onebox 1.5.21 → 1.5.22

data/spec/lib/onebox/engine/amazon_onebox_spec.rb

@@ -62,11 +62,19 @@ describe Onebox::Engine::AmazonOnebox do
 
   describe "#to_html" do
     it "includes image" do
-      expect(html).to include("img")
+      expect(html).to include("http://ecx.images-amazon.com/images/I/51opYcR6kVL._SY400_.jpg")
     end
 
     it "includes description" do
-      expect(html).to include("Using only the finest natural materials and ecologically sound")
+      expect(html).to include("I have been programming for 25 years in a variety of hardware and software languages.")
+    end
+
+    it "includes price" do
+      expect(html).to include("$25.34")
+    end
+
+    it "includes title" do
+      expect(html).to include("Seven Languages in Seven Weeks: A Pragmatic Guide to Learning Programming Languages (Pragmatic Programmers)")
     end
 
   end

data/spec/lib/onebox/engine/stack_exchange_onebox_spec.rb

@@ -3,7 +3,7 @@ require "spec_helper"
 describe Onebox::Engine::StackExchangeOnebox do
   before(:all) do
     @link = "http://stackoverflow.com/questions/17992553/concept-behind-these-four-lines-of-tricky-c-code"
-    fake("http://api.stackexchange.com/2.1/questions/17992553?site=stackoverflow.com", response(described_class.onebox_name))
+    fake("https://api.stackexchange.com/2.1/questions/17992553?site=stackoverflow.com", response(described_class.onebox_name))
   end
 
   include_context "engines"

data/spec/lib/onebox/engine/whitelisted_generic_onebox_spec.rb

@@ -50,18 +50,18 @@ describe Onebox::Engine::WhitelistedGenericOnebox do
   describe 'rewrites' do
     class DummyOnebox < Onebox::Engine::WhitelistedGenericOnebox
       def generic_html
-        "<iframe src='https://youtube.com/asdf'></iframe>"
+        "<iframe src='http://youtube.com/asdf'></iframe>"
       end
     end
 
     it "doesn't rewrite URLs that arent in the list" do
       Onebox::Engine::WhitelistedGenericOnebox.rewrites = []
-      expect(DummyOnebox.new("http://youtube.com").to_html).to eq "<iframe src='https://youtube.com/asdf'></iframe>"
+      expect(DummyOnebox.new("http://youtube.com").to_html).to eq "<iframe src='http://youtube.com/asdf'></iframe>"
     end
 
     it "rewrites URLs when whitelisted" do
       Onebox::Engine::WhitelistedGenericOnebox.rewrites = %w(youtube.com)
-      expect(DummyOnebox.new("http://youtube.com").to_html).to eq "<iframe src='//youtube.com/asdf'></iframe>"
+      expect(DummyOnebox.new("http://youtube.com").to_html).to eq "<iframe src='https://youtube.com/asdf'></iframe>"
     end
   end
 

data/spec/lib/onebox/engine/wikipedia_onebox_spec.rb

@@ -3,6 +3,7 @@ require "spec_helper"
 describe Onebox::Engine::WikipediaOnebox do
   before(:all) do
     @link = "http://en.wikipedia.org/wiki/Billy_Jack"
+    fake("https://en.wikipedia.org/wiki/Billy_Jack", response(described_class.onebox_name))
   end
 
   include_context "engines"

data/spec/lib/onebox/engine/youtube_onebox_spec.rb

@@ -2,8 +2,9 @@ require 'spec_helper'
 
 describe Onebox::Engine::YoutubeOnebox do
   before do
-    fake("http://www.youtube.com/watch?feature=player_embedded&v=21Lk4YiASMo", response("youtube"))
+    fake("https://www.youtube.com/watch?feature=player_embedded&v=21Lk4YiASMo", response("youtube"))
     fake("https://www.youtube.com/channel/UCL8ZULXASCc1I_oaOT0NaOQ", response("youtube-channel"))
+    fake("https://www.youtube.com/playlist?list=PL5308B2E5749D1696", response("youtube-playlist"))
   end
 
   it "adds wmode=opaque" do
@@ -31,7 +32,8 @@ describe Onebox::Engine::YoutubeOnebox do
   it "can onebox a playlist" do
     pending('no opengraph on playlists, needs special handling')
 
-    Onebox.preview('https://www.youtube.com/playlist?list=PL5308B2E5749D1696').to_s
+    expect(Onebox.preview('https://www.youtube.com/playlist?list=PL5308B2E5749D1696')
+    .to_s).to match(/Dear Sophie/)
   end
 
   it "does not make HTTP requests unless necessary" do

data/spec/lib/onebox/engine_spec.rb

@@ -21,8 +21,14 @@ describe Onebox::Engine do
     before { allow(Onebox::View).to receive(:template) { %|this shold be a template| } }
 
     it "escapes `link`" do
-      html = OneboxEngineExample.new(%|http://foo.com" onscript="alert('foo')|).to_html
-      expect(html).not_to include(%|onscript="alert('foo')|)
+      html = OneboxEngineExample.new(%|http://foo.com/'?a=1&b=2|).to_html
+      expect(html).not_to match(/&(?!amp;)(?!#39;)/)
+    end
+
+    it "escapes xss" do
+      skip 'this is checking the wrong thing'
+      html = OneboxEngineExample.new(%|http://foo.com/'?%20onmouseover=alert(/foo/)|).to_html
+      expect(html).not_to include(%|onmouseover=alert(/foo/)|)
     end
   end
 
@@ -66,6 +72,20 @@ describe Onebox::Engine do
     end
   end
 
+  class AlwaysHttpsEngineExample < OneboxEngineExample
+    always_https
+  end
+
+  describe "always_https" do
+    it "never returns a plain http url" do
+      url = 'http://play.google.com/store/apps/details?id=com.google.android.inputmethod.latin'
+      onebox = AlwaysHttpsEngineExample.new(url)
+      result = onebox.to_html
+      expect(result).to_not match(/http(?!s)/)
+      expect(result).to_not match(/['"]\/\//)
+      expect(result).to match(/https/)
+    end
+  end
 end
 
 describe ".onebox_name" do

data/spec/lib/onebox/preview_spec.rb

@@ -17,7 +17,7 @@ describe Onebox::Preview do
 
   describe "#to_s" do
     it "returns some html if given a valid url" do
-      title = "Knit Noro: Accessories"
+      title = "Seven Languages in Seven Weeks: A Pragmatic Guide to Learning Programming Languages (Pragmatic Programmers)"
       expect(preview.to_s).to include(title)
     end
 

data/templates/amazon.mustache

@@ -3,4 +3,4 @@
 <h3><a href='{{link}}'>{{title}}</a></h3>
 {{#by_info}}<b>{{by_info}}</b>{{/by_info}}
 <p>{{description}}</p>
-<p>{{price}}</p>
+<p><strong>{{price}}<strong></p>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: onebox
 version: !ruby/object:Gem::Version
-  version: 1.5.21
+  version: 1.5.22
 platform: ruby
 authors:
 - Joanna Zeta
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-26 00:00:00.000000000 Z
+date: 2015-07-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json
@@ -413,7 +413,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.6
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: A gem for turning URLs into previews.