rich_text_renderer 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 865de8333e3ce0f1a1273765b2771630e6f3ecb999a487ec861138a53df2012e
-  data.tar.gz: f8c6a2173cc8087f85a8d673c0bd2a3b37d74d886c209c1320526f3bdbbcba9a
+  metadata.gz: c0564e840440e02ea054c716664a738e1e081e93ea1ff5973b72d0e91c5aa075
+  data.tar.gz: 3b50e33011b385355b23bf9dc4d7aa7fd7d06a9a389ff5ae401fc1c72ece399e
 SHA512:
-  metadata.gz: b73eecb049a5be810e6c0c1f2715db1d29d5cde689c67caae08adc7a9e105e31b419d7a310dad48a709ba100921a680df43d55088275b08e48937d2a6f018f37
-  data.tar.gz: e6463218a559be8286ef543d08097ae7750750d8ccb1fa2a2b97177786a78867b5b04e4b5113596243f5b11562cc08c17968fd418b6c43cca5682a8b9f008bd8
+  metadata.gz: 2dd251c58a449e74096e498f74410b37fbe8849905745f970ab2c35a5eba872d45d127afcf53a2060342603459bb62069cd3d9d6df78d2124f19d44ca445893a
+  data.tar.gz: 86b19381e4e57e306f2a0859398a4ac50b62d8cbe0e1796510c1b84cc2f7c3cba1b5d56a2e613756c19d67a0ddba645b204d510da42b4e9d0a24751124c7a045

data/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+## v0.2.2
+### Fixed
+* Fixed mispelt blockquote tag. [#9](https://github.com/contentful/rich-text-renderer.rb/pull/9)
+* Removed the possibility of XSS via text in nodes. [#10](https://github.com/contentful/rich-text-renderer.rb/pull/10)
+
 ## v0.2.1
 ### Fixed
 * Default `EntryBlockRenderer` now properly stringifies `data.target` instead of just data.

data/lib/rich_text_renderer/block_renderers/blockquote_renderer.rb

@@ -6,7 +6,7 @@ module RichTextRenderer
     protected
 
     def render_tag
-      'blockqoute'
+      'blockquote'
     end
   end
 end

data/lib/rich_text_renderer/text_renderers/text_renderer.rb

@@ -7,6 +7,8 @@ module RichTextRenderer
     def render(node)
       node = Marshal.load(Marshal.dump(node)) # Clone the node
 
+      node['value'] = CGI.escapeHTML(node['value'])
+
       node.fetch('marks', []).each do |mark|
         renderer = mappings[mark['type']]
         return mappings[nil].new(mappings).render(mark) if renderer.nil? && mappings.key?(nil)

data/lib/rich_text_renderer/version.rb

@@ -1,4 +1,4 @@
 module RichTextRenderer
   # Gem Version
-  VERSION = '0.2.1'.freeze
+  VERSION = '0.2.2'.freeze
 end

data/spec/lib/rich_text_renderer/block_renderers/blockquote_renderer_spec.rb

@@ -14,12 +14,12 @@ describe RichTextRenderer::BlockQuoteRenderer do
   end
 
   describe '#render' do
-    it 'renders a blockqoute' do
-      expect(subject.render(mock_node)).to eq "<blockqoute><p>foo</p></blockqoute>"
+    it 'renders a blockquote' do
+      expect(subject.render(mock_node)).to eq "<blockquote><p>foo</p></blockquote>"
     end
 
     it 'will propagate marks to text renderers' do
-      expect(subject.render(mock_node_with_marks)).to eq "<blockqoute><p><b>foo</b></p></blockqoute>"
+      expect(subject.render(mock_node_with_marks)).to eq "<blockquote><p><b>foo</b></p></blockquote>"
     end
   end
 end

data/spec/lib/rich_text_renderer/text_renderers/text_renderer_spec.rb

@@ -14,6 +14,10 @@ mock_node_multiple_marks = {
 
 mock_node_unsupported_mark = {"value" => "foo", "nodeType" => "text", "marks" => [{"type" => "foobar"}]}
 
+mock_node_unsafe_value = {"value" => "<script>alert('XSS!');</script>", "nodeType" => "text", "marks" => []}
+
+mock_node_unsafe_value_with_marks = {"value" => "<script>alert('XSS!');</script>", "nodeType" => "text", "marks" => [{"type" => "underline"}, {"type" => "italic"}, {"type" => "bold"}]}
+
 describe RichTextRenderer::TextRenderer do
   subject do
     described_class.new(
@@ -49,5 +53,13 @@ describe RichTextRenderer::TextRenderer do
 
       expect(subject.render(mock_node_bold_only)).to eq "**foo**"
     end
+
+    it 'escapes value' do
+      expect(subject.render(mock_node_unsafe_value)).to eq "&lt;script&gt;alert(&#39;XSS!&#39;);&lt;/script&gt;"
+    end
+
+    it 'renders marks but keeps value escaped' do
+      expect(subject.render(mock_node_unsafe_value_with_marks)).to eq "<b><i><u>&lt;script&gt;alert(&#39;XSS!&#39;);&lt;/script&gt;</u></i></b>"
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rich_text_renderer
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Contentful GmbH (David Litvak Bruno)
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-08 00:00:00.000000000 Z
+date: 2019-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -358,8 +358,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Rich Text Renderer for the Contentful RichText field type