <%= f.submit :login, class: 'button' %>
+        <%= f.submit t("inline_forms.devise.login", default: "login"), class: 'button' %>
       </div>
     </div>
   <% else %>
     <div class="row">
       <div class="columns text-right">
-        <%= f.submit :login, class: 'button' %>
+        <%= f.submit t("inline_forms.devise.login", default: "login"), class: 'button' %>
       </div>
     </div>
   <% end -%>

data/app/views/inline_forms/_list.html.erb

@@ -42,11 +42,16 @@
   <% end %>
 <% end %>
 
-<%# List root is `<turbo-frame class="list_container">` (Step 4). See SCSS. %>
-<% if ul_needed -%>
-  <%= raw "<turbo-frame id=\"#{update_span}\" class=\"list_container\">" -%>
-<% end -%>
-
+<%#
+  List root is `<turbo-frame class="list_container">` (Step 4). See SCSS.
+  The rows and pagination are captured and wrapped with tag.turbo_frame at
+  the end, so the frame id is attribute-escaped: it is built from request
+  params (parent_class / parent_id / update), and the former
+  `raw "<turbo-frame id=\"#{update_span}\" …>"` put a crafted parent_id
+  straight into the page (reflected XSS). The controller also refuses
+  malformed parent params (refuse_malformed_parent_params).
+-%>
+<% list_body = capture do -%>
 <!--  # list of objects -->
 <% for object in objects %>
   <% if parent_class.nil?  %>
@@ -111,8 +116,17 @@
 <% end -%>
 <!--  # pagination -->
 <% if parent_id.nil? -%>
+  <%#
+    Page 2 of a filtered list must stay filtered (search and a host's own
+    filters such as first_name / sorteer / group[id]). will_paginate does
+    that itself: it puts the request's params (all params on GET, the query
+    string otherwise) into every page link, except script_name and
+    original_script_name. Do not merge request.query_parameters in here:
+    explicit params skip that exclusion, so ?script_name=javascript:… became
+    the start of every page link's href (XSS), and ?controller=x a 500.
+    test/integration/list_params_test.rb covers both.
+  -%>
   <% paginate_params = { update: update_span, ul_needed: true } %>
-  <% paginate_params[:search] = params[:search] if params[:search].present? %>
   <% pagination = will_paginate objects, params: paginate_params %>
 <% else %>
   <% if pagination %>
@@ -144,6 +158,9 @@
     </div>
   </div>
 <% end %>
+<% end -%>
 <% if ul_needed -%>
-  <%= raw "</turbo-frame>" -%>
+  <%= tag.turbo_frame(list_body, id: update_span, class: "list_container") -%>
+<% else -%>
+  <%= list_body -%>
 <% end -%>

data/app/views/inline_forms/_versions.html.erb

@@ -7,7 +7,7 @@
     (parent + rich_text), flickering as the user toggled the panel. -%>
 <div class="row form_element_header associated_auto_header callout">
   <div class='medium-11 large-11 column' >
-    <%= "Versions (#{inline_forms_history_for(object).length})" %>
+    <%= t("inline_forms.view.versions", count: inline_forms_history_for(object).length) %>
   </div>
   <div class='medium-1 large-1 column'>
       <%= link_to_versions_list(

data/app/views/inline_forms/_versions_file_entry.html.erb

@@ -23,7 +23,7 @@
     <%= t("inline_forms.files.event.#{entry[:file_event]}") %>
   </div>
   <div class="small-2 column">
-    <%= entry[:at] %>
+    <%= l(entry[:at], format: :short) %>
   </div>
   <div class="small-2 column">
     <%= inline_forms_file_user_name(entry[:by]) %>

data/app/views/inline_forms/_versions_list.html.erb

@@ -4,7 +4,7 @@
 <% restorable_files = inline_forms_restorable_file_entries(@object, entries.filter_map { |e| e[:entry]&.attribute_name }.uniq) -%>
 <div class="row form_element_header associated_auto_header callout">
   <div class='medium-11 large-11 column' >
-    <%= "Versions (#{entries.length})" %>
+    <%= t("inline_forms.view.versions", count: entries.length) %>
   </div>
   <div class='medium-1 large-1 column'>
     <%= close_versions_list_link(
@@ -32,16 +32,16 @@
     &nbsp;
   </div>
   <div class="small-1 column">
-    <strong>Event</strong>
+    <strong><%= t("inline_forms.view.versions_event") %></strong>
   </div>
   <div class="small-2 column">
-    <strong>When</strong>
+    <strong><%= t("inline_forms.view.versions_when") %></strong>
   </div>
   <div class="small-2 column">
-    <strong>Done by</strong>
+    <strong><%= t("inline_forms.view.versions_done_by") %></strong>
   </div>
   <div class="small-6 column">
-    <strong>Changeset</strong>
+    <strong><%= t("inline_forms.view.versions_changeset") %></strong>
   </div>
 </div>
 <% entries.reverse.each do |entry| %>
@@ -92,17 +92,17 @@
       <% end %>
     </div>
     <div class="small-1 column">
-      <%= version.event -%><% if entry[:kind] == :rich_text %> <em>(rich text)</em><% end %>
+      <%= t("inline_forms.view.version_events.#{version.event}", default: version.event) -%><% if entry[:kind] == :rich_text %> <em>(<%= t("inline_forms.view.versions_rich_text") %>)</em><% end %>
     </div>
     <div class="small-2 column">
-      <%= version.created_at -%>
+      <%= l(version.created_at, format: :short) -%>
     </div>
     <div class="small-2 column">
       <%= version_modified_by version.whodunnit -%>
     </div>
     <div class="small-6 column">
       <% if version.changeset.nil? || version.changeset.empty? %>
-        <em>empty</em>
+        <em><%= t("inline_forms.view.versions_empty") %></em>
       <% else %>
         <% version.changeset.each do |attribute, value| %>
           <% next if attribute == 'updated_at' %>
@@ -116,13 +116,15 @@
               <th></th>
             </tr>
             <tr>
-              <td>old value</td>
-              <td>new value</td>
+              <td><%= t("inline_forms.view.versions_old_value") %></td>
+              <td><%= t("inline_forms.view.versions_new_value") %></td>
             </tr>
             <tr>
               <% if entry[:kind] == :rich_text && attribute == 'body' %>
-                <td><%= raw value[0] %></td>
-                <td><%= raw value[1] %></td>
+                <%# Rich-text HTML as stored in the version: sanitized, never
+                    raw (a body posted outside Trix may carry script). -%>
+                <td><%= sanitize value[0].to_s %></td>
+                <td><%= sanitize value[1].to_s %></td>
               <% else %>
                 <td><%= value[0] %></td>
                 <td><%= value[1] %></td>

data/app/views/layouts/application.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html lang="<%= I18n.locale %>">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
@@ -11,6 +11,9 @@
     <%= stylesheet_link_tag "trix" %>
     <%= inline_forms_user_color_overrides_style %>
     <%= csrf_meta_tags %>
+    <%# Publishes the CSP nonce (nothing without a nonce generator) for the %>
+    <%# scripts Turbo inserts. %>
+    <%= csp_meta_tag %>
   </head>
 
   <body class="<%= inline_forms_body_theme_class %>">
@@ -19,10 +22,14 @@
     <%# Turbo (Hotwire) is loaded as an ES module so it does not collide with %>
     <%# the classic-script Sprockets bundle above. Drive uses the Turbo default %>
     <%# (enabled). %>
-    <script type="module">
+    <%# The nonce: hosts run a CSP with script-src 'nonce-…' (nil, so no %>
+    <%# attribute, without a nonce generator). data-turbo-eval="false": Turbo %>
+    <%# Drive must not re-run it on visits (Turbo is loaded; a re-inserted %>
+    <%# copy would carry a newer nonce the page's policy rejects). %>
+    <%= tag.script type: "module", nonce: content_security_policy_nonce, data: { turbo_eval: false } do %>
       import { Turbo } from "<%= asset_path('turbo.min.js') %>"
       window.Turbo = Turbo
-    </script>
+    <% end %>
     <%# Trix 2 (vendored; no CDN). Self-registers its custom elements on load. %>
     <%= javascript_include_tag "trix.min" %>
   </body>

data/app/views/layouts/devise.html.erb

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html lang="<%= I18n.locale %>">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />

data/app/views/layouts/inline_forms.html.erb

@@ -14,6 +14,9 @@
     <%= stylesheet_link_tag "trix" %>
     <%= inline_forms_user_color_overrides_style %>
     <%= csrf_meta_tags %>
+    <%# Publishes the CSP nonce (nothing without a nonce generator) for the %>
+    <%# scripts Turbo inserts. %>
+    <%= csp_meta_tag %>
   </head>
 
   <body class="<%= inline_forms_body_theme_class %>">
@@ -40,10 +43,14 @@
     <%# Turbo (Hotwire) is loaded as an ES module so it does not collide with %>
     <%# the classic-script Sprockets bundle above. Drive stays at the default %>
     <%# (enabled); inline interactions use `<turbo-frame>` + HTML responses. %>
-    <script type="module">
+    <%# The nonce: hosts run a CSP with script-src 'nonce-…' (nil, so no %>
+    <%# attribute, without a nonce generator). data-turbo-eval="false": Turbo %>
+    <%# Drive must not re-run it on visits (Turbo is loaded; a re-inserted %>
+    <%# copy would carry a newer nonce the page's policy rejects). %>
+    <%= tag.script type: "module", nonce: content_security_policy_nonce, data: { turbo_eval: false } do %>
       import { Turbo } from "<%= asset_path('turbo.min.js') %>"
       window.Turbo = Turbo
-    </script>
+    <% end %>
     <%# Trix 2 (vendored; no CDN). Self-registers its custom elements on load. %>
     <%= javascript_include_tag "trix.min" %>
   </body>

data/lib/inline_forms/form_elements/file_field_helper.rb

@@ -9,7 +9,9 @@ module InlineForms
       o = object.send(attribute)
       msg = o.to_s
       if o.send(:present?)
-        msg = "replace | <a href='#{o.send(:url)}'>#{o.send(:path).gsub(/^.*\//,'')}</a>".html_safe
+        # The stored file name and url are data: escape them before the
+        # string is marked html_safe.
+        msg = "replace | <a href='#{ERB::Util.h(o.send(:url))}'>#{ERB::Util.h(o.send(:path).gsub(/^.*\//,''))}</a>".html_safe
       end
         link_to_inline_edit object, attribute, msg, from_callee: __callee__
     end

data/lib/inline_forms/form_elements/info_list_helper.rb

@@ -11,7 +11,9 @@ module InlineForms
       out = "<div class='row #{cycle('odd', 'even')}'>--</div>" if object.send(attribute).empty? 
       object.send(attribute).sort.each do | item |
         out << "<div class='row #{cycle('odd', 'even')}'>"
-        out << item._presentation
+        # _presentation is model data (e.g. a User's name listed on a Role):
+        # escape it, the whole string is marked html_safe below.
+        out << ERB::Util.h(item._presentation)
         out << '</div>'
       end
       out.html_safe

data/lib/inline_forms/version.rb

@@ -1,5 +1,5 @@
 # -*- encoding : utf-8 -*-
 
 module InlineForms
-  VERSION = "8.1.56"
+  VERSION = "8.1.57"
 end

data/lib/locales/inline_forms.en.yml

@@ -14,6 +14,7 @@ en:
       sign_up: sign up
       login_with_email_and_password: login with email and password
       sign_in: sign in
+      login: login
       links:
         no_unlock_instructions: did you not receive unlock instructions?
         sign_up: sign up
@@ -31,6 +32,20 @@ en:
       trash: trash
       list_versions: List versions
       close_versions_list: Close versions list
+      undelete: undelete
+      versions: Versions (%{count})
+      versions_event: Event
+      versions_when: When
+      versions_done_by: Done by
+      versions_changeset: Changeset
+      versions_old_value: old value
+      versions_new_value: new value
+      versions_empty: empty
+      versions_rich_text: rich text
+      version_events:
+        create: create
+        update: update
+        destroy: destroy
     files:
       download: download
       replace: replace file
@@ -116,7 +131,13 @@ en:
           expired: expired
     pending_migration:
       notice: "pending migration \u2014 run rails db:migrate"
-  succes: success.
+  # The create flash (InlineFormsController#create). Was misspelled
+  # `succes`, so t("success") was missing in every app.
+  success: "%{message} created."
+  # The engine header (inline_forms/_header): the More menu and logout.
+  common:
+    more: more...
+    logout: logout
   activerecord:
     models:
       language: language

data/lib/locales/inline_forms.nl.yml

@@ -14,6 +14,7 @@ nl:
       sign_up: inschrijven
       login_with_email_and_password: aanmelden door email-adres en wachtwoord in te voeren.
       sign_in: aanmelden
+      login: inloggen
       links:
         no_unlock_instructions: geen instructies ontvangen om blokkade op te heffen?
         sign_up: inschrijven
@@ -27,7 +28,24 @@ nl:
       close: sluiten
       add_new: Maak een nieuw %{model}
       undo: terughalen
+      restore: terugzetten
       trash: weggooien
+      undelete: terughalen
+      list_versions: versies tonen
+      close_versions_list: versies verbergen
+      versions: Versies (%{count})
+      versions_event: Gebeurtenis
+      versions_when: Wanneer
+      versions_done_by: Door
+      versions_changeset: Wijzigingen
+      versions_old_value: oude waarde
+      versions_new_value: nieuwe waarde
+      versions_empty: leeg
+      versions_rich_text: opgemaakte tekst
+      version_events:
+        create: aangemaakt
+        update: gewijzigd
+        destroy: verwijderd
     files:
       download: downloaden
       replace: bestand vervangen
@@ -113,7 +131,13 @@ nl:
           expired: verlopen
     pending_migration:
       notice: "migratie in afwachting \u2014 draai rails db:migrate"
-  succes: het ding is aangemaakt.
+  # The create flash (InlineFormsController#create). Was misspelled
+  # `succes`, so t("success") was missing in every app.
+  success: "%{message} is aangemaakt."
+  # The engine header (inline_forms/_header): the More menu and logout.
+  common:
+    more: meer...
+    logout: uitloggen
   activerecord:
     models:
       language: taal

data/test/dummy/config/application.rb

@@ -17,6 +17,9 @@ require "action_view/railtie"
 Bundler.require(*Rails.groups)
 
 require "inline_forms"
+# Host apps list rails-i18n in their Gemfile (the installer writes it): the
+# Rails strings for nl (time/date formats, ...) the gem's views localize with.
+require "rails-i18n"
 # The schema-GUI engine (separate gem, same repo; on the load path via the
 # Gemfile's test group). Its integration tests live in test/integration/.
 require "inline_forms_schema_edit"
@@ -34,5 +37,13 @@ module Dummy
     config.active_record.maintain_test_schema = false
     # Raise in-place so integration failures carry the real backtrace.
     config.action_dispatch.show_exceptions = :none
+    # A nonce-based CSP like StProject's (report-only): the layouts' inline
+    # script must carry the per-request nonce (test/integration/csp_nonce_test.rb).
+    config.content_security_policy do |policy|
+      policy.script_src :self
+    end
+    config.content_security_policy_nonce_generator = ->(_request) { SecureRandom.base64(16) }
+    config.content_security_policy_nonce_directives = %w[script-src]
+    config.content_security_policy_report_only = true
   end
 end

data/test/integration/csp_nonce_test.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Host apps run a CSP with script-src 'nonce-…' (StProject; the dummy app is
+# configured the same way, report-only). Every inline <script> the gem's
+# layouts render carries the request's nonce, and the nonce is published in
+# a csp-nonce meta tag for the scripts Turbo inserts. The unused
+# inline_forms/_flash partial (an inline jQuery <script>) is gone.
+class CspNonceTest < InlineFormsIntegrationTestCase
+  def header_nonce
+    policy = response.headers["Content-Security-Policy-Report-Only"].to_s
+    policy[/'nonce-([^']+)'/, 1]
+  end
+
+  def inline_scripts(html)
+    html.scan(/<script\b[^>]*>/).reject { |tag| tag.include?(" src=") }
+  end
+
+  def assert_inline_scripts_nonced(html, nonce)
+    scripts = inline_scripts(html)
+    assert_predicate scripts, :any?, "the layout's Turbo module script"
+    scripts.each { |tag| assert_includes tag, %(nonce="#{nonce}"), tag }
+  end
+
+  test "the inline_forms layout nonces its inline script and publishes the nonce" do
+    get widgets_path
+
+    assert_response :success
+    nonce = header_nonce
+    assert nonce, "precondition: the dummy sends a nonce-based CSP"
+    assert_inline_scripts_nonced(response.body, nonce)
+    assert_match %r{<script type="module" nonce="#{Regexp.escape(nonce)}" data-turbo-eval="false">\s*import \{ Turbo \}}, response.body
+    assert_includes response.body, %(<meta name="csp-nonce" content="#{nonce}" />)
+  end
+
+  test "the application layout nonces its inline script too" do
+    get widgets_path
+    nonce = header_nonce
+    html = controller.render_to_string(template: "stats/show", layout: "application")
+
+    assert_inline_scripts_nonced(html, nonce)
+    assert_includes html, %(<meta name="csp-nonce" content="#{nonce}" />)
+  end
+
+  test "the unused inline_forms/_flash partial with its inline script is gone" do
+    get widgets_path
+    refute controller.lookup_context.exists?("flash", [ "inline_forms" ], true)
+  end
+end

data/test/integration/file_slots_test.rb

@@ -299,6 +299,44 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_nil @doc.reload.data
   end
 
+  # The stored SHA-256 is checked before bytes go back into a slot: a
+  # tampered (or corrupted) trash row is refused, nothing is written, and the
+  # row stays in the trash.
+  test "restore refuses a trash row whose bytes do not match its checksum" do
+    with_file
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+    InlineForms::TrashedFile.where(id: entry.id).update_all(data: OTHER)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame),
+         headers: stream_headers(@frame)
+
+    assert_response :success
+    assert_includes response.body, "can no longer be restored"
+    @doc.reload
+    assert_nil @doc.filename
+    assert_nil @doc.data
+    assert entry.reload.trashed?, "not marked restored"
+    assert_equal OTHER, entry.file_data, "the row is left as it is, for a look"
+  end
+
+  test "restore! raises and logs on a checksum mismatch, writing nothing" do
+    with_file
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+    InlineForms::TrashedFile.where(id: entry.id).update_all(checksum: Digest::SHA256.hexdigest("something else"))
+    log = StringIO.new
+    original_logger = Rails.logger
+    Rails.logger = ActiveSupport::Logger.new(log)
+
+    assert_raises(InlineForms::TrashedFile::NotRestorable) { entry.reload.restore!(by: 1) }
+
+    assert_includes log.string, "checksum mismatch entry=#{entry.id}"
+    assert_nil @doc.reload.data
+    assert entry.reload.trashed?
+    assert_equal 0, trash.where(reason: "replaced").count
+  ensure
+    Rails.logger = original_logger
+  end
+
   test "a trash entry of another record is not found" do
     other = Document.create!(title: "Dossier B", filename: upload(PLAN))
     entry = other.inline_forms_remove_file!(:filename, by: 1)
@@ -414,6 +452,43 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_includes response.body, "restorable until"
   end
 
+  # FileSlotsConcern has no per-tab attribute list, so the field it
+  # re-renders used to build its links' slots= from the model's full list:
+  # after a restore on one tab, the next action's panel (and the versions
+  # panel) listed the other tabs' slots. The page's own slots param now
+  # carries through.
+  test "a file action re-renders with the page's slots only" do
+    with_file
+    @doc.update!(plan_filename: upload(OTHER, "other-tab.pdf"))
+    @doc.inline_forms_remove_file!(:plan_filename, by: 1)
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame,
+                                          slots: "filename", panel: "open"),
+         headers: stream_headers(@frame)
+
+    assert_response :success
+    assert_equal PLAN, @doc.reload.data
+    remove_link = response.body[%r{href="([^"]*/remove_file\?[^"]*)"}, 1]
+    assert remove_link, "the restored field offers remove"
+    assert_equal "filename", Rack::Utils.parse_query(URI.parse(CGI.unescapeHTML(remove_link)).query)["slots"]
+    refute_includes response.body, "other-tab.pdf", "neither the trash panel nor the versions panel lists the other slot"
+  end
+
+  test "a file action's slots param is reduced to declared, listed slots" do
+    with_file
+    @doc.update!(plan_filename: upload(OTHER, "other-tab.pdf"))
+    @doc.inline_forms_remove_file!(:plan_filename, by: 1)
+    entry = @doc.inline_forms_remove_file!(:filename, by: 1)
+
+    post restore_file_document_path(@doc, attribute: "filename", trash_id: entry.id, update: @frame,
+                                          slots: "filename,title,data", panel: "open"),
+         headers: stream_headers(@frame)
+
+    remove_link = response.body[%r{href="([^"]*/remove_file\?[^"]*)"}, 1]
+    assert_equal "filename", Rack::Utils.parse_query(URI.parse(CGI.unescapeHTML(remove_link)).query)["slots"]
+  end
+
   test "the panel needs :read_file_trash" do
     Ability.restrictions = -> { cannot :read_file_trash, Document }
     panel = "document_#{@doc.id}_file_trash"
@@ -456,6 +531,22 @@ class FileSlotsTest < InlineFormsIntegrationTestCase
     assert_nil restored.data
   end
 
+  test "undoing a destroy refuses a tampered trash row: nothing is restored" do
+    with_file
+    row = "document_#{@doc.id}"
+    delete document_path(@doc, update: row), headers: frame_headers(row)
+    entry = trash.where(reason: "record_destroyed").sole
+    InlineForms::TrashedFile.where(id: entry.id).update_all(data: OTHER)
+
+    version = PaperTrail::Version.where(item_type: "Document", item_id: @doc.id, event: "destroy").last
+    post revert_document_path(version.id, update: "documents_list"), headers: stream_headers("documents_list")
+
+    assert_response :unprocessable_entity
+    refute Document.exists?(@doc.id), "the revert rolled back"
+    assert entry.reload.trashed?
+    assert_equal OTHER, entry.file_data
+  end
+
   test "reverting an update never touches a slot, even from an old version carrying a filename" do
     with_file
     @doc.update!(title: "Renamed")

data/test/integration/list_params_test.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Request params that end up in a list's markup.
+#
+# * parent_class / parent_id: _list built the nested frame as
+#   `raw "<turbo-frame id=\"#{update_span}\" …>"` with update_span made from
+#   params[:parent_id], and constantized params[:parent_class]; nothing found
+#   the parent before the render, so a crafted parent_id was reflected into
+#   the page. The controller now refuses malformed parent params (400) in
+#   index/new/create/show, and the frame is built with tag.turbo_frame.
+# * pagination: the page links carry every filter of the query string, not
+#   just `search`.
+#
+# Part and DailyReport belong to Machine; Widget is a top-level list
+# (per_page 7, see ApplicationRecord).
+class ListParamsTest < InlineFormsIntegrationTestCase
+  PAYLOAD = %("><img src=x onerror=alert(1)>)
+
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @part = Part.create!(name: "Gear", machine: @machine)
+    @list_frame = "machine_#{@machine.id}_parts_list"
+  end
+
+  def assert_refused_without_payload
+    assert_response :bad_request
+    assert controller.instance_variable_defined?(:@_authorized),
+      "the refusal runs after authorization (check_authorization stays satisfied)"
+    refute_includes response.body, "<img"
+  end
+
+  def nested(parent_id: @machine.id, parent_class: "Machine", update: @list_frame)
+    { parent_class: parent_class, parent_id: parent_id, update: update, ul_needed: 1 }
+  end
+
+  # ---- malformed parent params --------------------------------------------
+
+  test "a crafted parent_id on the nested list is a 400 and never rendered" do
+    get parts_path(nested(parent_id: PAYLOAD, update: "x")), headers: frame_headers("x")
+    assert_refused_without_payload
+  end
+
+  test "a crafted parent_id is refused on a full-page visit too" do
+    get parts_path(nested(parent_id: PAYLOAD, update: "x"))
+    assert_refused_without_payload
+  end
+
+  test "a parent_class that is not an association of the model is a 400" do
+    %w[Widget Kernel machine Machines ActiveRecord::Base].each do |parent_class|
+      get parts_path(nested(parent_class: parent_class)), headers: frame_headers(@list_frame)
+      assert_response :bad_request, "parent_class=#{parent_class}"
+    end
+  end
+
+  test "a non-integer parent_id is a 400, with or without parent_class" do
+    [ "1 OR 1=1", "-1", "1.5", "" ].each do |parent_id|
+      get parts_path(nested(parent_id: parent_id)), headers: frame_headers(@list_frame)
+      assert_response :bad_request, "parent_id=#{parent_id.inspect}"
+    end
+    get parts_path(parent_id: PAYLOAD, update: "x")
+    assert_refused_without_payload
+  end
+
+  test "new with crafted parent params is a 400" do
+    get new_part_path(nested(parent_id: PAYLOAD, update: "machine_#{@machine.id}_parts")),
+        headers: frame_headers("machine_#{@machine.id}_parts")
+    assert_refused_without_payload
+
+    get new_part_path(nested(parent_class: "Widget", update: "machine_#{@machine.id}_parts")),
+        headers: frame_headers("machine_#{@machine.id}_parts")
+    assert_response :bad_request
+  end
+
+  test "create with crafted parent params is a 400 and creates nothing" do
+    frame = "machine_#{@machine.id}_parts"
+    assert_no_difference -> { Part.count } do
+      post parts_path(nested(parent_id: PAYLOAD, update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+      assert_refused_without_payload
+      post parts_path(nested(parent_class: "Widget", update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+      assert_response :bad_request
+    end
+  end
+
+  test "show with a crafted parent_id is a 400" do
+    row = "machine_#{@machine.id}_part_#{@part.id}"
+    get part_path(@part, update: row, parent_class: "Machine", parent_id: PAYLOAD), headers: frame_headers(row)
+    assert_refused_without_payload
+  end
+
+  # ---- well-formed nested lists still work --------------------------------
+
+  test "a well-formed nested list renders its frame and rows" do
+    get parts_path(nested), headers: frame_headers(@list_frame)
+
+    assert_response :success
+    assert_includes response.body, %(<turbo-frame id="#{@list_frame}" class="list_container">)
+    assert_includes response.body, "Gear"
+  end
+
+  test "well-formed nested new and create still work" do
+    frame = "machine_#{@machine.id}_parts"
+    get new_part_path(nested(update: frame)), headers: frame_headers(frame)
+    assert_response :success
+
+    assert_difference -> { @machine.parts.count }, 1 do
+      post parts_path(nested(update: frame)), params: { name: "Bolt" }, headers: frame_headers(frame)
+    end
+    assert_response :success
+  end
+
+  test "the nested list of a not_accessible_through_html? child still renders" do
+    DailyReport.create!(name: "Monday", machine: @machine)
+    frame = "machine_#{@machine.id}_daily_reports_list"
+    get daily_reports_path(parent_class: "Machine", parent_id: @machine.id, update: frame, ul_needed: 1),
+        headers: frame_headers(frame)
+
+    assert_response :success
+    assert_includes response.body, "Monday"
+  end
+
+  test "the list frame id is attribute-escaped by the partial itself" do
+    html = PartsController.render(
+      partial: "inline_forms/list",
+      assigns: { Klass: Part, parent_class: "Machine", parent_id: PAYLOAD, ul_needed: "1",
+                 objects: Part.where(id: @part.id).paginate(page: 1) }
+    )
+
+    refute_includes html, "<img"
+    assert_includes html, %(<turbo-frame id="machine_&quot;&gt;&lt;img src=x onerror=alert(1)&gt;_parts_list" class="list_container">)
+  end
+
+  # ---- pagination keeps the filters ---------------------------------------
+
+  test "page links of a filtered list carry every filter" do
+    9.times { |i| Widget.create!(name: "Match #{i}") }
+    Widget.create!(name: "Other")
+
+    get widgets_path(search: "Match", sorteer: "name", first_name: "An", group: { id: 3 }, status: { id: 4 },
+                     update: "widgets_list"),
+        headers: frame_headers("widgets_list")
+
+    assert_response :success
+    page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+    assert page_link, "a link to page 2"
+    query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(page_link)).query)
+    assert_equal "Match", query["search"]
+    assert_equal "name", query["sorteer"]
+    assert_equal "An", query["first_name"]
+    assert_equal({ "id" => "3" }, query["group"])
+    assert_equal({ "id" => "4" }, query["status"])
+    assert_equal "widgets_list", query["update"]
+    assert_equal "2", query["page"]
+
+    get CGI.unescapeHTML(page_link), headers: frame_headers("widgets_list")
+    assert_response :success
+    back = response.body[/href="([^"]*page=1[^"]*)"/, 1]
+    assert back, "a link back to page 1"
+    back_query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(back)).query)
+    assert_equal "Match", back_query["search"]
+    assert_equal({ "id" => "3" }, back_query["group"])
+    refute_includes response.body, "Other"
+  end
+
+  test "page links of a list rendered after create keep the request's filters" do
+    9.times { |i| Machine.create!(name: "Match #{i}") }
+
+    post machines_path(update: "machines_list", search: "Match", sorteer: "name"),
+         params: { name: "Match 9" }, headers: frame_headers("machines_list")
+
+    assert_response :success
+    page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+    assert page_link, "a link to page 2"
+    query = Rack::Utils.parse_nested_query(URI.parse(CGI.unescapeHTML(page_link)).query)
+    assert_equal "Match", query["search"]
+    assert_equal "name", query["sorteer"]
+  end
+
+  # url_for options in the query string must not shape the page links.
+  # will_paginate leaves out script_name / original_script_name; merging
+  # request.query_parameters into the links bypassed that, so the payload
+  # became the start of every page link's href, and controller= raised.
+  test "url options in the query string never reach the page links" do
+    9.times { |i| Widget.create!(name: "W #{i}") }
+
+    %w[script_name original_script_name].each do |option|
+      get "/widgets?update=widgets_list&#{option}=javascript:alert(1)//", headers: frame_headers("widgets_list")
+      assert_response :success
+      page_link = response.body[/href="([^"]*page=2[^"]*)"/, 1]
+      assert page_link, "a link to page 2"
+      assert page_link.start_with?("/widgets?"), "#{option} shaped the page link: #{page_link}"
+      refute_includes response.body, "javascript:alert"
+    end
+
+    get "/widgets?update=widgets_list&controller=widgets_x", headers: frame_headers("widgets_list")
+    assert_response :success
+    assert_match %r{href="/widgets\?[^"]*page=2}, response.body
+  end
+end

data/test/integration/locale_test.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# The gem's own strings resolve in en and nl, also under
+# raise_on_missing_translations (StProject switched to :nl with :strict):
+# the create flash (`success`, misspelled `succes` in both locale files), the
+# versions panel (was hard-coded English), the nl view keys that were missing
+# (restore, list_versions, close_versions_list, undelete), localized version
+# timestamps, the Devise layout's lang and the sign-in button.
+class LocaleTest < InlineFormsIntegrationTestCase
+  KEYS = %w[
+    success
+    inline_forms.view.restore inline_forms.view.list_versions inline_forms.view.close_versions_list
+    inline_forms.view.undelete inline_forms.view.versions inline_forms.view.versions_event
+    inline_forms.view.versions_when inline_forms.view.versions_done_by inline_forms.view.versions_changeset
+    inline_forms.view.versions_old_value inline_forms.view.versions_new_value inline_forms.view.versions_empty
+    inline_forms.view.versions_rich_text inline_forms.view.version_events.create
+    inline_forms.view.version_events.update inline_forms.view.version_events.destroy
+    inline_forms.devise.login common.more common.logout
+  ].freeze
+
+  setup do
+    @machine = Machine.create!(name: "Press")
+    @machine.update!(name: "Press 2")
+  end
+
+  teardown do
+    I18n.backend.reload!
+  end
+
+  # Every translation the request looks up must exist: a missing one raises,
+  # in the views and in the controller (create's flash).
+  def strictly(locale)
+    original_view = ActionView::Helpers::TranslationHelper.raise_on_missing_translations
+    original_handler = I18n.exception_handler
+    original_default = I18n.default_locale
+    ActionView::Helpers::TranslationHelper.raise_on_missing_translations = true
+    I18n.exception_handler = ->(exception, *) { raise exception.respond_to?(:to_exception) ? exception.to_exception : exception }
+    # with_locale first: it restores the locale it found, so the thread's
+    # locale must not be read after default_locale changed (it would then
+    # restore :nl for every later test).
+    I18n.with_locale(locale) do
+      I18n.default_locale = locale
+      yield
+    end
+  ensure
+    I18n.default_locale = original_default
+    ActionView::Helpers::TranslationHelper.raise_on_missing_translations = original_view
+    I18n.exception_handler = original_handler
+  end
+
+  test "the gem's keys exist in en and nl, and the misspelled succes is gone" do
+    %i[en nl].each do |locale|
+      KEYS.each { |key| assert I18n.exists?(key, locale), "#{locale}.#{key}" }
+      refute I18n.exists?("succes", locale), "#{locale}.succes"
+    end
+    assert_equal "Machine created.", I18n.t("success", message: "Machine", locale: :en)
+    assert_equal "Machine is aangemaakt.", I18n.t("success", message: "Machine", locale: :nl)
+  end
+
+  test "create's success flash translates in nl" do
+    # The model top bar shows t(controller_name): host-supplied, like
+    # StProject's `clients: cliënten`.
+    I18n.backend.store_translations(:nl, machines: "machines")
+    strictly(:nl) do
+      post machines_path(update: "machines_list"), params: { name: "Lathe" }, headers: frame_headers("machines_list")
+    end
+
+    assert_response :success
+    assert_equal "Machine is aangemaakt.", controller.flash[:success]
+  end
+
+  test "the versions panel and list are translated, with localized timestamps" do
+    row = "machine_#{@machine.id}"
+    strictly(:nl) do
+      get machine_path(@machine, update: row), headers: frame_headers(row)
+      assert_response :success
+      assert_includes response.body, "Versies (2)"
+
+      get list_versions_machine_path(@machine, update: row), headers: frame_headers(row)
+    end
+
+    assert_response :success
+    body = response.body
+    %w[Versies Gebeurtenis Wanneer Door Wijzigingen aangemaakt gewijzigd terugzetten].each do |text|
+      assert_includes body, text
+    end
+    refute_includes body, "<strong>Event</strong>"
+    version = @machine.versions.last
+    assert_includes body, ERB::Util.h(I18n.l(version.created_at, format: :short, locale: :nl))
+  end
+
+  test "the versions list in en keeps its English labels" do
+    row = "machine_#{@machine.id}"
+    strictly(:en) do
+      get list_versions_machine_path(@machine, update: row), headers: frame_headers(row)
+    end
+
+    assert_response :success
+    assert_includes response.body, "Versions (2)"
+    assert_includes response.body, "<strong>Event</strong>"
+    assert_includes response.body, "old value"
+  end
+
+  test "the devise and application layouts declare the page language" do
+    get widgets_path
+    I18n.with_locale(:nl) do
+      assert_includes controller.render_to_string(template: "stats/show", layout: "devise"), %(<html lang="nl">)
+      assert_includes controller.render_to_string(template: "stats/show", layout: "application"), %(<html lang="nl">)
+    end
+  end
+end

data/test/integration/presentation_escaping_test.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require_relative "../integration_test_helper"
+
+# Model data that a helper concatenates into a string it marks html_safe must
+# be escaped first. info_list_show did `out << item._presentation`, so a
+# _presentation built from user input (StProject: User#name listed on a Role)
+# ran as markup on every page that showed the list (stored XSS). Same audit:
+# file_field_show (stored file name / url) and the rich-text changeset in the
+# versions list (was `raw`).
+class PresentationEscapingTest < InlineFormsIntegrationTestCase
+  MARKUP = "<img src=x onerror=alert(1)>"
+  ESCAPED = "&lt;img src=x onerror=alert(1)&gt;"
+
+  # A view context of a real request: helpers, can?, url helpers.
+  def view
+    @view ||= begin
+      get widgets_path
+      controller.view_context
+    end
+  end
+
+  test "info_list escapes each item's _presentation" do
+    machine = Machine.create!(name: "Press")
+    Part.create!(name: MARKUP, machine: machine)
+    Part.create!(name: "Gear", machine: machine)
+
+    html = view.info_list_show(machine, :parts)
+
+    refute_includes html, "<img"
+    assert_includes html, ESCAPED
+    assert_includes html, "Gear"
+    assert_includes html, "<div class='row", "the row markup itself is kept"
+  end
+
+  test "file_field escapes the stored file name and url" do
+    widget = Widget.create!(name: "Manual")
+    stored = Struct.new(:url, :path) do
+      def present? = true
+      def to_s = url
+    end.new(%(/uploads/x'><img src=x onerror=alert(1)>.pdf), %(/uploads/#{MARKUP}.pdf))
+    widget.define_singleton_method(:manual) { stored }
+
+    html = view.file_field_show(widget, :manual)
+
+    refute_includes html, "<img"
+    assert_includes html, ESCAPED
+  end
+
+  test "dropdown_with_other and the list rows escape _presentation" do
+    kind = Kind.create!(name: MARKUP)
+    widget = Widget.create!(name: MARKUP, kind: kind)
+
+    refute_includes view.dropdown_with_other_show(widget, :kind), "<img"
+
+    get widgets_path(update: "widgets_list"), headers: frame_headers("widgets_list")
+    assert_response :success
+    refute_includes response.body, "<img"
+    assert_includes response.body, ESCAPED
+  end
+
+  test "a rich-text changeset in the versions list is sanitized, not raw" do
+    machine = Machine.create!(name: "Press")
+    version = Struct.new(:id, :event, :changeset, :created_at, :whodunnit) do
+      def to_param = id.to_s
+    end.new(1, "update", { "body" => [ "<p>old</p><script>alert(1)</script>", "<p>new</p>#{MARKUP}" ] }, Time.current, nil)
+    context = view
+    context.instance_variable_set(:@object, machine)
+    context.define_singleton_method(:inline_forms_history_for) do |_object|
+      [ { version: version, kind: :rich_text, rich_text_name: "description", at: version.created_at } ]
+    end
+
+    html = context.render(partial: "inline_forms/versions_list")
+
+    refute_includes html, "<script"
+    refute_includes html, "onerror"
+    assert_includes html, "<p>old</p>"
+    assert_includes html, "<p>new</p>"
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: inline_forms
 version: !ruby/object:Gem::Version
-  version: 8.1.56
+  version: 8.1.57
 platform: ruby
 authors:
 - Ace Suares
@@ -153,7 +153,6 @@ files:
 - app/views/inline_forms/_close.html.erb
 - app/views/inline_forms/_edit.html.erb
 - app/views/inline_forms/_file_slot.html.erb
-- app/views/inline_forms/_flash.html.erb
 - app/views/inline_forms/_generic_search.html.erb
 - app/views/inline_forms/_header.html.erb
 - app/views/inline_forms/_list.html.erb
@@ -314,16 +313,20 @@ files:
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
+- test/integration/csp_nonce_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
 - test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
+- test/integration/list_params_test.rb
+- test/integration/locale_test.rb
 - test/integration/model_top_bar_test.rb
 - test/integration/native_inputs_test.rb
 - test/integration/open_after_create_test.rb
 - test/integration/pending_migration_gate_test.rb
+- test/integration/presentation_escaping_test.rb
 - test/integration/revert_skipped_columns_test.rb
 - test/integration/schema_batch_pipeline_test.rb
 - test/integration/schema_edit_test.rb
@@ -398,16 +401,20 @@ test_files:
 - test/inline_edit_polymorphic_path_test.rb
 - test/inline_forms_addto_generator_test.rb
 - test/inline_forms_generator_test.rb
+- test/integration/csp_nonce_test.rb
 - test/integration/field_authorization_test.rb
 - test/integration/file_slots_test.rb
 - test/integration/html_refusal_test.rb
 - test/integration/inline_forms_crud_test.rb
 - test/integration/layout_title_test.rb
 - test/integration/legacy_elements_test.rb
+- test/integration/list_params_test.rb
+- test/integration/locale_test.rb
 - test/integration/model_top_bar_test.rb
 - test/integration/native_inputs_test.rb
 - test/integration/open_after_create_test.rb
 - test/integration/pending_migration_gate_test.rb
+- test/integration/presentation_escaping_test.rb
 - test/integration/revert_skipped_columns_test.rb
 - test/integration/schema_batch_pipeline_test.rb
 - test/integration/schema_edit_test.rb

data/app/views/inline_forms/_flash.html.erb

@@ -1,13 +0,0 @@
-<% unless flash.empty? %>
-  <% identifier = Time.now.to_i.to_s %>
-  <div class="row" id="flash_<%= identifier %>">
-  <% flash.each do |key, value| %>
-    <%= value %>
-  <% end %>
-  <script>
-    $("#<%= "#{update_span}_auto_header" %>").ScrollTo();
-    $("#flash_<%= identifier %>").delay(1000).fadeToggle('2000');
-  </script>
-  </div>
-<% end %>
-