lazy_form 0.0.2 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 46cb809f06ff9f3f265019d51f973614b47e4ea2
-  data.tar.gz: 2c1bcc21bce9ba0ffde4dee860d05034f55d76e4
+  metadata.gz: ffa4a44f12319d4b5edd758c86137a65a43f75ae
+  data.tar.gz: 8e2dd5cdd07a57e8c25b55f5c401e23d8aa5e158
 SHA512:
-  metadata.gz: 39e24a9f2be2169e232b29fa7a5747a318679a3028bb9fa0e5e79cb4a5da9af299f65cd85eb5fe9e792fda4dbe1c6a971cc0320d61a9e7bf3b90a859cb6380f1
-  data.tar.gz: 4f96c72df723fef854157511359cf5394062c8e82de0ea162cdc407d1e901d95833652a153d142a7a839c3a611924ef4cc6aed170e27fcaec9f1e343dabbb4cf
+  metadata.gz: 99276e23a39f418542d03e8c3a883e45b7444ed852fe5fb4b994ad204c0bc720a5748687bcb5e28c5315e520de8ed30d3865b8cd190e7197205d756ad5026404
+  data.tar.gz: 274db62f40fa14f718de9a5ddafae0b86f41d0822aa4b0bf6e6fc097b7ce69ba141125e9b5484a5ac7eba982ac593b9b6fe19f9617eb34c153d7b612e6684f74

data/lazy_form.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = 'lazy_form'
-  spec.version       = '0.0.2'
+  spec.version       = '0.0.4'
   spec.authors       = ['Patricio Mac Adden']
   spec.email         = ['patriciomacadden@gmail.com']
   spec.summary       = %q{Forms for the rest of us, the lazy.}

data/lib/lazy_form.rb

@@ -1,4 +1,5 @@
 require 'inflecto'
+require 'cgi/escape'
 
 module LazyForm
   module Helper
@@ -23,6 +24,8 @@ module LazyForm
   class Tag
     attr_reader :name, :attributes, :block
 
+    BOOLEAN_ATTRIBUTES = %i(autofocus checked disabled readonly required)
+
     def initialize(name, attributes = {}, &block)
       @name = name
       @attributes = attributes
@@ -46,6 +49,8 @@ module LazyForm
       attributes.collect do |k, v|
         if v.is_a? Hash
           build_attributes Hash[v.collect { |ik, iv| [:"#{k}-#{ik}", iv] }]
+        elsif BOOLEAN_ATTRIBUTES.include? k
+          v ? k : ''
         else
           "#{k}=\"#{v}\""
         end
@@ -57,7 +62,6 @@ module LazyForm
     BUTTONS = %w(button image reset submit)
 
     INPUT_TYPES = [
-      'checkbox',
       'color',
       'date',
       'datetime',
@@ -91,6 +95,18 @@ module LazyForm
       end
     end
 
+    def checkbox(object_attribute, attributes = {})
+      attributes[:id] ||= as_id object_attribute
+      attributes[:name] ||= as_name object_attribute
+      attributes[:type] = 'checkbox'
+      begin
+        attributes[:checked] = :checked if object.send object_attribute
+      rescue NoMethodError
+      end
+
+      Tag.new 'input', attributes
+    end
+
     def datetime_local(object_attribute, attributes = {})
       attributes[:id] ||= as_id object_attribute
       attributes[:name] ||= as_name object_attribute
@@ -112,6 +128,7 @@ module LazyForm
           attributes[:value] ||= object.send object_attribute
         rescue NoMethodError
         end
+        attributes[:value] = escape attributes[:value]
 
         Tag.new 'input', attributes
       end
@@ -120,7 +137,7 @@ module LazyForm
     def label(object_attribute, content = nil, attributes = {})
       attributes[:for] ||= as_id object_attribute
 
-      Tag.new('label', attributes) { content }
+      Tag.new('label', attributes) { escape content }
     end
 
     def select(object_attribute, options = {}, attributes = {})
@@ -135,11 +152,15 @@ module LazyForm
       attributes[:name] ||= as_name object_attribute
       content ||= object.send object_attribute
 
-      Tag.new('textarea', attributes) { content }
+      Tag.new('textarea', attributes) { escape content }
     end
 
     private
 
+    def escape(text)
+      CGI.escapeHTML text unless text.nil?
+    end
+
     def as_id(attribute)
       Inflecto.underscore "#{object.class.name}_#{attribute}"
     end
@@ -158,7 +179,7 @@ module LazyForm
             opts[:selected] = :selected if k == object.send(object_attribute)
           rescue NoMethodError
           end
-          Tag.new('option', opts) { v }
+          Tag.new('option', opts) { escape v }
         end
       end.join
     end

data/test/builder_test.rb

@@ -12,6 +12,14 @@ scope LazyForm::Builder do
     end
   end
 
+  LazyForm::Tag::BOOLEAN_ATTRIBUTES.each do |attr|
+    scope attr do
+      test "returns an input with #{attr} attribute" do
+        assert_equal "<input #{attr} id=\"person_name\" name=\"person[name]\" type=\"radio\"/>", @builder.radio(:name, "#{attr}": :true).to_s
+      end
+    end
+  end
+
   LazyForm::Builder::BUTTONS.each do |type|
     scope type do
       test "returns a #{type} input" do
@@ -26,6 +34,18 @@ scope LazyForm::Builder do
     end
   end
 
+  scope '#checkbox' do
+    test "returns a checkbox input" do
+      tag = @builder.checkbox :admin
+      assert_equal '<input id="person_admin" name="person[admin]" type="checkbox"/>', tag.to_s
+    end
+
+    test "returns a checkbox input with attributes" do
+      tag = @builder.checkbox :admin, style: 'margin-top: 5px', data: { something: 'something' }
+      assert_equal '<input style="margin-top: 5px" data-something="something" id="person_admin" name="person[admin]" type="checkbox"/>', tag.to_s
+    end
+  end
+
   scope '#datetime_local' do
     test "returns a datetime-local input" do
       tag = @builder.datetime_local :birth_date
@@ -52,6 +72,19 @@ scope LazyForm::Builder do
     end
   end
 
+  scope '#text' do
+    test 'returns a text input with the passed value escaped' do
+      tag = @builder.send :text, :first_name, value: '"><script>alert("hello world")</script>'
+      assert_equal "<input value=\"&quot;&gt;&lt;script&gt;alert(&quot;hello world&quot;)&lt;/script&gt;\" id=\"person_first_name\" name=\"person[first_name]\" type=\"text\"/>", tag.to_s
+    end
+
+    test "returns a text input with the object's value escaped" do
+      @person.first_name = '"><script>alert("hello world")</script>'
+      tag = @builder.send :text, :first_name
+      assert_equal "<input id=\"person_first_name\" name=\"person[first_name]\" type=\"text\" value=\"&quot;&gt;&lt;script&gt;alert(&quot;hello world&quot;)&lt;/script&gt;\"/>", tag.to_s
+    end
+  end
+
   scope '#label' do
     test 'returns a label' do
       assert_equal '<label for="person_first_name">First name</label>', @builder.label(:first_name, 'First name').to_s
@@ -60,6 +93,10 @@ scope LazyForm::Builder do
     test 'returns a label with attributes' do
       assert_equal '<label style="color: blue" for="person_first_name">First name</label>', @builder.label(:first_name, 'First name', style: 'color: blue').to_s
     end
+
+    test 'returns an escaped label' do
+      assert_equal '<label style="color: blue" for="person_first_name">&lt;script&gt;alert(&quot;First name&quot;)&lt;/script&gt;</label>', @builder.label(:first_name, "<script>alert(\"First name\")</script>", style: 'color: blue').to_s
+    end
   end
 
   scope '#select' do
@@ -79,6 +116,10 @@ scope LazyForm::Builder do
       @person.gender = :m
       assert_equal '<select id="person_gender" name="person[gender]"><option value="m" selected="selected">Male</option><option value="f">Female</option></select>', @builder.select(:gender, { m: 'Male', f: 'Female' }).to_s
     end
+
+    test 'returns a select with options escaped' do
+      assert_equal '<select id="person_gender" name="person[gender]"><option value="m">&lt;script&gt;alert(&quot;male&quot;)&lt;/script&gt;</option><option value="f">Female</option></select>', @builder.select(:gender, { m: "<script>alert(\"male\")</script>", f: 'Female' }).to_s
+    end
   end
 
   scope '#textarea' do
@@ -91,6 +132,11 @@ scope LazyForm::Builder do
       assert_equal '<textarea id="person_first_name" name="person[first_name]">Patricio</textarea>', @builder.textarea(:first_name).to_s
     end
 
+    test "returns a textarea with the object's value escaped" do
+      @person.first_name = "</textarea><script>alert('hello world')</script><textarea>"
+      assert_equal '<textarea id="person_first_name" name="person[first_name]">&lt;/textarea&gt;&lt;script&gt;alert(&#39;hello world&#39;)&lt;/script&gt;&lt;textarea&gt;</textarea>', @builder.textarea(:first_name).to_s
+    end
+
     test 'returns a textarea with a default value' do
       assert_equal '<textarea id="person_first_name" name="person[first_name]">First name</textarea>', @builder.textarea(:first_name, 'First name').to_s
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lazy_form
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.4
 platform: ruby
 authors:
 - Patricio Mac Adden
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-10 00:00:00.000000000 Z
+date: 2018-07-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -192,7 +192,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.5.2.1
 signing_key: 
 specification_version: 4
 summary: Forms for the rest of us, the lazy.