qti 0.9.18 → 0.9.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f98b966174234c785257c789cdd6130cc59abb20
-  data.tar.gz: 58464a2cbc399e5c63e6d5209165fed1da5c7e81
+  metadata.gz: f08961302e59741f56b51aabcb16edb63f901be4
+  data.tar.gz: f9c74f21b63ee84c5049f5e4c7ea2f38cb99a621
 SHA512:
-  metadata.gz: bcad0a6d3725624c35e51ed164c347505870f49340eefdb020b0b3769211ac5f74efc6efef046d7336376c47cb8b3c9d4fd152c6a5a0c162a6fe7b625652feb9
-  data.tar.gz: d5713beb9bdb67e3bb00c0b875db8b9011a9eb964b703861023b5812edffa11fdebc37c6baa6444193530bf59de999f1eaa253b2501419e635a277262f0b9f56
+  metadata.gz: dd55d71f3a2d3da8630cb395f84e785b601a0d810445299788dcf8fa3d744655ebe9d0806422a81e68e7a60dfeba7325eea3fb005d33951573d443619ff2b7b6
+  data.tar.gz: '08526dd39ab4c10f740762c017cb5148855c00e5bc0c9eced6d91eccd6ad8d7962dc38941d5eba7cf163e32a50ca18b943c836a3793f8ce4d9c9422fc78ac066'

data/lib/qti/models/base.rb

@@ -1,7 +1,7 @@
 require 'nokogiri'
-require 'sanitize'
 require 'pathname'
 require 'mathml2latex'
+require 'qti/sanitizer'
 
 module Qti
   class ParseError < StandardError; end
@@ -13,45 +13,8 @@ module Qti
       attr_reader :doc, :path, :package_root
       attr_accessor :manifest
 
-      ELEMENTS_REMAP = {
-        'prompt' => 'div',
-        'simpleBlock' => 'div',
-        'simpleInline' => 'span',
-        'atomicBlock' => 'div',
-        'atomicInline' => 'span'
-      }.freeze
-
       def sanitize_content!(html)
-        Sanitize.fragment(html, sanitize_config)
-      end
-
-      def object_tag_transformer
-        lambda do |env|
-          return unless env[:node_name] == 'object'
-          return if env[:is_whitelisted] || !env[:node].element?
-          replace_object_node(env[:node])
-        end
-      end
-
-      def remap_unknown_tags_transformer
-        lambda do |env|
-          node_name = env[:node_name]
-          node = env[:node]
-
-          return if env[:is_whitelisted] || !node.element?
-          return unless ELEMENTS_REMAP.keys.include? node_name
-
-          new_name = ELEMENTS_REMAP[node_name]
-          env[:node].name = new_name
-          env[:node_name] = new_name
-        end
-      end
-
-      def sanitize_config(import_objects: true)
-        transformers = []
-        transformers << object_tag_transformer if import_objects
-        transformers << remap_unknown_tags_transformer
-        Sanitize::Config::RELAXED.merge transformers: transformers
+        sanitizer.clean(html)
       end
 
       def self.from_path!(path, package_root = nil)
@@ -131,33 +94,10 @@ module Qti
         @path = other_item.path
       end
 
-      def replace_object_node(node)
-        path = remap_href_path(node[:data])
-        if path
-          case node[:type]
-          when %r{^image\/}
-            return replace_with_image(node, node[:data])
-          when 'text/html'
-            return replace_with_html(node, path)
-          end
-        end
-        # remove unrecognized or invalid objects from the sanitized document
-        node.unlink
-      end
-
-      def replace_with_image(node, src)
-        node.name = 'img'
-        node[:src] = src
-      end
+      private
 
-      def replace_with_html(node, path)
-        content = File.read(path)
-        html_content = Sanitize.fragment(content, sanitize_config(import_objects: false))
-        node.name = 'div'
-        node.add_child(Nokogiri::HTML.fragment(html_content))
-      rescue StandardError => e
-        warn "failed to import html object #{path}: #{e.message}"
-        node.unlink
+      def sanitizer
+        @sanitizer ||= Sanitizer.new
       end
     end
   end

data/lib/qti/models/manifest.rb

@@ -75,7 +75,6 @@ module Qti
         canvas_extra_file(identifier, '.xml.qti')
       end
 
-
       def asset_resource_for_ims(identifier, qti_type)
         base_xpath = "[@identifier='#{identifier}' and starts-with(@type, '#{qti_type}')]"
         xmlns_resource(base_xpath + '/@href') || xmlns_resource(base_xpath + '/xmlns:file/@href')

data/lib/qti/sanitizer.rb

@@ -0,0 +1,125 @@
+require 'nokogiri'
+require 'sanitize'
+require 'uri'
+
+module Qti
+  class Sanitizer
+    ELEMENTS_REMAP = {
+      'prompt' => 'div',
+      'simpleBlock' => 'div',
+      'simpleInline' => 'span',
+      'atomicBlock' => 'div',
+      'atomicInline' => 'span'
+    }.freeze
+
+    PROTOCOLS = ['http', 'https', :relative].freeze
+    FILTER_TAGS = %w[iframe object embed].freeze
+
+    CONFIG =
+      {
+        elements: FILTER_TAGS,
+        protocols:
+          {
+            'iframe' => { 'src' => PROTOCOLS },
+            'object' => { 'src' => PROTOCOLS },
+            'embed' => { 'src' => PROTOCOLS }
+          }.freeze,
+        attributes:
+          {
+            'object' => %w[src width height style data type classid codebase],
+            'embed' => %w[name src type allowfullscreen pluginspage wmode
+                          allowscriptaccess width height],
+            'iframe' => %w[src width height name align frameborder scrolling sandbox
+                           allowfullscreen webkitallowfullscreen mozallowfullscreen
+                           allow] # TODO: remove explicit allow with domain whitelist account setting
+          }.freeze
+      }.freeze
+
+    def clean(html)
+      Sanitize.fragment(html, sanitize_config)
+    end
+
+    private
+
+    def object_tag_transformer
+      lambda do |env|
+        return unless env[:node_name] == 'object'
+        return if env[:is_whitelisted] || !env[:node].element?
+        replace_object_node(env[:node])
+      end
+    end
+
+    def remap_unknown_tags_transformer
+      lambda do |env|
+        node_name = env[:node_name]
+        node = env[:node]
+
+        return if env[:is_whitelisted] || !node.element?
+        return unless ELEMENTS_REMAP.keys.include? node_name
+
+        new_name = ELEMENTS_REMAP[node_name]
+        env[:node].name = new_name
+        env[:node_name] = new_name
+      end
+    end
+
+    def src_transformers
+      lambda do |env|
+        return unless FILTER_TAGS.include?(env[:node_name])
+        return if env[:is_whitelisted] || !env[:node].element?
+        Sanitize.node!(env[:node], CONFIG)
+        { node_whitelist: [env[:node]] }
+      end
+    end
+
+    def sanitize_config(import_objects: true)
+      transformers = []
+      transformers << src_transformers
+      transformers << object_tag_transformer if import_objects
+      transformers << remap_unknown_tags_transformer
+      Sanitize::Config::RELAXED.merge transformers: transformers
+    end
+
+    def remap_href_path(href)
+      return nil unless href
+      path = File.join(File.dirname(@path), href)
+      if @package_root.nil?
+        raise Qti::ParseError, "Potentially unsafe href '#{href}'" if href.split('/').include?('..')
+      else
+        unless Pathname.new(path).cleanpath.to_s.start_with?(@package_root)
+          raise Qti::ParseError, "Unsafe href '#{href}'"
+        end
+      end
+      path
+    end
+
+    def replace_object_node(node)
+      path = remap_href_path(node[:data])
+      if path
+        case node[:type]
+        when %r{^image\/}
+          return replace_with_image(node, node[:data])
+        when 'text/html'
+          return replace_with_html(node, path)
+        end
+      end
+      # remove unrecognized or invalid objects from the sanitized document
+      node.unlink
+    end
+
+    def replace_with_image(node, src)
+      node.name = 'img'
+      node[:src] = src
+    end
+
+    def replace_with_html(node, path)
+      content = File.read(path)
+      html_content = Sanitize.fragment(content, sanitize_config(import_objects: false))
+      node.name = 'div'
+      node.add_child(Nokogiri::HTML.fragment(html_content))
+    rescue StandardError => e
+      warn "failed to import html object #{path}: #{e.message}"
+      node.unlink
+    end
+  end
+end

data/lib/qti/v1/models/interactions/fill_blank_interaction.rb

@@ -92,7 +92,7 @@ module Qti
             if canvas_multiple_fib?
               @node.xpath('.//xmlns:response_label')
             else
-              @node.xpath('.//xmlns:varequal')
+              @node.xpath('.//xmlns:respcondition/xmlns:setvar/../xmlns:conditionvar/xmlns:varequal')
             end
           end
 

data/lib/qti/version.rb

@@ -1,3 +1,3 @@
 module Qti
-  VERSION = '0.9.18'.freeze
+  VERSION = '0.9.19'.freeze
 end

data/spec/fixtures/items_1.2/fib_feedback.xml

@@ -0,0 +1,117 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<questestinterop xmlns="http://www.imsglobal.org/xsd/ims_qtiasiv1p2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.imsglobal.org/xsd/ims_qtiasiv1p2 http://www.imsglobal.org/xsd/ims_qtiasiv1p2p1.xsd">
+  <item ident="i35ee28d5beb1008a385457c8ceb7d7fa" title="FITB question type. Stuff-N-Things">
+    <itemmetadata>
+      <qtimetadata>
+        <qtimetadatafield>
+          <fieldlabel>question_type</fieldlabel>
+          <fieldentry>short_answer_question</fieldentry>
+        </qtimetadatafield>
+        <qtimetadatafield>
+          <fieldlabel>points_possible</fieldlabel>
+          <fieldentry>3.5</fieldentry>
+        </qtimetadatafield>
+        <qtimetadatafield>
+          <fieldlabel>assessment_question_identifierref</fieldlabel>
+          <fieldentry>i83cfb4f7f8eb35b6c4c52c78e989362a</fieldentry>
+        </qtimetadatafield>
+      </qtimetadata>
+    </itemmetadata>
+    <presentation>
+      <material>
+        <mattext texttype="text/html">&lt;div&gt;&lt;p style="text-align: center;"&gt;Fill in the blank.&lt;/p&gt;&lt;/div&gt;</mattext>
+      </material>
+      <response_str ident="response1" rcardinality="Single">
+        <render_fib>
+          <response_label ident="answer1" rshuffle="No"/>
+        </render_fib>
+      </response_str>
+    </presentation>
+    <resprocessing>
+      <outcomes>
+        <decvar maxvalue="100" minvalue="0" varname="SCORE" vartype="Decimal"/>
+      </outcomes>
+      <respcondition continue="Yes">
+        <conditionvar>
+          <other/>
+        </conditionvar>
+        <displayfeedback feedbacktype="Response" linkrefid="general_fb"/>
+      </respcondition>
+      <respcondition continue="Yes">
+        <conditionvar>
+          <varequal respident="response1">blank</varequal>
+        </conditionvar>
+        <displayfeedback feedbacktype="Response" linkrefid="1226_fb"/>
+      </respcondition>
+      <respcondition continue="Yes">
+        <conditionvar>
+          <varequal respident="response1">Blank</varequal>
+        </conditionvar>
+        <displayfeedback feedbacktype="Response" linkrefid="5344_fb"/>
+      </respcondition>
+      <respcondition continue="Yes">
+        <conditionvar>
+          <varequal respident="response1">BLANK</varequal>
+        </conditionvar>
+        <displayfeedback feedbacktype="Response" linkrefid="3391_fb"/>
+      </respcondition>
+      <respcondition continue="No">
+        <conditionvar>
+          <varequal respident="response1">blank</varequal>
+          <varequal respident="response1">Blank</varequal>
+          <varequal respident="response1">BLANK</varequal>
+        </conditionvar>
+        <setvar action="Set" varname="SCORE">100</setvar>
+        <displayfeedback feedbacktype="Response" linkrefid="correct_fb"/>
+      </respcondition>
+      <respcondition continue="Yes">
+        <conditionvar>
+          <other/>
+        </conditionvar>
+        <displayfeedback feedbacktype="Response" linkrefid="general_incorrect_fb"/>
+      </respcondition>
+    </resprocessing>
+    <itemfeedback ident="general_fb">
+      <flow_mat>
+        <material>
+          <mattext texttype="text/html">&lt;p&gt;Generic feedback&lt;/p&gt;</mattext>
+        </material>
+      </flow_mat>
+    </itemfeedback>
+    <itemfeedback ident="correct_fb">
+      <flow_mat>
+        <material>
+          <mattext texttype="text/html">&lt;p&gt;Correct Feedback&lt;/p&gt;</mattext>
+        </material>
+      </flow_mat>
+    </itemfeedback>
+    <itemfeedback ident="general_incorrect_fb">
+      <flow_mat>
+        <material>
+          <mattext texttype="text/html">&lt;p&gt;Incorrect Feedback&lt;/p&gt;</mattext>
+        </material>
+      </flow_mat>
+    </itemfeedback>
+    <itemfeedback ident="1226_fb">
+      <flow_mat>
+        <material>
+          <mattext texttype="text/html">&lt;p&gt;Feedback on response 1226&lt;/p&gt;</mattext>
+        </material>
+      </flow_mat>
+    </itemfeedback>
+    <itemfeedback ident="5344_fb">
+      <flow_mat>
+        <material>
+          <mattext texttype="text/html">&lt;p&gt;Feedback on response 5344&lt;/p&gt;</mattext>
+        </material>
+      </flow_mat>
+    </itemfeedback>
+    <itemfeedback ident="3391_fb">
+      <flow_mat>
+        <material>
+          <mattext texttype="text/html">&lt;p&gt;Feedback on response 3391&lt;/p&gt;</mattext>
+        </material>
+      </flow_mat>
+    </itemfeedback>
+  </item>
+</questestinterop>

data/spec/lib/qti/models/base_spec.rb

@@ -59,6 +59,50 @@ describe Qti::Models::Base do
         end.to raise_error(Qti::ParseError)
       end
 
+      describe 'sanitize of href/src in html' do
+        let(:ftp) { 'ftp://foo.bar/' }
+        let(:http) { 'http://foo.bar/' }
+        let(:https) { 'https://foo.bar' }
+
+        shared_examples_for 'specific html elements' do
+          it 'removes a src with a bad protocol' do
+            ftp_tag = "<#{tag_name} #{src_attr}=\"#{ftp}\"></#{tag_name}>"
+            expect(loaded_class.sanitize_content!(ftp_tag)).to eq "<#{tag_name}></#{tag_name}>"
+          end
+
+          it 'removes a src with a valid http protocol' do
+            http_tag = "<#{tag_name} #{src_attr}=\"#{http}\"></#{tag_name}>"
+            expect(loaded_class.sanitize_content!(http_tag)).to eq(http_tag)
+          end
+
+          it 'removes a src with a valid https protocol' do
+            https_tag = "<#{tag_name} #{src_attr}=\"#{https}\"></#{tag_name}>"
+            expect(loaded_class.sanitize_content!(https_tag)).to eq(https_tag)
+          end
+        end
+
+        describe 'iframe elements' do
+          let(:tag_name) { 'iframe' }
+          let(:src_attr) { 'src' }
+
+          include_examples('specific html elements')
+        end
+
+        describe 'object elements' do
+          let(:tag_name) { 'object' }
+          let(:src_attr) { 'src' }
+
+          include_examples('specific html elements')
+        end
+
+        describe 'embed elements' do
+          let(:tag_name) { 'embed' }
+          let(:src_attr) { 'src' }
+
+          include_examples('specific html elements')
+        end
+      end
+
       context 'with explicit package root' do
         let(:package_root) { File.join('spec', 'fixtures', 'test_qti_2.2') }
         let(:item_path) { File.join(package_root, 'true-false', 'true-false.xml') }

data/spec/lib/qti/v1/models/interactions/fill_blank_interaction_spec.rb

@@ -123,6 +123,21 @@ describe Qti::V1::Models::Interactions::FillBlankInteraction do
     end
   end
 
+  context 'fib_feedback.xml' do
+    let(:file_path) { File.join(fixtures_path, 'fib_feedback.xml') }
+    let(:shuffle_value) { false }
+    let(:scoring_data_ids) { %w[response1 response1 response1] }
+    let(:scoring_data_values) { %w[blank Blank BLANK] }
+    let(:scoring_data_case) { %w[no no no] }
+    let(:answer_count) { 3 }
+    let(:expected_blanks) { [{ id: 'response1' }] }
+
+    include_examples 'shuffled?'
+    include_examples 'answers'
+    include_examples 'scoring_data_structs'
+    include_examples 'blanks'
+  end
+
   describe '#scoring_data_structs' do
     let(:nodexml) { double }
     let(:test_object) { double(package_root: 'dummy', path: 'dummy/blah') }