text_helpers 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f610ed6fbdfcc77dc691a49ec829c6476a061f08
-  data.tar.gz: 244695c5fe67c660b3c140d75a68c4deb5f3e529
+  metadata.gz: e0042dc19e9deddd4e91c467ee37e19dd35f0b2f
+  data.tar.gz: 1e39637937fe563fe9b6e81ce05a08fd7f4626f8
 SHA512:
-  metadata.gz: 1bad27e3bf042294009be3a0924c761e9ddac5ff51024a32032cf4d2b9f5a7dc586a17b77258e45b9211690ee55245fe74e5c45b870ed6af5df8f8c2944884e6
-  data.tar.gz: 4450a67219284ab29a6d8f6cded17ce561764ae274f1804c45304d4e77795b0d623658821d9bc29dd1602c0a2d64b88a072e02294d9d68f21f356f6091fa7e11
+  metadata.gz: 8f1e1554ca7e1f236cc374ea9858c4105fa8cbeba0553a81b3284733a04865c5ca5b65d477d1224d7c9936d1851e5a1e6ab04ad5800e1ec24ea80d994fc3453d
+  data.tar.gz: 32a613528353df4ee8379fd2bd62b74573e3e1a014d1f3a8dfbcb8a9f34f8bb3871ea041254448c51f1d2799421b6748b121c1414d872712cfcc49b3bb08d636

data/README.md

@@ -1,6 +1,6 @@
 # TextHelpers
 
-`TextHelpers` is a library intended to make working with static text in Rails 
+`TextHelpers` is a library intended to make working with static text in Rails
 projects as painless as possible.
 
 Include it in your `Gemfile` with:
@@ -11,9 +11,9 @@ gem "text_helpers"
 
 ## Suggested Use
 
-All static text should be placed in locale files, in a directory 
-structure mirroring the app directory structure. The text for 
-`app/views/some/_partial.html.haml` would go in 
+All static text should be placed in locale files, in a directory
+structure mirroring the app directory structure. The text for
+`app/views/some/_partial.html.haml` would go in
 `config/locales/views/some/partial.en.yml`, for example. This is not a strict
 requirement, but will go a long way toward keeping your locales easily
 maintainable.
@@ -35,10 +35,10 @@ used for variable text.
 ### In Views
 
 To access this text in views, two helpers are available, `text` and `html`.
-Both helpers take a lookup key, used to identify the desired piece of text, 
+Both helpers take a lookup key, used to identify the desired piece of text,
 and an argument hash, which is forwarded to the `I18n.t` call.
 
-`text` returns the requested text, with special values interpolated, and made 
+`text` returns the requested text, with special values interpolated, and made
 html_safe (so HTML can be used here, when absolutely necessary).
 
 `html` parses the requested text using Markdown, making it useful for rendering
@@ -53,6 +53,19 @@ HTML entities for common cases.
 If you want to render a small fragment of Markdown without `p` tag wrappers,
 you can pass `inline: true` as an option to `html`.
 
+`text` and `html` will escape all arguments passed to it in order to prevent XSS
+attacks. If you want to pass html content, you should ensure you mark it as .html_safe
+
+Example: `text('welcome_user', username)` will escape html characters in username
+```ruby
+Welcome <b>Bob</b>
+```
+
+Example: `text('welcome_user', username.html_safe)` will output html characters in username
+```ruby
+Welcome <b>Bob</b>
+```
+
 ### In Controllers
 
 The same helpers are available in controllers, with the translation scope based
@@ -61,7 +74,7 @@ used for flash messages or alerts of some kind.
 
 ## Testing
 
-Some shared `RSpec` contexts are available to allow the same locale 
+Some shared `RSpec` contexts are available to allow the same locale
 abstractions for testing. You can include these contexts with:
 
 ```

data/lib/text_helpers/translation.rb

@@ -23,7 +23,7 @@ module TextHelpers
       text = I18n.t(key, {
         scope: self.translation_scope,
         default: "!#{key}!"
-      }.merge(options)).strip
+      }.merge(html_safe_options(options))).strip
 
       # Interpolate any keypaths (e.g., `!some.lookup.path/key!`) found in the text.
       while text =~ /!([\w._\/]+)!/ do
@@ -82,5 +82,17 @@ module TextHelpers
     def translation_scope
       raise NotImplementedError
     end
+
+    # Protected: Convert all passed in arguments into html-safe strings
+    #
+    # hash - a set of key-value pairs, which converts the second argument into an html-safe string
+    #
+    # Returns a hash
+    def html_safe_options(hash)
+      hash.inject({}) do |result, (key, value)|
+        result[key] = ERB::Util.h(value)
+        result
+      end
+    end
   end
 end

data/lib/text_helpers/version.rb

@@ -1,3 +1,3 @@
 module TextHelpers
-  VERSION = "0.3.2"
+  VERSION = "0.4.0"
 end

data/test/lib/text_helpers/translation_test.rb

@@ -26,7 +26,9 @@ describe TextHelpers::Translation do
           list_key:         "* #{@scoped_text}",
           interpolated_key: "Global? (!test_key!)",
           recursive_key:    "Recursively !test.interpolated_key!",
-          quoted_key:       "They're looking for \"#{@global_text}\"--#{@scoped_text}"
+          quoted_key:       "They're looking for \"#{@global_text}\"--#{@scoped_text}",
+          argument_key:     "This is what %{user} said",
+          number_key:       "120\""
         }
       }
     end
@@ -101,6 +103,26 @@ describe TextHelpers::Translation do
       it "automatically converts quotes and dashes to clean HTML replacements" do
         assert_equal "<p>They&rsquo;re looking for &ldquo;#{@global_text}&rdquo;&ndash;#{@nb_scoped_text}</p>\n", @helper.html(:quoted_key)
       end
+
+      it "converts to straight quotes in the general case" do
+        assert_equal "120&quot;", @helper.text(:number_key) # 120"
+      end
+
+      it "handles i18n arguments" do
+        assert_equal "This is what Han Solo said", @helper.text(:argument_key, user: "Han Solo")
+      end
+
+      it "handles i18n arguments which are not strings" do
+        assert_equal "This is what 1234 said", @helper.text(:argument_key, user: 1234)
+      end
+
+      it "handles i18n arguments which are not html-safe" do
+        assert_equal "This is what &lt;b&gt;Han&lt;/b&gt; Solo said", @helper.text(:argument_key, user: "<b>Han</b> Solo")
+      end
+
+      it "handles i18n arguments which are html-safe" do
+        assert_equal "This is what <b>Han</b> Solo said", @helper.text(:argument_key, user: "<b>Han</b> Solo".html_safe)
+      end
     end
 
     describe "when no valid scope is provided" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: text_helpers
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Andrew Horner
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-21 00:00:00.000000000 Z
+date: 2014-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport