inquisition 0.2

data/lib/inquisition.rb

@@ -0,0 +1,54 @@
+require 'html5'
+require 'html5lib_sanitize'
+
+# == Introduction
+# 
+# Inquisition will escape html included in specified attributes to
+# eliminate xss-style attacks.
+module Inquisition
+  def self.included(klass)
+    klass.extend(ClassMethods)
+  end
+
+  module ClassMethods
+    def sanitize_attribute(*attributes)
+      sanitize_attribute_reader(*attributes)
+      sanitize_attribute_writer(*attributes)
+    end
+
+    def sanitize_attribute_reader(*attributes)
+      write_inheritable_attribute(:cleansed_attr_readers, attributes)
+      class_inheritable_reader(:cleansed_attr_readers)
+
+      define_method(:read_attribute_with_cleansing) do |attribute|
+        value = read_attribute_without_cleansing(attribute)
+        if cleansed_attr_readers.include?(attribute.to_sym) && !value.blank?
+          HTML5libSanitize.sanitize_html(value)
+        else
+          value
+        end
+      end
+      alias_method_chain :read_attribute, :cleansing
+
+      attributes.each { |attr| define_method(attr.to_sym) { read_attribute(attr.to_sym) } }
+    end
+
+    def sanitize_attribute_writer(*attributes)
+      write_inheritable_attribute(:cleansed_attr_writers, attributes)
+      class_inheritable_reader(:cleansed_attr_writers)
+
+      define_method(:write_attribute_with_cleansing) do |attribute, value|
+        if cleansed_attr_writers.include?(attribute.to_sym) && !value.blank?
+          value = HTML5libSanitize.sanitize_html(value)
+        end
+
+        write_attribute_without_cleansing(attribute, value)
+      end
+      alias_method_chain :write_attribute, :cleansing
+    end
+  end #Class Methods
+end #Inquisition
+
+class Object
+  include Inquisition
+end

data/test/inquisition_test.rb

@@ -0,0 +1,50 @@
+require File.join(File.dirname(__FILE__), 'test_helper')
+
+class InquisitionTest < Test::Unit::TestCase
+  context "a fine Whisky" do
+    setup do
+      @whisky = Whisky.new(:name => "<script>alert('Cragganmore')</script>", 
+        :origin => "<SCRIPT SRC=http://ha.ckers.org/xss.js>Scotland</SCRIPT>", :abv => 42,
+        :description => %Q['';!--"<XSS>=&{()}a buttery scotch])
+    end
+
+    should "have heresy removed from name" do
+      assert_equal "&lt;script&gt;alert('Cragganmore')&lt;/script&gt;", @whisky.name
+    end
+
+    should "remove already-ingrained heresey" do
+      @whisky.instance_variable_set(:@attributes, "name" => "<script>alert('Cragganmore')</script>")
+      assert_equal "&lt;script&gt;alert('Cragganmore')&lt;/script&gt;", @whisky.name
+    end
+
+    should "cleanse heresy before setting" do
+      @whisky.name = "<script>alert('Cragganmore')</script>"
+      private_name = @whisky.attributes["name"]
+
+      assert_equal "&lt;script&gt;alert('Cragganmore')&lt;/script&gt;", private_name
+    end
+
+    should "not cleanse fields not targeted for cleansing" do
+      assert_equal "<SCRIPT SRC=http://ha.ckers.org/xss.js>Scotland</SCRIPT>", @whisky.origin
+    end
+
+    should "not cleanse and set fields not targeted for cleansing" do
+      @whisky.origin = "<SCRIPT SRC=http://ha.ckers.org/xss.js>Scotland</SCRIPT>"
+      private_origin = @whisky.attributes["origin"]
+      assert_equal "<SCRIPT SRC=http://ha.ckers.org/xss.js>Scotland</SCRIPT>", @whisky.origin
+    end
+
+    should "not show pain for setting blank attributes" do
+      @whisky.origin = nil
+      @whisky.name = nil
+      assert_equal nil, @whisky.origin
+      assert_equal nil, @whisky.name
+    end
+
+    should "not show pain for getting blank attributes" do
+      @whisky.update_attributes(:origin => nil, :name => nil)
+      assert_equal nil, @whisky.origin
+      assert_equal nil, @whisky.name
+    end
+  end
+end

data/test/models.rb

@@ -0,0 +1,29 @@
+ActiveRecord::Base.establish_connection :adapter => 'sqlite3', :database => File.join(File.dirname(__FILE__), 'test.db')
+ 
+class CreateSchema < ActiveRecord::Migration
+  def self.up
+    create_table :whiskies, :force => true do |t|
+      t.string :name, :origin, :description
+      t.integer :abv
+    end
+    create_table :animals, :force => true do |t|
+      t.string :name, :noise
+    end
+  end
+end
+
+CreateSchema.suppress_messages { CreateSchema.migrate(:up) }
+
+class Animal < ActiveRecord::Base
+  def bark
+    "#{noise.capitalize}! #{noise.capitalize}!"
+  end
+end
+
+class Whisky < ActiveRecord::Base
+  sanitize_attribute :name, :description
+
+  def drink
+    "You quaffed #{description}"
+  end
+end

data/test/performance.rb

@@ -0,0 +1,29 @@
+require 'benchmark'
+require File.join(File.dirname(__FILE__), 'test_helper')
+
+@whisky = Whisky.new({})
+Benchmark.bmbm do |x|
+  x.report("normal") do 
+    1_000.times do 
+      @whisky.origin = "<script>foo</script>"
+      @whisky.instance_variable_set(:@origin, "<script>foo</script>")
+      @whisky.origin
+    end 
+  end
+  x.report("cleansed") do 
+    1_000.times do 
+      @whisky.name = "<script>foo</script>"
+      @whisky.instance_variable_set(:@name, "<script>foo</script>")
+      @whisky.name
+    end 
+  end
+  x.report("writer only") do 
+    1_000.times do @whisky.name = "<script>foo</script>" end 
+  end
+  x.report("reader only") do 
+    1_000.times do 
+      @whisky.instance_variable_set(:@name, "<script>foo</script>")
+      @whisky.name = "<script>foo</script>" 
+    end 
+  end
+end

data/test/test_helper.rb

@@ -0,0 +1,9 @@
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'rubygems'
+require 'test/unit'
+require 'activerecord'
+require 'activesupport'
+require 'shoulda'
+require 'inquisition'
+require 'models'

metadata

@@ -0,0 +1,75 @@
+--- !ruby/object:Gem::Specification 
+name: inquisition
+version: !ruby/object:Gem::Version 
+  version: "0.2"
+platform: ruby
+authors: 
+- toothrot
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2009-07-06 00:00:00 -05:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: html5
+  type: :runtime
+  version_requirement: 
+  version_requirements: !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: 0.10.0
+    version: 
+description: 
+email: scissorjammer@gmail.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- README.rdoc
+- LICENSE
+files: 
+- VERSION.yml
+- README.rdoc
+- lib/inquisition.rb
+- lib/html5lib_sanitize.rb
+- test/inquisition_test.rb
+- test/performance.rb
+- test/models.rb
+- test/test_helper.rb
+- Rakefile
+- LICENSE
+has_rdoc: true
+homepage: http://github.com/thumblemonks/inquisition
+licenses: []
+
+post_install_message: Choosy heretics choose Thumble Monks.
+rdoc_options: 
+- --inline-source
+- --charset=UTF-8
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.5
+signing_key: 
+specification_version: 2
+summary: Inquisition is a fancy way to protect your ActiveRecord attributes from XSS
+test_files: []
+