solidus_backend 1.1.2 → 1.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 29c8705d452ce74aad7d08b555aadc11a97b6731
-  data.tar.gz: 2d2cf2f35445346d51af6fc42413059c3143b8f8
+  metadata.gz: cd04d936c53077456873f926bdbc5f0a4ad82e37
+  data.tar.gz: 95fcac4f435671f54116dc09f2807f414acc1e0d
 SHA512:
-  metadata.gz: 017c4b597f2b74b6b322a589cd9d838ba2fed96eeef04dca2b8e8c74f152f3f1e367d7aae45e2d36cc7a19464556a9ec1ebd5e366d6cf22f233bc6118dcb1da1
-  data.tar.gz: 7c0bf214c2d9656452cbfacacc6d8c414d1a99f753c9a0915a14e92d9a552e29dc35296f4138db7ebce5d2dd1047b9f2f3868cc0e094d408e71dbad634ee02df
+  metadata.gz: 1366f87ab6e4bdfc6fe49a70dcaede2c32485c34e7f82380e4f6b075dc3f04079c053d25012315e2f2a7d8ac855e91d8f9ae514b9b83adf55a04f656066c354e
+  data.tar.gz: be9d240cf0dab33875e6fe90b72b36380ee328b2ab94695380ab50067de67877a3e4c8fa208f341cbc1d81547dd761bb5fc24a221d687401354bf25be36a4653

data/app/assets/javascripts/spree/backend/checkouts/edit.js

@@ -24,7 +24,7 @@ $(document).ready(function() {
           }
         },
         results: function(data, page) {
-          return { results: data }
+          return { results: data.users }
         }
       },
       dropdownCssClass: 'customer_search',
@@ -52,7 +52,7 @@ $(document).ready(function() {
             });
           });
         }
-        return customer.email;
+        return Select2.util.escapeMarkup(customer.email);
       }
     })
   }

data/app/assets/javascripts/spree/backend/option_type_autocomplete.js.erb

@@ -1,6 +1,10 @@
 $(document).ready(function () {
   'use strict';
 
+  function formatOptionType(option_type) {
+    return Select2.util.escapeMarkup(option_type.presentation + ' (' + option_type.name + ')');
+  }
+
   if ($('#product_option_type_ids').length > 0) {
     $('#product_option_type_ids').select2({
       placeholder: Spree.translations.option_type_placeholder,
@@ -31,12 +35,8 @@ $(document).ready(function () {
           };
         }
       },
-      formatResult: function (option_type) {
-        return option_type.presentation + ' (' + option_type.name + ')';
-      },
-      formatSelection: function (option_type) {
-        return option_type.presentation + ' (' + option_type.name + ')';
-      }
+      formatResult: formatOptionType,
+      formatSelection: formatOptionType
     });
   }
 });

data/app/assets/javascripts/spree/backend/option_value_picker.js

@@ -6,6 +6,10 @@ $.fn.optionValueAutocomplete = function (options) {
   var multiple = typeof(options['multiple']) !== 'undefined' ? options['multiple'] : true;
   var productSelect = options['productSelect'];
 
+  function formatOptionValue(option_value) {
+    return Select2.util.escapeMarkup(option_value.name);
+  }
+
   this.select2({
     minimumInputLength: 3,
     multiple: multiple,
@@ -33,11 +37,7 @@ $.fn.optionValueAutocomplete = function (options) {
         return { results: data };
       }
     },
-    formatResult: function (option_value) {
-      return option_value.name;
-    },
-    formatSelection: function (option_value) {
-      return option_value.name;
-    }
+    formatResult: formatOptionValue,
+    formatSelection: formatOptionValue
   });
 };

data/app/assets/javascripts/spree/backend/product_picker.js

@@ -5,6 +5,10 @@ $.fn.productAutocomplete = function (options) {
   options = options || {}
   var multiple = typeof(options['multiple']) !== 'undefined' ? options['multiple'] : true
 
+  function formatProduct(product) {
+    return Select2.util.escapeMarkup(product.name);
+  }
+
   this.select2({
     minimumInputLength: 3,
     multiple: multiple,
@@ -39,12 +43,8 @@ $.fn.productAutocomplete = function (options) {
         };
       }
     },
-    formatResult: function (product) {
-      return product.name;
-    },
-    formatSelection: function (product) {
-      return product.name;
-    }
+    formatResult: formatProduct,
+    formatSelection: formatProduct
   });
 };
 

data/app/assets/javascripts/spree/backend/stock_movement.js.coffee

@@ -17,5 +17,5 @@ jQuery ->
           return { results: data.stock_items, more: more }
       formatResult: (stock_item) ->
         variantTemplate({ variant: stock_item.variant })
-      formatSelection: (stock_item) ->
-        "#{stock_item.variant.name} (#{stock_item.variant.options_text})"
+      formatSelection: (stock_item, container, excapeMarkup) ->
+        Select2.util.escapeMarkup("#{stock_item.variant.name} (#{stock_item.variant.options_text})")

data/app/assets/javascripts/spree/backend/taxon_autocomplete.js.erb

@@ -1,6 +1,10 @@
 'use strict';
 
 var set_taxon_select = function(){
+  function formatTaxon(taxon) {
+    return Select2.util.escapeMarkup(taxon.pretty_name);
+  }
+
   if ($('#product_taxon_ids').length > 0) {
     $('#product_taxon_ids').select2({
       placeholder: Spree.translations.taxon_placeholder,
@@ -37,12 +41,8 @@ var set_taxon_select = function(){
           };
         }
       },
-      formatResult: function (taxon) {
-        return taxon.pretty_name;
-      },
-      formatSelection: function (taxon) {
-        return taxon.pretty_name;
-      }
+      formatResult: formatTaxon,
+      formatSelection: formatTaxon
     });
   }
 }

data/app/assets/javascripts/spree/backend/taxons.js.coffee

@@ -45,6 +45,9 @@ $ ->
     sortable.trigger('sortupdate', item: draggable)
   , 250
 
+  formatTaxon = (taxon) ->
+    Select2.util.escapeMarkup(taxon.pretty_name)
+
   $('#taxon_id').select2
     dropdownCssClass: "taxon_select_box",
     placeholder: Spree.translations.find_a_taxon,
@@ -59,10 +62,8 @@ $ ->
       results: (data) ->
         results: data['taxons'],
         more: data.current_page < data.pages
-    formatResult: (taxon) ->
-      taxon.pretty_name
-    formatSelection: (taxon) ->
-      taxon.pretty_name
+    formatResult: formatTaxon,
+    formatSelection: formatTaxon
 
   $('#taxon_id').on "change", (e) ->
     Spree.ajax

data/app/assets/javascripts/spree/backend/user_picker.js

@@ -1,6 +1,10 @@
 $.fn.userAutocomplete = function () {
   'use strict';
 
+  function formatUser(user) {
+    return Select2.util.escapeMarkup(user.email);
+  }
+
   this.select2({
     minimumInputLength: 1,
     multiple: true,
@@ -8,7 +12,7 @@ $.fn.userAutocomplete = function () {
       $.get(Spree.routes.user_search, {
         ids: element.val()
       }, function (data) {
-        callback(data);
+        callback(data.users);
       });
     },
     ajax: {
@@ -23,16 +27,12 @@ $.fn.userAutocomplete = function () {
       },
       results: function (data) {
         return {
-          results: data
+          results: data.users
         };
       }
     },
-    formatResult: function (user) {
-      return user.email;
-    },
-    formatSelection: function (user) {
-      return user.email;
-    }
+    formatResult: formatUser,
+    formatSelection: formatUser
   });
 };
 

data/app/assets/javascripts/spree/backend/variant_autocomplete.js.coffee.erb

@@ -33,8 +33,8 @@ $.fn.variantAutocomplete = (searchOptions = {}) ->
         results: data["variants"]
 
     formatResult: formatVariantResult
-    formatSelection: (variant) ->
+    formatSelection: (variant, container, escapeMarkup) ->
       if !!variant.options_text
-        variant.name + " (#{variant.options_text})"
+        Select2.util.escapeMarkup("#{variant.name} (#{variant.options_text}")
       else
-        variant.name
+        Select2.util.escapeMarkup(variant.name)

data/app/helpers/spree/admin/adjustments_helper.rb

@@ -26,11 +26,15 @@ module Spree
         parts << variant.product.name
         parts << "(#{variant.options_text})" if variant.options_text.present?
         parts << line_item.display_total
-        parts.join("<br>").html_safe
+        safe_join(parts, "<br />".html_safe)
       end
 
       def display_shipment(shipment)
-        "#{Spree.t(:shipment)} ##{shipment.number}<br>#{shipment.display_cost}".html_safe
+        parts = [
+          "#{Spree.t(:shipment)} ##{shipment.number}",
+          shipment.display_cost
+        ]
+        safe_join(parts, "<br />".html_safe)
       end
 
       def display_order(order)

data/app/helpers/spree/admin/base_helper.rb

@@ -15,8 +15,8 @@ module Spree
         obj = object.respond_to?(:errors) ? object : instance_variable_get("@#{object}")
 
         if obj && obj.errors[method].present?
-          errors = obj.errors[method].map { |err| h(err) }.join('<br />').html_safe
-          content_tag(:span, errors, :class => 'formError')
+          errors = safe_join(obj.errors[method], "<br />".html_safe)
+          content_tag(:span, errors, class: 'formError')
         else
           ''
         end
@@ -132,12 +132,11 @@ module Spree
 
       def preference_fields(object, form)
         return unless object.respond_to?(:preferences)
-        object.preferences.keys.map{ |key|
-
+        fields = object.preferences.keys.map { |key|
           form.label("preferred_#{key}", Spree.t(key) + ": ") +
-            preference_field_for(form, "preferred_#{key}", :type => object.preference_type(key))
-
-        }.join("<br />").html_safe
+            preference_field_for(form, "preferred_#{key}", type: object.preference_type(key))
+        }
+        safe_join(fields, "<br />".html_safe)
       end
 
       def link_to_add_fields(name, target, options = {})

data/app/helpers/spree/admin/navigation_helper.rb

@@ -74,7 +74,7 @@ module Spree
         options[:class] = (options[:class].to_s + " fa fa-#{icon_name} icon_link with-tip").strip
         options[:class] += ' no-text' if options[:no_text]
         options[:title] = text if options[:no_text]
-        text = options[:no_text] ? '' : raw("<span class='text'>#{text}</span>")
+        text = options[:no_text] ? '' : content_tag(:span, text, class: 'text')
         options.delete(:no_text)
         link_to(text, url, options)
       end
@@ -107,16 +107,10 @@ module Spree
           if html_options[:icon]
             html_options[:class] += " fa fa-#{html_options[:icon]}"
           end
-          link_to(text_for_button_link(text, html_options), url, html_options)
+          link_to(text, url, html_options)
         end
       end
 
-      def text_for_button_link(text, html_options)
-        s = ''
-        s << text
-        raw(s)
-      end
-
       def configurations_menu_item(link_text, url, description = '')
         %(<tr>
           <td>#{link_to(link_text, url)}</td>

data/app/helpers/spree/admin/orders_helper.rb

@@ -12,7 +12,7 @@ module Spree
                                     :data => { :confirm => Spree.t(:order_sure_want_to, :event => Spree.t(event)) })
           end
         end
-        links.join(' ').html_safe
+        safe_join(links, ' '.html_safe)
       end
 
       def line_item_shipment_price(line_item, quantity)

data/app/helpers/spree/admin/products_helper.rb

@@ -9,7 +9,8 @@ module Spree
                       :selected => ('selected' if selected)) do
             (taxon.ancestors.pluck(:name) + [taxon.name]).join(" -> ")
           end
-        end.join("").html_safe
+        end
+        safe_join(options)
       end
 
       def option_types_options_for(product)
@@ -20,7 +21,8 @@ module Spree
                       :selected => ('selected' if selected)) do
             option_type.name
           end
-        end.join("").html_safe
+        end
+        safe_join(options)
       end
     end
   end

data/app/helpers/spree/admin/stock_movements_helper.rb

@@ -15,9 +15,9 @@ module Spree
 
       def display_variant(stock_movement)
         variant = stock_movement.stock_item.variant
-        output = variant.name
-        output += "<br>(#{variant.options_text})" unless variant.options_text.blank?
-        output.html_safe
+        output = [variant.name]
+        output << variant.options_text unless variant.options_text.blank?
+        safe_join(output, "<br />".html_safe)
       end
     end
   end

data/app/views/spree/admin/search/users.rabl

@@ -1,4 +1,4 @@
-collection(@users)
+collection(@users => :users)
 attributes :email, :id
 address_fields = [:firstname, :lastname,
                   :address1, :address2,

data/spec/features/admin/orders/new_order_spec.rb

@@ -172,6 +172,18 @@ describe "New Order", :type => :feature do
     end
   end
 
+  context "customer with attempted XSS", js: true do
+    let(:xss_string) { %(<script>throw("XSS")</script>) }
+    before do
+      user.update!(email: xss_string)
+    end
+    it "displays the user's email escaped without executing" do
+      click_on "Customer Details"
+      targetted_select2_search user.email, from: "#s2id_customer_search"
+      expect(page).to have_field("Email", with: xss_string)
+    end
+  end
+
   def fill_in_address(kind = "bill")
     fill_in "First Name",                with: "John 99"
     fill_in "Last Name",                 with: "Doe"

data/spec/features/admin/products/edit/taxons_spec.rb

@@ -11,15 +11,16 @@ describe "Product Taxons", :type => :feature do
     Capybara.ignore_hidden_elements = false
   end
 
-  context "managing taxons" do
+  context "managing taxons", js: true do
     def selected_taxons
       find("#product_taxon_ids").value.split(',').map(&:to_i).uniq
     end
 
-    it "should allow an admin to manage taxons", :js => true do
+    let(:product) { create(:product) }
+
+    it "should allow an admin to manage taxons" do
       taxon_1 = create(:taxon)
-      taxon_2 = create(:taxon, :name => 'Clothing')
-      product = create(:product)
+      taxon_2 = create(:taxon, name: 'Clothing')
       product.taxons << taxon_1
 
       visit spree.admin_path
@@ -39,5 +40,17 @@ describe "Product Taxons", :type => :feature do
       expect(page).to have_css(".select2-search-choice", text: taxon_1.name)
       expect(page).to have_css(".select2-search-choice", text: taxon_2.name)
     end
+
+    context "with an XSS attempt" do
+      let(:taxon_name) { %(<script>throw("XSS")</script>) }
+      let!(:taxon) { create(:taxon, name: taxon_name) }
+      it "displays the escaped HTML without executing it" do
+        visit spree.edit_admin_product_path(product)
+
+        select2_search "<script>", from: "Taxons"
+
+        expect(page).to have_content(taxon_name)
+      end
+    end
   end
 end

data/spec/features/admin/promotions/option_value_rule_spec.rb

@@ -36,6 +36,26 @@ feature 'Promotion with option value rule' do
     expect(first_rule.preferred_eligible_values).to eq Hash[product.id => [option_value.id]]
   end
 
+  context "with an attempted XSS" do
+    let(:xss_string) { %(<script>throw("XSS")</script>) }
+    before do
+      option_value.update!(name: xss_string)
+    end
+    scenario "adding an option value rule", js: true do
+      select2 "Option Value(s)", from: "Add rule of type"
+      within("#rules_container") { click_button "Add" }
+
+      within("#rules_container .promotion-block") do
+        click_button "Add"
+      end
+
+      within('.promo-rule-option-value') do
+        targetted_select2_search product.name, from: '.js-promo-rule-option-value-product-select'
+        targetted_select2_search option_value.name, from: '.js-promo-rule-option-value-option-values-select'
+      end
+    end
+  end
+
   context "with an existing option value rule" do
     given(:variant1) { create :variant }
     given(:variant2) { create :variant }

data/spec/features/admin/promotions/user_rule_spec.rb

@@ -0,0 +1,25 @@
+require 'spec_helper'
+
+feature 'Promotion with user rule', js: true do
+  stub_authorization!
+
+  given(:promotion) { create :promotion }
+
+  background do
+    visit spree.edit_admin_promotion_path(promotion)
+  end
+
+  context "with an attempted XSS" do
+    let(:xss_string) { %(<script>throw("XSS")</script>) }
+    given!(:user) { create(:user, email: xss_string) }
+
+    scenario "adding an option value rule" do
+      select2 "User", from: "Add rule of type"
+      within("#rules_container") { click_button "Add" }
+
+      select2_search "<script>", from: "Choose users"
+
+      expect(page).to have_content(xss_string)
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: solidus_backend
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.1.3
 platform: ruby
 authors:
 - Solidus Team
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-22 00:00:00.000000000 Z
+date: 2016-02-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: solidus_api
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.1.2
+        version: 1.1.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.1.2
+        version: 1.1.3
 - !ruby/object:Gem::Dependency
   name: solidus_core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.1.2
+        version: 1.1.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.1.2
+        version: 1.1.3
 - !ruby/object:Gem::Dependency
   name: bourbon
   requirement: !ruby/object:Gem::Requirement
@@ -662,6 +662,7 @@ files:
 - spec/features/admin/promotion_adjustments_spec.rb
 - spec/features/admin/promotions/option_value_rule_spec.rb
 - spec/features/admin/promotions/tiered_calculator_spec.rb
+- spec/features/admin/promotions/user_rule_spec.rb
 - spec/features/admin/reports_spec.rb
 - spec/features/admin/stock_transfer_spec.rb
 - spec/features/admin/store_credits_spec.rb
@@ -734,3 +735,4 @@ signing_key:
 specification_version: 4
 summary: Admin interface for the Solidus e-commerce framework.
 test_files: []
+has_rdoc: