onebox 1.8.87 → 1.8.88

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: feb212710bc29cb9f40fe3a693fa2f1da63b4c62ef45f95bf16dd5665b6f2ea7
-  data.tar.gz: 5d1f092e320bd28f3ee17feac0e7b91139e769b0b42a4aeecc20f5e99dab2a00
+  metadata.gz: 05ff8777e383e0ca7f85d0b6779042a368bf2b5eeded7d5649acee095687cab5
+  data.tar.gz: edd3c4653a5574a5ad8f3720d340e1014cada9134d9f76145197a485dbc93f71
 SHA512:
-  metadata.gz: 18bc5e6a7f72de373929ddbcbec7605135911a5126406cb98829f68986332a0d936da17dc0c219daa30619111cb29e1ba0a3c38d6db63d443cb3e83eea441365
-  data.tar.gz: 0406d24b43f94876bc127b44a5e268ef2a56c4ad6233781d8f9a2d465b0b56e044c96ffaca05f84f6e6623cdb0f7faef5fe047642f20a8d0fb89fab070ee1b39
+  metadata.gz: 4bfd753abe8e3f406d729d23491bd86747b90a7e5ae125ae4ec7e7fc4205e16cfddd94355ea19536bed5371f2ad20001f86ef70b773c7f5f78a31390b03217f8
+  data.tar.gz: 23f3dcff844057f1c54de48121e163f94a306779a0b4d7312e98aab2da36501ab5f687683c7d36713c05f754642ed3637659cd2024787bb86fba6becef5d5283

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    onebox (1.8.87)
+    onebox (1.8.88)
       htmlentities (~> 4.3)
       moneta (~> 1.0)
       multi_json (~> 1.11)

data/lib/onebox/engine.rb

@@ -81,12 +81,7 @@ module Onebox
     end
 
     def link
-      @url.gsub(/['\"<>]/,
-        "'" => '&#39;',
-        '"' => '&quot;',
-        '<' => '&lt;',
-        '>' => '&gt;',
-      )
+      ::Onebox::Helpers.uri_encode(@url)
     end
 
     def always_https?

data/lib/onebox/helpers.rb

@@ -185,5 +185,52 @@ module Onebox
       end
       src
     end
+
+    RFC_3986_URI_REGEX = /^(?<scheme>([^:\/?#]+):)?(?<authority>\/\/([^\/?#]*))?(?<path>[^?#]*)(\?(?<query>[^#]*))?(#(?<fragment>.*))?$/
+
+    # Percent-encodes a URI query parameter per RFC3986 - https://tools.ietf.org/html/rfc3986
+    def self.uri_query_encode(query_string)
+      return "" unless query_string
+
+      # query can encode space to %20 OR +
+      # + MUST be encoded as %2B
+      # in RFC3968 both query and fragment are defined as:
+      # = *( pchar / "/" / "?" )
+      # CGI.escape turns space into + which is the most backward compatible
+      # however it doesn't roundtrip through URI.unescape which prefers %20
+      CGI.escape(query_string).gsub('+', '%20')
+    end
+
+    # Percent-encodes a URI string per RFC3986 - https://tools.ietf.org/html/rfc3986
+    def self.uri_encode(url)
+      return "" unless url
+
+      # parse uri into named matches, then reassemble properly encoded
+      parts = url.match(RFC_3986_URI_REGEX)
+
+      encoded = ""
+      encoded += parts[:scheme] unless parts[:scheme].nil?
+      encoded += parts[:authority] unless parts[:authority].nil?
+
+      # path requires space to be encoded as %20 (NEVER +)
+      # + should be left unencoded
+      # URI::parse and URI::Generic.build don't like paths encoded with CGI.escape
+      # URI.escape does not change / to %2F and : to %3A like CGI.escape
+      encoded += URI.escape(parts[:path]) unless parts[:path].nil?
+
+      # each query parameter
+      if !parts[:query].nil?
+        query_string = parts[:query].split('&').map do |pair|
+          # can optionally be separated by an =
+          pair.split('=').map do |v|
+            uri_query_encode(v)
+          end.join('=')
+        end.join('&')
+        encoded += '?' + query_string
+      end
+
+      encoded += '#' + uri_query_encode(parts[:fragment]) unless parts[:fragment].nil?
+      encoded
+    end
   end
 end

data/lib/onebox/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Onebox
-  VERSION = "1.8.87"
+  VERSION = "1.8.88"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: onebox
 version: !ruby/object:Gem::Version
-  version: 1.8.87
+  version: 1.8.88
 platform: ruby
 authors:
 - Joanna Zeta
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-30 00:00:00.000000000 Z
+date: 2019-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json