padrino-helpers 0.16.2 → 0.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12402f16964cbfb4911bf7488933f4b378f949dea6e7f6e30013ea2e16f5ab03
-  data.tar.gz: 19bad50f4edfeb5cf13d3c9052806ee450841134cd9335eddcdc70f77b88ecf3
+  metadata.gz: 51a50e7f371f332ea78163dcfb0bbe826f29e9a300731c71b7591dfef4515f16
+  data.tar.gz: 2bfcef2d07e371a896c4287e9870d939dd6a7a4d4c3f049ccfb29724e96cfbfe
 SHA512:
-  metadata.gz: dec2dd1bf508adb4c26dfc9c95fcb898ea3567f0ed236187dd904af754dfa893111a1e6eaa4731212ea6b92c853c615d6aa7f4a303d0a0bb2db49d7496609539
-  data.tar.gz: 4ef70dfe8ac251e5759685abcc9c648d3e24cc46378420a84ba58bc5150f8cd3398a038723d1c8cd5c8b9caf23a40a10be77af41a0b8fba3e920c327742079b8
+  metadata.gz: 65cdd233db5732c6561f6bd386efad8e3cd798b37e0497c87b79d69d8bf104bb54c0ec4294eddf456eb6fba8fc3dfef97604634ba652415a9d8677f9d3a0e9d9
+  data.tar.gz: d6cd233e716c7cbf85e2b76635ed7620c9f2d1a984af95d8b553b995b78c0716e10bc54e363f2feaa396b4abe17fd53f89d58385c2a73667bd199a373a61db94

data/lib/padrino/rendering/erb_template.rb

@@ -49,7 +49,7 @@ module Padrino
       def precompiled_preamble(locals)
         original = super
         return original unless @is_padrino_app
-        "__in_erb_template = true\n" << original
+        "__in_erb_template = true\n#{original}"
       end
     end
   end

data/lib/padrino/rendering/erubi_template.rb

@@ -22,7 +22,7 @@ module Padrino
 
     class ErubiTemplate < Tilt::ErubiTemplate
       def precompiled_preamble(*)
-        "__in_erb_template = true\n" << super
+        "__in_erb_template = true\n#{super}"
       end
     end
   end

data/lib/padrino/rendering/erubis_template.rb

@@ -53,7 +53,7 @@ module Padrino
       def precompiled_preamble(locals)
         original = super
         return original unless @is_padrino_app
-        "__in_erb_template = true\n" << original.rpartition("\n").first << "#{@outvar} = _buf = SafeBuffer.new\n"
+        "__in_erb_template = true\n#{original.rpartition("\n").first}#{@outvar} = _buf = SafeBuffer.new\n"
       end
     end
   end

data/lib/padrino/rendering/hamlit_template.rb

@@ -20,7 +20,7 @@ module Padrino
       include SafeTemplate
 
       def precompiled_preamble(locals)
-        "__in_hamlit_template = true\n" << super
+        "__in_hamlit_template = true\n#{super}"
       end
     end
   end

data/lib/padrino/rendering/slim_template.rb

@@ -20,7 +20,7 @@ module Padrino
       include SafeTemplate
 
       def precompiled_preamble(locals)
-        "__in_slim_template = true\n" << super
+        "__in_slim_template = true\n#{super}"
       end
     end
   end

data/lib/padrino/rendering.rb

@@ -111,7 +111,7 @@ module Padrino
       #
       def fetch_layout_path(given_layout, layouts_path = views)
         layout_name = (given_layout || @layout || :application).to_s
-        cache_layout_path(layout_name) do
+        cache_layout_path([layouts_path.to_s, layout_name]) do
           if Pathname.new(layout_name).absolute? && Dir["#{layout_name}.*"].any? || Dir["#{layouts_path}/#{layout_name}.*"].any?
             layout_name
           else
@@ -132,12 +132,12 @@ module Padrino
       def cache_template_path(options)
         began_at = Time.now
         @_cached_templates ||= {}
-        logging = defined?(settings) && settings.logging? && defined?(logger)
+        logging = defined?(settings) && settings.logging? && defined?(logger) && logger.respond_to?(:bench) && logger.debug?
         if !reload_templates? && (path = @_cached_templates[options])
-          logger.debug :cached, began_at, path[0] if logging
+          logger.bench :cached, began_at, path[0] if logging
         else
-          path = @_cached_templates[options] = yield(name)
-          logger.debug :template, began_at, path[0] if path && logging
+          path = @_cached_templates[options] = yield
+          logger.bench :template, began_at, path[0] if path && logging
         end
         path
       end
@@ -293,11 +293,10 @@ module Padrino
         template_path = template_path.to_s
         controller_key = respond_to?(:request) && request.respond_to?(:controller) && request.controller
         rendering_options = [template_path, content_type || :html, locale]
+        options = DEFAULT_RENDERING_OPTIONS.merge(options)
+        view_path = options[:views] || settings.views || './views'
 
-        settings.cache_template_path(["#{controller_key}/#{template_path}", rendering_options[1], rendering_options[2]]) do
-          options = DEFAULT_RENDERING_OPTIONS.merge(options)
-          view_path = options[:views] || settings.views || './views'
-
+        settings.cache_template_path([view_path.to_s, "#{controller_key}/#{template_path}", rendering_options[1], rendering_options[2]]) do
           template_candidates = glob_templates(view_path, template_path)
           selected_template = select_template(template_candidates, *rendering_options)
           selected_template ||= template_candidates.first unless options[:strict_format]
@@ -317,9 +316,13 @@ module Padrino
       def resolve_layout(layout, options = {})
         layouts_path = options[:layout_options] && options[:layout_options][:views] || options[:views] || settings.views || './views'
         template_path = settings.fetch_layout_path(layout, layouts_path)
+        if !layout && Pathname.new(template_path).absolute? && Dir["#{template_path}.*"].any?
+          layouts_path, _, template_path = template_path.rpartition('/')
+          options[:layout_options] = (options[:layout_options] || {}).merge(views: layouts_path)
+        end
         rendering_options = [template_path, content_type || :html, locale]
 
-        settings.cache_template_path(rendering_options) do
+        settings.cache_template_path([layouts_path.to_s, *rendering_options]) do
           template_candidates = glob_templates(layouts_path, template_path)
           selected_template = select_template(template_candidates, *rendering_options)
 

data/lib/padrino/safe_buffer.rb

@@ -1,3 +1,5 @@
+require 'cgi/escape'
+
 module Padrino
   ##
   # Padrino::SafeBuffer is based on ActiveSupport::SafeBuffer

data/lib/padrino-helpers/asset_tag_helpers.rb

@@ -5,7 +5,7 @@ module Padrino
     #
     module AssetTagHelpers
       APPEND_ASSET_EXTENSIONS = %w[js css]
-      ABSOLUTE_URL_PATTERN = %r{^(https?://)}
+      ABSOLUTE_URL_PATTERN = %r{\A(https?://)}
       ASSET_FOLDERS = {
         js: 'javascripts',
         css: 'stylesheets'
@@ -86,6 +86,7 @@ module Padrino
         name = block_given? ? '' : args.shift
         href = args.first
         options = { href: href ? escape_link(href) : '#' }.update(options)
+        options[:href] = escape_link(options[:href]) if options[:href]
         return name unless parse_conditions(href, options)
         block_given? ? content_tag(:a, options, &block) : content_tag(:a, name, options)
       end
@@ -315,8 +316,8 @@ module Padrino
       #
       def asset_path(kind, source = nil)
         kind, source = source, kind if source.nil?
-        source = asset_normalize_extension(kind, escape_link(source.to_s))
-        return source if source =~ ABSOLUTE_URL_PATTERN || source =~ %r{^/}
+        source = asset_normalize_extension(kind, source.to_s.gsub(' ', '%20'))
+        return source if source =~ ABSOLUTE_URL_PATTERN || source =~ %r{\A/}
         source = File.join(asset_folder_name(kind), source)
         timestamp = asset_timestamp(source)
         result_path = uri_root_path(source)

data/lib/padrino-helpers/form_builder/abstract_form_builder.rb

@@ -210,7 +210,7 @@ module Padrino
         # field_name(:number) => "user_telephone_attributes_number"
         # field_name(:street) => "user_addresses_attributes_0_street"
         def field_id(field = nil, value = nil)
-          result = namespace && !is_nested ? "#{namespace}_" : ''
+          result = namespace && !is_nested ? "#{namespace}_" : +''
           result << field_id_fragment
           result << "_#{field}" if field
           result << "_#{value}" if value

data/lib/padrino-helpers/form_helpers.rb

@@ -94,6 +94,7 @@ module Padrino
           protect_from_csrf: is_protected_from_csrf?,
           'accept-charset' => 'UTF-8'
         }.update(options)
+        options[:action] = escape_link(options[:action]) if options[:action]
         options[:enctype] = 'multipart/form-data' if options.delete(:multipart)
 
         if (desired_method = options[:method]) =~ /get/i
@@ -847,7 +848,7 @@ module Padrino
       def adjust_color(color)
         return '#000000' unless color =~ COLOR_CODE_REGEXP
         return color if (color_size = color.size) == 7
-        color.slice(1, color_size - 1).each_char.with_object('#') do |chr, obj|
+        color.slice(1, color_size - 1).each_char.with_object(+'#') do |chr, obj|
           obj << chr * 2
         end
       end

data/lib/padrino-helpers/format_helpers.rb

@@ -77,7 +77,7 @@ module Padrino
       def simple_format(text, options = {})
         t = options.delete(:tag) || :p
         start_tag = tag(t, options, true)
-        text = escape_html(text.to_s.dup) unless text.html_safe?
+        text = text.html_safe? ? text.dup : escape_html(text.to_s.dup)
         text.gsub!(/\r\n?/, "\n")                      # \r\n and \r -> \n
         text.gsub!(/\n\n+/, "</#{t}>\n\n#{start_tag}") # 2+ newline  -> paragraph
         text.gsub!(/([^\n]\n)(?=[^\n])/, '\1<br />')   # 1 newline   -> br
@@ -103,7 +103,7 @@ module Padrino
       #   pluralize(2, 'person') => '2 people'
       #
       def pluralize(count, singular, plural = nil)
-        "#{count || 0} " + ([1, '1'].include?(count) ? singular : (plural || singular.pluralize))
+        "#{count || 0} " + ([1, '1'].include?(count) ? singular : (plural || Inflections.pluralize(singular)))
       end
 
       ##

data/lib/padrino-helpers/tag_helpers.rb

@@ -235,17 +235,39 @@ module Padrino
         "<#{name}#{attributes}#{open ? '>' : ' />'}".html_safe
       end
 
+      SAFE_URI_SCHEMES = %w[http https mailto tel ftp].freeze
+
       ##
       # Returns an escaped document link.
+      # Rejects unsafe URI schemes (javascript:, data:, vbscript:, etc.)
+      # to prevent XSS via link injection.
       #
       # @example
       #   escape_link('http://example.com/spaced link')
       #   # => 'http://example.com/spaced%20link'
-      #   escape_link('already%20partially escaped')
-      #   # => 'already%20partially%20escaped'
+      #   escape_link('javascript:alert(1)')
+      #   # => '#'
       #
       def escape_link(link)
-        link.gsub(' ', '%20')
+        return link.gsub(' ', '%20') unless unsafe_uri_scheme?(link)
+
+        '#'
+      end
+
+      ##
+      # Returns true if the URI uses an unsafe scheme.
+      #
+      def unsafe_uri_scheme?(uri)
+        return false unless uri
+
+        # Read the scheme the way browsers do: drop tabs and newlines, skip leading
+        # control characters and spaces, then take a run of scheme characters
+        # followed by a colon. Relative links like 'search?q=a:b' have no scheme.
+        # Everything is anchored at the start so long inputs are scanned once.
+        scheme = uri.to_s.delete("\t\n\r")[/\A[\x00-\x20]*([a-z][a-z0-9+.-]*):/i, 1]
+        return false unless scheme
+
+        !SAFE_URI_SCHEMES.include?(scheme.downcase)
       end
 
       private
@@ -256,7 +278,7 @@ module Padrino
       def tag_attributes(options)
         return '' unless options
 
-        options.inject('') do |all, (key, value)|
+        options.inject(+'') do |all, (key, value)|
           next all unless value
 
           all << ' ' if all.empty?
@@ -283,7 +305,7 @@ module Padrino
       # Iterate through nested values.
       #
       def nested_values(attribute, hash)
-        hash.inject('') do |all, (key, value)|
+        hash.inject(+'') do |all, (key, value)|
           attribute_with_name = "#{attribute}-#{key.to_s.tr('_', '-')}"
           all <<
             if value.is_a?(Hash)

data/test/fixtures/apps/.components

@@ -1,6 +1,6 @@
 --- 
 :test: bacon
 :mock: mocha
-:orm: datamapper
+:orm: none
 :renderer: erb
 :script: jquery

data/test/test_asset_tag_helpers.rb

@@ -76,6 +76,63 @@ describe 'AssetTagHelpers' do
       assert_html_has_tag(actual_link, 'a', href: '/register%20new%20user')
     end
 
+    it 'should reject javascript: URIs' do
+      actual_link = link_to('click', 'javascript:alert(1)')
+      assert_html_has_tag(actual_link, 'a', href: '#', content: 'click')
+    end
+
+    it 'should reject javascript: URIs with mixed case and whitespace' do
+      actual_link = link_to('click', "JaVaScRiPt:\nalert(1)")
+      assert_html_has_tag(actual_link, 'a', href: '#', content: 'click')
+    end
+
+    it 'should reject data: URIs' do
+      actual_link = link_to('click', 'data:text/html,<script>alert(1)</script>')
+      assert_html_has_tag(actual_link, 'a', href: '#', content: 'click')
+    end
+
+    it 'should reject vbscript: URIs' do
+      actual_link = link_to('click', 'vbscript:MsgBox("xss")')
+      assert_html_has_tag(actual_link, 'a', href: '#', content: 'click')
+    end
+
+    it 'should reject unsafe schemes passed via options hash' do
+      actual_link = link_to('click', '/safe', href: 'javascript:alert(1)')
+      assert_html_has_tag(actual_link, 'a', href: '#', content: 'click')
+    end
+
+    it 'should allow http and https URIs' do
+      assert_match 'href="http://example.com"', link_to('click', 'http://example.com')
+      assert_match 'href="https://example.com"', link_to('click', 'https://example.com')
+    end
+
+    it 'should allow mailto and tel URIs' do
+      assert_match 'href="mailto:a@b.com"', link_to('email', 'mailto:a@b.com')
+      assert_match 'href="tel:+1234567890"', link_to('call', 'tel:+1234567890')
+    end
+
+    it 'should allow relative paths and anchors' do
+      assert_html_has_tag(link_to('click', '/path'), 'a', href: '/path')
+      assert_match 'href="#anchor"', link_to('click', '#anchor')
+      assert_match 'href="?query=1"', link_to('click', '?query=1')
+    end
+
+    it 'should allow relative paths with colons in the query or fragment' do
+      assert_match 'href="search?q=a:b"', link_to('click', 'search?q=a:b')
+      assert_match 'href="users/1?at=10:30"', link_to('click', 'users/1?at=10:30')
+      assert_match 'href="page#x:y"', link_to('click', 'page#x:y')
+    end
+
+    it 'should reject unsafe URIs preceded by control characters' do
+      actual_link = link_to('click', "\u0001 javascript:alert(1)")
+      assert_html_has_tag(actual_link, 'a', href: '#', content: 'click')
+    end
+
+    it 'should reject unsafe URIs with tabs or newlines inside the scheme' do
+      assert_html_has_tag(link_to('click', "java\tscript:alert(1)"), 'a', href: '#', content: 'click')
+      assert_html_has_tag(link_to('click', "java\nscript:alert(1)"), 'a', href: '#', content: 'click')
+    end
+
     it 'should not escape image_tag' do
       actual_link = link_to(image_tag('/my/fancy/image.png'), class: 'first', id: 'binky')
       assert_html_has_tag(actual_link, 'img', src: '/my/fancy/image.png')
@@ -410,5 +467,15 @@ describe 'AssetTagHelpers' do
     it 'should generate proper paths for public folder' do
       assert_match(%r{/files/file.ext\?\d+}, asset_path('files/file.ext'))
     end
+
+    it 'should keep colons in asset names' do
+      assert_match(%r{/images/a:b\.png\?\d+}, asset_path(:images, 'a:b.png'))
+      assert_match(%r{/images/photos/10:30\.png\?\d+}, asset_path(:images, 'photos/10:30.png'))
+    end
+
+    it 'should prefix sources whose later lines look absolute' do
+      assert_match(%r{\A/javascripts/data:}, asset_path(:js, "data:text/javascript,alert(1)//\n/x"))
+      assert_match(%r{\A/images/javascript:}, asset_path(:images, "javascript:alert(1)//\nhttp://x"))
+    end
   end
 end

data/test/test_form_helpers.rb

@@ -19,6 +19,16 @@ describe 'FormHelpers' do
       assert_html_has_tag(actual_html, 'form input', type: 'hidden', name: '_method', count: 0)
     end
 
+    it 'should reject unsafe action schemes passed via options hash' do
+      actual_html = form_tag('/safe', action: 'javascript:alert(1)') { 'Demo' }
+      assert_html_has_tag(actual_html, :form, action: '#')
+    end
+
+    it 'should allow relative actions with colons in the query' do
+      actual_html = form_tag('search?q=a:b') { 'Demo' }
+      assert_html_has_tag(actual_html, :form, action: 'search?q=a:b')
+    end
+
     it 'should display correct text inputs within form_tag' do
       actual_html = form_tag('/register', "accept-charset": 'UTF-8', class: 'test') { text_field_tag(:username) }
       assert_html_has_tag(actual_html, 'form input', type: 'text', name: 'username')

data/test/test_format_helpers.rb

@@ -39,6 +39,13 @@ describe 'FormatHelpers' do
       assert_equal "<p>Don't try to escape <b>me</b>!</p>", actual_text
     end
 
+    it 'should not modify already sanitized text it is given' do
+      text = "Keep me\nas I am".html_safe
+      simple_format(text)
+      assert_equal "Keep me\nas I am", text
+      assert_equal "<p>Keep me\n<br />as I am</p>", simple_format(text.freeze)
+    end
+
     describe 'wrapped in a custom tag' do
       it 'should format simple text into html format' do
         actual_text = simple_format("Here is some basic text...\n...with a line break.", tag: :div)
@@ -57,6 +64,28 @@ describe 'FormatHelpers' do
     end
   end
 
+  describe 'for #pluralize method' do
+    it 'should pluralize with the given count' do
+      assert_equal '1 person', pluralize(1, 'person')
+      assert_equal '2 people', pluralize(2, 'person')
+      assert_equal '2 folks', pluralize(2, 'person', 'folks')
+    end
+
+    it 'should pluralize without String#pluralize from ActiveSupport or padrino-gen' do
+      hidden = String.method_defined?(:pluralize)
+      if hidden
+        String.send(:alias_method, :__hidden_pluralize, :pluralize)
+        String.send(:remove_method, :pluralize)
+      end
+      assert_equal '2 items', pluralize(2, 'item')
+    ensure
+      if hidden
+        String.send(:alias_method, :pluralize, :__hidden_pluralize)
+        String.send(:remove_method, :__hidden_pluralize)
+      end
+    end
+  end
+
   describe 'for #word_wrap method' do
     it 'should return proper formatting for 8 max width' do
       actual_text = word_wrap('Once upon a time', line_width: 8)

data/test/test_rendering.rb

@@ -218,6 +218,38 @@ describe 'Rendering' do
       get '/'
       assert_equal 'default layout at application', body
     end
+
+    it 'should use a class-level layout given as an absolute path' do
+      absolute_layout = File.expand_path('fixtures/layouts/layout', __dir__)
+      create_view :foo, 'erb file'
+      create_view :foo, 'js file', format: :js
+      mock_app do
+        layout absolute_layout
+        get('/layout_test', provides: %i[html js]) { render :foo }
+      end
+      get '/layout_test'
+      assert_equal 'erb file absolute layout', body
+      get '/layout_test.js'
+      assert_equal 'js file', body
+    end
+
+    it 'should use a class-level absolute layout with cached templates' do
+      absolute_layout = File.expand_path('fixtures/layouts/layout', __dir__)
+      create_layout :"layouts/layout", 'relative layout <%= yield %>'
+      create_view :foo, 'erb file'
+      mock_app do
+        disable :reload_templates
+        layout absolute_layout
+        get('/absolute') { render :foo }
+        get('/relative') { render :foo, layout: :layout }
+      end
+      2.times do
+        get '/absolute'
+        assert_equal 'erb file absolute layout', body
+        get '/relative'
+        assert_equal 'relative layout erb file', body
+      end
+    end
   end
 
   it 'should solve layout in layouts paths' do
@@ -314,6 +346,24 @@ describe 'Rendering' do
       assert_equal 'bar', body
     end
 
+    it 'should render with logging and a logger without Padrino::Logger::Extensions' do
+      create_template :index, 'plain logger'
+      log = StringIO.new
+      save_logger = Padrino.logger
+      Padrino.logger = Logger.new(log)
+      mock_app do
+        enable :logging
+        get('/') { render(:index, layout: false) }
+      end
+      get '/'
+      assert_equal 200, status
+      assert_equal 'plain logger', body
+      assert_match(/TEMPLATE \(\d+\.\d+s\) .*index/, log.string)
+    ensure
+      Padrino.logger = save_logger
+      remove_views
+    end
+
     it 'should work properly with logging and layout' do
       create_layout :application, 'layout <%= yield %>'
       create_view :index, '<%= foo %>'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: padrino-helpers
 version: !ruby/object:Gem::Version
-  version: 0.16.2
+  version: 0.17.0
 platform: ruby
 authors:
 - Padrino Team
@@ -19,14 +19,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.16.2
+        version: 0.17.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.16.2
+        version: 0.17.0
 - !ruby/object:Gem::Dependency
   name: tilt
   requirement: !ruby/object:Gem::Requirement