tiny_template 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e5ede3dedd284a99cf689b33fd15498ba93343b3
-  data.tar.gz: 0193eb19023980520cad7bd2e0c817ee5217c3d6
+  metadata.gz: 02066fa4c22f30cfd0587243bfb37df1a265571e
+  data.tar.gz: 1fea1f8d41621846a5b7be46899fd75aac65a917
 SHA512:
-  metadata.gz: 9909cd0fd8bb5ca4c44ae0db9d39405d467eeb18fa1f3c94c48c8bb7d5678b1488a947df4ffd925ed52bb79b6d0bfe70bd08d4e0f45f966ecb2b9c943a256fd3
-  data.tar.gz: d2d80338256cc5a0b041b5d4c69210c4fb040739c5bc7c6c02c8168aa1bf61a210d2b6b5f27b84027b2395980e1ea8cb9e37fa44593467586f489548ee499607
+  metadata.gz: bcd96966ba3c89772805d322df18d4ccc925140106830981ac6634d73152f2b79ec7148fabe6e8c5790ca8a8746968eab438d75f07512c4b77986ea8a849c075
+  data.tar.gz: 474f0d7f682c7413d794ae67120820419f465c7808c976c9dcfee27556d891266e3d6eebc07122faeff9b4ed8af689db73d3d2c09de1315a933ad74fb655f4f0

data/README.md

@@ -54,6 +54,15 @@ template = "Hello {{client.name.upcase}} and welcome to {{configuration.title.ca
 TinyTemplate.parse(template, self)
 ````
 
+If your interpreted string comes from a non-trusted source (user inpur for instance), you can secure it by providing a white list of method chains.
+
+```ruby
+TinyTemplate.secure(['client.name', 'configuration.email']) do
+  ~my\_template
+  TinyTemplate.parse(my\_template)
+end
+````
+
 ## Contributing
 
 1. Fork it ( https://github.com/[my-github-username]/tiny_template/fork )

data/lib/tiny_template.rb

@@ -22,14 +22,31 @@ class TinyTemplate
     new(str).parse(context)
   end
 
+  def self.secure(allowed_keys, &block)
+    previous_keys = @allowed_keys
+    @allowed_keys = allowed_keys
+    yield.tap do
+      @allowed_keys = previous_keys
+    end
+  end
+
+  def self.allowed_keys
+    @allowed_keys
+  end
+
   private
     attr_accessor :str
 
     # Private method used to interpolate one single expression at a time
     def interpolate(match, context)
-      match.gsub(/\{|\}/, '')
-           .split('.')
-           .inject(context){ |result, e| result.public_send(e) }
+      cleaned = match.gsub(/\{|\}/, '')
+
+      if !self.class.allowed_keys || self.class.allowed_keys.include?(cleaned)
+        cleaned.split('.')
+               .inject(context){ |result, e| result.public_send(e) }
+      else
+        ""
+      end
 
     rescue
       match

data/lib/tiny_template/version.rb

@@ -1,3 +1,3 @@
 class TinyTemplate
-  VERSION = "0.0.1"
+  VERSION = "0.0.2"
 end

data/spec/spec_helper.rb

@@ -1,5 +1,4 @@
 require 'rubygems'
-require 'active_record'
 require 'tiny_template'
 
 RSpec.configure do |config|

data/spec/tiny_template_spec.rb

@@ -53,5 +53,40 @@ RSpec.describe TinyTemplate do
 
     expect(result).to match(/JOHN DOE/)
   end
+
+  it 'should not interpolate not authorized actions' do
+    @klass2 = Class.new do
+      def hello
+        TinyTemplate.parse(template, self)
+      end
+
+      def hello_secured
+        TinyTemplate.secure(['client.name', 'client.email']) do
+          TinyTemplate.parse(template, self)
+        end
+      end
+
+      attr_accessor :template
+
+      def client
+        OpenStruct.new(name: 'John Doe', email: '  John@doe.com   ')
+      end
+
+      def configuration
+        OpenStruct.new(title: 'my Fancy website')
+      end
+
+      def destroy
+        "Dangerous action triggered"
+      end
+    end
+
+    instance = @klass2.new
+    instance.template = "This is a malecious {{client.name}} template that can harm: {{destroy}} "
+    expect(instance.hello).to include('Dangerous action triggered')
+
+    expect(instance.hello_secured).not_to include('Dangerous action triggered')
+    expect(instance.hello_secured).to include('John Doe')
+  end
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tiny_template
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Ihcène Medjber (ihcene)
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-22 00:00:00.000000000 Z
+date: 2017-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: debug_inspector
@@ -117,7 +117,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.6.12
 signing_key: 
 specification_version: 4
 summary: Magical and secure string interpolation.