rails_autolink 1.1.5 → 1.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a9a91def4e38bcb28f15482c69da7024e299a19c
-  data.tar.gz: e987cc56142e5e1a882dfac7dd2aec775f3c68b4
+  metadata.gz: 91c4563b853f02631b7bf2d4b4cc26fed12c6e02
+  data.tar.gz: 6e4207505ba1093565b223b36fe7ca1c35020acc
 SHA512:
-  metadata.gz: ec0d9d57552ac9d0198c4593265c6f8f68d5acc3398c136b1dc3c35228da77cb46c4025444d31a786159b5025514266ef220a98691a01a5e40c78fb19a959739
-  data.tar.gz: a5ece6112a62cf23086f764938ad2781a86ed25539fd0e2b7b8a978fd3b57d1b8d6c7214b2bceb2871574c722e33ce9005018af13235d23e2bce3d84ebcbbce8
+  metadata.gz: be27ad19fd951b6631eba721eb250ce6cd32dde1c819ff4834c2ccb9bd676c708d099e6ca9fe5dbf878bf4b70095713a0fa3577c6a8f82d8f0ef8cdddce8fea7
+  data.tar.gz: fa33c890166fc907cbc4d54ec6aeda58c60b7850dcb80c8684b79c77e72042e2ea685338ef6882dea0c4b801dde29bec1559880e4f34f86c1b02059fc5d3fab2

data/.gitignore

@@ -10,4 +10,6 @@ pkg
 rdoc
 test/tmp
 test/version_tmp
-tmp
+tmp
+.rvmrc
+.ruby-*

data/CHANGELOG.rdoc

@@ -1,3 +1,11 @@
+=== 1.1.6 / 2014-06-08
+
+* Fixed a potential XSS vulnerability #47
+* Hold onto trailing = and & characters as part of urls #45
+* Ensure test compatibility with Rails 3.2.x/4.0.x/4.1.x #44
+* Readme typo #41
+* require timeout in tests #40
+
 === 1.1.5 / 2013-10-23
 
 * Improved performance of email regex

data/Gemfile

@@ -1,6 +1,13 @@
 source 'https://rubygems.org'
 
+# To test on latest Rails release, use the following:
 gem 'rails'
-gem 'arel'
-gem 'rack'
 gem 'minitest'
+
+# To test on Rails 4.0.x release, use the following e.g. for 4.0.1:
+# gem 'rails', '= 4.0.1'
+# gem 'minitest'
+
+# To test on Rails 3.2.x, use the following e.g. for 3.2.17:
+# gem 'rails', '= 3.2.17'
+# gem 'minitest', '= 4.2'

data/README.rdoc

@@ -11,7 +11,7 @@ bridge the gap for people migrating.
 == FEATURES:
 
 By default auto_link returns sanitized html_safe strings.
-This behaviour can be overriden setting the <tt>:sanitize</tt> option to false
+This behaviour can be overridden by setting the <tt>:sanitize</tt> option to false
 (thus making it insecure if you don't have the content under control).
 
 == SYNOPSIS:

data/Rakefile

@@ -6,3 +6,5 @@ Rake::TestTask.new do |t|
   t.libs << 'test'
   t.pattern = 'test/test_*.rb'
 end
+
+task :default => :test

data/lib/rails_autolink/helpers.rb

@@ -72,7 +72,7 @@ module RailsAutolink
 
           AUTO_LINK_RE = %r{
               (?: ((?:ed2k|ftp|http|https|irc|mailto|news|gopher|nntp|telnet|webcal|xmpp|callto|feed|svn|urn|aim|rsync|tag|ssh|sftp|rtsp|afs|file):)// | www\. )
-              [^\s<\u00A0]+
+              [^\s<\u00A0"]+
             }ix
 
           # regexps for determining context, used high-volume
@@ -98,7 +98,7 @@ module RailsAutolink
                 href
               else
                 # don't include trailing punctuation character as part of the URL
-                while href.sub!(/[^#{WORD_PATTERN}\/-]$/, '')
+                while href.sub!(/[^#{WORD_PATTERN}\/-=&]$/, '')
                   punctuation.push $&
                   if opening = BRACKETS[punctuation.last] and href.scan(opening).size > href.scan(punctuation.last).size
                     href << punctuation.pop

data/lib/rails_autolink/version.rb

@@ -1,3 +1,3 @@
 module RailsAutolink
-  VERSION = '1.1.5'
+  VERSION = '1.1.6'
 end

data/test/test_rails_autolink.rb

@@ -2,20 +2,16 @@
 
 require "minitest/autorun"
 require "rails"
-require "rails_autolink/helpers"
 require 'erb'
 require 'cgi'
-require 'active_support/core_ext/class/attribute_accessors'
+require 'active_support'
+require 'active_support/core_ext'
 require 'action_pack'
-require 'action_view/helpers/capture_helper'
-require 'action_view/helpers/sanitize_helper'
-require 'action_view/helpers/url_helper'
-require 'action_view/helpers/tag_helper'
-require 'active_support/core_ext/module/attribute_accessors'
-require 'active_support/core_ext/string/encoding'
+require 'action_view'
+require 'action_view/helpers'
 require 'action_dispatch/testing/assertions'
-require 'action_view/helpers/text_helper'
-require 'action_view/helpers/output_safety_helper'
+require 'timeout'
+require "rails_autolink/helpers"
 
 class TestRailsAutolink < MiniTest::Unit::TestCase
   include ActionView::Helpers::CaptureHelper
@@ -138,6 +134,14 @@ class TestRailsAutolink < MiniTest::Unit::TestCase
     assert_equal linked_email, auto_link(linked_email)
   end
 
+  def test_auto_link_with_malicious_attr
+    url1 = "http://api.rubyonrails.com/Foo.html"
+    malicious = "\"onmousemove=\"prompt()"
+    combination = "#{url1}#{malicious}"
+
+    assert_equal %(<p><a href="#{url1}">#{url1}</a>#{malicious}</p>), auto_link("<p>#{combination}</p>")
+  end
+
   def test_auto_link_at_eol
     url1 = "http://api.rubyonrails.com/Foo.html"
     url2 = "http://www.ruby-doc.org/core/Bar.html"
@@ -174,7 +178,12 @@ class TestRailsAutolink < MiniTest::Unit::TestCase
 
   def test_auto_link_email_addres_with_especial_chars
     email_raw    = "and&re$la*+r-a.o'rea=l~ly@tenderlovemaking.com"
-    email_sanitized = "and&amp;re$la*+r-a.o&#39;rea=l~ly@tenderlovemaking.com"
+    email_sanitized = if Rails.version =~ /^3/
+      # mail_to changed the number base it rendered HTML encoded characters at some point
+      "and&amp;re$la*+r-a.o&#x27;rea=l~ly@tenderlovemaking.com"
+    else
+      "and&amp;re$la*+r-a.o&#39;rea=l~ly@tenderlovemaking.com"
+    end
     email_result = %{<a href="mailto:#{email_raw}">#{email_sanitized}</a>}
     assert_equal email_result, auto_link(email_raw)
     assert !auto_link_email_addresses(email_result).html_safe?, 'should not be html safe'
@@ -311,6 +320,16 @@ class TestRailsAutolink < MiniTest::Unit::TestCase
     end
   end
 
+  def test_autolink_with_trailing_equals_on_link
+    url = "http://www.rubyonrails.com/foo.cgi?trailing_equals="
+    assert_equal generate_result(url), auto_link(url)
+  end
+
+  def test_autolink_with_trailing_amp_on_link
+    url = "http://www.rubyonrails.com/foo.cgi?trailing_ampersand=value&"
+    assert_equal generate_result(url), auto_link(url)
+  end
+
   def test_auto_link_does_not_timeout_when_parsing_odd_email_input
     inputs = %w(
       foo@...................................

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_autolink
 version: !ruby/object:Gem::Version
-  version: 1.1.5
+  version: 1.1.6
 platform: ruby
 authors:
 - Aaron Patterson
@@ -10,20 +10,20 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-23 00:00:00.000000000 Z
+date: 2014-06-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>'
+    - - ">"
       - !ruby/object:Gem::Version
         version: '3.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>'
+    - - ">"
       - !ruby/object:Gem::Version
         version: '3.1'
 description: This is an extraction of the `auto_link` method from rails. The `auto_link`
@@ -34,15 +34,15 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- lib/rails_autolink/helpers.rb
-- lib/rails_autolink/version.rb
-- lib/rails_autolink.rb
-- .autotest
-- .gitignore
+- ".autotest"
+- ".gitignore"
 - CHANGELOG.rdoc
 - Gemfile
 - README.rdoc
 - Rakefile
+- lib/rails_autolink.rb
+- lib/rails_autolink/helpers.rb
+- lib/rails_autolink/version.rb
 - rails_autolink.gemspec
 - test/test_rails_autolink.rb
 homepage: https://github.com/tenderlove/rails_autolink
@@ -55,17 +55,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.5
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: Automatic generation of html links in texts