ts_vector_tags 0.0.5 → 0.0.6

data/README.md

@@ -27,11 +27,19 @@ Tags can be set using either an array, or a comma separated list.
     post.tags
     => ['bing', 'bong']
 
-The including class has a scope:
+The including class has scopes:
+
+Common '&'-searches:
 
     Post.with_tags('Paris, Texas')
     Post.with_tags('Paris', 'Texas')
 
+Complex tsqueries:
+
+    Post.with_tags_query("foo & !(bar | baz)")
+
+tsqueries deemed potentially dangerous raises the `TsVectorTags::InvalidTsQueryError` exception.
+
 Tags are normalized:
 
     post.tags = ['  wtf#$%^   &*??!']

data/lib/ts_vector_tags.rb

@@ -1,6 +1,11 @@
 # encoding: utf-8
 module TsVectorTags
 
+  # Regexp to reject injection attacks with ts_queries
+  TSQUERY_VALIDATOR = /^[[:alnum:]\*\:\(\)\&\!\|[:space:]]+$/
+
+  class InvalidTsQueryError < StandardError; end
+
   module Standardizer
     class << self
       def tagify(tags)
@@ -14,11 +19,23 @@ module TsVectorTags
     end
   end
 
+  def self.acceptable_tsquery?(query)
+    # TODO: Check for balanced parantheses
+    query =~ TSQUERY_VALIDATOR
+  end
+
   def self.included(base)
     base.class_eval do
+      # Accepts a comma separated list of tags and applies the 'and'-operator to them
       scope :with_tags, lambda { |tags|
         where("tags_vector @@ to_tsquery('simple', ?) ", TsVectorTags::Standardizer.tagify(tags).join(' & '))
       }
+
+      # Accepts a proper ts_query an allows complex logical expressions like "foo & !(bar | bling)"
+      scope :with_tags_query, lambda { |query|
+        raise InvalidTsQueryError, "Invalid tag query '#{query}'" unless TsVectorTags.acceptable_tsquery?(query)
+        where("tags_vector @@ to_tsquery('simple', '#{query}')")
+      }
     end
   end
 

data/spec/ts_vector_tags_spec.rb

@@ -28,6 +28,19 @@ class Thing
 end
 
 describe TsVectorTags do
+
+  describe "tsqueries" do
+    it "rejects potentially dangerous tsqueries" do
+      TsVectorTags.acceptable_tsquery?("'").should be_false
+      TsVectorTags.acceptable_tsquery?('"').should be_false
+    end
+
+    it "accepts plain tsqueries" do
+      TsVectorTags.acceptable_tsquery?("foo & !(bar | fudd)")
+      TsVectorTags.acceptable_tsquery?("foo:*A")
+    end
+  end
+
   describe "accessors" do
     let(:thing) { Thing.new }
 

data/ts_vector_tags.gemspec

@@ -2,7 +2,7 @@
 $:.push File.expand_path("../lib", __FILE__)
 
 module TsVectorTags
-  VERSION = "0.0.5"
+  VERSION = "0.0.6"
 end
 
 Gem::Specification.new do |s|
@@ -22,4 +22,5 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   s.add_development_dependency "rspec"
+  s.add_development_dependency "rake"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ts_vector_tags
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
   prerelease: 
 platform: ruby
 authors:
@@ -10,11 +10,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-09-04 00:00:00.000000000 Z
+date: 2012-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70288914631240 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -22,7 +22,28 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70288914631240
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Extremely simple, if somewhat exotic, mixin that uses the tsvector feature
   in postgresql to add tags to an ActiveRecord model.
 email:
@@ -52,15 +73,21 @@ required_ruby_version: !ruby/object:Gem::Requirement
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: -2976820661742119530
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
+      segments:
+      - 0
+      hash: -2976820661742119530
 requirements: []
 rubyforge_project: ts_vector_tags
-rubygems_version: 1.8.15
+rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: Super simple tag mixin for postgresql and activerecord