sqreen 1.8.4-java → 1.8.5-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5a207be9e2f7828fee35541e9d87d2af291b6139
-  data.tar.gz: 718c476ee596ae0e26b5f0a90ffe238573450c35
+  metadata.gz: 5e1e52d6cf9228df5024c1fd53a95b4bf48c6a1e
+  data.tar.gz: 95f03d519edc6573cd1adbd2fad3062a8dabbf31
 SHA512:
-  metadata.gz: 6de34161fab960509c0e48f64e404d1914135086acd97a95e0d8c8efe2d2bc86e414fa1e92d92508a5556d92d84c75705189bdbb094cabbbc36f88acf5d0ae34
-  data.tar.gz: c052dc1011c91e97f611607dc7e34e6c00df0a903e7f77aec6ddc4247b8f99fb74884e66bbc225ac71547582e3b851f97e6b1fac2a9fb85b6c843a8b7c7b5251
+  metadata.gz: 69de15850bc5d6be5e287d924601342691edf1ace680956ec82aed6c1cba6a5d427ae8d703aff4b9a8ab2bb15571b54ea6f722596f29fc9de2200118f25f005c
+  data.tar.gz: 304174a40d56166d231e4e218f0733949d2e480434e7ef82c0fcb2350123b5b5d0888bcc051f76862f431dd5063012f9c3beaa9db6b8ba93d4fe57a7ee670967

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -90,7 +90,7 @@ module Sqreen
         if escape_html == false &&
            text.respond_to?(:include?) &&
            !text.include?('html_escape')
-          args[0].replace("Sqreen.escape_haml(#{args[0]})")
+          args[0].replace("Sqreen.escape_haml((#{args[0]}))")
         end
         nil
       end
@@ -104,7 +104,7 @@ module Sqreen
         if tag.value[:escape_html] == false &&
            tag.value[:value].respond_to?(:include?) &&
            !tag.value[:value].include?('html_escape')
-          tag.value[:value] = "Sqreen.escape_haml(#{tag.value[:value]})"
+          tag.value[:value] = "Sqreen.escape_haml((#{tag.value[:value]}))"
           return { :status => :override, :new_return_value => tag }
         end
         nil
@@ -126,7 +126,7 @@ module Sqreen
           else
             content = eval('"' + Haml::Util.balance(scan, '{', '}', 1)[0][0...-1] + '"')
             content = "Haml::Helpers.html_escape((#{content}))" if escape_html
-            res << '#{Sqreen.escape_haml(' + content + ')}' # Use eval to get rid of string escapes
+            res << '#{Sqreen.escape_haml((' + content + '))}' # Use eval to get rid of string escapes
           end
         end
         { :status => :skip, :new_return_value => res + rest }
@@ -180,7 +180,7 @@ module Sqreen
 
     class Haml5EscapableHookCB < RuleCB
       def pre(_inst, *args, &_block)
-        args[0] = "Sqreen.escape_haml(#{args[0]})"
+        args[0] = "Sqreen.escape_haml((#{args[0]}))"
         { :status => :modify_args, :args => args }
       end
     end
@@ -188,7 +188,7 @@ module Sqreen
     # Hook into temple template rendering
     class TempleEscapableHookCB < RuleCB
       def post(ret, _inst, *_args, &_block)
-        ret[1] = "Sqreen.escape_temple(#{ret[1]})"
+        ret[1] = "Sqreen.escape_temple((#{ret[1]}))"
         { :status => :override, :new_return_value => ret }
       end
     end

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.8.4'.freeze
+  VERSION = '1.8.5'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.8.4
+  version: 1.8.5
 platform: java
 authors:
 - Sqreen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-10-17 00:00:00.000000000 Z
+date: 2017-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs