localeapp 1.0.1 → 1.0.2

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    MzAxNGJkZThkNjM0NDY1MWFhODFhNDhlY2Q5ZGRkMDQzZTEzNzE3Ng==
+    ZmEzMjU2ZmQyMTM1NDcxY2MxNmY1MjA4ZGRiY2Y0ZTg0YjAzNjgyZQ==
   data.tar.gz: !binary |-
-    NjVkNzMyNTE3OTRlOGI1MmRiMGMzMTgxY2Y5Yzg3YzNhNTlkYWZmNA==
+    YTEwOGFlMWY2OTVjZjQ0NjRmMmE1NmQzZDMwMTkxMmQ0Y2Y0ZTMwMQ==
 SHA512:
   metadata.gz: !binary |-
-    NmJlNzRmYjQ3ZmUxZWRhM2FiNGExNzdlYzc4MTEzY2QzMjlhMGM1MDQ0MjNl
-    MTBkYTg2YmZmNDAxYmVlY2RhNDIwMmU0YTk1ZTQ4MzMyNWUzNDNhYzM1YzU2
-    ODNiOWM4Y2NiZmMxNDYyNjAyNDVmZTdkMjkyNDY2M2NhNGMzYjc=
+    NzViMWZmNjNlNGZlOGVjZTA4M2ZiOWZkMDMyMDM0NjhlMDVkYWFmYzQ2MzNj
+    MDAzOWZlNDM0NWQ0NGJiMTBhYWQ3OGQ2M2U4ODVlYjI2MDRlMjdmODI3ZDZh
+    YjM2Nzc2YjdlOWYxNDYxNzIxNjE1ZGM4YjU4Yzc4NzNiZjRlZWE=
   data.tar.gz: !binary |-
-    ZTE3NWYyN2EzNDMxNGUxZGFlNmEyYjU2ZWNmN2NlYjMwM2E4OTdiYWRlMDVh
-    NzVmY2EzM2E3NzVmYTUzYjM2ZWRiZTFkYjZiZjc0ODFmMmM0OGI1OTQ3ZDEw
-    OGRkYmQyOWE1M2YzMjhmMDk3ZTkyMDA2ODc4NTQ5ZjZkYzI3MjU=
+    NGY5MDhhNzZjNzE5MGU1NDI1OTIwODljZWJlNzU1OWIyNDU5ODc3MjhiMmE0
+    ZDVlYjI4NDkzYTBkMWE3YjVmY2I0MjE0ODZkZTRhYzAxZGFhYTEzNjQxYWI5
+    YzcwYTgwMTNiNzg0OTljYTA0ODM3Yzk1NjMyZTc1OWYxNGY2YWU=

data/.gitignore

@@ -3,6 +3,7 @@ pkg/*
 .bundle
 Gemfile.lock
 Gemfile.*.lock
+gemfiles/*.gemfile.lock
 .yardoc/*
 doc/*
 tmp/*

data/.travis.yml

@@ -2,22 +2,27 @@ before_install:
   - gem update bundler
 rvm:
   - 1.9.3
-  - 2.0.0
-  - 2.1.0
-  - 2.2.0
+  - 2.0
+  - 2.1
+  - 2.2
   - jruby
   - jruby-head
 gemfile:
-  - Gemfile.i18n_037
-  - Gemfile.i18n_050
-  - Gemfile.i18n_060
+  - gemfiles/i18n_0.3.gemfile
+  - gemfiles/i18n_0.4.gemfile
+  - gemfiles/i18n_0.5.gemfile
+  - gemfiles/i18n_0.6.gemfile
+  - gemfiles/i18n_0.7.gemfile
 matrix:
   exclude:
-    - rvm: 2.0.0
-      gemfile: Gemfile.i18n_037
-    - rvm: 2.1.0
-      gemfile: Gemfile.i18n_037
-    - rvm: 2.2.0
-      gemfile: Gemfile.i18n_037
+    - rvm: 2.0
+      gemfile: gemfiles/i18n_0.3.gemfile
+    - rvm: 2.1
+      gemfile: gemfiles/i18n_0.3.gemfile
+    - rvm: 2.2
+      gemfile: gemfiles/i18n_0.3.gemfile
     - rvm: jruby-head
-      gemfile: Gemfile.i18n_037
+      gemfile: gemfiles/i18n_0.3.gemfile
+notifications:
+  slack:
+    secure: JryUWfe2JR0cfNT+TIHwryy8NS8m9/hbRhg+5UqwuYWuEp6gtcWCA05wKsajQyRrGaNGYKu81RA9jpQrirgQWzDUJl5o3sEWbqKZv3pW0ybn8Tx52N1mxW3Puar5KLZ8TPRphKKIJ8/1EhAh4zpC5Mtxv8Sz1/AHuqnlu6l+bb4=

data/Appraisals

@@ -0,0 +1,20 @@
+appraise "i18n-0.3" do
+  gem "i18n", "~> 0.3.0"
+  gem "activesupport", "~> 2.3.18"
+end
+
+appraise "i18n-0.4" do
+  gem "i18n", "~> 0.4.0"
+end
+
+appraise "i18n-0.5" do
+  gem "i18n", "~> 0.5.0"
+end
+
+appraise "i18n-0.6" do
+  gem "i18n", "~> 0.6.0"
+end
+
+appraise "i18n-0.7" do
+  gem "i18n", "~> 0.7.0"
+end

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # master
 
+# Version 1.0.2
+
+* Fix a XSS vulnerability where translations keys could contain unescaped HTML (@grekko)
+
 # Version 1.0.1
 
 * Fix error when bundling with Rails >= 4.2 (due to a dependency on i18n < 0.7)

data/gemfiles/i18n_0.3.gemfile

@@ -0,0 +1,12 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "i18n", "~> 0.3.0"
+gem "activesupport", "~> 2.3.18"
+
+platforms :jruby do
+  gem "jruby-openssl"
+end
+
+gemspec :path => "../"

data/gemfiles/i18n_0.4.gemfile

@@ -0,0 +1,11 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "i18n", "~> 0.4.0"
+
+platforms :jruby do
+  gem "jruby-openssl"
+end
+
+gemspec :path => "../"

data/gemfiles/i18n_0.5.gemfile

@@ -0,0 +1,11 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "i18n", "~> 0.5.0"
+
+platforms :jruby do
+  gem "jruby-openssl"
+end
+
+gemspec :path => "../"

data/gemfiles/i18n_0.6.gemfile

@@ -0,0 +1,11 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "i18n", "~> 0.6.0"
+
+platforms :jruby do
+  gem "jruby-openssl"
+end
+
+gemspec :path => "../"

data/gemfiles/i18n_0.7.gemfile

@@ -0,0 +1,11 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "i18n", "~> 0.7.0"
+
+platforms :jruby do
+  gem "jruby-openssl"
+end
+
+gemspec :path => "../"

data/lib/localeapp/exception_handler.rb

@@ -1,16 +1,17 @@
 module Localeapp
   class ExceptionHandler
-    def self.call(exception, locale, key, options)
+    def self.call(exception, locale, key_or_keys, options)
+      keys = Array(key_or_keys).map { |key| ERB::Util.html_escape(key.to_s) }
       Localeapp.log(exception.message)
       # Which exact exception is set up by our i18n shims
       if exception.is_a? Localeapp::I18nMissingTranslationException
-        Localeapp.log("Detected missing translation for key(s) #{key.inspect}")
+        Localeapp.log("Detected missing translation for key(s) #{keys.inspect}")
 
-        [*key].each do |key|
+        keys.each do |key|
           Localeapp.missing_translations.add(locale, key, nil, options || {})
         end
 
-        [locale, key].join(', ')
+        [locale, keys].join(', ')
       else
         Localeapp.log('Raising exception')
         raise

data/lib/localeapp/missing_translations.rb

@@ -1,3 +1,5 @@
+require 'set'
+
 module Localeapp
   MissingTranslationRecord = Struct.new(:key, :locale, :description, :options) do
     def blacklisted?
@@ -10,7 +12,7 @@ module Localeapp
   end
 
   class MissingTranslations
-    @cached_keys = []
+    @cached_keys = Set.new
 
     class << self
       attr_accessor :cached_keys

data/lib/localeapp/routes.rb

@@ -1,142 +1,25 @@
 require 'rack/utils'
 
+require "localeapp/routes/base"
+require "localeapp/routes/projects"
+require "localeapp/routes/translations"
+require "localeapp/routes/export"
+require "localeapp/routes/remove"
+require "localeapp/routes/rename"
+require "localeapp/routes/missing_translations"
+require "localeapp/routes/import"
+
 module Localeapp
   module Routes
     VERSION = 'v1'
 
-    def project_endpoint(options = {})
-      [:get, project_url(options)]
-    end
-
-    def project_url(options = {})
-      options[:format] ||= 'json'
-      http_scheme.build(base_options.merge(:path => project_path(options[:format]))).to_s
-    end
-
-    def translations_url(options={})
-      options[:format] ||= 'yml'
-      url = http_scheme.build(base_options.merge(:path => translations_path(options[:format])))
-      url.query = options[:query].map { |k,v| "#{k}=#{v}" }.join('&') if options[:query]
-      url.to_s
-    end
-
-    def translations_endpoint(options = {})
-      [:get, translations_url(options)]
-    end
-
-    def create_translation_endpoint(options = {})
-      [:post, translations_url(options)]
-    end
-
-    def export_endpoint(options = {})
-      [:get, export_url(options)]
-    end
-
-    def remove_endpoint(options = {})
-      [:delete, remove_url(options)]
-    end
-
-    def remove_url(options = {})
-      url = http_scheme.build(base_options.merge(:path => remove_path(options[:key], options[:format])))
-      url.to_s
-    end
-
-    def rename_endpoint(options = {})
-      [:post, rename_url(options)]
-    end
-
-    def rename_url(options = {})
-      url = http_scheme.build(base_options.merge(:path => rename_path(options[:current_name], options[:format])))
-      url.to_s
-    end
-
-    def export_url(options = {})
-      options[:format] ||= 'yml'
-      url = http_scheme.build(base_options.merge(:path => export_path(options[:format])))
-      url.query = options[:query].map { |k,v| "#{k}=#{v}" }.join('&') if options[:query]
-      url.to_s
-    end
-
-    def missing_translations_endpoint(options = {})
-      [:post, missing_translations_url(options)]
-    end
-
-    def missing_translations_url(options={})
-      options[:format] ||= 'json'
-      url = http_scheme.build(base_options.merge(:path => missing_translations_path(options[:format])))
-      url.query = options[:query].map { |k,v| "#{k}=#{v}" }.join('&') if options[:query]
-      url.to_s
-    end
-
-    def import_endpoint(options = {})
-      [:post, import_url(options)]
-    end
-
-    def import_url(options={})
-      http_scheme.build(base_options.merge(:path => import_path)).to_s
-    end
-
-  private
-    def http_scheme
-      if Localeapp.configuration.secure
-        URI::HTTPS
-      else
-        URI::HTTP
-      end
-    end
-
-    def base_options
-      options = {:host => Localeapp.configuration.host, :port => Localeapp.configuration.port}
-      if Localeapp.configuration.http_auth_username
-        options[:userinfo] = "#{Localeapp.configuration.http_auth_username}:#{Localeapp.configuration.http_auth_password}"
-      end
-      options
-    end
-
-    def project_path(format = nil)
-      path = "/#{VERSION}/projects/#{Localeapp.configuration.api_key}"
-      path << ".#{format}" if format
-      path
-    end
-
-    def translations_path(format = nil)
-      path = project_path << '/translations'
-      path << ".#{format}" if format
-      path
-    end
-
-    def remove_path(key, format = nil)
-      raise "remove_path requires a key" if key.nil?
-      path = translations_path << "/#{escape_key(key)}"
-      path << ".#{format}" if format
-      path
-    end
-
-    def rename_path(current_name, format = nil)
-      raise "rename_path requires current name" if current_name.nil?
-      path = translations_path << "/#{escape_key(current_name)}" << '/rename'
-      path << ".#{format}" if format
-      path
-    end
-
-    def escape_key(key)
-      Rack::Utils.escape(key).gsub(/\./, '%2E')
-    end
-
-    def export_path(format = nil)
-      path = project_path << '/translations/all'
-      path << ".#{format}" if format
-      path
-    end
-
-    def missing_translations_path(format = nil)
-      path = project_path << '/translations/missing'
-      path << ".#{format}" if format
-      path
-    end
-
-    def import_path(format = nil)
-      project_path << '/import/'
-    end
+    include Base
+    include Projects
+    include Translations
+    include Export
+    include Remove
+    include Rename
+    include MissingTranslations
+    include Import
   end
 end

data/lib/localeapp/routes/base.rb

@@ -0,0 +1,28 @@
+module Localeapp
+  module Routes
+    module Base
+
+    private
+
+      def http_scheme
+        if Localeapp.configuration.secure
+          URI::HTTPS
+        else
+          URI::HTTP
+        end
+      end
+
+      def base_options
+        options = {:host => Localeapp.configuration.host, :port => Localeapp.configuration.port}
+        if Localeapp.configuration.http_auth_username
+          options[:userinfo] = "#{Localeapp.configuration.http_auth_username}:#{Localeapp.configuration.http_auth_password}"
+        end
+        options
+      end
+
+      def escape_key(key)
+        Rack::Utils.escape(key).gsub(/\./, '%2E')
+      end
+    end
+  end
+end

data/lib/localeapp/routes/export.rb

@@ -0,0 +1,24 @@
+module Localeapp
+  module Routes
+    module Export
+      def export_endpoint(options = {})
+        [:get, export_url(options)]
+      end
+
+      def export_url(options = {})
+        options[:format] ||= 'yml'
+        url = http_scheme.build(base_options.merge(:path => export_path(options[:format])))
+        url.query = options[:query].map { |k,v| "#{k}=#{v}" }.join('&') if options[:query]
+        url.to_s
+      end
+
+      private
+
+      def export_path(format = nil)
+        path = project_path << '/translations/all'
+        path << ".#{format}" if format
+        path
+      end
+    end
+  end
+end

data/lib/localeapp/routes/import.rb

@@ -0,0 +1,19 @@
+module Localeapp
+  module Routes
+    module Import
+      def import_endpoint(options = {})
+        [:post, import_url(options)]
+      end
+
+      def import_url(options={})
+        http_scheme.build(base_options.merge(:path => import_path)).to_s
+      end
+
+    private
+
+      def import_path(format = nil)
+        project_path << '/import/'
+      end
+    end
+  end
+end

data/lib/localeapp/routes/missing_translations.rb

@@ -0,0 +1,24 @@
+module Localeapp
+  module Routes
+    module MissingTranslations
+      def missing_translations_endpoint(options = {})
+        [:post, missing_translations_url(options)]
+      end
+
+      def missing_translations_url(options={})
+        options[:format] ||= 'json'
+        url = http_scheme.build(base_options.merge(:path => missing_translations_path(options[:format])))
+        url.query = options[:query].map { |k,v| "#{k}=#{v}" }.join('&') if options[:query]
+        url.to_s
+      end
+
+    private
+
+      def missing_translations_path(format = nil)
+        path = project_path << '/translations/missing'
+        path << ".#{format}" if format
+        path
+      end
+    end
+  end
+end

data/lib/localeapp/routes/projects.rb

@@ -0,0 +1,22 @@
+module Localeapp
+  module Routes
+    module Projects
+      def project_endpoint(options = {})
+        [:get, project_url(options)]
+      end
+
+      def project_url(options = {})
+        options[:format] ||= 'json'
+        http_scheme.build(base_options.merge(:path => project_path(options[:format]))).to_s
+      end
+
+    private
+
+      def project_path(format = nil)
+        path = "/#{VERSION}/projects/#{Localeapp.configuration.api_key}"
+        path << ".#{format}" if format
+        path
+      end
+    end
+  end
+end

data/lib/localeapp/routes/remove.rb

@@ -0,0 +1,23 @@
+module Localeapp
+  module Routes
+    module Remove
+      def remove_endpoint(options = {})
+        [:delete, remove_url(options)]
+      end
+
+      def remove_url(options = {})
+        url = http_scheme.build(base_options.merge(:path => remove_path(options[:key], options[:format])))
+        url.to_s
+      end
+
+    private
+
+      def remove_path(key, format = nil)
+        raise "remove_path requires a key" if key.nil?
+        path = translations_path << "/#{escape_key(key)}"
+        path << ".#{format}" if format
+        path
+      end
+    end
+  end
+end

data/lib/localeapp/routes/rename.rb

@@ -0,0 +1,24 @@
+module Localeapp
+  module Routes
+    module Rename
+      def rename_endpoint(options = {})
+        [:post, rename_url(options)]
+      end
+
+      def rename_url(options = {})
+        url = http_scheme.build(base_options.merge(:path => rename_path(options[:current_name], options[:format])))
+        url.to_s
+      end
+
+    private
+
+      def rename_path(current_name, format = nil)
+        raise "rename_path requires current name" if current_name.nil?
+        path = translations_path << "/#{escape_key(current_name)}" << '/rename'
+        path << ".#{format}" if format
+        path
+      end
+
+    end
+  end
+end

data/lib/localeapp/routes/translations.rb

@@ -0,0 +1,28 @@
+module Localeapp
+  module Routes
+    module Translations
+      def translations_url(options={})
+        options[:format] ||= 'yml'
+        url = http_scheme.build(base_options.merge(:path => translations_path(options[:format])))
+        url.query = options[:query].map { |k,v| "#{k}=#{v}" }.join('&') if options[:query]
+        url.to_s
+      end
+
+      def translations_endpoint(options = {})
+        [:get, translations_url(options)]
+      end
+
+      def create_translation_endpoint(options = {})
+        [:post, translations_url(options)]
+      end
+
+    private
+
+      def translations_path(format = nil)
+        path = project_path << '/translations'
+        path << ".#{format}" if format
+        path
+      end
+    end
+  end
+end

data/lib/localeapp/version.rb

@@ -1,3 +1,3 @@
 module Localeapp
-  VERSION = '1.0.1'
+  VERSION = "1.0.2"
 end

data/localeapp.gemspec

@@ -34,4 +34,5 @@ Gem::Specification.new do |s|
   s.add_development_dependency('aruba', '~> 0.8')
   s.add_development_dependency('cucumber', '~> 2.0')
   s.add_development_dependency('fakeweb')
+  s.add_development_dependency('appraisal')
 end

data/spec/localeapp/exception_handler_spec.rb

@@ -26,10 +26,20 @@ describe Localeapp::ExceptionHandler, '#call(exception, locale, key, options)' d
   end
 
   it "handles when the default is a Symbol that can't be resolved" do
-    expect(Localeapp.missing_translations).to receive(:add).with(:en, :foo, nil, {:default => :bar})
+    expect(Localeapp.missing_translations).to receive(:add).with(:en, 'foo', nil, {:default => :bar})
     I18n.t(:foo, :default => :bar)
   end
 
+  it "escapes html tags from keys to prevent xss attacks" do
+    expect(Localeapp.missing_translations).to receive(:add).with(:en, '<script>alert(1);</script>', nil, {})
+    expect(I18n.t('<script>alert(1);</script>')).to eq 'en, &lt;script&gt;alert(1);&lt;/script&gt;'
+  end
+
+  it "joins locale and keys correctly" do
+    expect(I18n.t('foo.bar')).to eq 'en, foo.bar'
+    expect(I18n.t(%w{foo.bar foo.baz})).to eq 'en, foo.bar, foo.baz'
+  end
+
   it "handles missing translation exception" do
     expect {
       exception = Localeapp::I18nMissingTranslationException.new(:en, 'foo', {})

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localeapp
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Christopher Dell
@@ -194,6 +194,20 @@ dependencies:
     - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: appraisal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Synchronizes i18n translation keys and content with localeapp.com so
   you don't have to manage translations by hand.
 email:
@@ -210,13 +224,10 @@ files:
 - .rspec
 - .rvmrc
 - .travis.yml
+- Appraisals
 - CHANGELOG.md
 - CONTRIBUTING.md
 - Gemfile
-- Gemfile.github_project.rb
-- Gemfile.i18n_037
-- Gemfile.i18n_050
-- Gemfile.i18n_060
 - README.md
 - Rakefile
 - bin/localeapp
@@ -233,6 +244,11 @@ files:
 - features/support/env.rb
 - features/support/hooks.rb
 - features/update.feature
+- gemfiles/i18n_0.3.gemfile
+- gemfiles/i18n_0.4.gemfile
+- gemfiles/i18n_0.5.gemfile
+- gemfiles/i18n_0.6.gemfile
+- gemfiles/i18n_0.7.gemfile
 - init.rb
 - lib/localeapp.rb
 - lib/localeapp/api_call.rb
@@ -261,6 +277,14 @@ files:
 - lib/localeapp/rails/force_exception_handler_in_translation_helper.rb
 - lib/localeapp/rails/mimic_rails_missing_translation_display.rb
 - lib/localeapp/routes.rb
+- lib/localeapp/routes/base.rb
+- lib/localeapp/routes/export.rb
+- lib/localeapp/routes/import.rb
+- lib/localeapp/routes/missing_translations.rb
+- lib/localeapp/routes/projects.rb
+- lib/localeapp/routes/remove.rb
+- lib/localeapp/routes/rename.rb
+- lib/localeapp/routes/translations.rb
 - lib/localeapp/sender.rb
 - lib/localeapp/sync_file.rb
 - lib/localeapp/tasks/localeapp.rake

data/Gemfile.github_project.rb

@@ -1,9 +0,0 @@
-source "http://rubygems.org"
-
-group :development do
-  gem "rspec", ">= 2.4.0"
-  gem "bundler"
-  gem "jeweler", "> 1.6.4"
-  gem 'i18n-spec'
-  gem 'localeapp'
-end

data/Gemfile.i18n_037

@@ -1,13 +0,0 @@
-source 'https://rubygems.org'
-gemspec
-
-gem 'i18n', '0.3.7'
-gem 'activesupport', '~> 2.3.18'
-
-platforms :ruby do
-  gem 'iconv'
-end
-
-platform :jruby do
-  gem 'jruby-openssl'
-end

data/Gemfile.i18n_050

@@ -1,8 +0,0 @@
-source 'https://rubygems.org'
-gemspec
-
-gem 'i18n', '0.5.0'
-
-platform :jruby do
-  gem 'jruby-openssl'
-end

data/Gemfile.i18n_060

@@ -1,8 +0,0 @@
-source 'https://rubygems.org'
-gemspec
-
-gem 'i18n', '~> 0.6.0'
-
-platform :jruby do
-  gem 'jruby-openssl'
-end