loofah 0.4.5 → 0.4.6

data/CHANGELOG.rdoc

@@ -1,6 +1,10 @@
 = Changelog
 
-== 0.4.4 (2010-02-01)
+== 0.4.4, 0.4.5, 0.4.6 (2010-02-01)
+
+Enhancements:
+
+  * Loofah::HTML::Document#text and Loofah::HTML::DocumentFragment#text now escape HTML entities.
 
 Bug fixes:
 

data/lib/loofah.rb

@@ -26,7 +26,7 @@ require 'loofah/helpers'
 #
 module Loofah
   # The version of Loofah you are using
-  VERSION = '0.4.5'
+  VERSION = '0.4.6'
 
   # The minimum required version of Nokogiri
   REQUIRED_NOKOGIRI_VERSION = '1.3.3'

data/lib/loofah/xss_foliate.rb

@@ -180,7 +180,7 @@ module Loofah
 
           # :text if we're here
           fragment = Loofah.scrub_fragment(value, :strip)
-          self[field] = fragment.nil? ? "" : fragment.to_s
+          self[field] = fragment.nil? ? "" : fragment.text
         end
       end
 

data/test/unit/test_xss_foliate.rb

@@ -107,7 +107,7 @@ class TestXssFoliate < Test::Unit::TestCase
           Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once.returns(mock_doc)
           Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :strip).once.returns(mock_doc)
           Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
-          mock_doc.expects(:to_s).twice
+          mock_doc.expects(:text).twice
           assert new_post.valid?
         end
       end
@@ -122,7 +122,7 @@ class TestXssFoliate < Test::Unit::TestCase
           Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once.returns(mock_doc)
           Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    :strip).never
           Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
-          mock_doc.expects(:to_s).once
+          mock_doc.expects(:text).once
           new_post.valid?
         end
       end
@@ -133,12 +133,12 @@ class TestXssFoliate < Test::Unit::TestCase
             Post.xss_foliate method => [:plain_text]
           end
 
-          should "not that field appropriately" do
+          should "scrub that field appropriately" do
             mock_doc = mock
-            Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once.returns(mock_doc)
+            Loofah.expects(:scrub_fragment).with(HTML_STRING,   :strip).once
             Loofah.expects(:scrub_fragment).with(PLAIN_TEXT,    method).once.returns(mock_doc)
             Loofah.expects(:scrub_fragment).with(INTEGER_VALUE, :strip).never
-            mock_doc.expects(:to_s).twice
+            mock_doc.expects(:to_s)
             new_post.valid?
           end
         end
@@ -177,10 +177,10 @@ class TestXssFoliate < Test::Unit::TestCase
       end
 
       should "escape html entities" do
-        hackattack = "&lt;script&gt;alert('evil')&lt;/script&gt;"
+        hackattack = "<div>&lt;script&gt;alert('evil')&lt;/script&gt;</div>"
         post = new_post :html_string => hackattack, :plain_text => hackattack
         post.valid?
-        assert_equal "&lt;script&gt;alert('evil')&lt;/script&gt;", post.html_string
+        assert_equal "<div>&lt;script&gt;alert('evil')&lt;/script&gt;</div>", post.html_string
         assert_equal "&lt;script&gt;alert('evil')&lt;/script&gt;", post.plain_text
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: loofah
 version: !ruby/object:Gem::Version 
-  version: 0.4.5
+  version: 0.4.6
 platform: ruby
 authors: 
 - Mike Dalessio