sanitize-rails 1.1.1 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ad93903cde4f5b45e19e7f622e012331d1e89d59
-  data.tar.gz: bc9c5e4327b7cbc9b596e26666cbc6106d9cca4a
+  metadata.gz: 931e707da0e8ce7c06594fd0a71797d3e3634bd3
+  data.tar.gz: 5f5cda287d0f61a7cb07e86a612c051bac2e1c69
 SHA512:
-  metadata.gz: 28d70faa43727594ef25e0b075ebdf347c7aa33878fc32a03e027811ba230b2d7c505851af1f5143174e3d5bad782229f0b5aca0945ee809b93badf770ebd9f3
-  data.tar.gz: c2af1083786439e15a66fc7c75d5cd283cb68f001632e030543b796e1ade9eef8a8ac1a814df3b609e0fe130971b138441152d2f7480694ebe240cb8733f061e
+  metadata.gz: da89f8f4b4194f2a39473514ff2a357275c86707134108cd1bfcef75edb4e9a41f4ab7b9c0777a69c048e15512f87f6fe017fb410974a24e179d554505ed4ba4
+  data.tar.gz: 27ef2c8673c8ec58586417962dee3a86f76569cf53d1d92e999940499d974bc0d2de203486eef007fdea01647da59e0e6f8a3d6530552aa7997379a88e6977d9

data/.gitignore

@@ -3,7 +3,9 @@
 *.sublime-*
 .ruby-version
 .bundle
+.byebug_history
 Gemfile.lock
+gemfiles/*.lock
 html
 pkg
 .idea

data/.travis.yml

@@ -1,6 +1,17 @@
+rvm:
+  - 2.2
+  - 2.3
+  - 2.4
+
+gemfile:
+  - gemfiles/rails_4.2.gemfile
+  - gemfiles/rails_5.0.gemfile
+  - gemfiles/rails_5.1.gemfile
+
+matrix:
+  exclude:
+    - rvm: 2.4
+      gemfile: gemfiles/rails_4.2.gemfile
+
 language: ruby
 cache: bundler
-rvm:
-  - 2.1.2
-  - 2.0.0
-  - 1.9.3

data/gemfiles/rails_4.2.gemfile

@@ -0,0 +1,5 @@
+source "https://rubygems.org"
+
+gem "rails", "~> 4.2.0"
+
+gemspec :path => "../"

data/gemfiles/rails_5.0.gemfile

@@ -0,0 +1,5 @@
+source "https://rubygems.org"
+
+gem "rails", "~> 5.0.0"
+
+gemspec :path => "../"

data/gemfiles/rails_5.1.gemfile

@@ -0,0 +1,5 @@
+source "https://rubygems.org"
+
+gem "rails", "~> 5.1.0"
+
+gemspec :path => "../"

data/lib/sanitize/rails/engine.rb

@@ -17,21 +17,26 @@ module Sanitize::Rails
     # FIXME: Remove this, as it is meant only not to break assumptions on old
     # applications.
     #
-    if defined?(::ActionView::Base) &&
+    require 'rails'
+
+    if defined?(::ActionView::Base) && Rails.version.to_i < 5 &&
       ::ActionView::Base.respond_to?(:sanitized_allowed_tags) &&
       ::ActionView::Base.sanitized_allowed_tags.respond_to?(:size) &&
       ::ActionView::Base.sanitized_allowed_tags.size > 0
 
       def config
-	@_config ||= {
-	  :elements => ::ActionView::Base.sanitized_allowed_tags.to_a,
-	  :attributes => { :all => ::ActionView::Base.sanitized_allowed_attributes.to_a },
-	  :protocols  => { :all => ::ActionView::Base.sanitized_allowed_protocols.to_a }
-	}
-      end
+        @_config ||= {
+          :elements => ::ActionView::Base.sanitized_allowed_tags.to_a,
+          :attributes => { :all => ::ActionView::Base.sanitized_allowed_attributes.to_a },
+          :protocols  => { :all => ::ActionView::Base.sanitized_allowed_protocols.to_a },
+          :entities_whitelist => {}
+        }
+      end.freeze
     else
       def config
-	@_config ||= ::Sanitize::Config::BASIC
+        @_config ||= ::Sanitize::Config::BASIC.dup.tap do |config|
+          config[:entities_whitelist] ||= {}
+        end.freeze
       end
     end
 
@@ -76,8 +81,22 @@ module Sanitize::Rails
 
     private
 
+    def decode_whitelisted_entities(string)
+      @_config[:entities_whitelist].each do |entity, decoded_value|
+        string.gsub!(entity.to_s, decoded_value.to_s)
+      end
+
+      string
+    end
+
     def cleaned_fragment(string)
-      cleaner.fragment(string)
+      sanitized_string = cleaner.fragment(string)
+
+      if @_config[:entities_whitelist].present?
+        sanitized_string = decode_whitelisted_entities(sanitized_string)
+      end
+
+      return sanitized_string
     end
   end
 end

data/lib/sanitize/rails/version.rb

@@ -1,5 +1,5 @@
 class Sanitize
   module Rails
-    VERSION = '1.1.1'
+    VERSION = '1.2.0'
   end
 end

data/sanitize-rails.gemspec

@@ -17,6 +17,8 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
   s.files         = `git ls-files`.split("\n")
 
-  s.add_dependency "rails",    ">= 3.0"
-  s.add_dependency "sanitize", ">= 3.0"
+  s.add_dependency "rails"
+  s.add_dependency "sanitize"
+
+  s.add_development_dependency "byebug"
 end

data/test/sanitize_rails_engine_test.rb

@@ -4,6 +4,7 @@ require 'test_helper'
 class SanitizeRailsEngineTest < Minitest::Test
   def setup
     @engine = Sanitize::Rails::Engine
+    @engine.configure({})
   end
 
   def test_respond_to_configure
@@ -25,7 +26,7 @@ class SanitizeRailsEngineTest < Minitest::Test
   def test_clean_bang_modifies_string_in_place
     string = %Q|<script>alert("hello world")</script>|
     @engine.clean! string
-    assert_equal string, %q|alert("hello world")|
+    assert_equal %q|alert("hello world")|, string
   end
 
   def test_respond_to_clean
@@ -35,8 +36,8 @@ class SanitizeRailsEngineTest < Minitest::Test
   def test_clean_does_not_modify_string_in_place
     string = %Q|<script>alert("hello world")</script>|
     new_string = @engine.clean string
-    assert_equal string, %Q|<script>alert("hello world")</script>|
-    assert_equal new_string, 'alert("hello world")'
+    assert_equal %Q|<script>alert("hello world")</script>|, string
+    assert_equal 'alert("hello world")', new_string
   end
 
   def test_clean_returns_safe_buffers
@@ -50,20 +51,27 @@ class SanitizeRailsEngineTest < Minitest::Test
   def test_clean_not_producing_malicious_html_entities
     string = %Q|&lt;script&gt;hello & world&lt;/script&gt;|
     @engine.clean! string
-    assert_equal string, "&lt;script&gt;hello &amp; world&lt;/script&gt;"
+    assert_equal "&lt;script&gt;hello &amp; world&lt;/script&gt;", string
+  end
+
+  def test_entities_whitelist
+    string = %Q|<script>hello & world</script>|
+    @engine.configure(entities_whitelist: { '&amp;': '&' })
+    @engine.clean! string
+    assert_equal "hello & world", string
   end
 
   def test_clean_making_html_entities
     string = %Q|<script>hello & world</script>|
     @engine.clean! string
-    assert_equal string, "hello &amp; world"
+    assert_equal "hello &amp; world", string
   end
 
   def test_clean_returns_blank_string_for_nil_input
-    assert_equal '', @engine.clean(nil)
+    assert_equal @engine.clean(nil), ''
   end
 
   def test_clean_bang_returns_blank_string_for_nil_input
-    assert_equal '', @engine.clean!(nil)
+    assert_equal @engine.clean!(nil), ''
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sanitize-rails
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.2.0
 platform: ruby
 authors:
 - Marcello Barnaba
@@ -18,28 +18,42 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: sanitize
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: 
 email:
 - vjt@openssl.it
@@ -56,6 +70,9 @@ files:
 - README.md
 - Rakefile
 - example/sanitizer.rb
+- gemfiles/rails_4.2.gemfile
+- gemfiles/rails_5.0.gemfile
+- gemfiles/rails_5.1.gemfile
 - lib/sanitize/rails.rb
 - lib/sanitize/rails/action_view.rb
 - lib/sanitize/rails/active_record.rb
@@ -89,7 +106,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.5.2.1
 signing_key: 
 specification_version: 4
 summary: A sanitizer bridge for Rails applications