rails_xss 0.1.0

data/test/rails_xss_test.rb

@@ -0,0 +1,23 @@
+require 'test_helper'
+
+class RailsXssTest < ActiveSupport::TestCase
+  test "ERB::Util.h should mark its return value as safe and escape it" do
+    escaped = ERB::Util.h("<p>")
+    assert_equal "&lt;p&gt;", escaped
+    assert escaped.html_safe?
+  end
+
+  test "ERB::Util.h should leave previously safe strings alone " do
+    # TODO this seems easier to compose and reason about, but
+    # this should be verified
+    escaped = ERB::Util.h("<p>".html_safe)
+    assert_equal "<p>", escaped
+    assert escaped.html_safe?
+  end
+
+  test "ERB::Util.h should not implode when passed a non-string" do
+    assert_nothing_raised do
+      assert_equal "1", ERB::Util.h(1)
+    end
+  end
+end

data/test/test_helper.rb

@@ -0,0 +1,5 @@
+abort 'RAILS_ROOT=/path/to/rails/2.3/app rake test' unless ENV['RAILS_ROOT']
+require File.expand_path('config/environment', ENV['RAILS_ROOT'])
+require File.expand_path('../../init', __FILE__)
+require 'active_support/test_case'
+require 'test/unit'

data/test/test_rails_xss.rb

@@ -0,0 +1,7 @@
+require 'helper'
+
+class TestRailsXss < Test::Unit::TestCase
+  should "probably rename this file and start testing for real" do
+    flunk "hey buddy, you should probably rename this file and start testing for real"
+  end
+end

data/test/text_helper_test.rb

@@ -0,0 +1,17 @@
+require 'test_helper'
+
+class TextHelperTest < ActionView::TestCase
+
+  def setup
+    @controller = Class.new do
+      attr_accessor :request
+      def url_for(*args) "http://www.example.com" end
+    end.new
+  end
+
+  def test_simple_format_with_escaping_html_options
+    assert_dom_equal(%(<p class="intro">It's nice to have options.</p>),
+                     simple_format("It's nice to have options.", :class=>"intro"))
+  end
+
+end

metadata

@@ -0,0 +1,97 @@
+--- !ruby/object:Gem::Specification 
+name: rails_xss
+version: !ruby/object:Gem::Version 
+  prerelease: false
+  segments: 
+  - 0
+  - 1
+  - 0
+  version: 0.1.0
+platform: ruby
+authors: 
+- joloudov
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2010-07-01 00:00:00 +04:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: erubis
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        segments: 
+        - 2
+        - 6
+        - 5
+        version: 2.6.5
+  type: :development
+  version_requirements: *id001
+description: This plugin replaces the default ERB template handlers with erubis, and switches the behaviour to escape by default rather than requiring you to escape. This is consistent with the behaviour in Rails 3.0.
+email: joloudov@gmail.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE
+- README.rdoc
+files: 
+- .document
+- .gitignore
+- LICENSE
+- README.rdoc
+- Rakefile
+- VERSION
+- lib/rails_xss.rb
+- test/helper.rb
+- test/test_rails_xss.rb
+has_rdoc: true
+homepage: http://github.com/joloudov/rails_xss
+licenses: []
+
+post_install_message: 
+rdoc_options: 
+- --charset=UTF-8
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.7
+signing_key: 
+specification_version: 3
+summary: A plugin for rails 2.3 apps which switches the default to escape by default
+test_files: 
+- test/deprecated_output_safety_test.rb
+- test/output_safety_test.rb
+- test/form_tag_helper_test.rb
+- test/form_helper_test.rb
+- test/test_helper.rb
+- test/erb_util_test.rb
+- test/date_helper_test.rb
+- test/active_record_helper_test.rb
+- test/caching_test.rb
+- test/test_rails_xss.rb
+- test/text_helper_test.rb
+- test/asset_tag_helper_test.rb
+- test/rails_xss_test.rb
+- test/helper.rb