sanitize-rails 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6ec8f2b92a344e0040ed2e8b9ab5f2f04aaeeca3
-  data.tar.gz: f0f4f8f6956493fa27bd846d8ddc6152ba93c74c
+  metadata.gz: bfbc2ae7c47122752b36bf9fd44265540afa1926
+  data.tar.gz: 4f1db27d08d573d55d58ae19dc93b97c5c3de292
 SHA512:
-  metadata.gz: 98043ba7284b51877fb1b2613cf1fb4c54b1ea7e76331e230b0f0613e180730db6427f134e10d7f01176fb82b173c9b8c43b7d1b95af8c666b3edd2ad7efa264
-  data.tar.gz: 2ccaf00041d33e2eb027e746d945f5d92f172237d4ae8d452c37eb306a3d672c64824656943213f0e15b52dcc729c9823cd52ad78a6ddd3310d45c2f0f4be91b
+  metadata.gz: 866afa7c09eaa6247abede68c7de213cfc8a8e744e4a7e5c078f70c8692c1fb3006e2fa560b23f31e617532b439c97c183a9482e6e68039ebcd634c4f0acb162
+  data.tar.gz: bbd0cbb0e5bd12ae42a8ff199098d13d8e81cf686c2c29fa10d9ccd332cb1c13b4a6b5ec412255515cbc211d42b6907e075a594d197dcf7a78781def3fdc7e6f

data/README.md

@@ -20,6 +20,10 @@ an initializer, say `config/initializers/sanitizer.rb`:
       ...
     )
 
+You may pass `escape_entities: false` if you don't want to escape
+html entities. Example: `Hello & World` will not be changed to
+`Hello & World`
+
 Check out the [example][] in the `example/` directory.
 
 ## Usage

data/lib/sanitize/rails.rb

@@ -8,6 +8,7 @@
 # MIT License
 #
 require 'sanitize'
+require 'htmlentities'
 require 'sanitize/rails/railtie' if defined? Rails
 
 module Sanitize::Rails

data/lib/sanitize/rails/engine.rb

@@ -16,7 +16,8 @@ module Sanitize::Rails
         {
           :elements   => ::ActionView::Base.sanitized_allowed_tags.to_a,
           :attributes => { :all => ::ActionView::Base.sanitized_allowed_attributes.to_a},
-          :protocols  => { :all => ::ActionView::Base.sanitized_allowed_protocols.to_a }
+          :protocols  => { :all => ::ActionView::Base.sanitized_allowed_protocols.to_a },
+          :escape_entities => true
         }
       rescue
         warn "ActionView not available, falling back to Sanitize's BASIC config"
@@ -25,6 +26,10 @@ module Sanitize::Rails
       @sanitizer ||= ::Sanitize.new(@@config)
     end
 
+    def coder
+      @coder ||= HTMLEntities.new
+    end
+
     # Returns a copy of the given `string` after sanitizing it and marking it
     # as `html_safe`
     #
@@ -32,14 +37,14 @@ module Sanitize::Rails
     # means that text passed through `Sanitize::Rails::Engine.clean`
     # will not be escaped by ActionView's XSS filtering utilities.
     def clean(string)
-      ::ActiveSupport::SafeBuffer.new cleaner.fragment(string)
+      ::ActiveSupport::SafeBuffer.new cleaned_fragment(string)
     end
 
     # Sanitizes the given `string` in place and does NOT mark it as `html_safe`
     #
     def clean!(string)
       return '' if string.nil?
-      string.replace cleaner.fragment(string)
+      string.replace cleaned_fragment(string)
     end
 
     def callback_for(options) #:nodoc:
@@ -55,5 +60,17 @@ module Sanitize::Rails
     def method_for(fields) #:nodoc:
       "sanitize_#{fields.join('_')}".intern
     end
+
+    private
+
+    def escape_entities
+      @@config[:escape_entities].nil? ? true : @@config[:escape_entities]
+    end
+
+    def cleaned_fragment(string)
+      result = cleaner.fragment(string)
+      result = coder.decode(result) unless escape_entities
+      result
+    end
   end
 end

data/lib/sanitize/rails/matchers.rb

@@ -24,11 +24,37 @@ module Sanitize::Rails::Matchers
     end
   end
 
-  # Sintactic sugar
+  # Syntactic sugar
   alias_method :sanitize_fields, :sanitize_field
 
   # Add matchers module to rspec configuration
-  RSpec.configure { |c| c.include(self) } if defined? RSpec and RSpec.respond_to?(:configure)
+  ::RSpec.configure { |c| c.include(self) } if defined? ::RSpec and ::RSpec.respond_to?(:configure)
+
+  # RSpec 3 syntax
+  module RSpec3
+
+    def failure_message
+      "Expected #{should_helper} to return sanitized value '#{valid_value}', got '#{attribute_values}'"
+    end
+
+    def failure_message_when_negated
+      "Expected #{field_helper} not to be sanitized"
+    end
+
+  end
+
+  # RSpec 2 syntax
+  module RSpec2
+
+    def failure_message_for_should
+      "Expected #{should_helper} to return sanitized value '#{valid_value}', got '#{attribute_values}'"
+    end
+
+    def failure_message_for_should_not
+      "Expected #{field_helper} not to be sanitized"
+    end
+
+  end
 
   # Actual matcher class
   class SanitizeFieldsMatcher
@@ -65,12 +91,11 @@ module Sanitize::Rails::Matchers
       fields.all? { |field| valid_value == instance.send(field) }
     end
 
-    def failure_message_for_should
-      "Expected #{should_helper} to return sanitized value '#{valid_value}', got '#{attribute_values}'"
-    end
-
-    def failure_message_for_should_not
-      "Expected #{field_helper} not to be sanitized"
+    # Conditionally include RSpec modules according to loaded version
+    if defined? ::RSpec::Core::Version::STRING
+      include (::RSpec::Core::Version::STRING.split('.')[0] == '2') ? RSpec2 : RSpec3
+    else
+      raise 'RSpec version detection failed, are you using RSpec 2 or 3?'
     end
 
     def description

data/lib/sanitize/rails/version.rb

@@ -1,5 +1,5 @@
 class Sanitize
   module Rails
-    VERSION = '1.0.0'
+    VERSION = '1.0.1'
   end
 end

data/sanitize-rails.gemspec

@@ -19,4 +19,5 @@ Gem::Specification.new do |s|
 
   s.add_dependency "rails", ">= 3.0"
   s.add_dependency "sanitize", "~> 3.0"
+  s.add_dependency "htmlentities", "~> 4.3.3"
 end

data/test/sanitize_rails_engine_test.rb

@@ -47,6 +47,20 @@ class SanitizeRailsEngineTest < Minitest::Test
     assert_instance_of ::ActiveSupport::SafeBuffer, new_string
   end
 
+  def test_clean_not_making_html_entities
+    string = %Q|<script>hello & world</script>|
+    @engine.configure(escape_entities: false)
+    @engine.clean! string
+    assert_equal string, "hello & world"
+  end
+
+  def test_clean_making_html_entities
+    string = %Q|<script>hello & world</script>|
+    @engine.configure(escape_entities: true)
+    @engine.clean! string
+    assert_equal string, "hello &amp; world"
+  end
+
   def test_clean_returns_blank_string_for_nil_input
     assert_equal '', @engine.clean(nil)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sanitize-rails
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Marcello Barnaba
@@ -40,6 +40,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: htmlentities
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 4.3.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 4.3.3
 description: 
 email:
 - vjt@openssl.it
@@ -89,7 +103,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: A sanitizer bridge for Rails applications