letter_opener_web 1.4.0 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e4e55f6426c388994e7d06824aa7a0b4ebe1f9342854f777bdc8cbdfb0f79eee
-  data.tar.gz: d683940cd611dc76784c050bf8872a6be7e8871891774117e7fa327de9e1f0d9
+  metadata.gz: cf8f22bcc360d6d8da5a1e462a24faa5d8dfe4589a7cad91bebe688a06a1001c
+  data.tar.gz: f9cc899aee871f4d68ec12390be6470d62fba0b85123ecb38ae5a11e98899f42
 SHA512:
-  metadata.gz: a647a30f84bc33477050478c485aec7a6a28b0778c4d5f689b1b195cc77470c6c37a3b9f608675953183fb430574eff90c67e997a106ffa41e0cb288be9bcb24
-  data.tar.gz: 65c306586fd9eb8a4aef17d73c46571a9b5e1b75540e48e72262e196328ac546ed2f8bed8c1a37837963d5df30429e578a894360930363fa8e2802ffd66eead9
+  metadata.gz: 79ecd487c5042e2acfd3627a38ee8379e8a372c06a64aaa8c01be30cddf01b123dc23ec80dafe1cc94f7924698ef80304066c1b06a5d776f8304a547ddaa11be
+  data.tar.gz: c5fb0b7be26b025400c346a8d4850e834e890f578cfd6a849fd949d1b12c93999aaefef65c1e641e8a6fca2a25e866467f6f223527ed84cea94fb4022b07984e

data/.travis.yml

@@ -1,4 +1,3 @@
-sudo: false
 language: ruby
 
 rvm:

data/CHANGELOG.md

@@ -1,4 +1,6 @@
-## [Unreleased](https://github.com/fgrehm/letter_opener_web/compare/v1.4.0...master)
+## [1.4.1](https://github.com/fgrehm/letter_opener_web/compare/v1.4.0...v1.4.1) (Oct 5, 2021)
+
+  - Ensure letter is within letters base path [#110](https://github.com/fgrehm/letter_opener_web/pull/110)
 
 ## [1.4.0](https://github.com/fgrehm/letter_opener_web/compare/v1.3.4...v1.4.0) (Jan 29, 2020)
 

data/Gemfile

@@ -6,3 +6,7 @@ source 'http://rubygems.org'
 # Bundler will treat runtime dependencies like base dependencies, and
 # development dependencies will be added by default to the :development group.
 gemspec
+
+group :test do
+  gem 'codecov', require: false
+end

data/README.md

@@ -1,8 +1,8 @@
 # letter_opener_web
 
-[![Build Status](https://travis-ci.org/fgrehm/letter_opener_web.png?branch=master)](https://travis-ci.org/fgrehm/letter_opener_web)
-[![Gem Version](https://badge.fury.io/rb/letter_opener_web.png)](http://badge.fury.io/rb/letter_opener_web)
-[![Code Climate](https://codeclimate.com/github/fgrehm/letter_opener_web.png)](https://codeclimate.com/github/fgrehm/letter_opener_web)
+[![Build Status](https://travis-ci.org/fgrehm/letter_opener_web.svg?branch=master)](https://travis-ci.org/fgrehm/letter_opener_web)
+[![Gem Version](https://badge.fury.io/rb/letter_opener_web.svg)](http://badge.fury.io/rb/letter_opener_web)
+[![Code Climate](https://codeclimate.com/github/fgrehm/letter_opener_web.svg)](https://codeclimate.com/github/fgrehm/letter_opener_web)
 
 Gives [letter_opener](https://github.com/ryanb/letter_opener) an interface for
 browsing sent emails.

data/app/controllers/letter_opener_web/letters_controller.rb

@@ -6,7 +6,7 @@ end
 
 module LetterOpenerWeb
   class LettersController < ApplicationController
-    before_action :check_style, only: [:show]
+    before_action :check_style, only: :show
     before_action :load_letter, only: %i[show attachment destroy]
 
     def index
@@ -48,7 +48,8 @@ module LetterOpenerWeb
 
     def load_letter
       @letter = Letter.find(params[:id])
-      head :not_found unless @letter.exists?
+
+      head :not_found unless @letter.valid?
     end
 
     def routes

data/app/models/letter_opener_web/letter.rb

@@ -56,17 +56,19 @@ module LetterOpenerWeb
     end
 
     def delete
-      FileUtils.rm_rf("#{LetterOpenerWeb.config.letters_location}/#{id}")
+      return unless valid?
+
+      FileUtils.rm_rf(base_dir.to_s)
     end
 
-    def exists?
-      File.exist?(base_dir)
+    def valid?
+      exists? && base_dir_within_letters_location?
     end
 
     private
 
     def base_dir
-      "#{LetterOpenerWeb.config.letters_location}/#{id}"
+      LetterOpenerWeb.config.letters_location.join(id).cleanpath
     end
 
     def read_file(style)
@@ -77,6 +79,14 @@ module LetterOpenerWeb
       File.exist?("#{base_dir}/#{style}.html")
     end
 
+    def exists?
+      File.exist?(base_dir)
+    end
+
+    def base_dir_within_letters_location?
+      base_dir.to_s.start_with?(LetterOpenerWeb.config.letters_location.to_s)
+    end
+
     def adjust_link_targets(contents)
       # We cannot feed the whole file to an XML parser as some mails are
       # "complete" (as in they have the whole <html> structure) and letter_opener

data/lib/letter_opener_web/delivery_method.rb

@@ -9,7 +9,7 @@ module LetterOpenerWeb
       ENV['LAUNCHY_DRY_RUN'] = 'true'
 
       super
-    rescue Launchy::CommandNotFoundError # rubocop:disable Lint/SuppressedException
+    rescue Launchy::CommandNotFoundError
       # Ignore for non-executable Launchy environment.
     ensure
       ENV['LAUNCHY_DRY_RUN'] = original

data/lib/letter_opener_web/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module LetterOpenerWeb
-  VERSION = '1.4.0'
+  VERSION = '1.4.1'
 end

data/spec/controllers/letter_opener_web/letters_controller_spec.rb

@@ -32,7 +32,7 @@ describe LetterOpenerWeb::LettersController do
     shared_examples 'found letter examples' do |letter_style|
       before(:each) do
         expect(LetterOpenerWeb::Letter).to receive(:find).with(id).and_return(letter)
-        expect(letter).to receive(:exists?).and_return(true)
+        expect(letter).to receive(:valid?).and_return(true)
         get :show, params: { id: id, style: letter_style }
       end
 
@@ -84,7 +84,7 @@ describe LetterOpenerWeb::LettersController do
 
     before do
       allow(LetterOpenerWeb::Letter).to receive(:find).with(id).and_return(letter)
-      allow(letter).to receive(:exists?).and_return(true)
+      allow(letter).to receive(:valid?).and_return(true)
     end
 
     it 'sends the file as an inline attachment' do
@@ -118,9 +118,20 @@ describe LetterOpenerWeb::LettersController do
     let(:id) { 'an-id' }
 
     it 'removes the selected letter' do
-      allow_any_instance_of(LetterOpenerWeb::Letter).to receive(:exists?).and_return(true)
+      allow_any_instance_of(LetterOpenerWeb::Letter).to receive(:valid?).and_return(true)
       expect_any_instance_of(LetterOpenerWeb::Letter).to receive(:delete)
       delete :destroy, params: { id: id }
     end
+
+    it 'throws a 404 if attachment is outside of the letters base path' do
+      bad_id = '../an-id'
+
+      allow_any_instance_of(LetterOpenerWeb::Letter).to receive(:valid?).and_return(false)
+      expect_any_instance_of(LetterOpenerWeb::Letter).not_to receive(:delete)
+
+      delete :destroy, params: { id: bad_id }
+
+      expect(response.status).to eq(404)
+    end
   end
 end

data/spec/models/letter_opener_web/letter_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 describe LetterOpenerWeb::Letter do
-  let(:location) { File.expand_path('../../tmp', __dir__) }
+  let(:location) { Pathname.new(__dir__).join('..', '..', 'tmp').cleanpath }
 
   def rich_text(mail_id)
     <<-MAIL
@@ -128,13 +128,24 @@ Rich text for #{mail_id}
 
   describe '#delete' do
     let(:id) { '1111_1111' }
+
     subject { described_class.new(id: id).delete }
 
-    it'removes the letter with given id' do
+    it 'removes the letter with given id' do
       subject
       directories = Dir["#{location}/*"]
       expect(directories.count).to eql(1)
       expect(directories.first).not_to match(id)
     end
+
+    context 'when the id is outside of the letters base path' do
+      let(:id) { '../3333_3333' }
+
+      it 'does not remove the letter' do
+        expect(FileUtils).not_to receive(:rm_rf).with(location.join(id).cleanpath.to_s)
+
+        expect(subject).to be_nil
+      end
+    end
   end
 end

data/spec/spec_helper.rb

@@ -1,5 +1,13 @@
 # frozen_string_literal: true
 
+require 'simplecov'
+SimpleCov.start
+
+if ENV.fetch('CI', '') == 'true'
+  require 'codecov'
+  SimpleCov.formatter = SimpleCov::Formatter::Codecov
+end
+
 require 'shoulda-matchers'
 
 RSpec.configure do |config|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: letter_opener_web
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.4.1
 platform: ruby
 authors:
 - Fabio Rehm
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-30 00:00:00.000000000 Z
+date: 2021-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionmailer
@@ -217,8 +217,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.7
+rubygems_version: 3.2.3
 signing_key: 
 specification_version: 4
 summary: Gives letter_opener an interface for browsing sent emails