loofah 1.1.0 → 1.2.0

data/CHANGELOG.rdoc

@@ -1,5 +1,12 @@
 = Changelog
 
+== 1.2.0 (2011-08-08)
+
+Enhancements:
+
+* Loofah::Helpers.sanitize_css is a replacement for Rails's built-in sanitize_css helper.
+* Improving ActionView integration.
+
 == 1.1.0 (2011-08-08)
 
 Enhancements:

data/README.rdoc

@@ -1,8 +1,8 @@
 = Loofah
 
 * http://github.com/flavorjones/loofah
-* http://loofah.rubyforge.org
-* http://rubyforge.org/projects/loofah
+* http://rubydoc.info/github/flavorjones/loofah/master/frames
+* http://librelist.com/browser/loofah
 
 == Description
 

data/lib/loofah.rb

@@ -29,7 +29,7 @@ require 'loofah/helpers'
 #
 module Loofah
   # The version of Loofah you are using
-  VERSION = '1.1.0'
+  VERSION = '1.2.0'
 
   class << self
     # Shortcut for Loofah::HTML::Document.parse

data/lib/loofah/helpers.rb

@@ -16,7 +16,19 @@ module Loofah
       #   Loofah::Helpers.sanitize("<script src=http://ha.ckers.org/xss.js></script>") # => "&lt;script src=\"http://ha.ckers.org/xss.js\"&gt;&lt;/script&gt;"
       #
       def sanitize(string_or_io)
-        Loofah.scrub_fragment(string_or_io, :strip).to_s
+        loofah_fragment = Loofah.fragment(string_or_io)
+        loofah_fragment.scrub!(:strip)
+        loofah_fragment.xpath("./form").each { |form| form.remove }
+        loofah_fragment.to_s
+      end
+
+      #
+      #  A replacement for Rails's built-in +sanitize_css+ helper.
+      #
+      #    Loofah::Helpers.sanitize_css("display:block;background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg)") # => "display: block;"
+      #
+      def sanitize_css style_string
+        ::Loofah::HTML5::Scrub.scrub_css style_string
       end
 
       #
@@ -26,5 +38,55 @@ module Loofah
         string.gsub(/\n\s*\n\s*\n/,"\n\n")
       end
     end
+
+    module ActionView
+      module ClassMethods # :nodoc:
+        def full_sanitizer
+          @full_sanitizer ||= ::Loofah::Helpers::ActionView::FullSanitizer.new
+        end
+
+        def white_list_sanitizer
+          @white_list_sanitizer ||= ::Loofah::Helpers::ActionView::WhiteListSanitizer.new
+        end
+      end
+
+      #
+      #  Replacement class for Rails's HTML::FullSanitizer.
+      #
+      #  To use by default, call this in an application initializer:
+      #
+      #      ActionView::Helpers::SanitizeHelper.full_sanitizer = ::Loofah::Helpers::ActionView::FullSanitizer.new
+      #
+      #  Or, to generally opt-in to Loofah's view sanitizers:
+      #
+      #      Loofah::Helpers::ActionView.set_as_default_sanitizer
+      #
+      class FullSanitizer
+        def sanitize html, *args
+          Loofah::Helpers.strip_tags html
+        end
+      end
+
+      #
+      #  Replacement class for Rails's HTML::WhiteListSanitizer.
+      #
+      #  To use by default, call this in an application initializer:
+      #
+      #      ActionView::Helpers::SanitizeHelper.white_list_sanitizer = ::Loofah::Helpers::ActionView::WhiteListSanitizer.new
+      #
+      #  Or, to generally opt-in to Loofah's view sanitizers:
+      #
+      #      Loofah::Helpers::ActionView.set_as_default_sanitizer
+      #
+      class WhiteListSanitizer
+        def sanitize html, *args
+          Loofah::Helpers.sanitize html
+        end
+
+        def sanitize_css style_string, *args
+          Loofah::Helpers.sanitize_css style_string
+        end
+      end
+    end
   end
 end

data/test/integration/test_helpers.rb

@@ -1,7 +1,7 @@
 require "helper"
 
 class IntegrationTestHelpers < Loofah::TestCase
-  context "#strip_tags" do
+  context ".strip_tags" do
     context "on safe markup" do
       it "strip out tags" do
         assert_equal "omgwtfbbq!!1!", Loofah::Helpers.strip_tags("<div>omgwtfbbq</div><span>!!1!</span>")
@@ -16,7 +16,7 @@ class IntegrationTestHelpers < Loofah::TestCase
     end
   end
 
-  context "#sanitize" do
+  context ".sanitize" do
     context "on safe markup" do
       it "render the safe html" do
         html = "<div>omgwtfbbq</div><span>!!1!</span>"
@@ -28,6 +28,16 @@ class IntegrationTestHelpers < Loofah::TestCase
       it "strip the unsafe tags" do
         assert_equal "alert('evil')<span>w00t</span>", Loofah::Helpers.sanitize("<script>alert('evil')</script><span>w00t</span>")
       end
+
+      it "strips form tags" do
+        assert_equal "alert('evil')<span>w00t</span>", Loofah::Helpers.sanitize("<script>alert('evil')</script><form action=\"/foo/bar\" method=\"post\"><input></form><span>w00t</span>")
+      end
+    end
+  end
+
+  context ".sanitize_css" do
+    it "removes unsafe css properties" do
+      assert_equal "display: block; background-color: blue;", Loofah::Helpers.sanitize_css("display:block;background-image:url(http://www.ragingplatypus.com/i/cam-full.jpg);background-color:blue")
     end
   end
 end

data/test/unit/test_helpers.rb

@@ -4,24 +4,59 @@ class UnitTestHelpers < Loofah::TestCase
 
   HTML_STRING = "<div>omgwtfbbq</div>"
 
-  context "#strip_tags" do
-    it "invoke Loofah.fragment.text" do
-      mock_doc = Object.new
-      mock(Loofah).fragment(HTML_STRING) { mock_doc }
-      mock(mock_doc).text
+  describe "Helpers" do
+    context ".strip_tags" do
+      it "invoke Loofah.fragment.text" do
+        mock_doc = Object.new
+        mock(Loofah).fragment(HTML_STRING) { mock_doc }
+        mock(mock_doc).text
 
-      Loofah::Helpers.strip_tags HTML_STRING
+        Loofah::Helpers.strip_tags HTML_STRING
+      end
     end
-  end
 
-  context "#sanitize" do
-    it "invoke Loofah.scrub_fragment(:strip).to_s" do
-      mock_doc = Object.new
-      mock(Loofah).fragment(HTML_STRING) { mock_doc }
-      mock(mock_doc).scrub!(:strip) { mock_doc }
-      mock(mock_doc).to_s
+    context ".sanitize" do
+      it "invoke Loofah.scrub_fragment(:strip).to_s" do
+        mock_doc = Object.new
+        mock_node = Object.new
+        mock(Loofah).fragment(HTML_STRING) { mock_doc }
+        mock(mock_doc).scrub!(:strip) { mock_doc }
+        mock(mock_doc).xpath("./form") { [mock_node] }
+        mock(mock_node).remove
+        mock(mock_doc).to_s
+
+        Loofah::Helpers.sanitize HTML_STRING
+      end
+    end
+
+    context ".sanitize_css" do
+      it "invokes HTML5lib's css scrubber" do
+        mock(Loofah::HTML5::Scrub).scrub_css("foobar")
+        Loofah::Helpers.sanitize_css("foobar")
+      end
+    end
+
+    describe "ActionView" do
+      describe "FullSanitizer#sanitize" do
+        it "calls .strip_tags" do
+          mock(Loofah::Helpers).strip_tags("foobar")
+          Loofah::Helpers::ActionView::FullSanitizer.new.sanitize "foobar"
+        end
+      end
+
+      describe "WhiteListSanitizer#sanitize" do
+        it "calls .sanitize" do
+          mock(Loofah::Helpers).sanitize("foobar")
+          Loofah::Helpers::ActionView::WhiteListSanitizer.new.sanitize "foobar"
+        end
+      end
 
-      Loofah::Helpers.sanitize HTML_STRING
+      describe "WhiteListSanitizer#sanitize_css" do
+        it "calls .sanitize_css" do
+          mock(Loofah::Helpers).sanitize_css("foobar")
+          Loofah::Helpers::ActionView::WhiteListSanitizer.new.sanitize_css "foobar"
+        end
+      end
     end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: loofah
 version: !ruby/object:Gem::Version 
-  hash: 19
+  hash: 31
   prerelease: 
   segments: 
   - 1
-  - 1
+  - 2
   - 0
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors: 
 - Mike Dalessio
@@ -20,8 +20,6 @@ date: 2011-08-08 00:00:00 -04:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
-  prerelease: false
-  type: :runtime
   requirement: &id001 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -35,9 +33,9 @@ dependencies:
         version: 1.4.4
   name: nokogiri
   version_requirements: *id001
-- !ruby/object:Gem::Dependency 
   prerelease: false
-  type: :development
+  type: :runtime
+- !ruby/object:Gem::Dependency 
   requirement: &id002 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -50,9 +48,9 @@ dependencies:
         version: "0.8"
   name: rake
   version_requirements: *id002
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id003 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -65,9 +63,9 @@ dependencies:
         version: "2.2"
   name: minitest
   version_requirements: *id003
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id004 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -80,9 +78,9 @@ dependencies:
         version: "1.0"
   name: rr
   version_requirements: *id004
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id005 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -94,9 +92,9 @@ dependencies:
         version: "0"
   name: json
   version_requirements: *id005
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id006 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -108,9 +106,9 @@ dependencies:
         version: "0"
   name: hoe-gemspec
   version_requirements: *id006
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id007 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -122,9 +120,9 @@ dependencies:
         version: "0"
   name: hoe-debugging
   version_requirements: *id007
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id008 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -136,9 +134,9 @@ dependencies:
         version: "0"
   name: hoe-bundler
   version_requirements: *id008
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id009 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -150,9 +148,9 @@ dependencies:
         version: "0"
   name: hoe-git
   version_requirements: *id009
-- !ruby/object:Gem::Dependency 
   prerelease: false
   type: :development
+- !ruby/object:Gem::Dependency 
   requirement: &id010 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
@@ -165,6 +163,8 @@ dependencies:
         version: "2.10"
   name: hoe
   version_requirements: *id010
+  prerelease: false
+  type: :development
 description: |-
   Loofah is a general library for manipulating and transforming HTML/XML
   documents and fragments. It's built on top of Nokogiri and libxml2, so