loofah-activerecord 1.0.0 → 1.1.0

data/rails_test/generate_test_directory

@@ -1,4 +1,4 @@
-#! /usr/bin/ruby
+#! /usr/bin/env ruby
 
 unless ARGV[0]
   puts "USAGE: #{File.basename($0)} <rails-version> [flavor]"

data/test/helper.rb

@@ -1,9 +1,19 @@
 require 'rubygems'
-require 'test/unit'
-require 'shoulda'
-require 'mocha'
+require 'rr'
+require 'minitest/unit'
+require 'minitest/spec'
+require 'minitest/autorun'
 require 'acts_as_fu'
+
 require File.expand_path(File.join(File.dirname(__FILE__), "..", "lib", "loofah-activerecord"))
 
 puts "=> testing with Nokogiri #{Nokogiri::VERSION_INFO.inspect}"
 puts "=> testing with Loofah #{Loofah::VERSION}"
+
+class Loofah::ActiveRecord::TestCase < MiniTest::Spec
+  include RR::Adapters::TestUnit
+
+  class << self
+    alias_method :context, :describe
+  end
+end

data/test/unit/test_active_record.rb

@@ -1,12 +1,12 @@
-require File.expand_path(File.join(File.dirname(__FILE__), '..', 'helper'))
+require "helper"
 
-class TestActiveRecord < Test::Unit::TestCase
+class TestActiveRecord < Loofah::ActiveRecord::TestCase
 
   HTML_STRING = "<div>omgwtfbbq</div>"
   PLAIN_TEXT  = "vanilla text"
 
   context "with a Post model" do
-    setup do
+    before do
       ActsAsFu.build_model(:posts) do
         string :plain_text
         string :html_string
@@ -15,24 +15,24 @@ class TestActiveRecord < Test::Unit::TestCase
 
     context "scrubbing a single field as a fragment" do
       context "using a symbol to indicate the attribute" do
-        setup do
+        before do
           Post.html_fragment :html_string, :scrub => :prune
           assert ! Post.xss_foliated?
           @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
         end
 
-        should "scrub the specified field" do
-          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).never
+        it "scrub the specified field" do
+          mock(Loofah).scrub_fragment(HTML_STRING, :prune).once
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,  :prune).never
           @post.valid?
         end
 
-        should "only call scrub_fragment once" do
-          Loofah.expects(:scrub_fragment).once
+        it "only call scrub_fragment once" do
+          mock(Loofah).scrub_fragment(anything, anything).once
           @post.valid?
         end
 
-        should "generate strings" do
+        it "generate strings" do
           @post.valid?
           assert_equal String,      @post.html_string.class
           assert_equal HTML_STRING, @post.html_string
@@ -40,15 +40,15 @@ class TestActiveRecord < Test::Unit::TestCase
       end
 
       context "using a string to indicate the attribute" do
-        setup do
+        before do
           Post.html_fragment 'html_string', :scrub => :prune
           assert ! Post.xss_foliated?
           @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
         end
 
-        should "scrub the specified field" do
-          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).never
+        it "scrub the specified field" do
+          mock(Loofah).scrub_fragment(HTML_STRING, :prune).once
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,  :prune).never
           @post.valid?
         end
       end
@@ -56,44 +56,44 @@ class TestActiveRecord < Test::Unit::TestCase
 
     context "scrubbing a single field as a document" do
       context "using a symbol to indicate the attribute" do
-        setup do
+        before do
           Post.html_document :html_string, :scrub => :strip
           @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
         end
 
-        should "scrub the specified field, but not other fields" do
-          Loofah.expects(:scrub_document).with(HTML_STRING, :strip).once
-          Loofah.expects(:scrub_document).with(PLAIN_TEXT,  :strip).never
+        it "scrub the specified field, but not other fields" do
+          mock(Loofah).scrub_document(HTML_STRING, :strip).once
+          mock(Loofah).scrub_document(PLAIN_TEXT,  :strip).never
           @post.valid?
         end
 
-        should "only call scrub_document once" do
-          Loofah.expects(:scrub_document).once
+        it "only call scrub_document once" do
+          mock(Loofah).scrub_document(anything, anything).once
           @post.valid?
         end
 
-        should "generate strings" do
+        it "generate strings" do
           @post.valid?
           assert_equal String, @post.html_string.class
         end
       end
 
       context "using a string to indicate the attribute" do
-        setup do
+        before do
           Post.html_document 'html_string', :scrub => :strip
           @post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
         end
 
-        should "scrub the specified field, but not other fields" do
-          Loofah.expects(:scrub_document).with(HTML_STRING, :strip).once
-          Loofah.expects(:scrub_document).with(PLAIN_TEXT,  :strip).never
+        it "scrubs the specified field, but not other fields" do
+          mock(Loofah).scrub_document(HTML_STRING, :strip).once
+          mock(Loofah).scrub_document(PLAIN_TEXT,  :strip).never
           @post.valid?
         end
       end
     end
 
     context "not passing any options" do
-      should "raise ArgumentError" do
+      it "raises ArgumentError" do
         assert_raises(ArgumentError) {
           Post.html_fragment :foo
         }
@@ -101,36 +101,32 @@ class TestActiveRecord < Test::Unit::TestCase
     end
 
     context "not passing :scrub option" do
-      should "raise ArgumentError" do
-        assert_raise(ArgumentError) {
+      it "raises ArgumentError" do
+        assert_raises(ArgumentError) {
           Post.html_fragment :foo, :bar => :quux
         }
       end
     end
 
     context "passing a :scrub option" do
-      should "not raise ArgumentError" do
-        assert_nothing_raised {
-          Post.html_fragment :foo, :scrub => :quux
-        }
+      it "does not raise ArgumentError" do
+        Post.html_fragment :foo, :scrub => :quux
       end
     end
 
     context "passing a Scrubber" do
-      setup do
+      before do
         @called = false
         @scrubber = Loofah::Scrubber.new do |node|
           @called = true
         end
       end
 
-      should "not raise ArgumentError" do
-        assert_nothing_raised {
-          Post.html_fragment :html_string, :scrub => @scrubber
-        }
+      it "does not raise ArgumentError" do
+        Post.html_fragment :html_string, :scrub => @scrubber
       end
 
-      should "scrub properly" do
+      it "scrubs properly" do
         Post.html_fragment :html_string, :scrub => @scrubber
         post = Post.new :html_string => HTML_STRING, :plain_text => PLAIN_TEXT
         post.valid?

data/test/unit/test_xss_foliate.rb

@@ -1,6 +1,6 @@
-require File.expand_path(File.join(File.dirname(__FILE__), '..', 'helper'))
+require "helper"
 
-class TestXssFoliate < Test::Unit::TestCase
+class TestXssFoliate < Loofah::ActiveRecord::TestCase
 
   HTML_STRING = "<div>omgwtfbbq</div>"
   PLAIN_TEXT = "vanilla text"
@@ -12,7 +12,7 @@ class TestXssFoliate < Test::Unit::TestCase
   end
 
   context "with a Post model" do
-    setup do
+    before do
       ActsAsFu.build_model(:posts) do
         string :plain_text
         string :html_string
@@ -22,27 +22,27 @@ class TestXssFoliate < Test::Unit::TestCase
 
     context "#xss_foliated?" do
       context "when xss_foliate has not been called" do
-        should "return false" do
+        it "return false" do
           assert ! Post.xss_foliated?
         end
       end
 
       context "when xss_foliate has been called with no options" do
-        setup do
+        before do
           Post.xss_foliate
         end
 
-        should "return true" do
+        it "return true" do
           assert Post.xss_foliated?
         end
       end
 
       context "when xss_foliate has been called with options" do
-        setup do
+        before do
           Post.xss_foliate :prune => :plain_text
         end
 
-        should "return true" do
+        it "return true" do
           assert Post.xss_foliated?
         end
       end
@@ -50,47 +50,43 @@ class TestXssFoliate < Test::Unit::TestCase
 
     context "#xss_foliate" do
       context "when passed invalid option" do
-        should "raise ArgumentError" do
-          assert_raise(ArgumentError) { Post.xss_foliate :quux => [:foo] }
+        it "raise ArgumentError" do
+          assert_raises(ArgumentError) { Post.xss_foliate :quux => [:foo] }
         end
       end
 
       context "when passed a symbol" do
-        should "calls the right scrubber" do
-          assert_nothing_raised(ArgumentError) { Post.xss_foliate :prune => :plain_text }
-          Loofah.expects(:scrub_fragment).with(HTML_STRING, :strip).once
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+        it "calls the right scrubber" do
+          Post.xss_foliate :prune => :plain_text
+          mock(Loofah).scrub_fragment(HTML_STRING, :strip).once
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,  :prune).once
           new_post.valid?
         end
       end
 
       context "when passed an array of symbols" do
-        should "calls the right scrubbers" do
-          assert_nothing_raised(ArgumentError) {
-            Post.xss_foliate :prune => [:plain_text, :html_string]
-          }
-          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+        it "calls the right scrubbers" do
+          Post.xss_foliate :prune => [:plain_text, :html_string]
+          mock(Loofah).scrub_fragment(HTML_STRING, :prune).once
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,  :prune).once
           new_post.valid?
         end
       end
 
       context "when passed a string" do
-        should "calls the right scrubber" do
-          assert_nothing_raised(ArgumentError) { Post.xss_foliate :prune => 'plain_text' }
-          Loofah.expects(:scrub_fragment).with(HTML_STRING, :strip).once
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+        it "calls the right scrubber" do
+          Post.xss_foliate :prune => 'plain_text'
+          mock(Loofah).scrub_fragment(HTML_STRING, :strip).once
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,  :prune).once
           new_post.valid?
         end
       end
 
       context "when passed an array of strings" do
-        should "calls the right scrubbers" do
-          assert_nothing_raised(ArgumentError) {
-            Post.xss_foliate :prune => ['plain_text', 'html_string']
-          }
-          Loofah.expects(:scrub_fragment).with(HTML_STRING, :prune).once
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :prune).once
+        it "calls the right scrubbers" do
+          Post.xss_foliate :prune => ['plain_text', 'html_string']
+          mock(Loofah).scrub_fragment(HTML_STRING, :prune).once
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,  :prune).once
           new_post.valid?
         end
       end
@@ -98,85 +94,85 @@ class TestXssFoliate < Test::Unit::TestCase
 
     context "declaring scrubbed fields" do
       context "on all fields" do
-        setup do
+        before do
           Post.xss_foliate
         end
 
-        should "scrub all fields" do
-          mock_doc = mock
-          Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once.returns(mock_doc)
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :strip).once.returns(mock_doc)
-          Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
-          mock_doc.expects(:text).twice
+        it "scrub all fields" do
+          mock_doc = Object.new
+          mock(Loofah).scrub_fragment(HTML_STRING,   :strip).once.returns(mock_doc)
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,    :strip).once.returns(mock_doc)
+          mock(Loofah).scrub_fragment(INTEGER_VALUE, :strip).never
+          mock(mock_doc).text.times(2)
           assert new_post.valid?
         end
       end
 
       context "omitting one field" do
-        setup do
+        before do
           Post.xss_foliate :except => [:plain_text]
         end
 
-        should "not scrub omitted field" do
-          mock_doc = mock
-          Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once.returns(mock_doc)
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :strip).never
-          Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
-          mock_doc.expects(:text).once
+        it "not scrub omitted field" do
+          mock_doc = Object.new
+          mock(Loofah).scrub_fragment(HTML_STRING,   :strip).once.returns(mock_doc)
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,    :strip).never
+          mock(Loofah).scrub_fragment(INTEGER_VALUE, :strip).never
+          mock(mock_doc).text.once
           new_post.valid?
         end
       end
 
       Loofah::Scrubbers.scrubber_symbols.each do |method|
         context "declaring one field to be scrubbed with #{method}" do
-          setup do
+          before do
             Post.xss_foliate method => [:plain_text]
           end
 
-          should "scrub that field appropriately" do
-            mock_doc = mock
-            Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once
-            Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    method).once.returns(mock_doc)
-            Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
-            mock_doc.expects(:to_s)
+          it "scrub that field appropriately" do
+            mock_doc = Object.new
+            mock(Loofah).scrub_fragment(HTML_STRING,   :strip).once
+            mock(Loofah).scrub_fragment(PLAIN_TEXT,    method).once.returns(mock_doc)
+            mock(Loofah).scrub_fragment(INTEGER_VALUE, :strip).never
+            mock(mock_doc).to_s
             new_post.valid?
           end
         end
       end
 
       context "declaring one field to be scrubbed with html5lib_sanitize" do
-        setup do
+        before do
           Post.xss_foliate :html5lib_sanitize => [:plain_text]
         end
 
-        should "not that field appropriately" do
-          Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip) .once
-          Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :escape).once
-          Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip) .never
+        it "not that field appropriately" do
+          mock(Loofah).scrub_fragment(HTML_STRING,   :strip) .once
+          mock(Loofah).scrub_fragment(PLAIN_TEXT,    :escape).once
+          mock(Loofah).scrub_fragment(INTEGER_VALUE, :strip) .never
           new_post.valid?
         end
       end
     end
 
     context "invalid model data" do
-      setup do
+      before do
         Post.validates_presence_of :html_string
         Post.xss_foliate
       end
 
-      should "not be valid after sanitizing" do
-        Loofah.expects(:scrub_fragment).with(WHITESPACEY, :strip).once
-        Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,  :strip).once
+      it "not be valid after sanitizing" do
+        mock(Loofah).scrub_fragment(WHITESPACEY, :strip).once
+        mock(Loofah).scrub_fragment(PLAIN_TEXT,  :strip).once
         assert ! new_post(:html_string => WHITESPACEY).valid?
       end
     end
 
     context "given an XSS attempt" do
-      setup do
+      before do
         Post.xss_foliate :strip => :html_string
       end
 
-      should "escape html entities" do
+      it "escape html entities" do
         hackattack = "<div>&lt;script&gt;alert('evil')&lt;/script&gt;</div>"
         post = new_post :html_string => hackattack, :plain_text => hackattack
         post.valid?
@@ -186,25 +182,29 @@ class TestXssFoliate < Test::Unit::TestCase
     end
 
     context "these tests should pass for libxml 2.7.5 and later" do
-      should "not scrub double quotes into html entities" do
+      before do
+        Post.xss_foliate
+      end
+
+      it "not scrub double quotes into html entities" do
         answer = new_post(:plain_text => "\"something\"")
         answer.valid?
         assert_equal "\"something\"", answer.plain_text
       end
 
-      should "not scrub ampersands into html entities" do
+      it "not scrub ampersands into html entities" do
         answer = new_post(:plain_text => "& Something")
         answer.valid?
         assert_equal "& Something", answer.plain_text
       end
 
-      should "not scrub \\r html entities" do
+      it "not scrub \\r html entities" do
         answer = new_post(:plain_text => "Another \r Something")
         answer.valid?
         assert_equal "Another \r Something", answer.plain_text
       end
 
-      should "not scrub \\n html entities" do
+      it "not scrub \\n html entities" do
         answer = new_post(:plain_text => "Another \n Something")
         answer.valid?
         assert_equal "Another \n Something", answer.plain_text