open_graph_reader 0.7.2 → 0.8.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +5 -5
- data/lib/open_graph_reader/base.rb +3 -3
- data/lib/open_graph_reader/builder.rb +2 -2
- data/lib/open_graph_reader/configuration.rb +8 -8
- data/lib/open_graph_reader/definitions.rb +21 -17
- data/lib/open_graph_reader/fetcher.rb +6 -3
- data/lib/open_graph_reader/object/dsl/types.rb +19 -25
- data/lib/open_graph_reader/object/dsl.rb +3 -3
- data/lib/open_graph_reader/object/registry.rb +1 -2
- data/lib/open_graph_reader/object.rb +1 -1
- data/lib/open_graph_reader/parser/graph.rb +9 -9
- data/lib/open_graph_reader/parser.rb +8 -3
- data/lib/open_graph_reader/version.rb +2 -2
- data/lib/open_graph_reader.rb +3 -3
- data/spec/fixtures/test_cases/image_alt_before_image.html +13 -0
- data/spec/integration/real_world_spec.rb +140 -140
- data/spec/integration/test_cases_spec.rb +17 -0
- data/spec/integration/valid_examples_spec.rb +5 -5
- data/spec/open_graph_reader/fetcher_spec.rb +1 -1
- data/spec/open_graph_reader_spec.rb +15 -15
- data/spec/spec_helper.rb +1 -1
- metadata +16 -88
@@ -5,7 +5,7 @@ RSpec.describe "real world examples" do
|
|
5
5
|
it "parses" do
|
6
6
|
expect {
|
7
7
|
OpenGraphReader.parse! fixture_html "real_world/mixed_case_properties"
|
8
|
-
}.
|
8
|
+
}.not_to raise_error
|
9
9
|
end
|
10
10
|
|
11
11
|
it "assigns the right attributes" do
|
@@ -18,7 +18,7 @@ RSpec.describe "real world examples" do
|
|
18
18
|
expect(object.og.site_name).to eq "Telepolis"
|
19
19
|
expect(object.og.image.url).to eq "http://www.heise.de/tp/artikel/43/43516/43516_1.jpg"
|
20
20
|
expect(object.og.description).to eq(
|
21
|
-
"Ungenehmigte Bürgerinitiative will das Paket EU-Kommissionschef Juncker zum Geburtstag "\
|
21
|
+
"Ungenehmigte Bürgerinitiative will das Paket EU-Kommissionschef Juncker zum Geburtstag " \
|
22
22
|
"schenken"
|
23
23
|
)
|
24
24
|
end
|
@@ -36,7 +36,7 @@ RSpec.describe "real world examples" do
|
|
36
36
|
it "parses" do
|
37
37
|
expect {
|
38
38
|
OpenGraphReader.parse! fixture_html "real_world/mixed_case_type"
|
39
|
-
}.
|
39
|
+
}.not_to raise_error
|
40
40
|
end
|
41
41
|
end
|
42
42
|
|
@@ -54,7 +54,7 @@ RSpec.describe "real world examples" do
|
|
54
54
|
expect(object.og.title).to eq "Emergency call system for all new cars by 2018"
|
55
55
|
expect(object.og.type).to eq "article"
|
56
56
|
expect(object.og.description).to eq(
|
57
|
-
"The European Parliament and EU member states have agreed that new cars must be fitted"\
|
57
|
+
"The European Parliament and EU member states have agreed that new cars must be fitted" \
|
58
58
|
" with an automated system to alert emergency services in event of a crash."
|
59
59
|
)
|
60
60
|
expect(object.og.site_name).to eq "BBC News"
|
@@ -77,7 +77,7 @@ RSpec.describe "real world examples" do
|
|
77
77
|
"http://cdn.instructables.com/FI2/D7XW/I2XTQWFE/FI2D7XWI2XTQWFE.RECTANGLE1.jpg"
|
78
78
|
)
|
79
79
|
expect(object.og.description).to eq(
|
80
|
-
"The OpenKnit machine is an open-source, low cost, digital fabrication tool developed by "\
|
80
|
+
"The OpenKnit machine is an open-source, low cost, digital fabrication tool developed by " \
|
81
81
|
"Gerard Rubio. The machine affords the user the opportunity to..."
|
82
82
|
)
|
83
83
|
end
|
@@ -99,10 +99,10 @@ RSpec.describe "real world examples" do
|
|
99
99
|
expect(object.og.type).to eq "article"
|
100
100
|
expect(object.og.title).to eq "Profesores y campesinos amarran a infiltrados en marcha"
|
101
101
|
expect(object.og.description).to eq(
|
102
|
-
"Regeneración, 6 de diciembre de 2014.-Durante la marcha que realizan profesores y "\
|
103
|
-
"organizaciones campesinas sobre avenida Paseo de la Reforma, maestros de la Coordinadora "\
|
104
|
-
"Estatal de Trabajadores de la Educación en Guerrero (CETEG) ubicaron a 12 jóvenes como "\
|
105
|
-
"“infiltrados”, a quienes amarraron de las manos en una cadena humana para evitar que "\
|
102
|
+
"Regeneración, 6 de diciembre de 2014.-Durante la marcha que realizan profesores y " \
|
103
|
+
"organizaciones campesinas sobre avenida Paseo de la Reforma, maestros de la Coordinadora " \
|
104
|
+
"Estatal de Trabajadores de la Educación en Guerrero (CETEG) ubicaron a 12 jóvenes como " \
|
105
|
+
"“infiltrados”, a quienes amarraron de las manos en una cadena humana para evitar que " \
|
106
106
|
"marchen con ellos, informó El …"
|
107
107
|
)
|
108
108
|
expect(object.og.url).to eq(
|
@@ -128,7 +128,7 @@ RSpec.describe "real world examples" do
|
|
128
128
|
expect(object.og.title).to eq "Emergency call system for all new cars by 2018"
|
129
129
|
expect(object.og.type).to eq "article"
|
130
130
|
expect(object.og.description).to eq(
|
131
|
-
"The European Parliament and EU member states have agreed that new cars must be fitted with"\
|
131
|
+
"The European Parliament and EU member states have agreed that new cars must be fitted with" \
|
132
132
|
" an automated system to alert emergency services in event of a crash."
|
133
133
|
)
|
134
134
|
expect(object.og.site_name).to eq "BBC News"
|
@@ -157,7 +157,7 @@ RSpec.describe "real world examples" do
|
|
157
157
|
"http://cdn.instructables.com/FI2/D7XW/I2XTQWFE/FI2D7XWI2XTQWFE.RECTANGLE1.jpg"
|
158
158
|
)
|
159
159
|
expect(object.og.description).to eq(
|
160
|
-
"The OpenKnit machine is an open-source, low cost, digital fabrication tool developed by "\
|
160
|
+
"The OpenKnit machine is an open-source, low cost, digital fabrication tool developed by " \
|
161
161
|
"Gerard Rubio. The machine affords the user the opportunity to..."
|
162
162
|
)
|
163
163
|
end
|
@@ -185,11 +185,11 @@ RSpec.describe "real world examples" do
|
|
185
185
|
|
186
186
|
expect(object.og.type).to eq "website"
|
187
187
|
expect(object.og.title).to eq(
|
188
|
-
"Ultra Conservative Christian Lady Goes To Museum, Tries To Debunk Evolution, Fails Beyond"\
|
188
|
+
"Ultra Conservative Christian Lady Goes To Museum, Tries To Debunk Evolution, Fails Beyond" \
|
189
189
|
" Miserably | Geekologie"
|
190
190
|
)
|
191
191
|
expect(object.og.image.url).to eq(
|
192
|
-
"http://geekologie.com/assets_c/2014/11/crazy-lady-goes-to-the"\
|
192
|
+
"http://geekologie.com/assets_c/2014/11/crazy-lady-goes-to-the" \
|
193
193
|
"-museum-thumb-640x389-29314.jpg"
|
194
194
|
)
|
195
195
|
end
|
@@ -229,7 +229,7 @@ RSpec.describe "real world examples" do
|
|
229
229
|
|
230
230
|
object = OpenGraphReader.parse!(
|
231
231
|
fixture_html("real_world/image_path_2"),
|
232
|
-
"http://motherboard.vice.com/de/read/forscher-kreieren-ein-material-das-fast-so-dunkel-ist"\
|
232
|
+
"http://motherboard.vice.com/de/read/forscher-kreieren-ein-material-das-fast-so-dunkel-ist" \
|
233
233
|
"-wie-ein-schwarzes-loch?trk_source=popular"
|
234
234
|
)
|
235
235
|
|
@@ -239,11 +239,11 @@ RSpec.describe "real world examples" do
|
|
239
239
|
)
|
240
240
|
expect(object.og.site_name).to eq "Motherboard"
|
241
241
|
expect(object.og.image.url).to eq(
|
242
|
-
"https://motherboard-images.vice.com/content-images/article/13701/1405417621515809.JPG?cro"\
|
242
|
+
"https://motherboard-images.vice.com/content-images/article/13701/1405417621515809.JPG?cro" \
|
243
243
|
"p=0.75xw:1xh;*,*&resize=500:*&output-format=jpeg&output-quality=90"
|
244
244
|
)
|
245
245
|
expect(object.og.url).to eq(
|
246
|
-
"http://motherboard.vice.com/de/read/forscher-kreieren-ein-material-das-fast-so-dunkel-ist"\
|
246
|
+
"http://motherboard.vice.com/de/read/forscher-kreieren-ein-material-das-fast-so-dunkel-ist" \
|
247
247
|
"-wie-ein-schwarzes-loch"
|
248
248
|
)
|
249
249
|
end
|
@@ -271,47 +271,47 @@ RSpec.describe "real world examples" do
|
|
271
271
|
expect(object.og.url).to eq(
|
272
272
|
"https://github.com/blog/1938-vulnerability-announced-update-your-git-clients"
|
273
273
|
)
|
274
|
-
expect(object.og.description).to eq
|
275
|
-
A critical Git security vulnerability has been announced today, affecting all versions of the \
|
276
|
-
official Git client and all related software that interacts with Git repositories, including \
|
277
|
-
GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, \
|
278
|
-
github.com and GitHub Enterprise are not directly affected.
|
279
|
-
|
280
|
-
The vulnerability concerns Git and Git-compatible clients that access Git repositories in a \
|
281
|
-
case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that \
|
282
|
-
will cause Git to overwrite its own .git/config file when cloning or checking out a repository, \
|
283
|
-
leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) \
|
284
|
-
or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux \
|
285
|
-
clients are not affected if they run in a case-sensitive filesystem.
|
286
|
-
|
287
|
-
We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as \
|
288
|
-
soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted \
|
289
|
-
on unsafe or untrusted hosts.
|
290
|
-
|
291
|
-
Repositories hosted on github.com cannot contain any of the malicious trees that trigger the \
|
292
|
-
vulnerability because we now verify and block these trees on push. We have also completed an \
|
293
|
-
automated scan of all existing content on github.com to look for malicious content that might have \
|
294
|
-
been pushed to our site before this vulnerability was discovered. This work is an extension of the \
|
295
|
-
data-quality checks we have always performed on repositories pushed to our servers to protect our \
|
296
|
-
users against malformed or malicious Git data.
|
297
|
-
|
298
|
-
Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and \
|
299
|
-
both contain the security fix on the Desktop application itself and on the bundled version of the \
|
300
|
-
Git command-line client.
|
301
|
-
|
302
|
-
In addition, the following updated versions of Git address this vulnerability:
|
303
|
-
|
304
|
-
|
305
|
-
The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, \
|
306
|
-
v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
|
307
|
-
Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
|
308
|
-
The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. \
|
309
|
-
Third party software using these libraries is strongly encouraged to update.
|
310
|
-
|
311
|
-
|
312
|
-
More details on the vulnerability can be found in the official Git mailing list announcement and on \
|
313
|
-
the git-blame blog.
|
314
|
-
DESCRIPTION
|
274
|
+
expect(object.og.description).to eq <<~DESCRIPTION.chomp
|
275
|
+
A critical Git security vulnerability has been announced today, affecting all versions of the \
|
276
|
+
official Git client and all related software that interacts with Git repositories, including \
|
277
|
+
GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, \
|
278
|
+
github.com and GitHub Enterprise are not directly affected.
|
279
|
+
|
280
|
+
The vulnerability concerns Git and Git-compatible clients that access Git repositories in a \
|
281
|
+
case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that \
|
282
|
+
will cause Git to overwrite its own .git/config file when cloning or checking out a repository, \
|
283
|
+
leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) \
|
284
|
+
or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux \
|
285
|
+
clients are not affected if they run in a case-sensitive filesystem.
|
286
|
+
|
287
|
+
We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as \
|
288
|
+
soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted \
|
289
|
+
on unsafe or untrusted hosts.
|
290
|
+
|
291
|
+
Repositories hosted on github.com cannot contain any of the malicious trees that trigger the \
|
292
|
+
vulnerability because we now verify and block these trees on push. We have also completed an \
|
293
|
+
automated scan of all existing content on github.com to look for malicious content that might have \
|
294
|
+
been pushed to our site before this vulnerability was discovered. This work is an extension of the \
|
295
|
+
data-quality checks we have always performed on repositories pushed to our servers to protect our \
|
296
|
+
users against malformed or malicious Git data.
|
297
|
+
|
298
|
+
Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and \
|
299
|
+
both contain the security fix on the Desktop application itself and on the bundled version of the \
|
300
|
+
Git command-line client.
|
301
|
+
|
302
|
+
In addition, the following updated versions of Git address this vulnerability:
|
303
|
+
|
304
|
+
|
305
|
+
The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, \
|
306
|
+
v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
|
307
|
+
Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
|
308
|
+
The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. \
|
309
|
+
Third party software using these libraries is strongly encouraged to update.
|
310
|
+
|
311
|
+
|
312
|
+
More details on the vulnerability can be found in the official Git mailing list announcement and on \
|
313
|
+
the git-blame blog.
|
314
|
+
DESCRIPTION
|
315
315
|
end
|
316
316
|
end
|
317
317
|
|
@@ -336,47 +336,47 @@ DESCRIPTION
|
|
336
336
|
expect(object.og.url).to eq(
|
337
337
|
"https://github.com/blog/1938-vulnerability-announced-update-your-git-clients"
|
338
338
|
)
|
339
|
-
expect(object.og.description).to eq
|
340
|
-
A critical Git security vulnerability has been announced today, affecting all versions of the \
|
341
|
-
official Git client and all related software that interacts with Git repositories, including \
|
342
|
-
GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, \
|
343
|
-
github.com and GitHub Enterprise are not directly affected.
|
344
|
-
|
345
|
-
The vulnerability concerns Git and Git-compatible clients that access Git repositories in a \
|
346
|
-
case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that \
|
347
|
-
will cause Git to overwrite its own .git/config file when cloning or checking out a repository, \
|
348
|
-
leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) \
|
349
|
-
or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux \
|
350
|
-
clients are not affected if they run in a case-sensitive filesystem.
|
351
|
-
|
352
|
-
We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as \
|
353
|
-
soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted \
|
354
|
-
on unsafe or untrusted hosts.
|
355
|
-
|
356
|
-
Repositories hosted on github.com cannot contain any of the malicious trees that trigger the \
|
357
|
-
vulnerability because we now verify and block these trees on push. We have also completed an \
|
358
|
-
automated scan of all existing content on github.com to look for malicious content that might have \
|
359
|
-
been pushed to our site before this vulnerability was discovered. This work is an extension of the \
|
360
|
-
data-quality checks we have always performed on repositories pushed to our servers to protect our \
|
361
|
-
users against malformed or malicious Git data.
|
362
|
-
|
363
|
-
Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and \
|
364
|
-
both contain the security fix on the Desktop application itself and on the bundled version of the \
|
365
|
-
Git command-line client.
|
366
|
-
|
367
|
-
In addition, the following updated versions of Git address this vulnerability:
|
368
|
-
|
369
|
-
|
370
|
-
The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, \
|
371
|
-
v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
|
372
|
-
Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
|
373
|
-
The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. \
|
374
|
-
Third party software using these libraries is strongly encouraged to update.
|
375
|
-
|
376
|
-
|
377
|
-
More details on the vulnerability can be found in the official Git mailing list announcement and on \
|
378
|
-
the git-blame blog.
|
379
|
-
DESCRIPTION
|
339
|
+
expect(object.og.description).to eq <<~DESCRIPTION.chomp
|
340
|
+
A critical Git security vulnerability has been announced today, affecting all versions of the \
|
341
|
+
official Git client and all related software that interacts with Git repositories, including \
|
342
|
+
GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, \
|
343
|
+
github.com and GitHub Enterprise are not directly affected.
|
344
|
+
|
345
|
+
The vulnerability concerns Git and Git-compatible clients that access Git repositories in a \
|
346
|
+
case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that \
|
347
|
+
will cause Git to overwrite its own .git/config file when cloning or checking out a repository, \
|
348
|
+
leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) \
|
349
|
+
or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux \
|
350
|
+
clients are not affected if they run in a case-sensitive filesystem.
|
351
|
+
|
352
|
+
We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as \
|
353
|
+
soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted \
|
354
|
+
on unsafe or untrusted hosts.
|
355
|
+
|
356
|
+
Repositories hosted on github.com cannot contain any of the malicious trees that trigger the \
|
357
|
+
vulnerability because we now verify and block these trees on push. We have also completed an \
|
358
|
+
automated scan of all existing content on github.com to look for malicious content that might have \
|
359
|
+
been pushed to our site before this vulnerability was discovered. This work is an extension of the \
|
360
|
+
data-quality checks we have always performed on repositories pushed to our servers to protect our \
|
361
|
+
users against malformed or malicious Git data.
|
362
|
+
|
363
|
+
Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and \
|
364
|
+
both contain the security fix on the Desktop application itself and on the bundled version of the \
|
365
|
+
Git command-line client.
|
366
|
+
|
367
|
+
In addition, the following updated versions of Git address this vulnerability:
|
368
|
+
|
369
|
+
|
370
|
+
The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, \
|
371
|
+
v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
|
372
|
+
Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
|
373
|
+
The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. \
|
374
|
+
Third party software using these libraries is strongly encouraged to update.
|
375
|
+
|
376
|
+
|
377
|
+
More details on the vulnerability can be found in the official Git mailing list announcement and on \
|
378
|
+
the git-blame blog.
|
379
|
+
DESCRIPTION
|
380
380
|
end
|
381
381
|
|
382
382
|
it "parses with datetime format parsing turned on" do
|
@@ -391,47 +391,47 @@ DESCRIPTION
|
|
391
391
|
expect(object.og.image.url).to eq "https://github.com/apple-touch-icon-144.png"
|
392
392
|
expect(object.og.title).to eq "Vulnerability announced: update your Git clients"
|
393
393
|
expect(object.og.url).to eq "https://github.com/blog/1938-vulnerability-announced-update-your-git-clients"
|
394
|
-
expect(object.og.description).to eq
|
395
|
-
A critical Git security vulnerability has been announced today, affecting all versions of the \
|
396
|
-
official Git client and all related software that interacts with Git repositories, including \
|
397
|
-
GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, \
|
398
|
-
github.com and GitHub Enterprise are not directly affected.
|
399
|
-
|
400
|
-
The vulnerability concerns Git and Git-compatible clients that access Git repositories in a \
|
401
|
-
case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that \
|
402
|
-
will cause Git to overwrite its own .git/config file when cloning or checking out a repository, \
|
403
|
-
leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) \
|
404
|
-
or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux \
|
405
|
-
clients are not affected if they run in a case-sensitive filesystem.
|
406
|
-
|
407
|
-
We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as \
|
408
|
-
soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted \
|
409
|
-
on unsafe or untrusted hosts.
|
410
|
-
|
411
|
-
Repositories hosted on github.com cannot contain any of the malicious trees that trigger the \
|
412
|
-
vulnerability because we now verify and block these trees on push. We have also completed an \
|
413
|
-
automated scan of all existing content on github.com to look for malicious content that might have \
|
414
|
-
been pushed to our site before this vulnerability was discovered. This work is an extension of the \
|
415
|
-
data-quality checks we have always performed on repositories pushed to our servers to protect our \
|
416
|
-
users against malformed or malicious Git data.
|
417
|
-
|
418
|
-
Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and \
|
419
|
-
both contain the security fix on the Desktop application itself and on the bundled version of the \
|
420
|
-
Git command-line client.
|
421
|
-
|
422
|
-
In addition, the following updated versions of Git address this vulnerability:
|
423
|
-
|
424
|
-
|
425
|
-
The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, \
|
426
|
-
v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
|
427
|
-
Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
|
428
|
-
The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. \
|
429
|
-
Third party software using these libraries is strongly encouraged to update.
|
430
|
-
|
431
|
-
|
432
|
-
More details on the vulnerability can be found in the official Git mailing list announcement and on \
|
433
|
-
the git-blame blog.
|
434
|
-
DESCRIPTION
|
394
|
+
expect(object.og.description).to eq <<~DESCRIPTION.chomp
|
395
|
+
A critical Git security vulnerability has been announced today, affecting all versions of the \
|
396
|
+
official Git client and all related software that interacts with Git repositories, including \
|
397
|
+
GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, \
|
398
|
+
github.com and GitHub Enterprise are not directly affected.
|
399
|
+
|
400
|
+
The vulnerability concerns Git and Git-compatible clients that access Git repositories in a \
|
401
|
+
case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that \
|
402
|
+
will cause Git to overwrite its own .git/config file when cloning or checking out a repository, \
|
403
|
+
leading to arbitrary command execution in the client machine. Git clients running on OS X (HFS+) \
|
404
|
+
or any version of Microsoft Windows (NTFS, FAT) are exploitable through this vulnerability. Linux \
|
405
|
+
clients are not affected if they run in a case-sensitive filesystem.
|
406
|
+
|
407
|
+
We strongly encourage all users of GitHub and GitHub Enterprise to update their Git clients as \
|
408
|
+
soon as possible, and to be particularly careful when cloning or accessing Git repositories hosted \
|
409
|
+
on unsafe or untrusted hosts.
|
410
|
+
|
411
|
+
Repositories hosted on github.com cannot contain any of the malicious trees that trigger the \
|
412
|
+
vulnerability because we now verify and block these trees on push. We have also completed an \
|
413
|
+
automated scan of all existing content on github.com to look for malicious content that might have \
|
414
|
+
been pushed to our site before this vulnerability was discovered. This work is an extension of the \
|
415
|
+
data-quality checks we have always performed on repositories pushed to our servers to protect our \
|
416
|
+
users against malformed or malicious Git data.
|
417
|
+
|
418
|
+
Updated versions of GitHub for Windows and GitHub for Mac are available for immediate download, and \
|
419
|
+
both contain the security fix on the Desktop application itself and on the bundled version of the \
|
420
|
+
Git command-line client.
|
421
|
+
|
422
|
+
In addition, the following updated versions of Git address this vulnerability:
|
423
|
+
|
424
|
+
|
425
|
+
The Git core team has announced maintenance releases for all current versions of Git (v1.8.5.6, \
|
426
|
+
v1.9.5, v2.0.5, v2.1.4, and v2.2.1).
|
427
|
+
Git for Windows (also known as MSysGit) has released maintenance version 1.9.5.
|
428
|
+
The two major Git libraries, libgit2 and JGit, have released maintenance versions with the fix. \
|
429
|
+
Third party software using these libraries is strongly encouraged to update.
|
430
|
+
|
431
|
+
|
432
|
+
More details on the vulnerability can be found in the official Git mailing list announcement and on \
|
433
|
+
the git-blame blog.
|
434
|
+
DESCRIPTION
|
435
435
|
end
|
436
436
|
end
|
437
437
|
|
@@ -500,7 +500,7 @@ DESCRIPTION
|
|
500
500
|
describe "just_other_prefix" do
|
501
501
|
it "parses" do
|
502
502
|
expect {
|
503
|
-
|
503
|
+
OpenGraphReader.parse! fixture_html "real_world/just_other_prefix"
|
504
504
|
}.to raise_error OpenGraphReader::NoOpenGraphDataError
|
505
505
|
end
|
506
506
|
end
|
@@ -0,0 +1,17 @@
|
|
1
|
+
require "spec_helper"
|
2
|
+
|
3
|
+
RSpec.describe "test cases" do
|
4
|
+
describe "image_alt_before_image" do
|
5
|
+
it "parses" do
|
6
|
+
expect {
|
7
|
+
OpenGraphReader.parse! fixture_html "test_cases/image_alt_before_image"
|
8
|
+
}.not_to raise_error
|
9
|
+
end
|
10
|
+
|
11
|
+
it "returns the data" do
|
12
|
+
object = OpenGraphReader.parse!(fixture_html("test_cases/image_alt_before_image"))
|
13
|
+
expect(object.og.image.content).to eq "https://example.com/example.png"
|
14
|
+
expect(object.og.image.alt).to eq "image:alt"
|
15
|
+
end
|
16
|
+
end
|
17
|
+
end
|
@@ -1,7 +1,7 @@
|
|
1
1
|
require "spec_helper"
|
2
2
|
|
3
3
|
RSpec.describe "valid examples" do
|
4
|
-
%w
|
4
|
+
%w[
|
5
5
|
article-offset
|
6
6
|
article-utc
|
7
7
|
audio-array
|
@@ -21,12 +21,12 @@ RSpec.describe "valid examples" do
|
|
21
21
|
video-array
|
22
22
|
video-movie
|
23
23
|
video
|
24
|
-
|
24
|
+
].each do |example|
|
25
25
|
describe example do
|
26
26
|
it "parses" do
|
27
27
|
expect {
|
28
28
|
OpenGraphReader.parse! example_html example
|
29
|
-
}.
|
29
|
+
}.not_to raise_error
|
30
30
|
end
|
31
31
|
end
|
32
32
|
end
|
@@ -37,7 +37,7 @@ RSpec.describe "valid examples" do
|
|
37
37
|
it "parses" do
|
38
38
|
expect {
|
39
39
|
object
|
40
|
-
}.
|
40
|
+
}.not_to raise_error
|
41
41
|
end
|
42
42
|
|
43
43
|
it "allows access to the first tag" do
|
@@ -70,7 +70,7 @@ RSpec.describe "valid examples" do
|
|
70
70
|
it "parses" do
|
71
71
|
expect {
|
72
72
|
OpenGraphReader.parse! example_html "errors/book"
|
73
|
-
}.
|
73
|
+
}.not_to raise_error
|
74
74
|
end
|
75
75
|
end
|
76
76
|
end
|
@@ -6,7 +6,7 @@ RSpec.describe OpenGraphReader::Fetcher do
|
|
6
6
|
let(:fetcher) { described_class.new uri }
|
7
7
|
let(:good_response) { {status: 200, body: "", headers: {"Content-Type" => "text/html"}} }
|
8
8
|
|
9
|
-
context "error during body fetch" do
|
9
|
+
context "with an error during body fetch" do
|
10
10
|
before do
|
11
11
|
stub_request(:head, host).to_return(good_response)
|
12
12
|
stub_request(:get, host).to_raise(Faraday::ConnectionFailed.new("execution expired"))
|
@@ -8,7 +8,7 @@ RSpec.describe OpenGraphReader do
|
|
8
8
|
allow(OpenGraphReader::Fetcher).to receive(:new).and_return(double(html?: false))
|
9
9
|
|
10
10
|
expect {
|
11
|
-
|
11
|
+
described_class.fetch! "http://example.org"
|
12
12
|
}.to raise_error OpenGraphReader::NoOpenGraphDataError
|
13
13
|
end
|
14
14
|
|
@@ -17,7 +17,7 @@ RSpec.describe OpenGraphReader do
|
|
17
17
|
allow(OpenGraphReader::Fetcher).to receive(:new).and_return(fetcher)
|
18
18
|
allow(OpenGraphReader::Parser).to receive(:new).and_return(double(any_tags?: false))
|
19
19
|
expect {
|
20
|
-
|
20
|
+
described_class.fetch! "http://example.org"
|
21
21
|
}.to raise_error OpenGraphReader::NoOpenGraphDataError
|
22
22
|
end
|
23
23
|
|
@@ -26,7 +26,7 @@ RSpec.describe OpenGraphReader do
|
|
26
26
|
allow(OpenGraphReader::Fetcher).to receive(:new).and_return(fetcher)
|
27
27
|
|
28
28
|
expect {
|
29
|
-
|
29
|
+
described_class.fetch! "http://example.org"
|
30
30
|
}.to raise_error OpenGraphReader::InvalidObjectError
|
31
31
|
end
|
32
32
|
end
|
@@ -36,8 +36,8 @@ RSpec.describe OpenGraphReader do
|
|
36
36
|
allow(OpenGraphReader::Fetcher).to receive(:new).and_return(double(html?: false))
|
37
37
|
|
38
38
|
expect {
|
39
|
-
|
40
|
-
}.
|
39
|
+
described_class.fetch "http://example.org"
|
40
|
+
}.not_to raise_error
|
41
41
|
end
|
42
42
|
|
43
43
|
it "does not raise if there are no tags" do
|
@@ -46,8 +46,8 @@ RSpec.describe OpenGraphReader do
|
|
46
46
|
allow(OpenGraphReader::Parser).to receive(:new).and_return(double(any_tags?: false))
|
47
47
|
|
48
48
|
expect {
|
49
|
-
|
50
|
-
}.
|
49
|
+
described_class.fetch "http://example.org"
|
50
|
+
}.not_to raise_error
|
51
51
|
end
|
52
52
|
|
53
53
|
it "does not raise if there's an invalid object" do
|
@@ -55,8 +55,8 @@ RSpec.describe OpenGraphReader do
|
|
55
55
|
allow(OpenGraphReader::Fetcher).to receive(:new).and_return(fetcher)
|
56
56
|
|
57
57
|
expect {
|
58
|
-
|
59
|
-
}.
|
58
|
+
described_class.fetch "http://example.org"
|
59
|
+
}.not_to raise_error
|
60
60
|
end
|
61
61
|
end
|
62
62
|
|
@@ -65,13 +65,13 @@ RSpec.describe OpenGraphReader do
|
|
65
65
|
allow(OpenGraphReader::Parser).to receive(:new).and_return(double(any_tags?: false))
|
66
66
|
|
67
67
|
expect {
|
68
|
-
|
68
|
+
described_class.parse! ""
|
69
69
|
}.to raise_error OpenGraphReader::NoOpenGraphDataError
|
70
70
|
end
|
71
71
|
|
72
72
|
it "raises if there's an invalid object" do
|
73
73
|
expect {
|
74
|
-
|
74
|
+
described_class.parse! invalid_object
|
75
75
|
}.to raise_error OpenGraphReader::InvalidObjectError
|
76
76
|
end
|
77
77
|
end
|
@@ -81,14 +81,14 @@ RSpec.describe OpenGraphReader do
|
|
81
81
|
allow(OpenGraphReader::Parser).to receive(:new).and_return(double(any_tags?: false))
|
82
82
|
|
83
83
|
expect {
|
84
|
-
|
85
|
-
}.
|
84
|
+
described_class.parse ""
|
85
|
+
}.not_to raise_error
|
86
86
|
end
|
87
87
|
|
88
88
|
it "does not raise if there's an invalid object" do
|
89
89
|
expect {
|
90
|
-
|
91
|
-
}.
|
90
|
+
described_class.parse invalid_object
|
91
|
+
}.not_to raise_error
|
92
92
|
end
|
93
93
|
end
|
94
94
|
end
|