rails_xss 0.1.2 → 0.1.3

data/{LICENSE → MIT-LICENSE}

@@ -1,4 +1,4 @@
-Copyright (c) 2009 joloudov
+Copyright (c) 2009 Koziarski Software Ltd.
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.markdown

@@ -0,0 +1,90 @@
+RailsXss
+========
+
+This plugin replaces the default ERB template handlers with erubis, and switches the behaviour to escape by default rather than requiring you to escape.  This is consistent with the behaviour in Rails 3.0.
+
+Strings now have a notion of "html safe",  which is false by default.  Whenever rails copies a string into the response body it checks whether or not the string is safe, safe strings are copied verbatim into the response body, but unsafe strings are escaped first.  
+
+All the XSS-proof helpers like link_to and form_tag now return safe strings, and will continue to work unmodified.  If you have your own helpers which return strings you *know* are safe,  you will need to explicitly tell rails that they're safe.  For an example, take the following helper.
+
+    
+    def some_helper
+      (1..5).map do |i|
+        "<li>#{i}</li>"
+      end.join("\n")
+    end
+
+With this plugin installed, the html will be escaped.  So you will need to do one of the following:
+
+1) Use the raw helper in your template.  raw will ensure that your string is copied verbatim into the response body.
+
+    <%= raw some_helper %>
+
+2) Mark the string as safe in the helper itself:
+
+    def some_helper
+      (1..5).map do |i|
+        "<li>#{i}</li>"
+      end.join("\n").html_safe
+    end
+  
+3) Use the safe_helper meta programming method:
+
+    module ApplicationHelper
+      def some_helper
+        #...
+      end
+      safe_helper :some_helper
+    end  
+
+Example
+-------
+
+BEFORE:
+
+    <%= params[:own_me] %>        => XSS attack
+    <%=h params[:own_me] %>       => No XSS
+    <%= @blog_post.content %>     => Displays the HTML
+                                
+AFTER:                          
+
+    <%= params[:own_me] %>        => No XSS 
+    <%=h params[:own_me] %>       => No XSS (same result)
+    <%= @blog_post.content %>     => *escapes* the HTML
+    <%= raw @blog_post.content %> => Displays the HTML
+  
+  
+Gotchas
+---
+
+#### textilize and simple_format do *not* return safe strings
+
+Both these methods support arbitrary HTML and are *not* safe to embed directly in your document.  You'll need to do something like:
+
+    <%= sanitize(textilize(@blog_post.content_textile)) %>
+
+#### Safe strings aren't magic.
+
+Once a string has been marked as safe, the only operations which will maintain that HTML safety are String#<<, String#concat and String#+.  All other operations are safety ignorant so it's still probably possible to break your app if you're doing something like
+
+    value = something_safe
+    value.gsub!(/a/, params[:own_me])
+
+Don't do that.
+
+#### String interpolation won't be safe, even when it 'should' be
+
+    value = "#{something_safe}#{something_else_safe}"
+    value.html_safe? # => false
+  
+This is intended functionality and can't be fixed.
+
+Getting Started
+===============
+
+1. Install rails 2.3.8 or higher, or freeze rails from 2-3-stable.
+2. Install erubis (gem install erubis)
+3. Install this plugin (ruby script/plugin install git://github.com/rails/rails_xss.git)
+4. Report anything that breaks.
+
+Copyright (c) 2009 Koziarski Software Ltd, released under the MIT license. For full details see MIT-LICENSE included in this distribution.

data/Rakefile

@@ -18,7 +18,6 @@ begin
       'lib/**/*.rb',
       'lib/**/*.rake',
     ]
-    # gem is a Gem::Specification... see http://www.rubygems.org/read/chapter/20 for additional settings
   end
   Jeweler::GemcutterTasks.new
 rescue LoadError

data/VERSION

@@ -1 +1 @@
-0.1.2
+0.1.3

data/init.rb

@@ -1,7 +1 @@
-unless $gems_rake_task
-  if Rails.version <= "2.3.7"
-    $stderr.puts "rails_xss requires Rails 2.3.8 or later. Please upgrade to enable automatic HTML safety."
-  else
-    require 'rails_xss'
-  end
-end
+require File.dirname(__FILE__) + "/rails/init".

metadata

@@ -5,8 +5,8 @@ version: !ruby/object:Gem::Version
   segments: 
   - 0
   - 1
-  - 2
-  version: 0.1.2
+  - 3
+  version: 0.1.3
 platform: ruby
 authors: 
 - joloudov
@@ -14,7 +14,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-07-02 00:00:00 +04:00
+date: 2010-07-14 00:00:00 +04:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -38,11 +38,10 @@ executables: []
 extensions: []
 
 extra_rdoc_files: 
-- LICENSE
-- README.rdoc
+- README.markdown
 files: 
-- LICENSE
-- README.rdoc
+- MIT-LICENSE
+- README.markdown
 - Rakefile
 - VERSION
 - init.rb
@@ -91,8 +90,6 @@ test_files:
 - test/date_helper_test.rb
 - test/active_record_helper_test.rb
 - test/caching_test.rb
-- test/test_rails_xss.rb
 - test/text_helper_test.rb
 - test/asset_tag_helper_test.rb
 - test/rails_xss_test.rb
-- test/helper.rb

data/README.rdoc

@@ -1,17 +0,0 @@
-= rails_xss
-
-Description goes here.
-
-== Note on Patches/Pull Requests
- 
-* Fork the project.
-* Make your feature addition or bug fix.
-* Add tests for it. This is important so I don't break it in a
-  future version unintentionally.
-* Commit, do not mess with rakefile, version, or history.
-  (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
-* Send me a pull request. Bonus points for topic branches.
-
-== Copyright
-
-Copyright (c) 2010 joloudov. See LICENSE for details.

data/test/helper.rb

@@ -1,10 +0,0 @@
-require 'rubygems'
-require 'test/unit'
-require 'shoulda'
-
-$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
-$LOAD_PATH.unshift(File.dirname(__FILE__))
-require 'rails_xss'
-
-class Test::Unit::TestCase
-end

data/test/test_rails_xss.rb

@@ -1,7 +0,0 @@
-require 'helper'
-
-class TestRailsXss < Test::Unit::TestCase
-  should "probably rename this file and start testing for real" do
-    flunk "hey buddy, you should probably rename this file and start testing for real"
-  end
-end