mixpanel 4.0.9 → 4.1.0

data/README.md

@@ -4,6 +4,8 @@ This Gem will not be maintained anymore, there is an Official gem being develope
 
 We will merge PR for bugs for a little period of time, but no new features will be added.
 
+# Upgrade to 4.1.0 to avoid XSS Vulnerability
+
 [Official Gem repository](https://github.com/mixpanel/mixpanel-ruby)
 
 ## Table of Contents

data/lib/mixpanel/tracker.rb

@@ -35,7 +35,10 @@ module Mixpanel
     end
 
     def append(type, *args)
-      queue << [type, args.collect {|arg| arg.to_json}]
+      js_args = args.collect do |arg|
+        escape_object_for_js(arg).to_json
+      end
+      queue << [type, js_args]
     end
 
     protected
@@ -86,5 +89,73 @@ module Mixpanel
         0
       end
     end
+
+    private
+
+    # Recursively escape anything in a primitive, array, or hash, in
+    # preparation for jsonifying it
+    def escape_object_for_js(object, i = 0)
+
+      if object.kind_of? Hash
+        # Recursive case
+        Hash.new.tap do |h|
+          object.each do |k, v|
+            h[escape_object_for_js(k, i + 1)] = escape_object_for_js(v, i + 1)
+          end
+        end
+
+      elsif object.kind_of? Enumerable
+        # Recursive case
+        object.map do |elt|
+          escape_object_for_js(elt, i + 1)
+        end
+
+      elsif object.respond_to? :iso8601
+        # Base case - safe object
+        object.iso8601
+
+      elsif object.kind_of?(Numeric)
+        # Base case - safe object
+        object
+
+      elsif [true, false, nil].member?(object)
+        # Base case - safe object
+        object
+
+      else
+        # Base case - use string sanitizer from ActiveSupport
+        escape_javascript(object.to_s)
+
+      end
+    end
+
+    # All this code borrowed from rails/action_pack - ActionView::Helpers::JavascriptHelper
+
+    JS_ESCAPE_MAP = {
+                     '\\'    => '\\\\',
+                     '</'    => '<\/',
+                     "\r\n"  => '\n',
+                     "\n"    => '\n',
+                     "\r"    => '\n',
+                     '"'     => '\\"',
+                     "'"     => "\\'"
+                    }
+
+    JS_ESCAPE_MAP["\342\200\250".force_encoding(Encoding::UTF_8).encode!] = '&#x2028;'
+    JS_ESCAPE_MAP["\342\200\251".force_encoding(Encoding::UTF_8).encode!] = '&#x2029;'
+
+    # Escapes carriage returns and single and double quotes for JavaScript segments.
+    #
+    # Also available through the alias j(). This is particularly helpful in JavaScript
+    # responses, like:
+    #
+    #   $('some_element').replaceWith('<%=j render 'some/element_template' %>');
+    def escape_javascript(javascript)
+      if javascript
+        javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"'])/u) {|match| JS_ESCAPE_MAP[match] }
+      else
+        ''
+      end
+    end
   end
 end

data/mixpanel.gemspec

@@ -2,7 +2,7 @@ files = ['README.md', 'LICENSE', 'Rakefile', 'mixpanel.gemspec', '{spec,lib}/**/
 
 spec = Gem::Specification.new do |s|
   s.name = "mixpanel"
-  s.version = "4.0.9"
+  s.version = "4.1.0"
   s.rubyforge_project = "mixpanel"
   s.description = "Simple lib to track events in Mixpanel service. It can be used in any rack based framework."
   s.author = "Alvaro Gil"

data/spec/mixpanel/tracker_spec.rb

@@ -146,6 +146,24 @@ describe Mixpanel::Tracker do
         mixpanel_queue_should_include(@mixpanel, "track", "Sign up", props)
       end
 
+      it "should sanitize property values" do
+        @mixpanel.append_track("Sign up", {:referer => "</script><script>alert('XSS');</script>"})
+        @mixpanel.queue.size.should == 1
+        enqueued = @mixpanel.queue.first
+        properties_json = enqueued[1][1]
+        properties_json.should_not match(%r|</script>|)
+      end
+
+      it "should be able to sanitize complex objects" do
+        properties = {'object' => ['foo', {2 => 1, 1 => ['bar', Time.now, nil, {'xss' => "</script><script>alert('XSS');</script>"}]}]}
+        @mixpanel.append_track("Sign up", properties)
+        @mixpanel.queue.size.should == 1
+        enqueued = @mixpanel.queue.first
+        properties_json = enqueued[1][1]
+        properties_json.should_not match(%r|</script>|)
+      end
+
+
       it "should give direct access to queue" do
         @mixpanel.append_track("Sign up", {:referer => 'http://example.com'})
         @mixpanel.queue.size.should == 1

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mixpanel
 version: !ruby/object:Gem::Version
-  version: 4.0.9
+  version: 4.1.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-11-07 00:00:00.000000000 Z
+date: 2013-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json