string_parse_erb 0.1.0

data/.document

@@ -0,0 +1,5 @@
+lib/**/*.rb
+bin/*
+- 
+features/**/*.feature
+LICENSE.txt

data/.rspec

@@ -0,0 +1 @@
+--color

data/.rvmrc

@@ -0,0 +1 @@
+rvm_gemset_create_on_use_flag=1; rvm gemset use string-parse-erb-dev

data/Gemfile

@@ -0,0 +1,13 @@
+source "http://rubygems.org"
+# Add dependencies required to use your gem here.
+# Example:
+#   gem "activesupport", ">= 2.3.5"
+
+# Add dependencies to develop your gem here.
+# Include everything needed to run rake, tests, features, etc.
+group :development do
+  gem "rspec", "~> 2.3.0"
+  gem "bundler", "~> 1.0.0"
+  gem "jeweler", "~> 1.6.4"
+  gem "rcov", ">= 0"
+end

data/Gemfile.lock

@@ -0,0 +1,28 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    diff-lcs (1.1.3)
+    git (1.2.5)
+    jeweler (1.6.4)
+      bundler (~> 1.0)
+      git (>= 1.2.5)
+      rake
+    rake (0.9.2)
+    rcov (0.9.10)
+    rspec (2.3.0)
+      rspec-core (~> 2.3.0)
+      rspec-expectations (~> 2.3.0)
+      rspec-mocks (~> 2.3.0)
+    rspec-core (2.3.1)
+    rspec-expectations (2.3.0)
+      diff-lcs (~> 1.1.2)
+    rspec-mocks (2.3.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bundler (~> 1.0.0)
+  jeweler (~> 1.6.4)
+  rcov
+  rspec (~> 2.3.0)

data/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2011 Nadav Blum
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,53 @@
+= string_parse_erb
+
+Say you design a CMS, and you want the ability to replace some place-holders inside an item-content with some external values.
+
+Of course, you can use regular expressions and friends to do the task.
+
+But why not use the power of ERB engine instead ?
+
+Implementing ERB fragments inside your content can open up wide array of possibilities,
+all of the sudden you get the power of ruby inside you content: not just variables-replacement but conditionals, loops and so on..
+
+The downside of this is security...
+
+* You wouldn't want to process an item-content with something like:
+
+  <tt>"The time now is <%= time %>. Say bye bye... <% system('shutdown -r now') %>"</tt>
+
+  While 'time' may be a legal variable to be used inside the item-content template, calling #system
+  should definitely be forbidden.
+
+* You would like to limit the 'binding' object passed to ERB, so it includes only the variables you wish to expose, and not any variable happen to be in the program's context.
+
+The solution taken by this gem is very simple, (and so may not be perfect), and discussed in a couple of posts like: http://stackoverflow.com/questions/3619516/how-do-you-mark-a-ruby-binding-as-trusted
+
+== Installation
+*  gem install string_parse_erb
+
+*  include of extend StrParseErb module
+
+*  string_parse_erb(template, var_hash, safe_level=4)
+   Where:
+   *  template - a string containing erb fragments
+   *  var_hash - A hash of variables and their values to be exposed for template usage
+   *  safe_level(defaults to 4) - ruby SAFE level, under which ERB will operate
+
+== Examples
+  string_parse_erb(
+             "Good <%= part_of_day %>, the time is <%= time %>.",
+             {:part_of_day => "morning", :time => "six o'clock"}
+   )
+   # =>  "Good morning, the time is six o'clock."
+
+   string_parse_erb(
+             "<%= cmd %>",
+             {:cmd=> "abort"}
+   )
+   # => Raises SecurityError Exception
+
+== Copyright
+
+Copyright (c) 2011 Nadav Blum. See LICENSE.txt for
+further details.
+

data/Rakefile

@@ -0,0 +1,49 @@
+# encoding: utf-8
+
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'rake'
+
+require 'jeweler'
+Jeweler::Tasks.new do |gem|
+  # gem is a Gem::Specification... see http://docs.rubygems.org/read/chapter/20 for more options
+  gem.name = "string_parse_erb"
+  gem.homepage = "http://github.com/bnadav/string_parse_erb"
+  gem.license = "MIT"
+  gem.summary = %Q{Process ERB fragments in a String, according to variables hash}
+  gem.description = %Q{Process ERB fragments in a String, according to variables hash, no extenal vars are visible to ERB, safe level and untainting of string can be set}
+  gem.email = "nadav.blum@gmail.com"
+  gem.authors = ["Nadav Blum"]
+  # dependencies defined in Gemfile
+end
+Jeweler::RubygemsDotOrgTasks.new
+
+require 'rspec/core'
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new(:spec) do |spec|
+  spec.pattern = FileList['spec/**/*_spec.rb']
+end
+
+RSpec::Core::RakeTask.new(:rcov) do |spec|
+  spec.pattern = 'spec/**/*_spec.rb'
+  spec.rcov = true
+end
+
+task :default => :spec
+
+require 'rake/rdoctask'
+Rake::RDocTask.new do |rdoc|
+  version = File.exist?('VERSION') ? File.read('VERSION') : ""
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "string_parse_erb #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/VERSION

@@ -0,0 +1 @@
+0.1.0

data/lib/str_parse_erb/str_parse_erb.rb

@@ -0,0 +1,16 @@
+module StrParseErb
+
+   VERSION = "0.1.0"
+
+   def string_parse_erb(template, var_hash, safe_level=4)
+     data = VarHash.new(var_hash)
+     ERB.new(template, safe_level).result(data.get_binding.taint)
+   end
+
+   class VarHash < OpenStruct
+     def get_binding
+       binding
+     end
+   end
+
+end

data/lib/string_parse_erb.rb

@@ -0,0 +1,7 @@
+require 'erb'
+require 'ostruct'
+
+path = File.expand_path(File.dirname(__FILE__))
+$:.unshift path unless $:.include?(path)
+
+require 'str_parse_erb/str_parse_erb.rb'

data/spec/spec_helper.rb

@@ -0,0 +1,13 @@
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'rspec'
+require 'string_parse_erb'
+include StrParseErb
+
+# Requires supporting files with custom matchers and macros, etc,
+# in ./support/ and its subdirectories.
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
+
+RSpec.configure do |config|
+
+end

data/spec/string_parse_erb_spec.rb

@@ -0,0 +1,55 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe "StringParseErb" do
+  it "does not change a string with no erb fragments" do
+    str = "Hello World!"
+    string_parse_erb(str, {}).should == "Hello World!"
+  end
+
+  it "deletes from string, erb fragments which have no match in the variables hash" do
+    str = "Who are <%= person %>"
+    string_parse_erb(str, {:man => "you"}).should == "Who are "
+  end
+
+  it "replaces erb fragments with values from vars_hash" do
+    str = "Good <%= part_of_day %>, the time is <%= time %>."
+    vars_hash = {:part_of_day => "morning", :time => "six o'clock"}
+    string_parse_erb(str, vars_hash).should == "Good morning, the time is six o'clock."
+  end
+
+  it "replaces erb fragments with values from vars_hash, when string is tainted" do
+    str = "Good <%= part_of_day %>, the time is <%= time %>."
+    vars_hash = {:part_of_day => "morning", :time => "six o'clock"}
+    string_parse_erb(str.taint, vars_hash).should == "Good morning, the time is six o'clock."
+  end
+
+  it "blocks insecure operations by default" do
+    str = "<%= eval(\"system('ls')\") %>"
+    lambda { string_parse_erb(str, {}) }.should raise_error(SecurityError)
+  end
+
+  it "blocks another insecure operations by default" do
+    lambda { string_parse_erb("<%= abort %>", {}) }.should raise_error(SecurityError)
+  end
+
+  it "blocks insecure operations by default, when string is tainted" do
+    str = "<%= eval(\"system('ls')\") %>"
+    lambda { string_parse_erb(str.taint, {}) }.should raise_error(SecurityError)
+  end
+
+  it "allows changing SAFE level" do
+    str = " 1 + 1 = <%= eval(\"1 + 1 \") %>"
+    string_parse_erb(str, {}, 0).should == " 1 + 1 = 2"
+  end
+
+  it "does not bind external variables" do
+    str = "Good <%= part_of_day %>"
+    @part_of_day = part_of_day = @@part_of_day = "morning"
+    string_parse_erb(str, {}).should == "Good "
+  end
+
+  it "processes complex fragments" do
+    str = "Hello<% if planet %> planet <% else %> earth <% end %>"
+    string_parse_erb(str, {:planet => false}).should == "Hello earth "
+  end
+end

data/string_parse_erb.gemspec

@@ -0,0 +1,63 @@
+# Generated by jeweler
+# DO NOT EDIT THIS FILE DIRECTLY
+# Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = %q{string_parse_erb}
+  s.version = "0.1.0"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Nadav Blum"]
+  s.date = %q{2011-09-02}
+  s.description = %q{Process ERB fragments in a String, according to variables hash, no extenal vars are visible to ERB, safe level and untainting of string can be set}
+  s.email = %q{nadav.blum@gmail.com}
+  s.extra_rdoc_files = [
+    "LICENSE.txt",
+    "README.rdoc"
+  ]
+  s.files = [
+    ".document",
+    ".rspec",
+    ".rvmrc",
+    "Gemfile",
+    "Gemfile.lock",
+    "LICENSE.txt",
+    "README.rdoc",
+    "Rakefile",
+    "VERSION",
+    "lib/str_parse_erb/str_parse_erb.rb",
+    "lib/string_parse_erb.rb",
+    "spec/spec_helper.rb",
+    "spec/string_parse_erb_spec.rb",
+    "string_parse_erb.gemspec"
+  ]
+  s.homepage = %q{http://github.com/bnadav/string_parse_erb}
+  s.licenses = ["MIT"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = %q{1.3.7}
+  s.summary = %q{Process ERB fragments in a String, according to variables hash}
+
+  if s.respond_to? :specification_version then
+    current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_development_dependency(%q<rspec>, ["~> 2.3.0"])
+      s.add_development_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_development_dependency(%q<jeweler>, ["~> 1.6.4"])
+      s.add_development_dependency(%q<rcov>, [">= 0"])
+    else
+      s.add_dependency(%q<rspec>, ["~> 2.3.0"])
+      s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_dependency(%q<jeweler>, ["~> 1.6.4"])
+      s.add_dependency(%q<rcov>, [">= 0"])
+    end
+  else
+    s.add_dependency(%q<rspec>, ["~> 2.3.0"])
+    s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+    s.add_dependency(%q<jeweler>, ["~> 1.6.4"])
+    s.add_dependency(%q<rcov>, [">= 0"])
+  end
+end
+

metadata

@@ -0,0 +1,142 @@
+--- !ruby/object:Gem::Specification 
+name: string_parse_erb
+version: !ruby/object:Gem::Version 
+  hash: 27
+  prerelease: false
+  segments: 
+  - 0
+  - 1
+  - 0
+  version: 0.1.0
+platform: ruby
+authors: 
+- Nadav Blum
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2011-09-02 00:00:00 +03:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: rspec
+  version_requirements: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 2
+        - 3
+        - 0
+        version: 2.3.0
+  requirement: *id001
+  type: :development
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: bundler
+  version_requirements: &id002 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 23
+        segments: 
+        - 1
+        - 0
+        - 0
+        version: 1.0.0
+  requirement: *id002
+  type: :development
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: jeweler
+  version_requirements: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 7
+        segments: 
+        - 1
+        - 6
+        - 4
+        version: 1.6.4
+  requirement: *id003
+  type: :development
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: rcov
+  version_requirements: &id004 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  requirement: *id004
+  type: :development
+description: Process ERB fragments in a String, according to variables hash, no extenal vars are visible to ERB, safe level and untainting of string can be set
+email: nadav.blum@gmail.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE.txt
+- README.rdoc
+files: 
+- .document
+- .rspec
+- .rvmrc
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.rdoc
+- Rakefile
+- VERSION
+- lib/str_parse_erb/str_parse_erb.rb
+- lib/string_parse_erb.rb
+- spec/spec_helper.rb
+- spec/string_parse_erb_spec.rb
+- string_parse_erb.gemspec
+has_rdoc: true
+homepage: http://github.com/bnadav/string_parse_erb
+licenses: 
+- MIT
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.7
+signing_key: 
+specification_version: 3
+summary: Process ERB fragments in a String, according to variables hash
+test_files: []
+