remotipart 1.4.2 → 1.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 64a58022f26cafc03a5df9677d924414f310a24b
-  data.tar.gz: c55e884eae5f737d86881c4b083a61de00346639
+SHA256:
+  metadata.gz: 7f907807b9aca70acccb9e475dce3f63b1f1df778aa02739a6eb88a2d6548c8b
+  data.tar.gz: a1322a4b8c3e797872849c5e00918125781a1d9966adc6e50a66b145736c3061
 SHA512:
-  metadata.gz: af8c8de8a633bebb06ef2e1ca5361465fab8be54a754d956a48078f753ccb4288df27fb01c4e51911783774f01d73489c013646e45c6ec325e386a46c2595e9a
-  data.tar.gz: 27ba12dac43255f00ac5e3c00dd7a4a9fe488496619907a4890eaa7f1a678a6ecd73632390b51d75b48d9a45b9a0419323fc625c4a917a33175fec9ebd5c3638
+  metadata.gz: 8286b71b28af65126061abbe5250809b37a395dad7dfcc98ac974c47966c67cf61095555799e682eceddcf605317d6dfcf9cd08662c494c8c3c6ec9312bdfe78
+  data.tar.gz: f8abfd59c500552d3caeb9fc7095a6e90b8b80a5cd41908e4729b8ec5601055fa2642c36b3903dc4697510016b550377fd5fe289d289bfdb8105154245cd9651

data/.travis.yml

@@ -0,0 +1,35 @@
+language: ruby
+
+before_install:
+  # https://github.com/danmayer/coverband/issues/162#issuecomment-452173268
+  - rm /home/travis/.rvm/gems/*/specifications/bundler-2.*.gemspec || true
+  - gem install bundler -v '<2'
+
+bundler_args: --without development --jobs=3 --retry=3 --path=../vendor/bundle
+
+cache: bundler
+
+env:
+  matrix:
+    - JQUERY_VERSION=
+
+rvm:
+  - 2.5.5
+
+gemfile:
+  - gemfiles/rails_3.2.gemfile
+  - gemfiles/rails_4.2.gemfile
+  - gemfiles/rails_5.2.gemfile
+  - gemfiles/rails_6.0.gemfile
+
+dist: trusty
+
+sudo: false
+
+matrix:
+  include:
+    - env: JQUERY_VERSION=2
+      gemfile: gemfiles/rails_6.0.gemfile
+    - env: JQUERY_VERSION=3
+      gemfile: gemfiles/rails_6.0.gemfile
+  fast_finish: true

data/Appraisals

@@ -0,0 +1,25 @@
+appraise "rails-3.2" do
+  gem 'rails', '~> 3.2.0'
+  gem 'test-unit', '~> 3.0'
+  gem "strong_parameters"
+
+  group :development, :test do
+    gem 'sqlite3', '~> 1.3.5'
+  end
+end
+
+appraise "rails-4.2" do
+  gem 'rails', '~> 4.2.0'
+
+  group :development, :test do
+    gem 'sqlite3', '~> 1.3.6'
+  end
+end
+
+appraise "rails-5.2" do
+  gem 'rails', '~> 5.2.0'
+end
+
+appraise "rails-6.0" do
+  gem 'rails', '~> 6.0.0.rc1'
+end

data/Gemfile

@@ -8,3 +8,16 @@ group :development do
   #gemspec
 end
 
+group :development, :test do
+  gem 'appraisal'
+  gem 'jquery-rails'
+  gem 'sqlite3'
+  gem 'paperclip'
+  gem 'remotipart', path: '.'
+end
+
+group :test do
+  gem 'database_cleaner'
+  gem 'poltergeist'
+  gem 'rspec-rails'
+end

data/History.rdoc

@@ -1,5 +1,10 @@
 = History
 
+=== 1.4.3 / 2019-05-23
+
+* Fixed xhr.responseText not being populated.
+* Security: fixed cross-site scripting vulnerability when server renders user input.
+
 === 1.4.2 / 2018-04-25
 
 * Fixed ActionView::Template::Error in web-console.

data/README.rdoc

@@ -1,5 +1,7 @@
 = Remotipart: Rails jQuery File Uploads
 
+{<img src="https://badge.fury.io/rb/remotipart.svg" alt="Gem Version" />}[https://badge.fury.io/rb/remotipart]
+{<img src="https://travis-ci.com/JangoSteve/remotipart.svg?branch=master" alt="Build Status" />}[https://travis-ci.com/JangoSteve/remotipart]
 {<img src="https://codeclimate.com/github/JangoSteve/remotipart/badges/gpa.svg" />}[https://codeclimate.com/github/JangoSteve/remotipart]
 
 Remotipart is a Ruby on Rails gem enabling AJAX file uploads with jQuery in Rails 3 and Rails 4 remote forms.

data/Rakefile

@@ -21,13 +21,6 @@ rescue LoadError
   puts "Jeweler (or a dependency) not available. Install it with: gem install jeweler"
 end
 
-require 'rake/testtask'
-Rake::TestTask.new(:test) do |test|
-  test.libs << 'lib' << 'test'
-  test.pattern = 'test/**/test_*.rb'
-  test.verbose = true
-end
-
 begin
   require 'rcov/rcovtask'
   Rcov::RcovTask.new do |test|
@@ -51,3 +44,8 @@ Rake::RDocTask.new do |rdoc|
   rdoc.rdoc_files.include('README*')
   rdoc.rdoc_files.include('lib/**/*.rb')
 end
+
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new(:spec)
+
+task default: :spec

data/gemfiles/rails_3.2.gemfile

@@ -0,0 +1,26 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 3.2.0"
+gem "test-unit", "~> 3.0"
+gem "strong_parameters"
+
+group :development do
+  gem "rake"
+  gem "jeweler"
+end
+
+group :development, :test do
+  gem "appraisal"
+  gem "jquery-rails"
+  gem "sqlite3", "~> 1.3.5"
+  gem "paperclip"
+  gem "remotipart", path: "../"
+end
+
+group :test do
+  gem "database_cleaner"
+  gem "poltergeist"
+  gem "rspec-rails"
+end

data/gemfiles/rails_4.2.gemfile

@@ -0,0 +1,24 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 4.2.0"
+
+group :development do
+  gem "rake"
+  gem "jeweler"
+end
+
+group :development, :test do
+  gem "appraisal"
+  gem "jquery-rails"
+  gem "sqlite3", "~> 1.3.6"
+  gem "paperclip"
+  gem "remotipart", path: "../"
+end
+
+group :test do
+  gem "database_cleaner"
+  gem "poltergeist"
+  gem "rspec-rails"
+end

data/gemfiles/rails_5.2.gemfile

@@ -0,0 +1,24 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 5.2.0"
+
+group :development do
+  gem "rake"
+  gem "jeweler"
+end
+
+group :development, :test do
+  gem "appraisal"
+  gem "jquery-rails"
+  gem "sqlite3"
+  gem "paperclip"
+  gem "remotipart", path: "../"
+end
+
+group :test do
+  gem "database_cleaner"
+  gem "poltergeist"
+  gem "rspec-rails"
+end

data/gemfiles/rails_6.0.gemfile

@@ -0,0 +1,24 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 6.0.0.rc1"
+
+group :development do
+  gem "rake"
+  gem "jeweler"
+end
+
+group :development, :test do
+  gem "appraisal"
+  gem "jquery-rails"
+  gem "sqlite3"
+  gem "paperclip"
+  gem "remotipart", path: "../"
+end
+
+group :test do
+  gem "database_cleaner"
+  gem "poltergeist"
+  gem "rspec-rails"
+end

data/lib/remotipart/rails/version.rb

@@ -1,6 +1,6 @@
 module Remotipart
   module Rails
-    VERSION = "1.4.2"
-    IFRAMETRANSPORT_VERSION = "02.06.2013"
+    VERSION = "1.4.3"
+    IFRAMETRANSPORT_VERSION = "1.0.1.remotipart"
   end
 end

data/lib/remotipart/render_overrides.rb

@@ -3,6 +3,7 @@ module Remotipart
   # as expected by iframe-transport.
   module RenderOverrides
     include ERB::Util
+    include ActionView::Helpers::JavaScriptHelper
 
     def self.included(base)
       base.class_eval do
@@ -15,8 +16,7 @@ module Remotipart
     def render_with_remotipart(*args, &block)
       render_return_value = render_without_remotipart(*args, &block)
       if remotipart_submitted?
-        textarea_body = response.content_type == 'text/html' ? html_escape(response.body) : response.body
-        response.body = %{<script type=\"text/javascript\">try{window.parent.document;}catch(err){document.domain=document.domain;}</script> <textarea data-type=\"#{response.content_type}\" data-status=\"#{response.response_code}\" data-statusText=\"#{response.message}\">#{textarea_body}</textarea>}
+        response.body = %{<script type="text/javascript">try{window.parent.document;}catch(err){document.domain=document.domain;}</script><textarea data-type="#{response.content_type}" data-status="#{response.response_code}" data-statusText="#{response.message}"></textarea><script type="text/javascript">document.querySelector("textarea").value="#{escape_javascript(response.body)}";</script>}
         response.content_type = ::Rails.version >= '5' ? Mime[:html] : Mime::HTML
         response_body
       else

data/lib/remotipart/view_helper.rb

@@ -1,15 +1,6 @@
 module Remotipart
   module ViewHelper
 
-    def escape_javascript(javascript)
-      if remotipart_submitted?
-        super("#{javascript}")
-      else
-        super
-      end
-    end
-    alias_method :j, :escape_javascript
-
     #No longer used
     #Retrained to prevent issues while updating
     def remotipart_response(options = {}, &block)

data/remotipart.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: remotipart 1.4.2 ruby lib
+# stub: remotipart 1.4.3 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "remotipart".freeze
-  s.version = "1.4.2"
+  s.version = "1.4.3"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib".freeze]
   s.authors = ["Greg Leppert".freeze, "Steve Schwartz".freeze]
-  s.date = "2018-04-25"
+  s.date = "2019-05-23"
   s.description = "Remotipart is a Ruby on Rails gem enabling remote multipart forms (AJAX style file uploads) with jquery-rails.\n    This gem augments the native Rails 3 jQuery-UJS remote form function enabling asynchronous file uploads with little to no modification to your application.\n    ".freeze
   s.email = ["greg@formasfunction.com".freeze, "steve@alfajango.com".freeze]
   s.extra_rdoc_files = [
@@ -20,6 +20,8 @@ Gem::Specification.new do |s|
   ]
   s.files = [
     ".document",
+    ".travis.yml",
+    "Appraisals",
     "CONTRIBUTING.md",
     "Gemfile",
     "History.rdoc",
@@ -27,6 +29,10 @@ Gem::Specification.new do |s|
     "README.rdoc",
     "Rakefile",
     "VERSION_COMPATIBILITY.rdoc",
+    "gemfiles/rails_3.2.gemfile",
+    "gemfiles/rails_4.2.gemfile",
+    "gemfiles/rails_5.2.gemfile",
+    "gemfiles/rails_6.0.gemfile",
     "lib/generators/remotipart/install/install_generator.rb",
     "lib/remotipart.rb",
     "lib/remotipart/middleware.rb",
@@ -38,11 +44,62 @@ Gem::Specification.new do |s|
     "lib/remotipart/request_helper.rb",
     "lib/remotipart/view_helper.rb",
     "remotipart.gemspec",
+    "spec/dummy_app/.gitignore",
+    "spec/dummy_app/Rakefile",
+    "spec/dummy_app/app/assets/images/rails.png",
+    "spec/dummy_app/app/assets/javascripts/application.js.erb",
+    "spec/dummy_app/app/assets/javascripts/comments.js",
+    "spec/dummy_app/app/assets/stylesheets/application.css",
+    "spec/dummy_app/app/assets/stylesheets/scaffold.css",
+    "spec/dummy_app/app/controllers/application_controller.rb",
+    "spec/dummy_app/app/controllers/comments_controller.rb",
+    "spec/dummy_app/app/helpers/application_helper.rb",
+    "spec/dummy_app/app/helpers/comments_helper.rb",
+    "spec/dummy_app/app/models/comment.rb",
+    "spec/dummy_app/app/views/comments/_comment.html.erb",
+    "spec/dummy_app/app/views/comments/_form.html.erb",
+    "spec/dummy_app/app/views/comments/_new_comment_links.html.erb",
+    "spec/dummy_app/app/views/comments/create.html.erb",
+    "spec/dummy_app/app/views/comments/create.js.erb",
+    "spec/dummy_app/app/views/comments/destroy.js.erb",
+    "spec/dummy_app/app/views/comments/edit.html.erb",
+    "spec/dummy_app/app/views/comments/escape_test.html.erb",
+    "spec/dummy_app/app/views/comments/index.html.erb",
+    "spec/dummy_app/app/views/comments/new.html.erb",
+    "spec/dummy_app/app/views/comments/show.html.erb",
+    "spec/dummy_app/app/views/layouts/application.html.erb",
+    "spec/dummy_app/bin/bundle",
+    "spec/dummy_app/bin/rails",
+    "spec/dummy_app/bin/rake",
+    "spec/dummy_app/bin/setup",
+    "spec/dummy_app/bin/update",
+    "spec/dummy_app/config.ru",
+    "spec/dummy_app/config/application.rb",
+    "spec/dummy_app/config/boot.rb",
+    "spec/dummy_app/config/database.yml",
+    "spec/dummy_app/config/environment.rb",
+    "spec/dummy_app/config/environments/development.rb",
+    "spec/dummy_app/config/environments/test.rb",
+    "spec/dummy_app/config/initializers/secret_token.rb",
+    "spec/dummy_app/config/routes.rb",
+    "spec/dummy_app/config/secrets.yml",
+    "spec/dummy_app/db/migrate/20110209210252_create_comments.rb",
+    "spec/dummy_app/db/migrate/20110209210315_add_attachment_to_comment.rb",
+    "spec/dummy_app/db/migrate/20110714205346_add_other_attachment_to_comment.rb",
+    "spec/dummy_app/db/schema.rb",
+    "spec/dummy_app/db/seeds.rb",
+    "spec/features/comments_spec.rb",
+    "spec/fixtures/hi.txt",
+    "spec/fixtures/qr.jpg",
+    "spec/spec_helper.rb",
+    "spec/support/arel_helper.rb",
+    "spec/support/connection_helper.rb",
+    "spec/support/integration_helper.rb",
     "vendor/assets/javascripts/jquery.iframe-transport.js",
     "vendor/assets/javascripts/jquery.remotipart.js"
   ]
   s.homepage = "http://opensource.alfajango.com/remotipart/".freeze
-  s.rubygems_version = "2.5.2".freeze
+  s.rubygems_version = "2.7.8".freeze
   s.summary = "Remotipart is a Ruby on Rails gem enabling remote multipart forms (AJAX style file uploads) with jquery-rails.".freeze
 
   if s.respond_to? :specification_version then
@@ -51,13 +108,28 @@ Gem::Specification.new do |s|
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
       s.add_development_dependency(%q<rake>.freeze, [">= 0"])
       s.add_development_dependency(%q<jeweler>.freeze, [">= 0"])
+      s.add_development_dependency(%q<appraisal>.freeze, [">= 0"])
+      s.add_development_dependency(%q<jquery-rails>.freeze, [">= 0"])
+      s.add_development_dependency(%q<sqlite3>.freeze, [">= 0"])
+      s.add_development_dependency(%q<paperclip>.freeze, [">= 0"])
+      s.add_development_dependency(%q<remotipart>.freeze, [">= 0"])
     else
       s.add_dependency(%q<rake>.freeze, [">= 0"])
       s.add_dependency(%q<jeweler>.freeze, [">= 0"])
+      s.add_dependency(%q<appraisal>.freeze, [">= 0"])
+      s.add_dependency(%q<jquery-rails>.freeze, [">= 0"])
+      s.add_dependency(%q<sqlite3>.freeze, [">= 0"])
+      s.add_dependency(%q<paperclip>.freeze, [">= 0"])
+      s.add_dependency(%q<remotipart>.freeze, [">= 0"])
     end
   else
     s.add_dependency(%q<rake>.freeze, [">= 0"])
     s.add_dependency(%q<jeweler>.freeze, [">= 0"])
+    s.add_dependency(%q<appraisal>.freeze, [">= 0"])
+    s.add_dependency(%q<jquery-rails>.freeze, [">= 0"])
+    s.add_dependency(%q<sqlite3>.freeze, [">= 0"])
+    s.add_dependency(%q<paperclip>.freeze, [">= 0"])
+    s.add_dependency(%q<remotipart>.freeze, [">= 0"])
   end
 end
 

data/spec/dummy_app/.gitignore

@@ -0,0 +1,17 @@
+# See http://help.github.com/ignore-files/ for more about ignoring files.
+#
+# If you find yourself ignoring temporary files generated by your text editor
+# or operating system, you probably want to add a global ignore instead:
+#   git config --global core.excludesfile ~/.gitignore_global
+
+# Ignore bundler config
+/.bundle
+
+# Ignore the default SQLite database.
+/db/*.sqlite3
+
+# Ignore all logfiles and tempfiles.
+/log/*.log
+/tmp
+
+/public/system

data/spec/dummy_app/Rakefile

@@ -0,0 +1,7 @@
+#!/usr/bin/env rake
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require File.expand_path('../config/application', __FILE__)
+
+DummyApp::Application.load_tasks