rhales 0.6.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 249890f733fb9b88bbabe22bcc327aa5d0422c00ea595e4b67751e335e790feb
-  data.tar.gz: 69259f0ab5cc091cc2c4fab33e3eee13859e28ef789e522119e6702f695155ab
+  metadata.gz: bc4ab2b108b173b1781fb48ada4b2cfba22547d79d0ecc4659838a67c2407363
+  data.tar.gz: 59f4e4b981c3166722d3ddebeba27861dc949575719c8eaa53d23b4e6a41f8d2
 SHA512:
-  metadata.gz: c424d4d348c48686ddb60fe068d2839627c552d94a03a507b9cf54f1d39d11dc4d18aaefccc8731ec0aa8fb79d72ef18ea838460d0e36f5d69b5575d7d15ac3d
-  data.tar.gz: 65139df9054a39981ca7f6fd51818544aca039847d4a1d60521e879c2d542f3ca1f2ca9bbeb030154cc735404882d5ca0ede2fcabe64ef55a8194c622518c963
+  metadata.gz: 06547d4e90656b20b5dd8dee5f6b468ea5ff63fc1f76becdca3b48889af7f62a42793acca89ced4f32f91017eb026f18862d772ffa1c606582a4aa0ad8fbb490
+  data.tar.gz: 1d5eb58558b5b45c3c24c95f2ee0f26ba171e6c11553e3b55d41aa598c41f2f53573b7e05c36abd52865d7b884aa571a076698183a4a1b135f31ec1a29b3319c

data/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-06-21
+
+### Security
+- Validate JSONP callback names against a JS identifier / dotted-path pattern to
+  block reflected XSS; invalid names raise `ArgumentError` (`HydrationEndpoint#render_jsonp`).
+- Escape `<`, `>`, `&`, U+2028, and U+2029 in hydration JSON so payloads like
+  `</script>` can't break out of the script context (`JSONSerializer.dump_html_safe`,
+  used by `View` and `HydrationEndpoint`).
+
 ## [0.6.2] - 2026-05-25
 
 ### Added

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rhales (0.6.2)
+    rhales (0.7.0)
       json_schemer (~> 2)
       logger
       tilt (~> 2)

data/lib/rhales/core/view.rb

@@ -390,7 +390,7 @@ module Rhales
         # Create JSON script tag with optional reflection attributes
         json_attrs = reflection_enabled? ? " data-window=\"#{window_attr}\"" : ''
         json_script = <<~HTML.strip
-          <script#{nonce_attr} id="#{unique_id}" type="application/json"#{json_attrs}>#{JSONSerializer.dump(data)}</script>
+          <script#{nonce_attr} id="#{unique_id}" type="application/json"#{json_attrs}>#{JSONSerializer.dump_html_safe(data)}</script>
         HTML
 
         # Create hydration script with optional reflection attributes

data/lib/rhales/hydration/hydration_endpoint.rb

@@ -42,6 +42,14 @@ module Rhales
   # module_response = endpoint.render_module('template_name')
   # ```
   class HydrationEndpoint
+    # Valid JSONP callback names: a JS identifier or dotted member path
+    # (e.g. "handleData", "app.callbacks.handleData"). Each dotted segment must
+    # be its own valid identifier, so malformed paths like "foo.", "foo..bar"
+    # or "foo.1bar" are rejected rather than producing unusable JSONP. Anything
+    # outside this set could break out of the callback invocation and inject
+    # script.
+    CALLBACK_NAME_PATTERN = /\A[a-zA-Z_$][a-zA-Z0-9_$]*(?:\.[a-zA-Z_$][a-zA-Z0-9_$]*)*\z/
+
     def initialize(config, context = nil)
       @config = config
       @context = context
@@ -93,18 +101,26 @@ module Rhales
       merged_data = process_template_data(template_name, additional_context)
 
       {
-        content: "export default #{JSONSerializer.dump(merged_data)};",
+        content: "export default #{JSONSerializer.dump_html_safe(merged_data)};",
         content_type: 'text/javascript',
         headers: module_headers(merged_data)
       }
     end
 
     # Render JSONP response with callback
+    #
+    # The callback name is reflected directly into the executable response
+    # body, so it must be validated before use. Without validation a caller
+    # supplying something like "alert(1)//" would inject arbitrary JavaScript.
     def render_jsonp(template_name, callback_name, additional_context = {})
+      unless callback_name.is_a?(String) && callback_name.match?(CALLBACK_NAME_PATTERN)
+        raise ArgumentError, "Invalid callback: #{callback_name.inspect}"
+      end
+
       merged_data = process_template_data(template_name, additional_context)
 
       {
-        content: "#{callback_name}(#{JSONSerializer.dump(merged_data)});",
+        content: "#{callback_name}(#{JSONSerializer.dump_html_safe(merged_data)});",
         content_type: 'application/javascript',
         headers: jsonp_headers(merged_data),
       }

data/lib/rhales/utils/json_serializer.rb

@@ -32,6 +32,19 @@ module Rhales
   #   # => :oj (if available) or :json (stdlib)
   #
   module JSONSerializer
+    # Characters that can terminate an HTML <script> element or, in legacy
+    # JavaScript engines, a string literal. They are escaped as \uXXXX, which
+    # is equivalent JSON/JS and round-trips identically through any parser.
+    HTML_ESCAPE = {
+      '<' => '\u003c',
+      '>' => '\u003e',
+      '&' => '\u0026',
+      "\u2028" => '\u2028',
+      "\u2029" => '\u2029',
+    }.freeze
+
+    HTML_ESCAPE_PATTERN = /[<>&

]/
+
     class << self
       # Serialize Ruby object to JSON string
       #
@@ -44,6 +57,22 @@ module Rhales
         @json_dumper.call(obj)
       end
 
+      # Serialize Ruby object to a JSON string safe to embed in an HTML
+      # <script> element or a JavaScript resource body.
+      #
+      # Standard JSON generation does not escape <, >, & or the U+2028/U+2029
+      # line separators, so a value containing "</script>" would break out of
+      # the surrounding script context and allow markup/JavaScript injection
+      # (XSS). This method escapes those characters as \uXXXX. The result is
+      # still valid JSON and parses back to the identical value.
+      #
+      # @param obj [Object] Ruby object to serialize
+      # @return [String] HTML/JS-context-safe JSON string
+      # @raise [TypeError] if object contains non-serializable types
+      def dump_html_safe(obj)
+        dump(obj).gsub(HTML_ESCAPE_PATTERN, HTML_ESCAPE)
+      end
+
       # Serialize Ruby object to pretty-printed JSON string
       #
       # Uses the serializer backend determined at load time (Oj or stdlib JSON).

data/lib/rhales/version.rb

@@ -5,6 +5,6 @@
 module Rhales
   # Version information for the RSFC gem
   unless defined?(Rhales::VERSION)
-    VERSION = '0.6.2'
+    VERSION = '0.7.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rhales
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.7.0
 platform: ruby
 authors:
 - delano