rack-utf8_sanitizer 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 69f0fb52847e155e4c7afd57565531b8bf506149
-  data.tar.gz: 0502a652822279ce9fd6b22e2db54126b9247b49
+  metadata.gz: 7122c2055da0fbed5a8f18a81078283040d0f614
+  data.tar.gz: 45526c40b0c2e96572f9511911c7fdc87d4c0a6a
 SHA512:
-  metadata.gz: '01215648794d9d0b47ef805f40116644b0afab096a00d88ebe0d84df4aed839d025641ba1a40c032b62d525ff9467ec89498e396b6c3e69483535cd71b43e997'
-  data.tar.gz: 95d5d7cfe3a6ec0564a566fe95aaed96f48605265a101483e98dd82a46eaf5a7aa1ff3a29106105fba5aa03f1ef6f108eb29c80ccd11a053ad6b91642e8a3003
+  metadata.gz: 766ad027d90baee2a60fdb4a6ac932ca94d42d8a65636ed3e50695e44b843a1512909966283da42484a9b243e8d26dc1836216fdbea42c78e1eec3cbc5be5d46
+  data.tar.gz: caade282f19e01c14ecce793b83adcc125a95f0f1d8b6c37f6ce2f0203518d7ec604776015265027a92ef45be1c21cb19680a5297d7995c3f347a994da8fa954

data/.travis.yml

@@ -5,8 +5,10 @@ rvm:
   - 2.0.0
   - 2.1
   - 2.2
+  - 2.3
+  - 2.4
+  - 2.5
   - jruby
-  - rbx-2
 
 before_install:
   - gem install bundler

data/README.md

@@ -55,6 +55,22 @@ To explicitly set sanitizable content types and override the defaults, use the `
 
     config.middleware.insert 0, Rack::UTF8Sanitizer, sanitizable_content_types: ['application/vnd.api+json']
 
+### Whitelist/Blacklist Rack Env Keys
+
+Using the `:only` and `:except` keys you can skip sanitation of values in the Rack Env. `:only` and `:except` are arrays that can contain strings or regular expressions.
+
+Only sanitize the body, query string, and url of a request.
+
+```ruby
+config.middleware.insert 0, Rack::UTF8Sanitizer, only: ['rack.input', 'PATH_INFO', 'QUERY_STRING']
+```
+
+Sanitize everything except HTTP headers.
+
+```ruby
+config.middleware.insert 0, Rack::UTF8Sanitizer, except: [/HTTP_.+/]
+```
+
 ### Strategies
 
 There are two built in strategies for handling invalid characters. The default strategy is `:replace`, which will cause any invalid characters to be replaces with the unicode replacement character (�). The second built in strategy is `:exception` which will cause an `EncodingError` exception to be raised if invalid characters are found (the exception can then be handled by another Rack middleware).

data/lib/rack/utf8_sanitizer.rb

@@ -14,6 +14,8 @@ module Rack
       @strategy = build_strategy(options)
       @sanitizable_content_types = options[:sanitizable_content_types]
       @sanitizable_content_types ||= SANITIZABLE_CONTENT_TYPES + (options[:additional_content_types] || [])
+      @only = Array(options[:only]).flatten
+      @except = Array(options[:except]).flatten
     end
 
     def call(env)
@@ -62,6 +64,8 @@ module Rack
     def sanitize(env)
       sanitize_rack_input(env)
       env.each do |key, value|
+        next if skip?(key)
+
         if URI_FIELDS.include?(key)
           env[key] = transfer_frozen(value,
               sanitize_uri_encoded_string(value))
@@ -76,6 +80,13 @@ module Rack
 
     protected
 
+    def skip?(rack_env_key)
+      return true if !@except.empty? && @except.any? { |matcher| rack_env_key[matcher] }
+      return true if !@only.empty? && @only.none? { |matcher| rack_env_key[matcher] }
+
+      false
+    end
+
     def build_strategy(options)
       strategy = options.fetch(:strategy) { :replace }
 
@@ -157,6 +168,7 @@ module Rack
     #
     # The result is guaranteed to be UTF-8-safe.
     def sanitize_uri_encoded_string(input)
+      return input if input.nil?
       decoded_value = decode_string(input)
       reencode_string(decoded_value)
     end

data/rack-utf8_sanitizer.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |gem|
   gem.name          = "rack-utf8_sanitizer"
-  gem.version       = '1.4.0'
+  gem.version       = '1.5.0'
   gem.authors       = ["whitequark"]
   gem.license       = "MIT"
   gem.email         = ["whitequark@whitequark.org"]

data/test/test_utf8_sanitizer.rb

@@ -409,6 +409,63 @@ describe Rack::UTF8Sanitizer do
     end
   end
 
+  describe "with only and/or except options" do
+    before do
+      @plain_input = "foo\xe0".force_encoding('UTF-8')
+    end
+
+    def request_env
+      {
+          "REQUEST_METHOD" => "POST",
+          "CONTENT_TYPE" => "application/json",
+          "HTTP_USER_AGENT" => @plain_input,
+          "HTTP_CUSTOM_HEADER" => @plain_input,
+          "rack.input" => @rack_input,
+      }
+    end
+
+    def sanitize_data(request_env = request_env())
+      @response_env = @app.(request_env)
+    end
+
+    it 'skips unless in only' do
+      @app = Rack::UTF8Sanitizer.new(
+        -> env { env },
+        only: ['HTTP_CUSTOM_HEADER']
+      )
+      @rack_input = StringIO.new('{}')
+
+      sanitize_data
+      @response_env['HTTP_CUSTOM_HEADER'].should != @plain_input
+      @response_env['HTTP_USER_AGENT'].should == @plain_input
+    end
+
+    it 'skips if in except' do
+      @app = Rack::UTF8Sanitizer.new(
+        -> env { env },
+        except: ['HTTP_CUSTOM_HEADER']
+      )
+      @rack_input = StringIO.new('{}')
+
+      sanitize_data
+      @response_env['HTTP_CUSTOM_HEADER'].should == @plain_input
+      @response_env['HTTP_USER_AGENT'].should != @plain_input
+    end
+
+    it 'works with regular expressions' do
+      @app = Rack::UTF8Sanitizer.new(
+        -> env { env },
+        only: ['HTTP_CUSTOM_HEADER', /(agent|input)/i]
+      )
+      @rack_input = StringIO.new(@plain_input.force_encoding(Encoding::ASCII_8BIT))
+
+      sanitize_data
+      @response_env['HTTP_CUSTOM_HEADER'].should != @plain_input
+      @response_env['HTTP_USER_AGENT'].should != @plain_input
+      @response_env['rack.input'].read.should != @plain_input
+    end
+  end
+
   describe "with custom strategy" do
     def request_env
       @plain_input = "foo bar лол".force_encoding('UTF-8')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-utf8_sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - whitequark
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-12-22 00:00:00.000000000 Z
+date: 2018-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -110,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2.1
+rubygems_version: 2.5.2.2
 signing_key: 
 specification_version: 4
 summary: Rack::UTF8Sanitizer is a Rack middleware which cleans up invalid UTF8 characters