scrub_params 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 35978ee0837fbe0f7e929ad8e46be76ac8697d75
-  data.tar.gz: e2b14a8966c868c509aea60827906d34d8fa2e4d
+  metadata.gz: 59ce5d172db14eff6568862d843b8999c06743da
+  data.tar.gz: 0a0a73b82ae709556ff900d00e056e553332e534
 SHA512:
-  metadata.gz: ae5d80fff8ac67b82929bffd90ce1471184400b8b9bc37d7ae0ab8d13bc2d2598e0d43fe5d81f3061475781726cba465ee26f4a8d9014d37df200be807a89244
-  data.tar.gz: 10fdfb8269ffd57d6bdf1d63c159d3c6671d4dd19dcf397ba4a81b7f18a639d46516dbbfb82beb9a55824ce71e2aa9bd008a40c5d49b0332f8e78c8a707698a8
+  metadata.gz: 4b3825d8c6d0fe626436ee433778b0bc515e5507f8c3999ae766cccf8ec737774e3f2d7b30b0f84e35dc623d044603218b39f92c4452a1cd8eeeab720f65babb
+  data.tar.gz: 1bf0a240ed5e94eba192996b7d083731fec08ae8188945c9036be369240c45a3ff7adaf39901104638320fb9967153505cb7a0bc20cacc3cb446eacbfca11c74

data/README.md

@@ -2,10 +2,12 @@
 
 :lock: Secure Rails parameters by default
 
-> Insecure by default is insecure
-
 HTML has no business in most parameters. Take the **whitelist approach** and remove it by default.
 
+**Note:** Rails has done amazing work to prevent XSS, but storing `<script>badThings()</script>` in your database makes it much easier to make mistakes.
+
+Works with Rails 3.2 and above.
+
 ## Get Started
 
 Add this line to your application’s Gemfile:

data/lib/scrub_params.rb

@@ -1,57 +1,15 @@
 require "scrub_params/version"
+require "active_support/hash_with_indifferent_access"
 require "action_controller"
 require "sanitize"
+require "scrub_params/parameters"
+require "scrub_params/controller"
 require "scrub_params/log_subscriber"
 
-module ActionController
-  class Parameters < ActiveSupport::HashWithIndifferentAccess
-    attr_accessor :scrubbed_keys
-
-    def scrub!
-      self.scrubbed_keys = []
-      each_pair do |k, v|
-        self[k] = scrub_value(k, v)
-      end
-      if scrubbed_keys.any?
-        ActiveSupport::Notifications.instrument("scrubbed_parameters.action_controller", keys: scrubbed_keys)
-      end
-      self
-    end
-
-    protected
-
-    def scrub_value(key, value)
-      case value
-      when Hash
-        h = {}
-        value.each do |k, v|
-          h[k] = scrub_value(k, v)
-        end
-        h
-      when Array
-        value.map{|v| scrub_value(key, v) }
-      when String
-        scrubbed_value = Sanitize.clean(value)
-        if scrubbed_value != value
-          self.scrubbed_keys << key unless scrubbed_keys.include?(key)
-        end
-        scrubbed_value
-      else
-        value
-      end
-    end
-
-  end
+if defined?(ActionController::Parameters)
+  ActionController::Parameters.send :include, ScrubParams::Parameters
+else
+  ActiveSupport::HashWithIndifferentAccess.send :include, ScrubParams::Parameters
 end
 
-module ActionController
-  class Base
-    protected
-
-    before_filter :scrub_params
-
-    def scrub_params
-      params.scrub!
-    end
-  end
-end
+ActionController::Base.send :include, ScrubParams::Controller

data/lib/scrub_params/controller.rb

@@ -0,0 +1,14 @@
+module ScrubParams
+  module Controller
+    extend ActiveSupport::Concern
+
+    included do
+      before_filter :scrub_params
+    end
+
+    def scrub_params
+      params.scrub!
+    end
+
+  end
+end

data/lib/scrub_params/parameters.rb

@@ -0,0 +1,44 @@
+module ScrubParams
+  module Parameters
+    extend ActiveSupport::Concern
+
+    included do
+      attr_accessor :scrubbed_keys
+    end
+
+    def scrub!
+      self.scrubbed_keys = []
+      each_pair do |k, v|
+        self[k] = scrub_value(k, v)
+      end
+      if scrubbed_keys.any?
+        ActiveSupport::Notifications.instrument("scrubbed_parameters.action_controller", keys: scrubbed_keys)
+      end
+      self
+    end
+
+    protected
+
+    def scrub_value(key, value)
+      case value
+      when Hash
+        h = {}
+        value.each do |k, v|
+          h[k] = scrub_value(k, v)
+        end
+        h
+      when Array
+        value.map{|v| scrub_value(key, v) }
+      when String
+        scrubbed_value = Sanitize.clean(value)
+        if scrubbed_value != value
+          self.scrubbed_keys << key unless scrubbed_keys.include?(key)
+        end
+        scrubbed_value
+      else
+        value
+      end
+    end
+
+  end
+end

data/lib/scrub_params/version.rb

@@ -1,3 +1,3 @@
 module ScrubParams
-  VERSION = "0.0.1"
+  VERSION = "0.0.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: scrub_params
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Andrew Kane
@@ -107,7 +107,9 @@ files:
 - README.md
 - Rakefile
 - lib/scrub_params.rb
+- lib/scrub_params/controller.rb
 - lib/scrub_params/log_subscriber.rb
+- lib/scrub_params/parameters.rb
 - lib/scrub_params/version.rb
 - scrub_params.gemspec
 - test/scrub_params_test.rb