sqreen 1.6.3-java → 1.6.4-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fb1277e9fe14768daa5419ca6d0e42ab07e95e67
-  data.tar.gz: c8c556e20ad621bd7f18414a4bbc8ee80a56820c
+  metadata.gz: 16272b9166ff785fd074fa26c4f9d4d57d9a4999
+  data.tar.gz: 2a8e6688467b84113424e9888053f7ee16a8c979
 SHA512:
-  metadata.gz: 8caed917d587a1f571c00281d7135e5c5828be9539567ec13ddce6c2052c26111b67a50022243557baa17d2085a208f29e454ef41c6e6a1492008cdbff6f0e2f
-  data.tar.gz: 9b22ce8731b3487d65820bb3f2696c91e89b1c4ab5d93866cec5ca495ecdc839bc531d9826144f7d8dbb058d6ab1ade434e816f2abba0426ce2c33e7572663a6
+  metadata.gz: a81ca9d97fef431d8a3ec8d3de8755c04ab8b252ba8b88080cce05699ca9e18eb52facec8e4cbbb76c4835a17095eb24b6d7fa978bb927233bc75a263ca9a106
+  data.tar.gz: 44dfd38d40d3e6d2824c4892d110636620af9a71675f96ab06c052aaf7cc1c42c7ff326ec5ba7fd6b413b778426ceb239bfe737822516d87317de5aa2249bfaf

data/lib/sqreen/rules_callbacks/reflected_xss.rb

@@ -53,7 +53,6 @@ module Sqreen
 
         advise_action(nil)
       end
-
     end
     # look for reflected XSS with haml template engine
     # hook function arguments of
@@ -85,10 +84,12 @@ module Sqreen
     class Haml4ParserScriptHookCB < RuleCB
       def pre(_inst, *args, &_block)
         return unless args.size > 1
-        return unless Haml::VERSION < "5"
+        return unless Haml::VERSION < '5'
         text = args[0]
         escape_html = args[1]
-        if escape_html == false && !text.include?('html_escape')
+        if escape_html == false &&
+           text.respond_to?(:include?) &&
+           !text.include?('html_escape')
           args[0].replace("Sqreen.escape_haml(#{args[0]})")
         end
         nil
@@ -98,9 +99,10 @@ module Sqreen
     # Hook into haml4 tag parser
     class Haml4ParserTagHookCB < RuleCB
       def post(ret, _inst, *_args, &_block)
-        return unless Haml::VERSION < "5"
+        return unless Haml::VERSION < '5'
         tag = ret
         if tag.value[:escape_html] == false &&
+           tag.value[:value].respond_to?(:include?) &&
            !tag.value[:value].include?('html_escape')
           tag.value[:value] = "Sqreen.escape_haml(#{tag.value[:value]})"
           return { :status => :override, :new_return_value => tag }
@@ -134,7 +136,7 @@ module Sqreen
     # Hook build attributes
     class Haml4CompilerBuildAttributeCB < XSSCB
       def pre(inst, *args, &_block)
-        return unless Haml::VERSION < "5"
+        return unless Haml::VERSION < '5'
         attrs = args[-1]
         new_attrs, found_xss = Haml4CompilerBuildAttributeCB.clean_hash_key(attrs) do |key|
           if !key.nil? && key.is_a?(String) && framework.full_params_include?(key)
@@ -148,11 +150,12 @@ module Sqreen
 
         return if !found_xss || !block
         # potential XSS! let's escape
-        if !framework || !find_whitelisted_path(framework.request_path.to_s)
-          args[-1] = new_attrs
-          r = inst.send(method, *args)
-          return { :status => :skip, :new_return_value => r }
+        if framework && find_whitelisted_path(framework.request_path.to_s)
+          return nil
         end
+        args[-1] = new_attrs
+        r = inst.send(method, *args)
+        { :status => :skip, :new_return_value => r }
       end
 
       def self.clean_hash_key(hash, limit = 10, seen = [], &block)
@@ -186,7 +189,6 @@ module Sqreen
       end
     end
 
-
     # Hook into temple template rendering
     class TempleEscapableHookCB < RuleCB
       def post(ret, _inst, *_args, &_block)
@@ -195,7 +197,6 @@ module Sqreen
       end
     end
 
-
     # Hook into temple template rendering
     class SlimSplatBuilderCB < XSSCB
       def pre(inst, *args, &_block)

data/lib/sqreen/version.rb

@@ -1,5 +1,5 @@
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.io/terms.html
 module Sqreen
-  VERSION = '1.6.3'.freeze
+  VERSION = '1.6.4'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sqreen
 version: !ruby/object:Gem::Version
-  version: 1.6.3
+  version: 1.6.4
 platform: java
 authors:
 - Sqreen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-05-22 00:00:00.000000000 Z
+date: 2017-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: execjs