rack-utf8_sanitizer 1.0.0 → 1.1.0

data/.travis.yml

@@ -9,3 +9,7 @@ rvm:
 
 script:
   - rake spec
+
+matrix:
+  allow_failures:
+    - rvm: jruby-19mode

data/README.md

@@ -18,11 +18,15 @@ Or install it yourself as:
 
 For Rails, add this to your `application.rb`:
 
-    config.middleware.insert_before "Rack::Lock", Rack::UTF8Sanitizer
+``` ruby
+config.middleware.insert_before "Rack::Lock", Rack::UTF8Sanitizer
+```
 
 For Rack apps, add this to `config.ru`:
 
-    use Rack::UTF8Sanitizer
+``` ruby
+use Rack::UTF8Sanitizer
+```
 
 ## Usage
 

data/lib/rack/utf8_sanitizer.rb

@@ -1,3 +1,5 @@
+# encoding: ascii-8bit
+
 require 'uri'
 
 module Rack
@@ -30,12 +32,13 @@ module Rack
           #
           # The result is guaranteed to be UTF-8-safe.
 
-          decoded_value = URI.decode(
+          decoded_value = unescape_unreserved(
               sanitize_string(value).
               force_encoding('ASCII-8BIT'))
 
           env[key] = transfer_frozen(value,
-              URI.encode(sanitize_string(decoded_value)))
+              escape_unreserved(
+                sanitize_string(decoded_value)))
 
         elsif key =~ /^HTTP_/
           # Just sanitize the headers and leave them in UTF-8. There is
@@ -49,6 +52,41 @@ module Rack
 
     protected
 
+    # This regexp matches all 'unreserved' characters from RFC3986 (2.3),
+    # plus all multibyte UTF-8 characters.
+    UNRESERVED_OR_UTF8 = /[A-Za-z0-9\-._~\x80-\xFF]/
+
+    # RFC3986, 2.2 states that the characters from 'reserved' group must be
+    # protected during normalization (which is what UTF8Sanitizer does).
+    #
+    # However, the regexp approach used by URI.unescape is not sophisticated
+    # enough for our task.
+    def unescape_unreserved(input)
+      input.gsub(/%([a-f\d]{2})/i) do |encoded|
+        decoded = [$1.hex].pack('C')
+
+        if decoded =~ UNRESERVED_OR_UTF8
+          decoded
+        else
+          encoded
+        end
+      end
+    end
+
+    # This regexp matches unsafe characters, i.e. everything except 'reserved'
+    # and 'unreserved' characters from RFC3986 (2.3), and additionally '%',
+    # as percent-encoded unreserved characters could be left over from the
+    # `unescape_unreserved` invocation.
+    #
+    # See also URI::REGEXP::PATTERN::{UNRESERVED,RESERVED}.
+    UNSAFE           = /[^\-_.!~*'()a-zA-Z\d;\/?:@&=+$,\[\]%]/
+
+    # Performs the reverse function of `unescape_unreserved`. Unlike
+    # the previous function, we can reuse the logic in URI#escape.
+    def escape_unreserved(input)
+      URI.escape(input, UNSAFE)
+    end
+
     def sanitize_string(input)
       if input.is_a? String
         input = input.dup.force_encoding('UTF-8')

data/rack-utf8_sanitizer.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |gem|
   gem.name          = "rack-utf8_sanitizer"
-  gem.version       = '1.0.0'
+  gem.version       = '1.1.0'
   gem.authors       = ["Peter Zotov"]
   gem.email         = ["whitequark@whitequark.org"]
   gem.description   = %{Rack::UTF8Sanitizer is a Rack middleware which cleans up } <<

data/test/test_utf8_sanitizer.rb

@@ -31,7 +31,7 @@ describe Rack::UTF8Sanitizer do
   describe "with invalid UTF-8 input" do
     before do
       @plain_input = "foo\xe0".force_encoding('UTF-8')
-      @uri_input   = "foo%E0".force_encoding('UTF-8')
+      @uri_input   = "http://bar/foo%E0".force_encoding('UTF-8')
     end
 
     behaves_like :does_sanitize_plain
@@ -40,7 +40,7 @@ describe Rack::UTF8Sanitizer do
 
   describe "with invalid, incorrectly percent-encoded UTF-8 URI input" do
     before do
-      @uri_input   = "foo%E0\xe0".force_encoding('UTF-8')
+      @uri_input   = "http://bar/foo%E0\xe0".force_encoding('UTF-8')
     end
 
     behaves_like :does_sanitize_uri
@@ -49,7 +49,7 @@ describe Rack::UTF8Sanitizer do
   describe "with invalid ASCII-8BIT input" do
     before do
       @plain_input = "foo\xe0"
-      @uri_input   = "foo%E0"
+      @uri_input   = "http://bar/foo%E0"
     end
 
     behaves_like :does_sanitize_plain
@@ -58,7 +58,7 @@ describe Rack::UTF8Sanitizer do
 
   describe "with invalid, incorrectly percent-encoded ASCII-8BIT URI input" do
     before do
-      @uri_input   = "foo%E0\xe0"
+      @uri_input   = "http://bar/foo%E0\xe0"
     end
 
     behaves_like :does_sanitize_uri
@@ -89,16 +89,24 @@ describe Rack::UTF8Sanitizer do
   describe "with valid UTF-8 input" do
     before do
       @plain_input = "foo bar лол".force_encoding('UTF-8')
-      @uri_input   = "foo+bar+%D0%BB%D0%BE%D0%BB".force_encoding('UTF-8')
+      @uri_input   = "http://bar/foo+bar+%D0%BB%D0%BE%D0%BB".force_encoding('UTF-8')
     end
 
     behaves_like :identity_plain
     behaves_like :identity_uri
+
+    describe "with URI characters from reserved range" do
+      before do
+        @uri_input   = "http://bar/foo+%2F%3A+bar+%D0%BB%D0%BE%D0%BB".force_encoding('UTF-8')
+      end
+
+      behaves_like :identity_uri
+    end
   end
 
   describe "with valid, not percent-encoded UTF-8 URI input" do
     before do
-      @uri_input   = "foo+bar+лол".force_encoding('UTF-8')
+      @uri_input   = "http://bar/foo+bar+лол".force_encoding('UTF-8')
     end
 
     it "does not change URI-like entity (REQUEST_PATH)" do
@@ -114,17 +122,25 @@ describe Rack::UTF8Sanitizer do
   describe "with valid ASCII-8BIT input" do
     before do
       @plain_input = "bar baz"
-      @uri_input   = "bar+baz"
+      @uri_input   = "http://bar/bar+baz"
     end
 
     behaves_like :identity_plain
     behaves_like :identity_uri
+
+    describe "with URI characters from reserved range" do
+      before do
+        @uri_input   = "http://bar/foo+%2F%3A+bar+%D0%BB%D0%BE%D0%BB"
+      end
+
+      behaves_like :identity_uri
+    end
   end
 
   describe "with frozen strings" do
     before do
       @plain_input = "bar baz".freeze
-      @uri_input   = "bar+baz".freeze
+      @uri_input   = "http://bar/bar+baz".freeze
     end
 
     it "preserves the frozen? status of input" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-utf8_sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-05 00:00:00.000000000 Z
+date: 2013-03-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack