inline_svg 1.7.1 → 1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 923ca3f0952247f48b3346decfe83b44216566a52a2f2bf4a9ba117a2626712b
-  data.tar.gz: afef4e221a4e7becce12338289eafe79b60138bd2706ec76a51229a588fe8e5d
+  metadata.gz: fd31243686f41f3d2acfc2f7235685baaab23ca967774d6f642e7f5aab7f2fbc
+  data.tar.gz: 1c6bdf6fc08c4a145c5ecefea9aaa2fe60d2f1d0142c78aed17a73d4acaaa9ce
 SHA512:
-  metadata.gz: 72bc4f1be354aa23bda0bb62814d194568691b9833e21b8da89594eea213f5ce6fc523ea60c04f19a7e23e546826c98a35ba6cf812579162c70bc6a0905c5d09
-  data.tar.gz: c0db9494ac8b67ad61c2dfa38f8b6bb64dad204bbf1978cc86f58600d71ee10f977a38ae74b69b7212293f31eec7ebec183c3c90e14aa274605ebe3972626ec7
+  metadata.gz: baee695644bd79e2561183326818a30f2dd1be7e4262973faacc2fa17ba7970888f9b4beb5cb0ebf2ce9a8c477d99d941f29431bdfaea32d66bd654c244e9545
+  data.tar.gz: 16347bfe873b1f0ab075a43b5f98590a5d2f80cb985849dd7d6c868e4d753a8e5f86209bab55c06e47ea67f89b622132ce3fc88343cbb4a388ae94b798009ca1

data/.github/workflows/integration_test.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        test-branch: [rails3, rails4, master, rails6, rails6-webpacker]
+        test-branch: [rails3, rails4, main, rails6, rails6-webpacker]
     steps:
     - name: Checkout
       uses: actions/checkout@v2

data/CHANGELOG.md

@@ -6,6 +6,11 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 - Nothing
 
+## [1.7.2] - 2020-12-07
+### Fixed
+- Improve performance of `CachedAssetFile`. [#118](https://github.com/jamesmartin/inline_svg/pull/118). Thanks [@stevendaniels](https://github.com/stevendaniels)
+- Avoid XSS by preventing malicious input of filenames. [#117](https://github.com/jamesmartin/inline_svg/pull/117). Thanks [@pbyrne](https://github.com/pbyrne).
+
 ## [1.7.1] - 2020-03-17
 ### Fixed
 - Static Asset Finder uses pathname for compatibility with Sprockets 4+. [#106](https://github.com/jamesmartin/inline_svg/pull/106). Thanks [@subdigital](https://github.com/subdigital)
@@ -234,7 +239,8 @@ transformations](https://github.com/jamesmartin/inline_svg/blob/master/README.md
 ### Added
 - Basic Railtie and view helper to inline SVG documents to Rails views.
 
-[unreleased]: https://github.com/jamesmartin/inline_svg/compare/v1.7.1...HEAD
+[unreleased]: https://github.com/jamesmartin/inline_svg/compare/v1.7.2...HEAD
+[1.7.2]: https://github.com/jamesmartin/inline_svg/compare/v1.7.1...v1.7.2
 [1.7.1]: https://github.com/jamesmartin/inline_svg/compare/v1.7.0...v1.7.1
 [1.7.0]: https://github.com/jamesmartin/inline_svg/compare/v1.6.0...v1.7.0
 [1.6.0]: https://github.com/jamesmartin/inline_svg/compare/v1.5.2...v1.6.0

data/README.md

@@ -98,6 +98,7 @@ key                     | description
 `preserve_aspect_ratio` | adds a `preserveAspectRatio` attribute to the SVG
 `aria`                  | adds common accessibility attributes to the SVG (see [PR #34](https://github.com/jamesmartin/inline_svg/pull/34#issue-152062674) for details)
 `aria_hidden`           | adds the `aria-hidden=true` attribute to the SVG
+`fallback`              | set fallback SVG document
 
 Example:
 
@@ -113,7 +114,8 @@ inline_svg_tag(
   nocomment: true,
   preserve_aspect_ratio: 'xMaxYMax meet',
   aria: true,
-  aria_hidden: true
+  aria_hidden: true,
+  fallback: 'fallback-document.svg'
 )
 ```
 

data/lib/inline_svg/action_view/helpers.rb

@@ -26,6 +26,15 @@ module InlineSvg
 
       private
 
+      def backwards_compatible_html_escape(filename)
+        # html_escape_once was introduced in newer versions of Rails.
+        if ERB::Util.respond_to?(:html_escape_once)
+          ERB::Util.html_escape_once(filename)
+        else
+          ERB::Util.html_escape(filename)
+        end
+      end
+
       def render_inline_svg(filename, transform_params={})
         begin
           svg_file = read_svg(filename)
@@ -55,7 +64,7 @@ module InlineSvg
 
       def placeholder(filename)
         css_class = InlineSvg.configuration.svg_not_found_css_class
-        not_found_message = "'#{filename}' #{extension_hint(filename)}"
+        not_found_message = "'#{backwards_compatible_html_escape(filename)}' #{extension_hint(filename)}"
 
         if css_class.nil?
           return "<svg><!-- SVG file not found: #{not_found_message}--></svg>".html_safe

data/lib/inline_svg/cached_asset_file.rb

@@ -18,6 +18,7 @@ module InlineSvg
       @paths = Array(paths).compact.map { |p| Pathname.new(p) }
       @filters = Array(filters).map { |f| Regexp.new(f) }
       @assets = @paths.reduce({}) { |assets, p| assets.merge(read_assets(assets, p)) }
+      @sorted_asset_keys = assets.keys.sort { |a, b| a.size <=> b.size }
     end
 
     # Public: Finds the named asset and returns the contents as a string.
@@ -39,17 +40,7 @@ module InlineSvg
     # Returns a String representing the key for the named asset or nil if there
     # is no match.
     def key_for_asset(asset_name)
-      match = all_keys_matching(asset_name).sort do |a, b|
-        a.string.size <=> b.string.size
-      end.first
-      match && match.string
-    end
-
-    # Internal: Find all potential asset keys matching the given asset name.
-    #
-    # Returns an array of MatchData objects for keys matching the asset name.
-    def all_keys_matching(asset_name)
-      assets.keys.map { |k| /(#{asset_name})/.match(k.to_s) }.compact
+      @sorted_asset_keys.find { |k| k.include?(asset_name) }
     end
 
     # Internal: Recursively descends through current_paths reading each file it

data/lib/inline_svg/version.rb

@@ -1,3 +1,3 @@
 module InlineSvg
-  VERSION = "1.7.1"
+  VERSION = "1.7.2"
 end

data/spec/helpers/inline_svg_spec.rb

@@ -46,6 +46,17 @@ describe InlineSvg::ActionView::Helpers do
         expect(output).to be_html_safe
       end
 
+      it "escapes malicious input" do
+        malicious = "--></svg><script>alert(1)</script><svg>.svg"
+        allow(InlineSvg::AssetFile).to receive(:named).
+          with(malicious).
+          and_raise(InlineSvg::AssetFile::FileNotFound.new)
+
+        output = helper.send(helper_method, malicious)
+        expect(output).to eq "<svg><!-- SVG file not found: '--&gt;&lt;/svg&gt;&lt;script&gt;alert(1)&lt;/script&gt;&lt;svg&gt;.svg' --></svg>"
+        expect(output).to be_html_safe
+      end
+
       it "gives a helpful hint when no .svg extension is provided in the filename" do
         allow(InlineSvg::AssetFile).to receive(:named).
           with('missing-file-with-no-extension').

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inline_svg
 version: !ruby/object:Gem::Version
-  version: 1.7.1
+  version: 1.7.2
 platform: ruby
 authors:
 - James Martin
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-03-17 00:00:00.000000000 Z
+date: 2020-12-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -200,7 +200,7 @@ homepage: https://github.com/jamesmartin/inline_svg
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -215,9 +215,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Embeds an SVG document, inline.
 test_files: