turbo_frame_src 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +25 -0
- data/lib/turbo_frame_src/middleware.rb +1 -1
- data/lib/turbo_frame_src/version.rb +1 -1
- data/package.json +2 -2
- metadata +2 -3
- data/lib/turbo_frame_src/railtie.rb +0 -7
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7de88d83d5fa26f62ecd79a75f7bec078eed2517ebdbddc39359792433953585
|
|
4
|
+
data.tar.gz: d55ee3b54d9ba2903859b00b6f5cdfee98f4ada62ad2c9299296df13f7af7e5a
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 8d39fdbd3baa7508b9e24b9e2faf8a6652061d5817da49dd25ff2260adac6fc099293a9ca9895c0880bdc242803d451a63b098b62c8a4e72bfb31c0a9459a9f8
|
|
7
|
+
data.tar.gz: b0231d0925da6a829645de7bc197ef2379b2e94f6a1567577ff04012a6347851ba666760377679c1620d0a3ba987f18b189465dd783e4b52ee5c73ec54fdc865
|
data/README.md
CHANGED
|
@@ -127,6 +127,31 @@ module Filterable
|
|
|
127
127
|
end
|
|
128
128
|
```
|
|
129
129
|
|
|
130
|
+
### Security: treat `turbo_frame_src` as untrusted input
|
|
131
|
+
|
|
132
|
+
The `X-Turbo-Frame-Src` header is echoed back by the middleware verbatim, but its value originates from the client — any request that also carries Turbo's `Turbo-Frame` header can set it to whatever it wants. Nothing in this gem restricts it to a same-origin path.
|
|
133
|
+
|
|
134
|
+
If you pass `turbo_frame_src` to `redirect_to` (or otherwise use it to build a URL), validate it first, the same way you would any other user-supplied redirect target, to avoid an open redirect:
|
|
135
|
+
|
|
136
|
+
```ruby
|
|
137
|
+
def reset_filters
|
|
138
|
+
reset_filters_for(params[:scope])
|
|
139
|
+
|
|
140
|
+
redirect_to safe_turbo_frame_src || request.referer
|
|
141
|
+
end
|
|
142
|
+
|
|
143
|
+
private
|
|
144
|
+
|
|
145
|
+
def safe_turbo_frame_src
|
|
146
|
+
return unless turbo_frame_src
|
|
147
|
+
|
|
148
|
+
Rails.application.routes.recognize_path(turbo_frame_src)
|
|
149
|
+
turbo_frame_src
|
|
150
|
+
rescue ActionController::RoutingError
|
|
151
|
+
nil
|
|
152
|
+
end
|
|
153
|
+
```
|
|
154
|
+
|
|
130
155
|
## Development
|
|
131
156
|
|
|
132
157
|
After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
|
@@ -6,7 +6,7 @@ class TurboFrameSrc::Middleware
|
|
|
6
6
|
end
|
|
7
7
|
|
|
8
8
|
def call(env)
|
|
9
|
-
initial_frame_src = env['HTTP_X_TURBO_FRAME_SRC']
|
|
9
|
+
initial_frame_src = env['HTTP_X_TURBO_FRAME_SRC'] unless env['HTTP_TURBO_FRAME'].to_s.empty?
|
|
10
10
|
|
|
11
11
|
status, headers, response = @app.call(env)
|
|
12
12
|
|
data/package.json
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "turbo_frame_src",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"description": "Preserve initial Turbo Frame src during navigation",
|
|
5
5
|
"main": "app/javascript/turbo_frame_src/index.js",
|
|
6
6
|
"module": "app/javascript/turbo_frame_src/index.js",
|
|
7
7
|
"files": [
|
|
8
8
|
"app/javascript"
|
|
9
9
|
],
|
|
10
|
-
"author": "
|
|
10
|
+
"author": "AlexisCro",
|
|
11
11
|
"license": "MIT"
|
|
12
12
|
}
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: turbo_frame_src
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1.
|
|
4
|
+
version: 0.1.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Alexis Crozier
|
|
@@ -26,7 +26,6 @@ files:
|
|
|
26
26
|
- lib/turbo_frame_src/engine.rb
|
|
27
27
|
- lib/turbo_frame_src/helper.rb
|
|
28
28
|
- lib/turbo_frame_src/middleware.rb
|
|
29
|
-
- lib/turbo_frame_src/railtie.rb
|
|
30
29
|
- lib/turbo_frame_src/version.rb
|
|
31
30
|
- package.json
|
|
32
31
|
- sig/turbo_frame_src.rbs
|
|
@@ -36,7 +35,7 @@ licenses:
|
|
|
36
35
|
metadata:
|
|
37
36
|
allowed_push_host: https://rubygems.org
|
|
38
37
|
homepage_uri: https://github.com/AlexisCro/turbo_frame_src
|
|
39
|
-
source_code_uri: https://
|
|
38
|
+
source_code_uri: https://github.com/AlexisCro/turbo_frame_src/
|
|
40
39
|
changelog_uri: https://github.com/AlexisCro/turbo_frame_src/blob/main/CHANGELOG.md
|
|
41
40
|
rdoc_options: []
|
|
42
41
|
require_paths:
|