sanitize-url 0.1.2 → 0.1.3

data/README.markdown

@@ -26,7 +26,6 @@ This gem uses a whitelist approach, killing any schemes that aren't in the list.
 	https://
 	ftp://
 	ftps://
-	mailto://
 	svn://
 	svn+ssh://
 	git://

data/VERSION

@@ -1 +1 @@
-0.1.2
+0.1.3

data/lib/sanitize-url.rb

@@ -13,6 +13,10 @@ module SanitizeUrl
 	
 	HTTP_STYLE_SCHEMES = ['http', 'https', 'ftp', 'ftps', 'svn', 'svn+ssh', 'git'] # Common schemes whose format should be "scheme://" instead of "scheme:"
 	
+	# Sanitize the URL. Example usage:
+	#   sanitize_url('javascript:alert("XSS")')
+	#   sanitize_url('javascript:alert("XSS")', :replace_evil_with => 'Replaced')
+	#   sanitize_url('ftp://example.com', :schemes => ['http', 'https'])
 	def sanitize_url(url, options = {})
 		raise(ArgumentError, 'options[:schemes] must be an array') if options.has_key?(:schemes) and !options[:schemes].is_a?(Array)
 		options = {
@@ -59,7 +63,7 @@ module SanitizeUrl
 			end
 		end
 		
-		if options[:schemes].include?(scheme.downcase)
+		if options[:schemes].collect { |s| s.to_s }.include?(scheme.downcase)
 			if HTTP_STYLE_SCHEMES.include?(scheme.downcase) and !opaque.match(/^\/\//)
 				# It's an HTTP-like scheme, but the two slashes are missing. We'll fix that as a courtesy.
 				url = scheme + '://' + opaque
@@ -73,7 +77,7 @@ module SanitizeUrl
 		end
 	end	
 	
-	def self.dereference_numerics(str)
+	def self.dereference_numerics(str) #:nodoc:
 		# Decimal code points, e.g. j &#106 j &#0000106
 		str = str.gsub(/&#([a-fA-f0-9]+);?/) do
 			char_or_url_encoded($1.to_i)
@@ -87,7 +91,7 @@ module SanitizeUrl
 	# Return either the literal char or the URL-encoded equivalent,
 	# depending on our normalization rules. Requires a decimal
 	# code point. Code point can be outside the single-byte range.
-	def self.char_or_url_encoded(code)
+	def self.char_or_url_encoded(code) #:nodoc:
 		if url_encode?(code)
 			utf_8_str = ([code.to_i].pack('U'))
 			'%' + utf_8_str.unpack('H2' * utf_8_str.length).join('%').upcase
@@ -98,7 +102,7 @@ module SanitizeUrl
 	
 	# Should we URL-encode the byte?
 	# Must receive an integer code point
-	def self.url_encode?(code)
+	def self.url_encode?(code) #:nodoc:
 		!(
 			(code >= 48 and code <= 57)  or   # Numbers
 			(code >= 65 and code <= 90)  or   # Uppercase

data/sanitize-url.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = %q{sanitize-url}
-  s.version = "0.1.2"
+  s.version = "0.1.3"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["jarrett"]

data/spec/sanitize_url_spec.rb

@@ -60,6 +60,11 @@ describe SanitizeUrl do
 					sanitize_url(good_url, :schemes => ['http', 'https']).should == good_url
 				end
 			end
+			
+			it 'works with schemes given as symbols' do
+				sanitize_url('ftp://example.com', :schemes => [:http, :https], :replace_evil_with => 'replaced').should == 'replaced'
+				sanitize_url('ftp://example.com', :schemes => [:http, :https, :ftp]).should == 'ftp://example.com'
+			end
 		end
 		
 		it 'prepends http:// if no scheme is given' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: sanitize-url
 version: !ruby/object:Gem::Version 
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors: 
 - jarrett