loofah-activerecord 1.0.0.beta.1

data/rails_test/rails-3.0.0.beta4-xss_foliate/public/javascripts/rails.js

@@ -0,0 +1,118 @@
+document.observe("dom:loaded", function() {
+  function handleRemote(element) {
+    var method, url, params;
+
+    if (element.tagName.toLowerCase() === 'form') {
+      method = element.readAttribute('method') || 'post';
+      url    = element.readAttribute('action');
+      params = element.serialize(true);
+    } else {
+      method = element.readAttribute('data-method') || 'get';
+      url    = element.readAttribute('href');
+      params = {};
+    }
+
+    var event = element.fire("ajax:before");
+    if (event.stopped) return false;
+
+    new Ajax.Request(url, {
+      method: method,
+      parameters: params,
+      asynchronous: true,
+      evalScripts: true,
+
+      onLoading:     function(request) { element.fire("ajax:loading", {request: request}); },
+      onLoaded:      function(request) { element.fire("ajax:loaded", {request: request}); },
+      onInteractive: function(request) { element.fire("ajax:interactive", {request: request}); },
+      onComplete:    function(request) { element.fire("ajax:complete", {request: request}); },
+      onSuccess:     function(request) { element.fire("ajax:success", {request: request}); },
+      onFailure:     function(request) { element.fire("ajax:failure", {request: request}); }
+    });
+
+    element.fire("ajax:after");
+  }
+
+  function handleMethod(element) {
+    var method, url, token_name, token;
+
+    method     = element.readAttribute('data-method');
+    url        = element.readAttribute('href');
+    csrf_param = $$('meta[name=csrf-param]').first();
+    csrf_token = $$('meta[name=csrf-token]').first();
+
+    var form = new Element('form', { method: "POST", action: url, style: "display: none;" });
+    element.parentNode.appendChild(form);
+
+    if (method != 'post') {
+      var field = new Element('input', { type: 'hidden', name: '_method', value: method });
+      form.appendChild(field);
+    }
+
+    if (csrf_param) {
+      var param = csrf_param.readAttribute('content');
+      var token = csrf_token.readAttribute('content');
+      var field = new Element('input', { type: 'hidden', name: param, value: token });
+      form.appendChild(field);
+    }
+
+    form.submit();
+  }
+
+  $(document.body).observe("click", function(event) {
+    var message = event.findElement().readAttribute('data-confirm');
+    if (message && !confirm(message)) {
+      event.stop();
+      return false;
+    }
+
+    var element = event.findElement("a[data-remote]");
+    if (element) {
+      handleRemote(element);
+      event.stop();
+      return true;
+    }
+
+    var element = event.findElement("a[data-method]");
+    if (element) {
+      handleMethod(element);
+      event.stop();
+      return true;
+    }
+  });
+
+  // TODO: I don't think submit bubbles in IE
+  $(document.body).observe("submit", function(event) {
+    var element = event.findElement(),
+        message = element.readAttribute('data-confirm');
+    if (message && !confirm(message)) {
+      event.stop();
+      return false;
+    }
+
+    var inputs = element.select("input[type=submit][data-disable-with]");
+    inputs.each(function(input) {
+      input.disabled = true;
+      input.writeAttribute('data-original-value', input.value);
+      input.value = input.readAttribute('data-disable-with');
+    });
+
+    var element = event.findElement("form[data-remote]");
+    if (element) {
+      handleRemote(element);
+      event.stop();
+    }
+  });
+
+  $(document.body).observe("ajax:after", function(event) {
+    var element = event.findElement();
+
+    if (element.tagName.toLowerCase() === 'form') {
+      var inputs = element.select("input[type=submit][disabled=true][data-disable-with]");
+      inputs.each(function(input) {
+        input.value = input.readAttribute('data-original-value');
+        input.writeAttribute('data-original-value', null);
+        input.disabled = false;
+      });
+    }
+  });
+});

data/rails_test/rails-3.0.0.beta4-xss_foliate/public/robots.txt

@@ -0,0 +1,5 @@
+# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file
+#
+# To ban all spiders from the entire site uncomment the next two lines:
+# User-Agent: *
+# Disallow: /

data/rails_test/rails-3.0.0.beta4-xss_foliate/script/rails

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby1.8
+# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
+
+APP_PATH = File.expand_path('../../config/application',  __FILE__)
+require File.expand_path('../../config/boot',  __FILE__)
+require 'rails/commands'

data/rails_test/rails-3.0.0.beta4-xss_foliate/test/performance/browsing_test.rb

@@ -0,0 +1,9 @@
+require 'test_helper'
+require 'rails/performance_test_help'
+
+# Profiling results for each test method are written to tmp/performance.
+class BrowsingTest < ActionDispatch::PerformanceTest
+  def test_homepage
+    get '/'
+  end
+end

data/rails_test/rails-3.0.0.beta4-xss_foliate/test/test_helper.rb

@@ -0,0 +1,13 @@
+ENV["RAILS_ENV"] = "test"
+require File.expand_path('../../config/environment', __FILE__)
+require 'rails/test_help'
+
+class ActiveSupport::TestCase
+  # Setup all fixtures in test/fixtures/*.(yml|csv) for all tests in alphabetical order.
+  #
+  # Note: You'll currently still have to declare fixtures explicitly in integration tests
+  # -- they do not yet inherit this setting
+  fixtures :all
+
+  # Add more helper methods to be used by all tests here...
+end

data/rails_test/rails-3.0.0.beta4-xss_foliate/test/unit/posts_test.rb

@@ -0,0 +1,14 @@
+require File.join(File.dirname(__FILE__), "../test_helper")
+
+class PostsTest < Test::Unit::TestCase
+  def test_loofah_scrubbing
+    post = Post.new :title => "<script>yo dawg</script>", :body => "<script>omgwtfbbq</script>"
+    post.valid?
+    assert_equal "yo dawg", post.title
+    assert_equal "omgwtfbbq", post.body
+  end
+
+  def test_xss_foliation
+    assert Post.xss_foliated?
+  end
+end

data/test/helper.rb

@@ -0,0 +1,9 @@
+require 'rubygems'
+require 'test/unit'
+require 'shoulda'
+require 'mocha'
+require 'acts_as_fu'
+require File.expand_path(File.join(File.dirname(__FILE__), "..", "lib", "loofah-activerecord"))
+
+puts "=> testing with Nokogiri #{Nokogiri::VERSION_INFO.inspect}"
+puts "=> testing with Loofah #{Loofah::VERSION}"

data/test/unit/test_active_record.rb

@@ -0,0 +1,141 @@
+require File.expand_path(File.join(File.dirname(__FILE__), '..', 'helper'))
+
+class TestActiveRecord < Test::Unit::TestCase
+
+  HTML_STRING = "<div>omgwtfbbq</div>"
+  PLAIN_TEXT  = "vanilla text"
+
+  context "with a Post model" do
+    setup do
+      ActsAsFu.build_model(:posts) do
+        string :plain_text
+        string :html_string
+      end
+    end
+
+    context "scrubbing a single field as a fragment" do
+      context "using a symbol to indicate the attribute" do
+        setup do
+          Post.html_fragment :html_string, :scrub => :prune
+          assert ! Post.xss_foliated?
+          @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
+        end
+
+        should "scrub the specified field" do
+          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).never
+          @post.valid?
+        end
+
+        should "only call scrub_fragment once" do
+          Loofah.expects(:scrub_fragment).once
+          @post.valid?
+        end
+
+        should "generate strings" do
+          @post.valid?
+          assert_equal String,      @post.html_string.class
+          assert_equal HTML_STRING, @post.html_string
+        end
+      end
+
+      context "using a string to indicate the attribute" do
+        setup do
+          Post.html_fragment 'html_string', :scrub => :prune
+          assert ! Post.xss_foliated?
+          @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
+        end
+
+        should "scrub the specified field" do
+          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).never
+          @post.valid?
+        end
+      end
+    end
+
+    context "scrubbing a single field as a document" do
+      context "using a symbol to indicate the attribute" do
+        setup do
+          Post.html_document :html_string, :scrub => :strip
+          @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
+        end
+
+        should "scrub the specified field, but not other fields" do
+          Loofah.expects(:scrub_document).with(HTML_STRING, :strip).once
+          Loofah.expects(:scrub_document).with(PLAIN_TEXT,  :strip).never
+          @post.valid?
+        end
+
+        should "only call scrub_document once" do
+          Loofah.expects(:scrub_document).once
+          @post.valid?
+        end
+
+        should "generate strings" do
+          @post.valid?
+          assert_equal String, @post.html_string.class
+        end
+      end
+
+      context "using a string to indicate the attribute" do
+        setup do
+          Post.html_document 'html_string', :scrub => :strip
+          @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
+        end
+
+        should "scrub the specified field, but not other fields" do
+          Loofah.expects(:scrub_document).with(HTML_STRING, :strip).once
+          Loofah.expects(:scrub_document).with(PLAIN_TEXT,  :strip).never
+          @post.valid?
+        end
+      end
+    end
+
+    context "not passing any options" do
+      should "raise ArgumentError" do
+        assert_raises(ArgumentError) {
+          Post.html_fragment :foo
+        }
+      end
+    end
+
+    context "not passing :scrub option" do
+      should "raise ArgumentError" do
+        assert_raise(ArgumentError) {
+          Post.html_fragment :foo, :bar => :quux
+        }
+      end
+    end
+
+    context "passing a :scrub option" do
+      should "not raise ArgumentError" do
+        assert_nothing_raised {
+          Post.html_fragment :foo, :scrub => :quux
+        }
+      end
+    end
+
+    context "passing a Scrubber" do
+      setup do
+        @called = false
+        @scrubber = Loofah::Scrubber.new do |node|
+          @called = true
+        end
+      end
+
+      should "not raise ArgumentError" do
+        assert_nothing_raised {
+          Post.html_fragment :html_string, :scrub => @scrubber
+        }
+      end
+
+      should "scrub properly" do
+        Post.html_fragment :html_string, :scrub => @scrubber
+        post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
+        post.valid?
+        assert @called
+      end
+    end
+  end
+end

data/test/unit/test_xss_foliate.rb

@@ -0,0 +1,215 @@
+require File.expand_path(File.join(File.dirname(__FILE__), '..', 'helper'))
+
+class TestXssFoliate < Test::Unit::TestCase
+
+  HTML_STRING = "<div>omgwtfbbq</div>"
+  PLAIN_TEXT = "vanilla text"
+  INTEGER_VALUE = "1234"
+  WHITESPACEY = " <br> "
+
+  def new_post(overrides={})
+    Post.new({:html_string => HTML_STRING, :plain_text => PLAIN_TEXT, :not_a_string => INTEGER_VALUE}.merge(overrides))
+  end
+
+  context "with a Post model" do
+    setup do
+      ActsAsFu.build_model(:posts) do
+        string :plain_text
+        string :html_string
+        integer :not_a_string
+      end
+    end
+
+    context "#xss_foliated?" do
+      context "when xss_foliate has not been called" do
+        should "return false" do
+          assert ! Post.xss_foliated?
+        end
+      end
+
+      context "when xss_foliate has been called with no options" do
+        setup do
+          Post.xss_foliate
+        end
+
+        should "return true" do
+          assert Post.xss_foliated?
+        end
+      end
+
+      context "when xss_foliate has been called with options" do
+        setup do
+          Post.xss_foliate :prune => :plain_text
+        end
+
+        should "return true" do
+          assert Post.xss_foliated?
+        end
+      end
+    end
+
+    context "#xss_foliate" do
+      context "when passed invalid option" do
+        should "raise ArgumentError" do
+          assert_raise(ArgumentError) { Post.xss_foliate :quux => [:foo] }
+        end
+      end
+
+      context "when passed a symbol" do
+        should "calls the right scrubber" do
+          assert_nothing_raised(ArgumentError) { Post.xss_foliate :prune => :plain_text }
+          Loofah.expects(:scrub_fragment).with(HTML_STRING, :strip).once
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+          new_post.valid?
+        end
+      end
+
+      context "when passed an array of symbols" do
+        should "calls the right scrubbers" do
+          assert_nothing_raised(ArgumentError) {
+            Post.xss_foliate :prune => [:plain_text, :html_string]
+          }
+          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+          new_post.valid?
+        end
+      end
+
+      context "when passed a string" do
+        should "calls the right scrubber" do
+          assert_nothing_raised(ArgumentError) { Post.xss_foliate :prune => 'plain_text' }
+          Loofah.expects(:scrub_fragment).with(HTML_STRING, :strip).once
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+          new_post.valid?
+        end
+      end
+
+      context "when passed an array of strings" do
+        should "calls the right scrubbers" do
+          assert_nothing_raised(ArgumentError) {
+            Post.xss_foliate :prune => ['plain_text', 'html_string']
+          }
+          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+          new_post.valid?
+        end
+      end
+    end
+
+    context "declaring scrubbed fields" do
+      context "on all fields" do
+        setup do
+          Post.xss_foliate
+        end
+
+        should "scrub all fields" do
+          mock_doc = mock
+          Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once.returns(mock_doc)
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :strip).once.returns(mock_doc)
+          Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
+          mock_doc.expects(:text).twice
+          assert new_post.valid?
+        end
+      end
+
+      context "omitting one field" do
+        setup do
+          Post.xss_foliate :except => [:plain_text]
+        end
+
+        should "not scrub omitted field" do
+          mock_doc = mock
+          Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once.returns(mock_doc)
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :strip).never
+          Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
+          mock_doc.expects(:text).once
+          new_post.valid?
+        end
+      end
+
+      Loofah::Scrubbers.scrubber_symbols.each do |method|
+        context "declaring one field to be scrubbed with #{method}" do
+          setup do
+            Post.xss_foliate method => [:plain_text]
+          end
+
+          should "scrub that field appropriately" do
+            mock_doc = mock
+            Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once
+            Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    method).once.returns(mock_doc)
+            Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
+            mock_doc.expects(:to_s)
+            new_post.valid?
+          end
+        end
+      end
+
+      context "declaring one field to be scrubbed with html5lib_sanitize" do
+        setup do
+          Post.xss_foliate :html5lib_sanitize => [:plain_text]
+        end
+
+        should "not that field appropriately" do
+          Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip) .once
+          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :escape).once
+          Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip) .never
+          new_post.valid?
+        end
+      end
+    end
+
+    context "invalid model data" do
+      setup do
+        Post.validates_presence_of :html_string
+        Post.xss_foliate
+      end
+
+      should "not be valid after sanitizing" do
+        Loofah.expects(:scrub_fragment).with(WHITESPACEY, :strip).once
+        Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :strip).once
+        assert ! new_post(:html_string => WHITESPACEY).valid?
+      end
+    end
+
+    context "given an XSS attempt" do
+      setup do
+        Post.xss_foliate :strip => :html_string
+      end
+
+      should "escape html entities" do
+        hackattack = "<div>&lt;script&gt;alert('evil')&lt;/script&gt;</div>"
+        post = new_post :html_string => hackattack, :plain_text => hackattack
+        post.valid?
+        assert_equal "<div>&lt;script&gt;alert('evil')&lt;/script&gt;</div>", post.html_string
+        assert_equal "&lt;script&gt;alert('evil')&lt;/script&gt;", post.plain_text
+      end
+    end
+
+    context "these tests should pass for libxml 2.7.5 and later" do
+      should "not scrub double quotes into html entities" do
+        answer = new_post(:plain_text => "\"something\"")
+        answer.valid?
+        assert_equal "\"something\"", answer.plain_text
+      end
+
+      should "not scrub ampersands into html entities" do
+        answer = new_post(:plain_text => "& Something")
+        answer.valid?
+        assert_equal "& Something", answer.plain_text
+      end
+
+      should "not scrub \\r html entities" do
+        answer = new_post(:plain_text => "Another \r Something")
+        answer.valid?
+        assert_equal "Another \r Something", answer.plain_text
+      end
+
+      should "not scrub \\n html entities" do
+        answer = new_post(:plain_text => "Another \n Something")
+        answer.valid?
+        assert_equal "Another \n Something", answer.plain_text
+      end
+    end
+  end
+end
+