repost 0.5.3 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41b967cb4d60089de6bdb34b27fa765201b3216186c7da3d0259b4ed18694ac4
-  data.tar.gz: a348d14926f1b1df688dd7d8bca93ad3f721f7f4259f366e6075447e48d63882
+  metadata.gz: 13ce32e38cce21aa7a91ca98660f2aa14472e8a909cb038c8d232d4b3ebcdc11
+  data.tar.gz: 1dc85d08c2671b04b7c6b59e87f5f56ef70680cce4e180f8c1251af23645b717
 SHA512:
-  metadata.gz: fcf88d8239d00a462d962b4659f6cb29c1ed85027941a73d96b06d014e76d019745318fb2a5d535d1c52051b3ed69f86f7fa7430066d12b8eaed38a4ce11fa32
-  data.tar.gz: b1e9ac130d2b5e8d2ae213da35ce40a3a5b6ffe468a7b536a9390935792cbb00d15d3a414f530810578ff515139101e74976c5915b18f79f56c8a551c64fa969
+  metadata.gz: 50a8cde0aa5fbc95f090b53be99062f2faaa02a28aa3f49395fd7f70b53005c22e47a72bcb21b37becab3431b3a365607491514d9e76d59d3eff612ce3536820
+  data.tar.gz: 6edb7e357589700615ee12ac0f6b7582d8bfc6d3c06ce18d83d11e8663538f86126f291d7d68007f12711a66cece65e08782ae4213298ed3317ba2b7de001eed

data/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+## 0.6.0 (2026-11-05)
+
+### Security
+- The target URL must be `http`, `https` or relative. `javascript:`, `data:` and other schemes now raise `Repost::UnsafeUrlError`, because escaping can't make them safe. Allow more schemes with `options: { allowed_schemes: %w[https myapp] }`.
+
+### Changed
+- All markup is built by one helper that escapes every attribute value, so a value can't be left unescaped by mistake. The output is the same apart from formatting: the autosubmit script is on one line, and the CSRF input lists `type` first.
+- The Rails helpers now live in `Repost::ExtendController`, included into `ActionController::Base` through `on_load(:action_controller_base)`. Before, the gem reopened `ActionController::Base` from a hook that also ran for API controllers.
+- No longer requires the `cgi` library, which prints a warning on Ruby 4.0.
+
+### Added
+- Rails integration specs, run on Rails 7.1 through 8.x.
+
+## 0.5.3 (2026-11-05)
+- Fixed autosubmit failing when a param is named `submit`: the hidden input shadowed `form.submit`, leaving the user on a blank page.
+- Fixed autosubmit failing when `form_id` contains `"`, `&`, `<` or `>`.
+- CI moved from Travis to GitHub Actions (Ruby 2.7 to 4.0).
+
+## 0.5.2 (2026-07-03)
+- `method: :put`, `:patch` and `:delete` are sent as POST with a hidden `_method` field (Rails-style override).
+- An explicit `autosubmit_nonce`, including `nil`, overrides the Rails CSP nonce. The Rails helper no longer modifies the options hash passed to it.
+- `class` attributes are left out when no decor classes are set. Generated form ids are random instead of timestamp-based.
+
+## 0.5.1 (2026-01-28)
+
+### Security
+- Fixed cross-site scripting ([#29](https://github.com/vergilet/repost/issues/29)): the URL, param names and values, and all options are now HTML-escaped. All earlier versions are affected; please upgrade.
+
+## 0.5.0 (2026-01-28)
+- Attempted fix for [#29](https://github.com/vergilet/repost/issues/29) by sanitizing the output of the Rails helper. This also stripped the form, so `repost` and `redirect_post` stopped working in Rails. Use 0.5.1 or later.
+
+## 0.4.2 and earlier
+See the [commit history](https://github.com/vergilet/repost/commits/master).

data/README.md

@@ -50,8 +50,8 @@ I faced with this problem when was dealing with bank transactions. You can see t
   <img src="https://user-images.githubusercontent.com/2478436/55143646-d0da3500-5147-11e9-91a3-1bac9d560fb2.png"></a>
 </p>
 
-> **P.S. The `repost` gem was initially created in response to the redirection process required by [Adyen 3D Secure 1](https://docs.adyen.com/online-payments/classic-integrations/api-integration-ecommerce/3d-secure/3d-secure-1/#step-2-redirect-to-the-card-issuer), which often involved creating an HTML form and submitting it via POST. <br>
-However, with the advent of 3D Secure 2, which aims for a more integrated authentication experience, the use of such forms for POST submissions has not been encountered. 3D Secure 2 typically manages authentication data exchanges in the background, potentially eliminating the need for manual form submission.**
+> **P.S. The `repost` gem was initially created for the redirect required by [Adyen 3D Secure 1](https://docs.adyen.com/online-payments/classic-integrations/api-integration-ecommerce/3d-secure/3d-secure-1/#step-2-redirect-to-the-card-issuer), which meant building an HTML form and submitting it via POST.** <br>
+The same pattern is still needed wherever another site expects the browser to arrive with a POST: payment pages and 3D Secure 2 browser challenges, SAML's HTTP-POST binding, OpenID Connect's `form_post` response mode, and partner logins.
 
 
 ## Usage
@@ -143,6 +143,7 @@ redirect_post('http://examp.io/endpoint',            # URL, looks understandable
     form_id: 'CustomFormID',                         # OPTIONAL - DEFAULT is autogenerated
     autosubmit: false,                               # OPTIONAL - DEFAULT is true, if you want to get a confirmation for redirect
     autosubmit_nonce: '1d3n7i4ier',                  # RAILS - DEFAULT is content_security_policy_nonce, for pure Ruby - string identifier, more info - https://edgeguides.rubyonrails.org/security.html#content-security-policy
+    allowed_schemes: %w[https myapp],                # OPTIONAL - DEFAULT is %w[http https]. Relative URLs are always allowed; other schemes raise Repost::UnsafeUrlError
     decor: {                                         # If autosubmit is turned off or Javascript is disabled on client
       section: {                                     # ... you can decorate confirmation section and button
         classes: 'red-bg red-text',                  # OPTIONAL - <DIV> section, set classNames, separate with space
@@ -177,6 +178,14 @@ Currently you can pass the **authenticity token** in two ways:
     ```
 
 
+## Security
+
+- Every value repost writes into the page (URL, param names and values, all options) is HTML-escaped, so it's safe to pass user input. The one exception is `decor: { section: { html: ... } }`, which is inserted as-is by design: never put user input there.
+- Only `http`, `https` and relative target URLs are allowed by default. `javascript:`, `data:` and other schemes raise `Repost::UnsafeUrlError`, because escaping can't make them safe. Use the `allowed_schemes` option to allow others.
+- Versions before **0.5.1** don't escape these values and allow cross-site scripting ([#29](https://github.com/vergilet/repost/issues/29)). Please upgrade.
+
+See [CHANGELOG.md](CHANGELOG.md) for what changed in each version.
+
 
 ## License
 The gem is available as open source under the terms of the MIT License.

data/lib/repost/extend_controller.rb

@@ -1,36 +1,28 @@
-if defined?(Rails) && defined?(ActiveSupport)
-  ActiveSupport.on_load(:action_controller) do
-    class ::ActionController::Base
-      def repost(url, params: {}, options: {})
-        options = options.dup
-        status = options.delete(:status) || :ok
-        authenticity_token = if ['auto', :auto].include?(options[:authenticity_token])
-                               form_authenticity_token
-                             else
-                               options[:authenticity_token]
-                             end
-        # Rails' per-request CSP nonce is the default; an explicitly passed
-        # :autosubmit_nonce (even nil, to opt out) takes precedence.
-        autosubmit_nonce = options.fetch(:autosubmit_nonce) { content_security_policy_nonce }
-
-        html_payload = Repost::Senpai.perform(
-          url,
-          params: params,
-          options: options.merge({
-                                   authenticity_token: authenticity_token,
-                                   autosubmit_nonce: autosubmit_nonce
-                                 }.compact)
-        )
-
-        render html: html_payload.html_safe, status: status
+module Repost
+  # Adds #repost and #redirect_post to Rails controllers. Included into
+  # ActionController::Base when it loads (not into ActionController::API).
+  module ExtendController
+    def repost(url, params: {}, options: {})
+      options = options.dup
+      status = options.delete(:status) || :ok
+      if ['auto', :auto].include?(options[:authenticity_token])
+        options[:authenticity_token] = form_authenticity_token
+      end
+      # Rails' per-request CSP nonce is the default; an explicitly passed
+      # :autosubmit_nonce (even nil, to opt out) takes precedence.
+      unless options.key?(:autosubmit_nonce)
+        options[:autosubmit_nonce] = content_security_policy_nonce if respond_to?(:content_security_policy_nonce, true)
       end
 
-      alias :redirect_post :repost
+      # html_safe is correct here: Senpai escapes every value it inserts
+      # (except decor section html, which is raw by design).
+      render html: Repost::Senpai.perform(url, params: params, options: options).html_safe, status: status
     end
+
+    alias redirect_post repost
   end
 end
 
-# Sinatra & Rack Protection
-# TODO
-# defined?(Sinatra::Base) && defined?(Rack::Protection::AuthenticityToken)
-# env&.fetch('rack.session', :csrf)
+if defined?(ActiveSupport) && ActiveSupport.respond_to?(:on_load)
+  ActiveSupport.on_load(:action_controller_base) { include Repost::ExtendController }
+end

data/lib/repost/senpai.rb

@@ -1,127 +1,124 @@
-require 'cgi'
 require 'json'
 require 'securerandom'
 
 module Repost
+  # Builds an HTML form that submits itself, so a browser can be "redirected"
+  # with a POST body. All markup comes from #tag, which escapes every
+  # attribute value, so no call site can forget to escape.
   class Senpai < Action
     DEFAULT_SUBMIT_BUTTON_TEXT = 'Continue'
     DEFAULT_CHARSET = 'UTF-8'
+    DEFAULT_ALLOWED_SCHEMES = %w[http https].freeze
     # Browsers only submit forms via GET or POST; other verbs are sent as POST
     # with a Rails-style "_method" override field.
     OVERRIDE_METHODS = %w[put patch delete].freeze
+    HTML_ESCAPES = { '&' => '&amp;', '<' => '&lt;', '>' => '&gt;', '"' => '&quot;', "'" => '&#39;' }.freeze
+    # Characters that must not appear raw in a JS string inside <script>.
+    JS_UNSAFE = /[<>&\u{2028}\u{2029}]/.freeze
 
     def initialize(url, params: {}, options: {})
-      @url                = url
-      @params             = params
-      @options            = options
-      @method             = options.fetch(:method, :post).to_s.downcase
+      @url                = url.to_s
+      @params             = params || {}
+      @http_method        = options.fetch(:method, :post).to_s.downcase
       @authenticity_token = options.fetch(:authenticity_token, nil)
       @charset            = options.fetch(:charset, DEFAULT_CHARSET)
-      @form_id            = options.fetch(:form_id, generated_form_id)
+      @form_id            = options.fetch(:form_id) { generated_form_id }
       @autosubmit         = options.fetch(:autosubmit, true)
       @autosubmit_nonce   = options.fetch(:autosubmit_nonce, nil)
+      @allowed_schemes    = Array(options.fetch(:allowed_schemes, DEFAULT_ALLOWED_SCHEMES)).map { |s| s.to_s.downcase }
       @section_classes    = options.dig(:decor, :section, :classes)
       @section_html       = options.dig(:decor, :section, :html)
       @submit_classes     = options.dig(:decor, :submit, :classes)
       @submit_text        = options.dig(:decor, :submit, :text) || DEFAULT_SUBMIT_BUTTON_TEXT
+      check_url_scheme!
     end
 
     def perform
-      compiled_body = if autosubmit
-                        form_body << auto_submit_script << no_script
-                      else
-                        form_body << submit_section
-                      end
-      form_head << compiled_body << form_footer
+      controls = autosubmit ? auto_submit_script + tag(:noscript, submit_section) : submit_section
+      tag(:form, form_inputs + controls,
+          id: form_id, action: url, method: form_method, 'accept-charset': charset)
     end
 
     private
 
-    attr_reader :url, :params, :options, :method, :form_id, :autosubmit,
+    attr_reader :url, :params, :http_method, :form_id, :autosubmit, :allowed_schemes,
                 :section_classes, :section_html, :submit_classes,
                 :submit_text, :authenticity_token, :charset, :autosubmit_nonce
 
+    # The only place markup is produced. Attribute values are always escaped
+    # (nil drops the attribute); content is markup built by this class, or
+    # decor section html, which is raw by design.
+    def tag(name, content = nil, **attributes)
+      attrs = attributes.compact.map { |key, value| %( #{key}="#{escape(value)}") }.join
+      content.nil? ? "<#{name}#{attrs}>" : "<#{name}#{attrs}>#{content}</#{name}>"
+    end
+
     def escape(value)
-      CGI.escapeHTML(value.to_s)
+      value.to_s.gsub(/[&<>"']/, HTML_ESCAPES)
     end
 
-    def form_head
-      %Q(<form id="#{escape(form_id)}" action="#{escape(url)}" method="#{escape(form_method)}" accept-charset="#{escape(charset)}">)
+    # Escaping can't make a javascript: or data: URL safe, so only http(s)
+    # and relative URLs are allowed unless the caller allows more schemes.
+    def check_url_scheme!
+      # Browsers ignore leading whitespace/control characters and drop tabs
+      # and newlines anywhere, so "java\nscript:" still runs as javascript:.
+      normalized = url.gsub(/[\t\n\r]/, '').sub(/\A[\x00-\x20]+/, '')
+      scheme = normalized[/\A([a-z][a-z0-9+.\-]*):/i, 1]
+      return if scheme.nil? || allowed_schemes.include?(scheme.downcase)
+
+      raise UnsafeUrlError,
+            "repost refuses to submit a form to a #{scheme}: URL. Allowed schemes: " \
+            "#{allowed_schemes.join(', ')} (change with options[:allowed_schemes])"
     end
 
     def form_method
-      method_override? ? 'post' : method
+      method_override? ? 'post' : http_method
     end
 
     def method_override?
-      OVERRIDE_METHODS.include?(method)
+      OVERRIDE_METHODS.include?(http_method)
     end
 
-    def form_body
-      inputs = params.map do |key, value|
-        form_input(key, value)
-      end
-      inputs.unshift(csrf_token) if authenticity_token
-      inputs.unshift(method_override_input) if method_override?
+    def form_inputs
+      inputs = []
+      inputs << hidden_input('_method', http_method) if method_override?
+      inputs << hidden_input('authenticity_token', authenticity_token) if authenticity_token
+      params.each { |key, value| inputs << form_input(key, value) }
       inputs.join
     end
 
-    def method_override_input
-      %Q(<input type="hidden" name="_method" value="#{escape(method)}">)
-    end
-
-    def form_input(key, value)
+    def form_input(name, value)
       case value
-      when Hash
-        value.map do |inner_key, inner_value|
-          form_input("#{key}[#{inner_key}]", inner_value)
-        end.join
-      when Array
-        value.map do |inner_value|
-          form_input("#{key}[]", inner_value)
-        end.join
-      else
-        %Q(<input type="hidden" name="#{escape(key)}" value="#{escape(value)}">)
+      when Hash  then value.map { |key, inner| form_input("#{name}[#{key}]", inner) }.join
+      when Array then value.map { |inner| form_input("#{name}[]", inner) }.join
+      else hidden_input(name, value)
       end
     end
 
-    def form_footer
-      %Q(</form>)
-    end
-
-    def csrf_token
-      %Q(<input name="authenticity_token" value="#{escape(authenticity_token)}" type="hidden">)
-    end
-
-    def no_script
-      %Q(<noscript>#{submit_section}</noscript>)
+    def hidden_input(name, value)
+      tag(:input, type: 'hidden', name: name, value: value.to_s)
     end
 
     def submit_section
-      %Q(<div#{class_attr(section_classes)}>#{section_html}<input#{class_attr(submit_classes)} type="submit" value="#{escape(submit_text)}"></div>)
-    end
-
-    def class_attr(classes)
-      %Q( class="#{escape(classes)}") if classes
-    end
-
-    def generated_form_id
-      "repost-#{SecureRandom.hex(8)}"
+      button = tag(:input, class: submit_classes, type: 'submit', value: submit_text)
+      tag(:div, "#{section_html}#{button}", class: section_classes)
     end
 
     # Calls the prototype's submit() so a param named "submit" (which the
     # browser exposes as form.submit, shadowing the method) can't break it.
     def auto_submit_script
-      nonce_attr = %Q( nonce="#{escape(autosubmit_nonce)}") if autosubmit_nonce
-      %Q(<script#{nonce_attr}>
-        HTMLFormElement.prototype.submit.call(document.getElementById(#{js_string(form_id)}));
-      </script>)
+      tag(:script, "HTMLFormElement.prototype.submit.call(document.getElementById(#{js_string(form_id)}));",
+          nonce: autosubmit_nonce)
     end
 
     # A JS string literal that is also safe inside an HTML <script> element.
     # HTML escaping is wrong here: entities are not decoded inside <script>.
     def js_string(value)
-      JSON.generate(value.to_s).gsub(/[<>&

]/) { |char| format('\u%04x', char.ord) }
+      JSON.generate(value.to_s).gsub(/[<>&

]/JS_UNSAFE) { |char| format('\u%04x', char.ord) }
+    end
+
+    def generated_form_id
+      "repost-#{SecureRandom.hex(8)}"
     end
   end
 end

data/lib/repost/version.rb

@@ -1,3 +1,3 @@
 module Repost
-  VERSION = "0.5.3"
+  VERSION = "0.6.0"
 end

data/lib/repost.rb

@@ -1,9 +1,10 @@
-require "repost/version"
-require "repost/action"
-require "repost/senpai"
-require "repost/extend_controller"
-
 module Repost
   class Error < StandardError; end
+  # Raised when the target URL uses a scheme that isn't allowed (javascript:, data:, ...).
+  class UnsafeUrlError < Error; end
 end
 
+require "repost/version"
+require "repost/action"
+require "repost/senpai"
+require "repost/extend_controller"

metadata

@@ -1,15 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: repost
 version: !ruby/object:Gem::Version
-  version: 0.5.3
+  version: 0.6.0
 platform: ruby
 authors:
 - YaroslavO
 autorequire:
-bindir: exe
+bindir: bin
 cert_chain: []
 date: 2026-11-05 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: actionpack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -46,9 +66,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE.txt
 - README.md
-- Rakefile
 - lib/repost.rb
 - lib/repost/action.rb
 - lib/repost/extend_controller.rb
@@ -58,8 +78,9 @@ homepage: https://github.com/vergilet/repost
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/vergilet/repost
   source_code_uri: https://github.com/vergilet/repost
+  changelog_uri: https://github.com/vergilet/repost/blob/master/CHANGELOG.md
+  bug_tracker_uri: https://github.com/vergilet/repost/issues
 post_install_message:
 rdoc_options: []
 require_paths:

data/Rakefile

@@ -1,6 +0,0 @@
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
-RSpec::Core::RakeTask.new(:spec)
-
-task :default => :spec