repost 0.5.0 → 0.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7399517ab4d8add105196f6d329ede828d10f90f5fa3eb47e79c645d8f8269c2
-  data.tar.gz: 18dbb378fddea7a84897dac996a5561ad2627496250d331a8c3a20500aa3b45c
+  metadata.gz: c72321c2698ca6688271f051495bae51c38f6ab3395833dba654314a33c5e942
+  data.tar.gz: a24252efb08f6e194628c033c06acf61d28ef18ae075b25f294149e8b0da9412
 SHA512:
-  metadata.gz: c4caed61603b62417cb1367fc8e162758ba134739f84c6ba5dc3c097d010c38c6024a3d3efe3b9e00461de5a761a6e99f387874b0d840532e5fa9dbd8811e6d7
-  data.tar.gz: ad8fe848e483398718e7214744c6f207b75079a89f5644b969b0617c9eb99c4bbe5902f6ada82d19805082342420322547bac638bbb70d91f20fc9c1d29e4c76
+  metadata.gz: 5cdc9fc605bf4358f9105a51d341d8b0bcf50f81e61787730fef1a9338e9ebaccb91f32ec795d570f9e7db08cf05ee57e8d413c2161444c24cbafe005c84e899
+  data.tar.gz: 29850c217d7e15f1ef4df3a9eda4d772a98a7a728ace1969c18b52ef68676b338fd2c1df137f439c400a29250dcdbce42c47bc9cfff1856dcb28810d6f585c8c

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2019 YaroslavO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,188 @@
+<p align="right">
+    <a href="https://github.com/vergilet/repost"><img align="" src="https://user-images.githubusercontent.com/2478436/51829223-cb05d600-22f5-11e9-9245-bc6e82dcf028.png" width="56" height="56" /></a>
+<a href="https://rubygems.org/gems/repost"><img align="right" src="https://user-images.githubusercontent.com/2478436/51829691-c55cc000-22f6-11e9-99a5-42f88a8f2a55.png" width="56" height="56" /></a>
+</p>
+
+
+<p align="center">
+    <a href="https://rubygems.org/gems/repost">
+  <img width="460" src="https://user-images.githubusercontent.com/2478436/55672583-44491880-58a5-11e9-945c-939f90470df8.png"></a>
+</p>
+
+Gem **Repost** implements Redirect using POST method.
+
+Implementation story and some details in the following article [Redirect using POST in Rails](https://medium.com/@momlookhowican/redirect-using-post-in-rails-5748da354343).
+
+[![Gem Version](https://badge.fury.io/rb/repost.svg)](https://badge.fury.io/rb/repost)
+[![Build Status](https://travis-ci.com/vergilet/repost.svg?branch=master)](https://app.travis-ci.com/github/vergilet/repost)
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'repost'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install repost
+
+
+
+## What problem does it solve?
+
+When you need to send some parameters to an endpoint which should redirect you after execution. There wouldn't be a problem if an endpoint receives [GET], because you can just use: 
+```ruby
+redirect_to entity_url(id: @model.id, token: model.token...)
+```
+
+
+But when an endpoint receives [POST], you have to generate html form and submit it. So `repost` gem helps to avoid creation of additional view with html form, just use `redirect_post` method instead.
+I faced with this problem when was dealing with bank transactions. You can see the approximate scheme:
+
+<p align="center">
+    <a href="https://user-images.githubusercontent.com/2478436/55143646-d0da3500-5147-11e9-91a3-1bac9d560fb2.png">
+  <img src="https://user-images.githubusercontent.com/2478436/55143646-d0da3500-5147-11e9-91a3-1bac9d560fb2.png"></a>
+</p>
+
+> **P.S. The `repost` gem was initially created in response to the redirection process required by [Adyen 3D Secure 1](https://docs.adyen.com/online-payments/classic-integrations/api-integration-ecommerce/3d-secure/3d-secure-1/#step-2-redirect-to-the-card-issuer), which often involved creating an HTML form and submitting it via POST. <br>
+However, with the advent of 3D Secure 2, which aims for a more integrated authentication experience, the use of such forms for POST submissions has not been encountered. 3D Secure 2 typically manages authentication data exchanges in the background, potentially eliminating the need for manual form submission.**
+
+
+## Usage
+
+If you use Rails, gem automatically includes helper methods to your controllers:
+
+```ruby
+repost(...)
+```
+and, as an alias
+
+```ruby
+redirect_post(...)
+```
+
+*Under the hood it calls `render` method of current controller with `html:`.*
+
+### Example in Rails app:
+
+```ruby
+class MyController < ApplicationController
+  ...
+  def index
+    repost(...)
+  end
+  ...
+  # or
+  def show
+    redirect_post(...)
+  end
+end
+```
+______________
+
+If you use Sinatra, Roda or etc., you need to require it first somewhere in you project:
+
+```ruby
+require 'repost'
+```
+
+Then ask senpai to generate a string with html:
+
+
+```ruby
+Repost::Senpai.perform(...)
+```
+
+### Example in Sinatra, Roda, etc. app:
+
+```ruby
+class MyController < Sinatra::Base
+  get '/' do
+    Repost::Senpai.perform(...)
+  end
+end
+```
+
+
+
+#### *Reminder:*
+
+- *In Rails app use `repost` or `redirect_post` method in your controller which performs 'redirect' when it is called.*
+
+- *In Sinatra, Roda, etc. app or if you need html output - call Senpai*
+
+
+#### Full example:
+
+*UPD: authenticity token is **turned off** by default. Use `:auto` or `'auto'` to turn on default authenticity token from Rails. Any other string value would be treated as custom auth token value.*
+
+```ruby
+# plain ruby
+# Repost::Senpai.perform('http://......)
+
+
+# Rails
+redirect_post('http://examp.io/endpoint',            # URL, looks understandable
+  params: {
+            a: 1,
+            'b': { "c": 2 },
+            d: [ 3, 4, 5 ],
+            e: { f: 'string', g: [ 6, 7, 8 ] }
+          },                                         # Your request body, also nested params and arrays
+  options: {
+    method: :post,                                   # OPTIONAL - DEFAULT is :post. :put/:patch/:delete are sent as POST with a hidden "_method" field (Rails-style override)
+    status: :ok,                                     # OPTIONAL - DEFAULT is :ok. This is the http status that the form will be returned with.
+    authenticity_token: 'auto',                      # OPTIONAL - :auto or 'auto' for Rails form_authenticity_token, string - custom token
+    charset: 'Windows-1251',                         # OPTIONAL - DEFAULT is "UTF-8", corresponds for accept-charset
+    form_id: 'CustomFormID',                         # OPTIONAL - DEFAULT is autogenerated
+    autosubmit: false,                               # OPTIONAL - DEFAULT is true, if you want to get a confirmation for redirect
+    autosubmit_nonce: '1d3n7i4ier',                  # RAILS - DEFAULT is content_security_policy_nonce, for pure Ruby - string identifier, more info - https://edgeguides.rubyonrails.org/security.html#content-security-policy
+    decor: {                                         # If autosubmit is turned off or Javascript is disabled on client
+      section: {                                     # ... you can decorate confirmation section and button
+        classes: 'red-bg red-text',                  # OPTIONAL - <DIV> section, set classNames, separate with space
+        html: '<h1>Press this button, dude!</h1>'    # OPTIONAL - Any html, which will appear before submit button. Rendered as-is (NOT escaped) - never pass user input here
+      },
+      submit: {
+        classes: 'button-decorated round-border',    # OPTIONAL - <Input> with type submit, set classNames, separate with space
+        text: 'c0n71nue ...'                         # OPTIONAL - DEFAULT is 'Continue'
+      }
+    }
+  }
+)
+
+```
+
+### Authenticity Token (Rails)
+
+Currently you can pass the **authenticity token** in two ways:
+
+* Recommended:
+
+    *Use `options` and `:auto` to pass the auth token. That should protect you from any implementation changes in future Rails versions*
+
+    ```ruby
+    redirect_post('https://exmaple.io/endpoint', options: {authenticity_token: :auto})
+    ```
+* Or, it is still valid to:
+
+    *use `params` and `form_authenticity_token` method directly from ActionController*
+    ```ruby
+    redirect_post('https://exmaple.io/endpoint', params: {authenticity_token: form_authenticity_token})
+    ```
+
+
+
+## License
+The gem is available as open source under the terms of the MIT License.
+
+Copyright © 2019 Yaro.
+
+[![GitHub license](https://img.shields.io/badge/license-MIT-brightgreen)](https://raw.githubusercontent.com/vergilet/repost/master/LICENSE.txt)
+
+**That's all folks.**

data/lib/repost/extend_controller.rb

@@ -2,22 +2,27 @@ if defined?(Rails) && defined?(ActiveSupport)
   ActiveSupport.on_load(:action_controller) do
     class ::ActionController::Base
       def repost(url, params: {}, options: {})
+        options = options.dup
         status = options.delete(:status) || :ok
-
-        token = if ['auto', :auto].include?(options[:authenticity_token])
-                  form_authenticity_token
-                end
+        authenticity_token = if ['auto', :auto].include?(options[:authenticity_token])
+                               form_authenticity_token
+                             else
+                               options[:authenticity_token]
+                             end
+        # Rails' per-request CSP nonce is the default; an explicitly passed
+        # :autosubmit_nonce (even nil, to opt out) takes precedence.
+        autosubmit_nonce = options.fetch(:autosubmit_nonce) { content_security_policy_nonce }
 
         html_payload = Repost::Senpai.perform(
           url,
           params: params,
           options: options.merge({
-                                   authenticity_token: token,
-                                   autosubmit_nonce: content_security_policy_nonce,
+                                   authenticity_token: authenticity_token,
+                                   autosubmit_nonce: autosubmit_nonce
                                  }.compact)
         )
 
-        render html: ActionController::Base.helpers.sanitize(html_payload), status: status
+        render html: html_payload.html_safe, status: status
       end
 
       alias :redirect_post :repost

data/lib/repost/senpai.rb

@@ -1,13 +1,19 @@
+require 'cgi'
+require 'securerandom'
+
 module Repost
   class Senpai < Action
     DEFAULT_SUBMIT_BUTTON_TEXT = 'Continue'
     DEFAULT_CHARSET = 'UTF-8'
+    # Browsers only submit forms via GET or POST; other verbs are sent as POST
+    # with a Rails-style "_method" override field.
+    OVERRIDE_METHODS = %w[put patch delete].freeze
 
     def initialize(url, params: {}, options: {})
       @url                = url
       @params             = params
       @options            = options
-      @method             = options.fetch(:method, :post)
+      @method             = options.fetch(:method, :post).to_s.downcase
       @authenticity_token = options.fetch(:authenticity_token, nil)
       @charset            = options.fetch(:charset, DEFAULT_CHARSET)
       @form_id            = options.fetch(:form_id, generated_form_id)
@@ -21,10 +27,10 @@ module Repost
 
     def perform
       compiled_body = if autosubmit
-        form_body << auto_submit_script << no_script
-      else
-        form_body << submit_section
-      end
+                        form_body << auto_submit_script << no_script
+                      else
+                        form_body << submit_section
+                      end
       form_head << compiled_body << form_footer
     end
 
@@ -34,8 +40,20 @@ module Repost
                 :section_classes, :section_html, :submit_classes,
                 :submit_text, :authenticity_token, :charset, :autosubmit_nonce
 
+    def escape(value)
+      CGI.escapeHTML(value.to_s)
+    end
+
     def form_head
-      %Q(<form id="#{form_id}" action="#{url}" method="#{method}" accept-charset="#{charset}">)
+      %Q(<form id="#{escape(form_id)}" action="#{escape(url)}" method="#{escape(form_method)}" accept-charset="#{escape(charset)}">)
+    end
+
+    def form_method
+      method_override? ? 'post' : method
+    end
+
+    def method_override?
+      OVERRIDE_METHODS.include?(method)
     end
 
     def form_body
@@ -43,9 +61,14 @@ module Repost
         form_input(key, value)
       end
       inputs.unshift(csrf_token) if authenticity_token
+      inputs.unshift(method_override_input) if method_override?
       inputs.join
     end
 
+    def method_override_input
+      %Q(<input type="hidden" name="_method" value="#{escape(method)}">)
+    end
+
     def form_input(key, value)
       case value
       when Hash
@@ -57,7 +80,7 @@ module Repost
           form_input("#{key}[]", inner_value)
         end.join
       else
-        %Q(<input type="hidden" name="#{key}" value=#{process_value(value)}>)
+        %Q(<input type="hidden" name="#{escape(key)}" value="#{escape(value)}">)
       end
     end
 
@@ -66,36 +89,30 @@ module Repost
     end
 
     def csrf_token
-      %Q(<input name="authenticity_token" value="#{authenticity_token}" type="hidden">)
+      %Q(<input name="authenticity_token" value="#{escape(authenticity_token)}" type="hidden">)
     end
 
     def no_script
-      %Q(<noscript>
-        #{submit_section}
-      </noscript>)
+      %Q(<noscript>#{submit_section}</noscript>)
     end
 
     def submit_section
-      %Q(<div class="#{section_classes}">
-        #{section_html}
-        <input class="#{submit_classes}" type="submit" value="#{submit_text}"></input>
-      </div>)
+      %Q(<div#{class_attr(section_classes)}>#{section_html}<input#{class_attr(submit_classes)} type="submit" value="#{escape(submit_text)}"></div>)
+    end
+
+    def class_attr(classes)
+      %Q( class="#{escape(classes)}") if classes
     end
 
     def generated_form_id
-      "repost-#{Time.now.to_i}"
+      "repost-#{SecureRandom.hex(8)}"
     end
 
     def auto_submit_script
-      nonce_attr = %Q( nonce="#{autosubmit_nonce}") if autosubmit_nonce
+      nonce_attr = %Q( nonce="#{escape(autosubmit_nonce)}") if autosubmit_nonce
       %Q(<script#{nonce_attr}>
-        document.getElementById("#{form_id}").submit();
+        document.getElementById("#{escape(form_id)}").submit();
       </script>)
     end
-
-    def process_value(value)
-      return value if value.is_a?(Integer)
-      %Q("#{value.to_s.gsub("\"", '\'')}")
-    end
   end
 end

data/lib/repost/version.rb

@@ -1,3 +1,3 @@
 module Repost
-  VERSION = "0.5.0"
+  VERSION = "0.5.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: repost
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.2
 platform: ruby
 authors:
 - YaroslavO
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-01-28 00:00:00.000000000 Z
+date: 2026-07-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -46,6 +46,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE.txt
+- README.md
 - Rakefile
 - lib/repost.rb
 - lib/repost/action.rb
@@ -57,6 +59,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/vergilet/repost
+  source_code_uri: https://github.com/vergilet/repost
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -65,7 +68,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="