subdomainbox 0.2.0

data/.document

@@ -0,0 +1,5 @@
+lib/**/*.rb
+bin/*
+- 
+features/**/*.feature
+LICENSE.txt

data/.rspec

@@ -0,0 +1 @@
+--color

data/.rvmrc

@@ -0,0 +1 @@
+rvm use 1.9.3@subdomainbox

data/Gemfile

@@ -0,0 +1,14 @@
+source 'http://rubygems.org'
+
+gem 'uuidtools'
+
+group :development do
+  gem 'rspec', '2.10.0'
+  gem 'jeweler', '~> 1.8.4'
+end
+
+group :development, :test do
+  gem 'pry'
+  gem 'pry-nav'
+  gem 'pry-stack_explorer'
+end

data/Gemfile.lock

@@ -0,0 +1,49 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    binding_of_caller (0.7.1)
+      debug_inspector (>= 0.0.1)
+    coderay (1.0.9)
+    debug_inspector (0.0.2)
+    diff-lcs (1.1.3)
+    git (1.2.5)
+    jeweler (1.8.4)
+      bundler (~> 1.0)
+      git (>= 1.2.5)
+      rake
+      rdoc
+    json (1.7.7)
+    method_source (0.8.1)
+    pry (0.9.12)
+      coderay (~> 1.0.5)
+      method_source (~> 0.8)
+      slop (~> 3.4)
+    pry-nav (0.2.3)
+      pry (~> 0.9.10)
+    pry-stack_explorer (0.4.9)
+      binding_of_caller (>= 0.7)
+      pry (~> 0.9.11)
+    rake (10.0.3)
+    rdoc (4.0.0)
+      json (~> 1.4)
+    rspec (2.10.0)
+      rspec-core (~> 2.10.0)
+      rspec-expectations (~> 2.10.0)
+      rspec-mocks (~> 2.10.0)
+    rspec-core (2.10.1)
+    rspec-expectations (2.10.0)
+      diff-lcs (~> 1.1.3)
+    rspec-mocks (2.10.1)
+    slop (3.4.3)
+    uuidtools (2.1.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  jeweler (~> 1.8.4)
+  pry
+  pry-nav
+  pry-stack_explorer
+  rspec (= 2.10.0)
+  uuidtools

data/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2013 Daniel Nelson
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,62 @@
+subdomainbox
+============
+
+Subdomain boxing was inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html). Subdomain boxing limits the reach of any XSS attacks. If an attacker manages to insert javascript onto a page of your application, the javascript on that page will be unable to read data from or post data to any pages on different subdomains in your application. Post protection is achieved by creating a separate CSRF token for each subdomain. CSRF protection is also strengthened by changing the CSRF token based on session id.
+
+The subdomainbox gem is simple to add even to existing Rails applications:
+
+    class PostsController < ApplicationController
+
+      subdomainbox 'posts', :only => :index
+      subdomainbox ['posts-%{id}', 'comments-%{pop_id}'], :except => :index
+
+      ...
+
+    end
+
+
+    class Admin::PostsController < ApplicationController
+
+      subdomainbox 'admin', :only => :index
+      subdomainbox 'admin-%{post_id}', :except => :index
+
+      ...
+
+    end
+
+
+Testing
+=======
+
+In controller specs:
+
+    controller.stub(:subdomainbox)
+
+
+To make request/feature/integration specs work:
+
+    brew install dnsmasq
+    mkdir -pv $(brew --prefix)/etc/
+    echo 'address=/.dev/127.0.0.1' > $(brew --prefix)/etc/dnsmasq.conf
+    sudo cp -v $(brew --prefix dnsmasq)/homebrew.mxcl.dnsmasq.plist /Library/LaunchDaemons
+    sudo launchctl load -w /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist
+    sudo mkdir -v /etc/resolver
+    sudo bash -c 'echo "nameserver 127.0.0.1" > /etc/resolver/dev'
+
+-- source [http://www.echoditto.com/blog/never-touch-your-local-etchosts-file-os-x-again](http://www.echoditto.com/blog/never-touch-your-local-etchosts-file-os-x-again)
+
+Contributing to subdomainbox
+============================
+
+* Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet.
+* Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it.
+* Fork the project.
+* Start a feature/bugfix branch.
+* Commit and push until you are happy with your contribution.
+* Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
+* Please try not to mess with the Rakefile, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.
+
+Credits
+=======
+
+Inspired by Egor Homakov's [post on pageboxing](http://homakov.blogspot.com/2013/02/pagebox-website-gatekeeper.html).

data/Rakefile

@@ -0,0 +1,49 @@
+# encoding: utf-8
+
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'rake'
+
+require 'jeweler'
+Jeweler::Tasks.new do |gem|
+  # gem is a Gem::Specification... see http://docs.rubygems.org/read/chapter/20 for more options
+  gem.name = "subdomainbox"
+  gem.homepage = "http://github.com/populr/subdomainbox"
+  gem.license = "MIT"
+  gem.summary = %Q{prevent XSS incursions from accessing entire application}
+  gem.description = %Q{use subdomains to prevent XSS from accessing your entire application if it should happen to be injected into some page in your app}
+  gem.email = "dnelson@centresource.com"
+  gem.authors = ["Daniel Nelson"]
+  # dependencies defined in Gemfile
+end
+Jeweler::RubygemsDotOrgTasks.new
+
+require 'rspec/core'
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new(:spec) do |spec|
+  spec.pattern = FileList['spec/**/*_spec.rb']
+end
+
+RSpec::Core::RakeTask.new(:rcov) do |spec|
+  spec.pattern = 'spec/**/*_spec.rb'
+  spec.rcov = true
+end
+
+task :default => :spec
+
+require 'rdoc/task'
+Rake::RDocTask.new do |rdoc|
+  version = File.exist?('VERSION') ? File.read('VERSION') : ""
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "subdomainbox #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/VERSION

@@ -0,0 +1 @@
+0.2.0

data/lib/generators/subdomainbox_generator.rb

@@ -0,0 +1,7 @@
+class SubdomainboxGenerator < Rails::Generators::Base
+
+  def create_initializer_file
+    create_file "config/initializers/xsrf_token_secret.rb", "XSRF_TOKEN_SECRET = '#{SecureRandom.base64(48)}'"
+  end
+
+end

data/lib/secure_xsrf_token.rb

@@ -0,0 +1,21 @@
+require 'digest/sha1'
+
+module ActionController #:nodoc:
+
+  module RequestForgeryProtection
+
+    protected
+
+      alias_method :original_form_authenticity_token, :form_authenticity_token
+      # Sets the token value for the current session.
+      def form_authenticity_token
+        raise 'XSRF token secret must be defined' if XSRF_TOKEN_SECRET.nil? || XSRF_TOKEN_SECRET.empty?
+        if request.session_options[:id]
+          Digest::SHA1.hexdigest("#{XSRF_TOKEN_SECRET}#{request.session_options[:id]}#{request.subdomain}")
+        else
+          original_form_authenticity_token
+        end
+      end
+
+  end
+end

data/lib/subdomainbox.rb

@@ -0,0 +1,81 @@
+module ActionController
+  class Base
+
+    class SubdomainboxDomainViolation < StandardError
+    end
+
+    def self.subdomainbox(allowed, options={})
+      before_filter(lambda { subdomainbox(:allowed => allowed) }, options)
+    end
+
+    def subdomainbox(options)
+      allowed = subdomainbox_process_definitions(options)
+      subdomain_match = subdomainbox_find_subdomain_match(allowed)
+      subdomainbox_no_subdomain_match!(allowed) if subdomain_match.empty?
+    end
+
+    private
+
+    def subdomainbox_no_subdomain_match!(allowed)
+      if request.format == 'text/html'
+        if request.get?
+          flash[:alert] = flash.now[:alert]
+          flash[:notice] = flash.now[:notice]
+          flash[:info] = flash.now[:info]
+
+          default_definition = allowed.first
+          if default_definition.first == ''
+            redirect_to(request.protocol + request.domain + request.port_string + request.fullpath)
+          else
+            allowed_id_name = default_definition.pop
+            allowed_id_name = allowed_id_name if allowed_id_name
+            default_definition << params[allowed_id_name]
+            default_definition.compact!
+            default_definition.pop if default_definition.length == 2
+
+            redirect_to(request.protocol + default_definition.join + '.' + request.domain + request.port_string + request.fullpath)
+          end
+        else
+          raise SubdomainboxDomainViolation.new
+        end
+      else
+        raise SubdomainboxDomainViolation.new
+      end
+    end
+
+    def subdomainbox_find_subdomain_match(allowed)
+      allowed.each do |allowed_subdomain, separator, allowed_id_name|
+        if allowed_subdomain == ''
+          next unless request.subdomain.nil? || request.subdomain.empty?
+        else
+          next unless request.subdomain =~ /\A#{allowed_subdomain}\.?/
+        end
+        if allowed_id_name
+          if id = request.subdomain.sub(/\A#{allowed_subdomain}\.?/, '')
+            if params.keys.include?(allowed_id_name)
+              return [] unless id == params[allowed_id_name]
+            else
+              params[allowed_id_name] = id
+            end
+          end
+        end
+        return [allowed_subdomain, separator, id]
+      end
+      []
+    end
+
+    def subdomainbox_process_definitions(options)
+      allowed = []
+      raw_definitions = options[:allowed]
+      raw_definitions = [raw_definitions] unless raw_definitions.is_a?(Array)
+      raw_definitions.each do |definition|
+        discard, allowed_subdomain, separator, allowed_id_name = definition.match(/([^%]*?)(\.?)\%\{([^}]*)\}/).to_a
+        allowed_subdomain = definition if allowed_subdomain.nil?
+        allowed_id_name = allowed_id_name if allowed_id_name
+        allowed << [allowed_subdomain, separator, allowed_id_name]
+      end
+      allowed
+    end
+
+  end
+end

data/spec/secure_xsrf_token_spec.rb

@@ -0,0 +1,44 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe "ActionController::RequestForgeryProtection" do
+  include ActionController::RequestForgeryProtection
+  let(:request) { double('request') }
+  let(:session) { {} }
+
+  before(:each) do
+    request.stub(:subdomain).and_return('pets')
+    request.stub_chain(:session_options, :[]).and_return('abc')
+  end
+
+  describe "#form_authenticity_token" do
+
+    context "when XSRF_TOKEN_SECRET is blank" do
+      it "should raise an exception" do
+        XSRF_TOKEN_SECRET = ''
+        lambda {
+          form_authenticity_token
+        }.should raise_error
+      end
+    end
+
+    context "when the user has a session" do
+
+      it "should be generated from the XSRF_TOKEN_SECRET salted with the session id and the subdomain" do
+        request.stub_chain(:session_options, :[]).and_return('abc')
+        XSRF_TOKEN_SECRET = 'xyz'
+        form_authenticity_token.should == Digest::SHA1.hexdigest('xyzabcpets')
+      end
+
+    end
+
+    context "when there is no session id" do
+      it "should call the original form_authenticity_token" do
+        request.stub_chain(:session_options, :[]).and_return(nil)
+        self.should_receive(:original_form_authenticity_token)
+        form_authenticity_token
+      end
+    end
+
+  end
+
+end

data/spec/spec_helper.rb

@@ -0,0 +1,30 @@
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+
+
+
+module ActionController
+  module RequestForgeryProtection
+    def form_authenticity_token
+      raise 'wrong form_authenticity_token method'
+    end
+  end
+end
+
+
+require 'rspec'
+require 'subdomainbox'
+require 'secure_xsrf_token'
+require 'bundler'
+Bundler.require
+require 'pry'
+require 'pry-nav'
+require 'pry-stack_explorer'
+
+# Requires supporting files with custom matchers and macros, etc,
+# in ./support/ and its subdirectories.
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
+
+RSpec.configure do |config|
+
+end

data/spec/subdomainbox_spec.rb

@@ -0,0 +1,326 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe ActionController::Base do
+
+  # default behavior:
+  # subdomainbox 'mysubdomain%{pop_id}', :except => []
+  # subdomainbox 'mysubdomain', :only => []
+  describe "#subdomainbox" do
+    let(:request) { double('request') }
+    let(:controller) { ActionController::Base.new }
+    let(:flash) { double('flash') }
+    let(:flash_now) { double('flash_now') }
+
+    before(:each) do
+      request.stub(:domain).and_return('peanuts.com')
+      controller.stub(:request).and_return(request)
+      controller.stub(:params).and_return({})
+
+      flash.stub(:now).and_return(flash_now)
+      flash.stub(:[]=)
+      flash_now.stub(:[])
+      controller.stub(:flash).and_return(flash)
+    end
+
+    context "when the specified subdomain includes an id" do
+      before(:each) do
+        request.stub(:format).and_return('text/html')
+        request.stub(:subdomain).and_return('pets.abc')
+      end
+
+      context "when the params include a matching id" do
+        it "should not raise an exception" do
+          params = { 'pet_id' => 'abc' }
+          controller.stub(:params).and_return(params)
+          lambda {
+            controller.subdomainbox :allowed => 'pets.%{pet_id}'
+          }.should_not raise_error
+        end
+      end
+
+
+      context "when the params don't include an id of the specified name" do
+        it "should not raise an exception" do
+          params = { 'id' => 'efg' }
+          controller.stub(:params).and_return(params)
+          lambda {
+            controller.subdomainbox :allowed => 'pets.%{pet_id}'
+          }.should_not raise_error
+        end
+
+        it "should set a param of the specified name on params" do
+          params = {}
+          controller.stub(:params).and_return(params)
+          controller.subdomainbox :allowed => 'pets.%{pet_id}'
+          params['pet_id'].should == 'abc'
+        end
+      end
+
+    end
+
+    context "when the requested format is html" do
+      before(:each) do
+        request.stub(:format).and_return('text/html')
+        request.stub(:subdomain).and_return('pets')
+      end
+
+      context "when the params include an id that doesn't match the id in the subdomain" do
+        it "should redirect to the subdomain + id domain" do
+          request.stub(:subdomain).and_return('www')
+          request.stub(:protocol).and_return('https://')
+          request.stub(:port_string).and_return(':8080')
+          request.stub(:fullpath).and_return('/pets?e=123')
+          request.stub(:get?).and_return(true)
+
+
+          params = { 'pet_id' => 'efg' }
+          controller.stub(:params).and_return(params)
+
+          controller.should_receive(:redirect_to).with('https://pets.efg.peanuts.com:8080/pets?e=123')
+          request.stub(:subdomain).and_return('pets')
+          controller.subdomainbox :allowed => 'pets.%{pet_id}'
+
+          controller.should_receive(:redirect_to).with('https://pets.efg.peanuts.com:8080/pets?e=123')
+          request.stub(:subdomain).and_return('pets.abc')
+          controller.subdomainbox :allowed => 'pets.%{pet_id}'
+        end
+      end
+
+      context "when the origin subdomain is the specified subdomain" do
+        it "should not raise an exception or redirect" do
+          controller.should_not_receive(:redirect_to)
+          lambda {
+            controller.subdomainbox :allowed => 'pets'
+          }.should_not raise_error
+        end
+
+        context "when the origin subdomain includes an id" do
+          it "should not raise an exception or redirect" do
+            request.stub(:subdomain).and_return('pets.abc')
+            params = { 'pet_id' => 'abc' }
+            controller.stub(:params).and_return(params)
+            controller.should_not_receive(:redirect_to)
+            lambda {
+              controller.subdomainbox :allowed => 'pets.%{pet_id}'
+            }.should_not raise_error
+          end
+        end
+      end
+
+      context "when the origin subdomain is included in the list" do
+        it "should not raise an exception or redirect" do
+          controller.should_not_receive(:redirect_to)
+          lambda {
+            controller.subdomainbox :allowed => ['activities', 'pets']
+          }.should_not raise_error
+        end
+
+        context "when the origin subdomain includes an id" do
+          it "should not raise an exception or redirect" do
+            request.stub(:subdomain).and_return('petsabc')
+            params = { 'pet_id' => 'abc' }
+            controller.stub(:params).and_return(params)
+            controller.should_not_receive(:redirect_to)
+            lambda {
+              controller.subdomainbox :allowed => ['activities%{pet_id}', 'pets%{pet_id}']
+            }.should_not raise_error
+          end
+        end
+      end
+
+      context "when the origin subdomain is not the specified subdomain" do
+        before(:each) do
+          request.stub(:subdomain).and_return('www')
+          request.stub(:protocol).and_return('https://')
+          request.stub(:port_string).and_return(':8080')
+          request.stub(:fullpath).and_return('/pets?e=123')
+        end
+
+        context "when this is a GET request" do
+          before(:each) do
+            request.stub(:get?).and_return(true)
+            controller.stub(:redirect_to)
+          end
+
+          it "should 'forward' all flash notices so that they are not lost in the redirect" do
+
+            flash_now.should_receive(:[]).with(:alert).and_return('The alert flash')
+            flash_now.should_receive(:[]).with(:notice).and_return('The notice flash')
+            flash_now.should_receive(:[]).with(:info).and_return('The info flash')
+
+            flash.should_receive(:[]=).with(:alert, 'The alert flash')
+            flash.should_receive(:[]=).with(:notice, 'The notice flash')
+            flash.should_receive(:[]=).with(:info, 'The info flash')
+
+            controller.subdomainbox :allowed => 'pets'
+          end
+
+          it "should redirect to the same path (including http variables) at the specified subdomain prefixing the root of the origin domain" do
+            controller.should_receive(:redirect_to).with('https://pets.peanuts.com:8080/pets?e=123')
+            controller.subdomainbox :allowed => 'pets'
+          end
+
+          context "when the specified subdomain is an empty string" do
+            it "should redirect to the root domain" do
+              controller.should_receive(:redirect_to).with('https://peanuts.com:8080/pets?e=123')
+              controller.subdomainbox :allowed => ''
+            end
+          end
+
+          context "when the specified subdomain includes an id" do
+            it "the redirection subdomain should include the id" do
+              controller.should_receive(:redirect_to).with('https://pets.abc.peanuts.com:8080/pets?e=123')
+              params = { 'pet_id' => 'abc' }
+              controller.stub(:params).and_return(params)
+              controller.subdomainbox :allowed => 'pets.%{pet_id}'
+            end
+
+            context "when no id param matching the specified id name exists" do
+              it "the redirection subdomain should not include the id" do
+                controller.should_receive(:redirect_to).with('https://pets.peanuts.com:8080/pets?e=123')
+                params = { 'id' => 'abc' }
+                controller.stub(:params).and_return(params)
+                controller.subdomainbox :allowed => 'pets.%{pet_id}'
+              end
+            end
+          end
+
+          context "when no id is specified in the subdomainbox" do
+            it "the redirection subdomain should not include the id" do
+              controller.should_receive(:redirect_to).with('https://pets.peanuts.com:8080/pets?e=123')
+              params = { 'pet_id' => 'abc' }
+              controller.stub(:params).and_return(params)
+              controller.subdomainbox :allowed => 'pets'
+            end
+          end
+        end
+
+        context "when this is not a GET request" do
+          it "should raise SubdomainboxDomainViolation" do
+            request.stub(:get?).and_return(false)
+            lambda {
+              controller.subdomainbox :allowed => 'pets'
+            }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+          end
+        end
+      end
+
+      context "when the origin subdomain is not in the list of approved subdomains" do
+        before(:each) do
+          request.stub(:subdomain).and_return('www')
+          request.stub(:protocol).and_return('https://')
+          request.stub(:port_string).and_return(':8080')
+          request.stub(:fullpath).and_return('/pets?e=123')
+        end
+
+
+
+        context "when this is a GET request" do
+          it "should redirect to the same path (http variables) at the first subdomain in the list prefixing the root of the origin domain" do
+            request.stub(:get?).and_return(true)
+            controller.should_receive(:redirect_to).with('https://activities.peanuts.com:8080/pets?e=123')
+            controller.subdomainbox :allowed => ['activities', 'pets']
+          end
+        end
+
+        context "when this is not a GET request" do
+          it "should raise SubdomainboxDomainViolation" do
+            request.stub(:get?).and_return(false)
+            lambda {
+              controller.subdomainbox :allowed => ['activities', 'pets']
+            }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+          end
+        end
+      end
+
+
+    end
+
+
+    context "when the requested format is not html" do
+      before(:each) do
+        request.stub(:format).and_return('application/json')
+      end
+
+
+      context "when the origin subdomain is the specified subdomain" do
+        it "should not raise an exception" do
+          request.stub(:subdomain).and_return('pets')
+          lambda {
+            controller.subdomainbox :allowed => 'pets'
+          }.should_not raise_error
+        end
+
+        context "when the origin subdomain includes an id" do
+          it "should not raise an exception" do
+            request.stub(:subdomain).and_return('pets.abc')
+            lambda {
+              controller.subdomainbox :allowed => 'pets'
+            }.should_not raise_error
+          end
+        end
+      end
+
+
+      context "when the origin subdomain is in the specified subdomain list" do
+        it "should not raise an exception" do
+          request.stub(:subdomain).and_return('pets')
+          lambda {
+            controller.subdomainbox :allowed => ['activities', 'pets']
+          }.should_not raise_error
+        end
+
+        context "when the origin subdomain includes an id" do
+          it "should not raise an exception" do
+            request.stub(:subdomain).and_return('pets.abc')
+            lambda {
+              controller.subdomainbox :allowed => ['activities', 'pets']
+            }.should_not raise_error
+          end
+        end
+      end
+
+
+      context "when the origin subdomain is not the specified subdomain" do
+        it "should raise SubdomainboxDomainViolation" do
+          # recommend using around filter to rescue these exceptions and respond accordingly from that one place
+          request.stub(:subdomain).and_return('houses')
+          lambda {
+            controller.subdomainbox :allowed => 'pets'
+          }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+        end
+
+        context "when the origin subdomain includes an id" do
+          it "should not raise an exception" do
+            request.stub(:subdomain).and_return('houses.abc')
+            lambda {
+              controller.subdomainbox :allowed => 'pets'
+            }.should raise_error
+          end
+        end
+      end
+
+      context "when the origin subdomain is not in the specified subdomain list" do
+        it "should raise SubdomainboxDomainViolation" do
+          request.stub(:subdomain).and_return('houses')
+          lambda {
+            controller.subdomainbox :allowed => ['activities', 'pets']
+          }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+        end
+
+        context "when the origin subdomain includes an id" do
+          it "should raise an exception" do
+            request.stub(:subdomain).and_return('houses.abc')
+            lambda {
+              controller.subdomainbox :allowed => ['activities', 'pets']
+            }.should raise_error(ActionController::Base::SubdomainboxDomainViolation)
+          end
+        end
+      end
+
+    end
+
+  end
+
+
+end

metadata

@@ -0,0 +1,132 @@
+--- !ruby/object:Gem::Specification
+name: subdomainbox
+version: !ruby/object:Gem::Version
+  version: 0.2.0
+  prerelease: 
+platform: ruby
+authors:
+- Daniel Nelson
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2013-03-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: uuidtools
+  requirement: &2152124540 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: *2152124540
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: &2152122180 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - =
+      - !ruby/object:Gem::Version
+        version: 2.10.0
+  type: :development
+  prerelease: false
+  version_requirements: *2152122180
+- !ruby/object:Gem::Dependency
+  name: jeweler
+  requirement: &2152121100 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.8.4
+  type: :development
+  prerelease: false
+  version_requirements: *2152121100
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: &2152119700 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: *2152119700
+- !ruby/object:Gem::Dependency
+  name: pry-nav
+  requirement: &2152133520 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: *2152133520
+- !ruby/object:Gem::Dependency
+  name: pry-stack_explorer
+  requirement: &2152131660 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: *2152131660
+description: use subdomains to prevent XSS from accessing your entire application
+  if it should happen to be injected into some page in your app
+email: dnelson@centresource.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- LICENSE.txt
+- README.md
+files:
+- .document
+- .rspec
+- .rvmrc
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.md
+- Rakefile
+- VERSION
+- lib/generators/subdomainbox_generator.rb
+- lib/secure_xsrf_token.rb
+- lib/subdomainbox.rb
+- spec/secure_xsrf_token_spec.rb
+- spec/spec_helper.rb
+- spec/subdomainbox_spec.rb
+homepage: http://github.com/populr/subdomainbox
+licenses:
+- MIT
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+      segments:
+      - 0
+      hash: 1510684682428060724
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.10
+signing_key: 
+specification_version: 3
+summary: prevent XSS incursions from accessing entire application
+test_files: []