vidibus-xss 0.1.16 → 0.1.17

data/VERSION

@@ -1 +1 @@
-0.1.16
+0.1.17

data/lib/vidibus/xss/extensions/controller.rb

@@ -208,7 +208,7 @@ module Vidibus
 
           # determine scope
           if !(scope = params[:scope]).blank?
-            scope = "$('##{scope}')"
+            scope = "jQuery('##{scope}')"
           else
             scope = "$s#{xss_random_string}"
             xss << %(var #{scope}=vidibus.xss.detectScope();)

data/public/javascripts/vidibus.js

@@ -1,11 +1,5 @@
-// if (typeof console == undefined) {
-//   console = {};
-// }
-
-
 var vidibus = {};
-
-jQuery(function ($) {
+(function($) {
   
   /**
    * Assign global cross-site request forgery protection variables.
@@ -28,14 +22,13 @@ jQuery(function ($) {
   if(vidibus.csrf.param && vidibus.csrf.token) {
     vidibus.csrf.data[vidibus.csrf.param] = encodeURIComponent(vidibus.csrf.token);
   }
-});
-
+}(jQuery));
 
 /**
  * Implement ajax handler.
  * This is the default handler provided in rails.js with some extensions.
  */
-$(function($) {
+(function($) {
   $.fn.extend({
 
     /**
@@ -43,24 +36,24 @@ $(function($) {
      */
     callAjax: function(url, method, data) {
       var el = this,
-        method = method || el.attr('method') || el.attr('data-method') || 'GET',
+        meth = method || el.attr('method') || el.attr('data-method') || 'GET',
         dataType = el.attr('data-type')  || 'script';
-      if (!url) url = el.attr('action') || el.attr('href') || el.attr('data-url');
+      if (!url) {url = el.attr('action') || el.attr('href') || el.attr('data-url');}
       if (url === undefined) {
         throw "No URL specified for remote call (action or href must be present).";
       } else {
         if (el.triggerAndReturn('ajax:before')) {
           data = data || el.is('form') ? el.serializeArray() : {};
-          if (method == 'delete') {
-            data['_method'] = method;
-            method = 'POST';
+          if (meth === 'delete') {
+            data._method = meth;
+            meth = 'POST';
           }
           $.extend(data, vidibus.csrf.data());
           $.ajax({
             url: url,
             data: data,
             dataType: dataType,
-            type: method.toUpperCase(),
+            type: meth.toUpperCase(),
             beforeSend: function(xhr) {
               el.trigger('ajax:loading', xhr);
             },
@@ -79,4 +72,4 @@ $(function($) {
       }
     }
   });
-});
+}(jQuery));

data/public/javascripts/vidibus.loader.js

@@ -1,191 +1,194 @@
 // Basic loader for stylesheets and javascripts.
-var xssLoader = {
-
-  complete: true,       // indicates that loading has been finished
-  queue: [],            // holds resources that are queued to load
-  loading: undefined,   // holds resource that is currently being loaded
-  preloaded: undefined, // holds resources that are included in consumer base file
-  loaded: {},           // holds resources that are currently loaded
-  unused: {},           // holds resources that are loaded, but not required anymore
-
-  /**
-   * Load resources.
-   */
-  load: function(resources, scope) {
-    this.initStaticResources();
-    this.complete = false;
-    this.unused = jQuery.extend({}, this.loaded); // clone
-
-    $(resources).each(function() {
-      var resource = this,
-          src = resource.src,
-          name = xssLoader.resourceName(src);
-
-      resource.name = name;
-      resource.scopes = {};
-      resource.scopes[scope] = true;
-
-      // remove current file, because it is used
-      delete xssLoader.unused[name];
+var xssLoader;
+(function($) {
+  xssLoader = {
+
+    complete: true,       // indicates that loading has been finished
+    queue: [],            // holds resources that are queued to load
+    loading: undefined,   // holds resource that is currently being loaded
+    preloaded: undefined, // holds resources that are included in consumer base file
+    loaded: {},           // holds resources that are currently loaded
+    unused: {},           // holds resources that are loaded, but not required anymore
+
+    /**
+     * Load resources.
+     */
+    load: function(resources, scope) {
+      this.initStaticResources();
+      this.complete = false;
+      this.unused = jQuery.extend({}, this.loaded); // clone
+
+      $(resources).each(function() {
+        var resource = this,
+            src = resource.src,
+            name = xssLoader.resourceName(src);
+
+        resource.name = name;
+        resource.scopes = {};
+        resource.scopes[scope] = true;
+
+        // remove current file, because it is used
+        delete xssLoader.unused[name];
+
+        // skip files that have already been loaded
+        if (xssLoader.loaded[name]) {
+          xssLoader.loaded[name].scopes[scope] = true; // add current scope
+          return; // continue
+        } else if (xssLoader.preloaded[name]) {
+          return; // continue
+        }
 
-      // skip files that have already been loaded
-      if (xssLoader.loaded[name]) {
-        xssLoader.loaded[name].scopes[scope] = true; // add current scope
-        return; // continue
-      } else if (xssLoader.preloaded[name]) {
-        return; // continue
-      }
+        xssLoader.loaded[name] = resource;
+        switch (resource.type) {
+
+          // load css file directly
+          case 'text/css':
+            var element = document.createElement("link");
+            element.rel = 'stylesheet';
+            element.href = src;
+            element.media = resource.media || 'all';
+            element.type = 'text/css';
+            xssLoader.appendToHead(element);
+            break;
+
+          // push script file to loading queue
+          case 'text/javascript':
+            xssLoader.queue.push(resource);
+            break;
+
+          default: console.log('xssLoader.load: unsupported resource type: '+resource.type);
+        }
+      });
 
-      xssLoader.loaded[name] = resource;
-      switch (resource.type) {
-
-        // load css file directly
-        case 'text/css':
-          var element = document.createElement("link");
-          element.rel = 'stylesheet';
-          element.href = src;
-          element.media = resource.media || 'all';
-          element.type = 'text/css';
-          xssLoader.appendToHead(element);
-          break;
-
-        // push script file to loading queue
-        case 'text/javascript':
-          xssLoader.queue.push(resource);
-          break;
-
-        default: console.log('xssLoader.load: unsupported resource type: '+resource.type);
+      this.loadQueue(true);
+      this.unloadUnused(scope);
+    },
+
+    /**
+     * Returns file name of resource.
+     */
+    resourceName: function(url) {
+      return url.match(/\/([^\/\?]+)(\?.*)*$/)[1];
+    },
+
+    /**
+     * Returns list of static resources.
+     */
+    initStaticResources: function() {
+      if (xssLoader.preloaded === undefined) {
+        xssLoader.preloaded = {};
+        var $resource, src, name;
+        $('script[src],link[href]',$('head')).each(function() {
+          $resource = $(this);
+          src = $resource.attr('src') || $resource.attr('href');
+          name = xssLoader.resourceName(src);
+          xssLoader.preloaded[name] = src;
+        });
       }
-    });
-
-    this.loadQueue(true);
-    this.unloadUnused(scope);
-  },
-
-  /**
-   * Returns file name of resource.
-   */
-  resourceName: function(url) {
-    return url.match(/\/([^\/\?]+)(\?.*)*$/)[1];
-  },
-
-  /**
-   * Returns list of static resources.
-   */
-  initStaticResources: function() {
-    if (xssLoader.preloaded === undefined) {
-      xssLoader.preloaded = {};
-      var $resource, src, name;
-      $('script[src],link[href]',$('head')).each(function() {
-        $resource = $(this);
-        src = $resource.attr('src') || $resource.attr('href');
-        name = xssLoader.resourceName(src);
-        xssLoader.preloaded[name] = src;
-      });
-    }
-  },
+    },
 
-  /**
-   * Loads resources in queue.
-   */
-  loadQueue: function(start) {
+    /**
+     * Loads resources in queue.
+     */
+    loadQueue: function(start) {
 
-    // Reduce queue if this method is called as callback.
-    if(start !== true) {
-      xssLoader.queue.shift();
-    }
+      // Reduce queue if this method is called as callback.
+      if(start !== true) {
+        xssLoader.queue.shift();
+      }
 
-    var resource = xssLoader.queue[0];
+      var resource = xssLoader.queue[0];
 
-    // return if file is currently loading
-    if (resource) {
-      if (resource === xssLoader.loading) {
-        // console.log('CURRENTLY LOADING: '+resource.src);
-        return;
+      // return if file is currently loading
+      if (resource) {
+        if (resource === xssLoader.loading) {
+          // console.log('CURRENTLY LOADING: '+resource.src);
+          return;
+        }
+        xssLoader.loading = resource;
+        xssLoader.loadScript(resource.src, xssLoader.loadQueue);
+      } else {
+        xssLoader.loading = undefined;
+        xssLoader.complete = true;
       }
-      xssLoader.loading = resource;
-      xssLoader.loadScript(resource.src, xssLoader.loadQueue);
-    } else {
-      xssLoader.loading = undefined;
-      xssLoader.complete = true;
-    }
-  },
-
-  /**
-   * Loads script src.
-   */
-  loadScript: function(src, callback) {
-    var element = document.createElement("script");
-    if (element.addEventListener) {
-      element.addEventListener("load", callback, false);
-    } else {
-      // IE
-      element.onreadystatechange = function() {
-        if (this.readyState === 'loaded') {
-          callback.call(this);
+    },
+
+    /**
+     * Loads script src.
+     */
+    loadScript: function(src, callback) {
+      var element = document.createElement("script");
+      if (element.addEventListener) {
+        element.addEventListener("load", callback, false);
+      } else {
+        // IE
+        element.onreadystatechange = function() {
+          if (this.readyState === 'loaded') {
+            callback.call(this);
+          }
+        };
+      }
+      element.type = 'text/javascript';
+      element.src = src;
+      xssLoader.appendToHead(element);
+      element = null;
+    },
+
+    /**
+     * Detects unused resources and removes them.
+     */
+    unloadUnused: function(scope) {
+      var name, resources = [];
+      for(name in xssLoader.unused) {
+        if (xssLoader.unused.hasOwnProperty(name)) {
+          // Remove dependency for given scope.
+          if (xssLoader.unused[name].scopes[scope]) {
+            delete xssLoader.unused[name].scopes[scope];
+          }
+
+          // Unload resource if it has no dependencies left.
+          if ($.isEmptyObject(xssLoader.unused[name].scopes)) {
+            resources.push(xssLoader.unused[name]);
+          }
         }
-      };
-    }
-    element.type = 'text/javascript';
-    element.src = src;
-    xssLoader.appendToHead(element);
-    element = null;
-  },
-
-  /**
-   * Detects unused resources and removes them.
-   */
-  unloadUnused: function(scope) {
-    var name, resources = [];
-    for(name in xssLoader.unused) {
-      if (xssLoader.unused.hasOwnProperty(name)) {
-        // Remove dependency for given scope.
-        if (xssLoader.unused[name].scopes[scope]) {
-          delete xssLoader.unused[name].scopes[scope];
+      }
+      xssLoader.unload(resources);
+      xssLoader.unused = {};
+    },
+
+    /**
+     * Removes resources given in list.
+     */
+    unload: function(resources) {
+      var src, resource;
+      $(resources).each(function() {
+        resource = this;
+        src = resource.src;
+        switch (resource.type) {
+          case "text/css":
+            $('link[href="'+src+'"]').remove();
+            break;
+
+          case "text/javascript":
+            $('script[src="'+src+'"]').remove();
+            break;
+
+          default: console.log('xssLoader.unload: unsupported resource type: '+resource.type);
         }
+        delete xssLoader.loaded[resource.name];
+      });
+    },
 
-        // Unload resource if it has no dependencies left.
-        if ($.isEmptyObject(xssLoader.unused[name].scopes)) {
-          resources.push(xssLoader.unused[name]);
-        }
-      }
+    /**
+     * Appends given element to document head.
+     */
+    appendToHead: function(element) {
+      $("head")[0].appendChild(element);
     }
-    xssLoader.unload(resources);
-    xssLoader.unused = {};
-  },
-
-  /**
-   * Removes resources given in list.
-   */
-  unload: function(resources) {
-    var src, resource;
-    $(resources).each(function() {
-      resource = this;
-      src = resource.src;
-      switch (resource.type) {
-        case "text/css":
-          $('link[href="'+src+'"]').remove();
-          break;
-
-        case "text/javascript":
-          $('script[src="'+src+'"]').remove();
-          break;
-
-        default: console.log('xssLoader.unload: unsupported resource type: '+resource.type);
-      }
-      delete xssLoader.loaded[resource.name];
-    });
-  },
-
-  /**
-   * Appends given element to document head.
-   */
-  appendToHead: function(element) {
-    $("head")[0].appendChild(element);
-  }
-};
+  };
 
-// Maintain compatibility
-if (typeof vidibus !== "undefined") {
-  vidibus.loader = xssLoader;
-}
+  // Maintain compatibility
+  if (typeof vidibus !== "undefined") {
+    vidibus.loader = xssLoader;
+  }
+}(jQuery));

data/public/javascripts/vidibus.xss.js

@@ -13,290 +13,287 @@
 // } else {
 //     $.ajax({...});
 // }
-
-vidibus.xss = {
-  initialized: {},      // holds true for every scope that has been initialized
-  fileExtension: 'xss', // use 'xss' as file extension
-  loadedUrls: {},       // store urls currently loaded in each scope
-  pathPrefix: '',       // set a fixed prefix for all paths
-
-  ready: function() {
-    // TODO: implement real event handler
-  },
-
-  /**
-   * Detects scope of script block to be executed.
-   * Must be called from embedding page.
-   */
-  detectScope: function() {
-    document.write('<div id="scopeDetector"></div>');
-    var $detector = $("#scopeDetector");
-    var $scope = $detector.parent();
-    $detector.remove();
-    return $scope;
-  },
-
-  /**
-   * Usage:
-   *   vidibus.xss.embed('<div>Some HTML</div>', $('#scope') [, ".some element"]);
-   */
-  embed: function(html, $scope, selector) {
-    html = this.transformPaths(html, $scope); // Transform local paths before embedding html into page!
-    if (selector) {
-      $(selector, $scope).html(html);
-    } else {
-      $scope.html(html);
-    }
-    this.setUrls($scope);
-    this.setActions($scope);
-    this.ready();
-  },
-
-  /**
-   * Calls given path for given scope. If a third parameter is set to true,
-   * the location will be loaded, even if it is currently loaded.
-   *
-   * Usage:
-   *   vidibus.xss.get('path', $('#scope') [, true]);
-   *
-   * If no host is provided, host of scope will be used.
-   */
-  get: function(path, $scope, reload) {
-    // escape query parts
-    path = path.replace("?", "%3F").replace("&", "%26").replace("=", "%3D");
-
-    // remove path prefix
-    if (typeof xssPathPrefix !== "undefined" && xssPathPrefix) {
-      path = path.replace(xssPathPrefix,'');
-    }
-
-    var scopeId = $scope[0].id,
-        params = scopeId+'='+this.getPath(path),
-        keepCurrentLocation = this.initialized[scopeId] ? 0 : 1,
-        location = $.param.fragment(String(document.location), params, keepCurrentLocation),
-        reloadScope = {};
-
-    this.initialized[scopeId] = true;
-    window.location.href = location; // write history
-    reloadScope[scopeId] = reload;
-    this.loadUrl(location, reloadScope);
-  },
-
-  /**
-   * Redirect to given path while forcing reloading.
-   */
-  redirect: function(path, $scope) {
-    this.get(path, $scope, true);
-  },
-
-  /**
-   * Handles callback action.
-   *
-   * Requires data.status:
-   *   redirect, TODO: ok, error
-   *
-   * Accepts actions depending on status:
-   *   (redirect) to: Performs redirect to location.
-   */
-  callback: function(data, $scope) {
-    if (data.status === "redirect") {
-      this.redirect(data.to, $scope);
-    }
-  },
-
-  /**
-   * Sets host for given scope.
-   */
-  setHost: function(host, $scope) {
-    $scope.attr('data-host', host);
-  },
-
-  /**
-   * Returns host for given scope.
-   */
-  getHost: function($scope) {
-    return $scope.attr('data-host');
-  },
-
-  /**
-   * Turns given path into an absolute url.
-   */
-  getUrl: function(path, host) {
-    if (path.match(/https?:\/\//)) { return path; }
-    return host + path;
-  },
-
-  /**
-   * Returns relative path from url.
-   */
-  getPath: function(url) {
-    return url.replace(/https?:\/\/[^\/]+/,'');
-  },
-
-  /**
-   * Rewrites links to absolute urls.
-   */
-  setUrls: function($scope) {
-    var host = this.getHost($scope);
-
-    // Rewrite links
-    $('a[href]:not([href^=http])', $scope).each(function(e) {
-      var href = $(this).attr('href');
-      $(this).attr('href', vidibus.xss.getUrl(href, host));
-    });
-
-    // Rewrite forms
-    $('form[action]', $scope).each(function(e) {
-      var action = $(this).attr('action');
-      $(this).attr('href', vidibus.xss.getUrl(action, host));
-    });
-  },
-
-  /**
-   * Set xss actions for interactive elements.
-   */
-  setActions: function($scope) {
-    var host = this.getHost($scope);
-
-    // Set action for GET links
-    // TODO: Allow links to be flagged as "external"
-    $('a[href^='+host+']:not([data-method],[data-remote])', $scope).bind('click.xss', function(e) {
-      var href = $(this).attr('href');
-      vidibus.xss.get(href, $scope);
-      e.preventDefault();
-    });
-
-    // Set action non-GET links
-    // TODO: Remove bindings from links that match current host only: a[data-method][href^='+host+']:not([data-remote])
-    $('a[data-method]:not([data-remote])').die('click').unbind('click'); // remove bindings
-    $('a[data-method][href^='+host+']:not([data-remote])', $scope).click(function(e) {
-      var $link = $(this),
-          path = $link.attr('href'),
-          url = vidibus.xss.buildUrl(path, $scope);
-      $(this).callAjax(url);
-      e.preventDefault();
-    });
-
-    // Set form action
-    $('form[action]').die('submit').unbind('submit'); // remove bindings
-    $('form[action][href^='+host+']', $scope).submit(function(e) {
-      var $form = $(this),
-          path = $form.attr('action');
-          url = vidibus.xss.buildUrl(path, $scope);
-      $(this).callAjax(url);
-      return false;
-    });
-  },
-
-  /**
-   * Modifies paths within given html string.
-   * This method must be called before embedding html snippet into the page
-   * to avoid loading errors from invalid relative paths.
-   */
-  transformPaths: function(html, $scope) {
-    var match, url;
-    while (true) {
-      match = html.match(/src="((?!http)[^"]+)"/);
-      if (!match) {
-        break;
+(function($) {
+  vidibus.xss = {
+    initialized: {},      // holds true for every scope that has been initialized
+    fileExtension: 'xss', // use 'xss' as file extension
+    loadedUrls: {},       // store urls currently loaded in each scope
+    pathPrefix: '',       // set a fixed prefix for all paths
+
+    ready: function() {
+      // TODO: implement real event handler
+    },
+
+    /**
+     * Detects scope of script block to be executed.
+     * Must be called from embedding page.
+     */
+    detectScope: function() {
+      document.write('<div id="scopeDetector"></div>');
+      var $detector = $("#scopeDetector");
+      var $scope = $detector.parent();
+      $detector.remove();
+      return $scope;
+    },
+
+    /**
+     * Usage:
+     *   vidibus.xss.embed('<div>Some HTML</div>', $('#scope') [, ".some element"]);
+     */
+    embed: function(html, $scope, selector) {
+      html = this.transformPaths(html, $scope); // Transform local paths before embedding html into page!
+      if (selector) {
+        $(selector, $scope).html(html);
+      } else {
+        $scope.html(html);
+      }
+      this.setUrls($scope);
+      this.setActions($scope);
+      this.ready();
+    },
+
+    /**
+     * Calls given path for given scope. If a third parameter is set to true,
+     * the location will be loaded, even if it is currently loaded.
+     *
+     * Usage:
+     *   vidibus.xss.get('path', $('#scope') [, true]);
+     *
+     * If no host is provided, host of scope will be used.
+     */
+    get: function(path, $scope, reload) {
+      // escape query parts
+      path = path.replace("?", "%3F").replace("&", "%26").replace("=", "%3D");
+
+      // remove path prefix
+      if (typeof xssPathPrefix !== "undefined" && xssPathPrefix) {
+        path = path.replace(xssPathPrefix,'');
       }
-      url = vidibus.xss.buildUrl(match[1], $scope);
-      html = html.replace(match[0], 'src="'+url+'"');
-    }
-    return html;
-  },
 
-  /**
-   * Load XSS sources from given url.
-   * If url is empty, the current location will be used.
-   */
-  loadUrl: function(url, reload) {
-    var scope, $scope, path, loaded, params = $.deparam.fragment();
-    for(scope in params) {
-      if (params.hasOwnProperty(scope)) {
-        path = params[scope];
-
-        // don't reload locations that have already been loaded
-        loaded = this.loadedUrls[scope];
-        if((!reload || !reload[scope]) && loaded && loaded === path) {
-          continue;
+      var scopeId = $scope[0].id,
+          params = scopeId+'='+this.getPath(path),
+          keepCurrentLocation = this.initialized[scopeId] ? 0 : 1,
+          location = $.param.fragment(String(document.location), params, keepCurrentLocation),
+          reloadScope = {};
+
+      this.initialized[scopeId] = true;
+      window.location.href = location; // write history
+      reloadScope[scopeId] = reload;
+      this.loadUrl(location, reloadScope);
+    },
+
+    /**
+     * Redirect to given path while forcing reloading.
+     */
+    redirect: function(path, $scope) {
+      this.get(path, $scope, true);
+    },
+
+    /**
+     * Handles callback action.
+     *
+     * Requires data.status:
+     *   redirect, TODO: ok, error
+     *
+     * Accepts actions depending on status:
+     *   (redirect) to: Performs redirect to location.
+     */
+    callback: function(data, $scope) {
+      if (data.status === "redirect") {
+        this.redirect(data.to, $scope);
+      }
+    },
+
+    /**
+     * Sets host for given scope.
+     */
+    setHost: function(host, $scope) {
+      $scope.attr('data-host', host);
+    },
+
+    /**
+     * Returns host for given scope.
+     */
+    getHost: function($scope) {
+      return $scope.attr('data-host');
+    },
+
+    /**
+     * Turns given path into an absolute url.
+     */
+    getUrl: function(path, host) {
+      if (path.match(/^(https?:\/\/|#)/)) { return path; }
+      return host + path;
+    },
+
+    /**
+     * Returns relative path from url.
+     */
+    getPath: function(url) {
+      return url.replace(/https?:\/\/[^\/]+/,'');
+    },
+
+    /**
+     * Rewrites links to absolute urls.
+     */
+    setUrls: function($scope) {
+      var host = this.getHost($scope);
+
+      // Rewrite links
+      $('a[href]:not([href^=http])', $scope).each(function(e) {
+        var href = $(this).attr('href');
+        $(this).attr('href', vidibus.xss.getUrl(href, host));
+      });
+
+      // Rewrite forms
+      $('form[action]', $scope).each(function(e) {
+        var action = $(this).attr('action');
+        $(this).attr('href', vidibus.xss.getUrl(action, host));
+      });
+    },
+
+    /**
+     * Set xss actions for interactive elements.
+     */
+    setActions: function($scope) {
+      var host = this.getHost($scope);
+
+      // Set action for GET links
+      // TODO: Allow links to be flagged as "external"
+      $('a[href^='+host+']:not([data-method],[data-remote])', $scope).bind('click.xss', function(e) {
+        var href = $(this).attr('href');
+        vidibus.xss.get(href, $scope);
+        e.preventDefault();
+      });
+
+      // Set action non-GET links
+      // TODO: Remove bindings from links that match current host only: a[data-method][href^='+host+']:not([data-remote])
+      $('a[data-method]:not([data-remote])').die('click').unbind('click'); // remove bindings
+      $('a[data-method][href^='+host+']:not([data-remote])', $scope).click(function(e) {
+        var $link = $(this),
+            path = $link.attr('href'),
+            url = vidibus.xss.buildUrl(path, $scope);
+        $(this).callAjax(url);
+        e.preventDefault();
+      });
+
+      // Set form action
+      $('form[action]').die('submit').unbind('submit'); // remove bindings
+      $('form[action][href^='+host+']', $scope).submit(function(e) {
+        var $form = $(this),
+            path = $form.attr('action');
+            url = vidibus.xss.buildUrl(path, $scope);
+        $(this).callAjax(url);
+        return false;
+      });
+    },
+
+    /**
+     * Modifies paths within given html string.
+     * This method must be called before embedding html snippet into the page
+     * to avoid loading errors from invalid relative paths.
+     */
+    transformPaths: function(html, $scope) {
+      var match, url;
+      while (true) {
+        match = html.match(/src="((?!http)[^"]+)"/);
+        if (!match) {
+          break;
         }
-
-        $scope = $('#'+scope);
-        if($scope[0] === undefined) {
-          console.log('Scope not found: '+scope);
-        } else {
-          this.loadedUrls[scope] = path;
-          this.loadData(path, $scope);
+        url = vidibus.xss.buildUrl(match[1], $scope);
+        html = html.replace(match[0], 'src="'+url+'"');
+      }
+      return html;
+    },
+
+    /**
+     * Load XSS sources from given url.
+     * If url is empty, the current location will be used.
+     */
+    loadUrl: function(url, reload) {
+      var scope, $scope, path, loaded, params = $.deparam.fragment();
+      for(scope in params) {
+        if (params.hasOwnProperty(scope)) {
+          path = params[scope];
+
+          // don't reload locations that have already been loaded
+          loaded = this.loadedUrls[scope];
+          if((!reload || !reload[scope]) && loaded && loaded === path) {
+            continue;
+          }
+
+          $scope = $('#'+scope);
+          if($scope[0] === undefined) {
+            console.log('Scope not found: '+scope);
+          } else {
+            this.loadedUrls[scope] = path;
+            this.loadData(path, $scope);
+          }
         }
       }
-    }
-  },
-
-  /**
-   * Load relative path into given scope.
-   * Transforms scope host and path into a XSS location.
-   */
-  loadData: function(path, $scope) {
-    var url = this.buildUrl(path, $scope, true);
-    $.ajax({
-      url: url,
-      data: [],
-      dataType: 'script',
-      type: 'GET'
-    });
-  },
+    },
+
+    /**
+     * Load relative path into given scope.
+     * Transforms scope host and path into a XSS location.
+     */
+    loadData: function(path, $scope) {
+      var url = this.buildUrl(path, $scope, true);
+      $.ajax({
+        url: url,
+        data: [],
+        dataType: 'script',
+        type: 'GET'
+      });
+    },
+
+    /**
+     * Tranforms local paths to absolute ones.
+     */
+    buildUrl: function(path, $scope, uncached) {
+      var parts = path.split("?");
+      path = parts[0];
+      params = parts[1];
+      if(params) {
+        params = params.split("&");
+      } else {
+        params = [];
+      }
 
-  /**
-   * Tranforms local paths to absolute ones.
-   */
-  buildUrl: function(path, $scope, uncached) {
-    var parts = path.split("?");
-    path = parts[0];
-    params = parts[1];
-    if(params) {
-      params = params.split("&");
-    } else {
-      params = [];
-    }
+      // prepend path prefix
+      if (typeof xssPathPrefix !== "undefined" && xssPathPrefix && !path.match(xssPathPrefix)) {
+        path = xssPathPrefix + path;
+      }
 
-    // prepend path prefix
-    if (typeof xssPathPrefix !== "undefined" && xssPathPrefix && !path.match(xssPathPrefix)) {
-      path = xssPathPrefix + path;
-    }
+      var host = this.getHost($scope),
+        scope = $scope.attr('id'),
+        url = this.getUrl(path, host);
 
-    var host = this.getHost($scope),
-      scope = $scope.attr('id'),
-      url = this.getUrl(path, host);
+      if (!url.match(/\.[a-z]+((\?|\#).*)?$/)) { url += '.xss'; }
+      if (url.indexOf('.xss') > -1 && params.toString().indexOf('scope='+scope) === -1) {
+        params.push('scope='+scope);
+      }
 
-    if (!url.match(/\.[a-z]+((\?|\#).*)?$/)) { url += '.xss'; }
-    if (url.indexOf('.xss') > -1 && params.toString().indexOf('scope='+scope) === -1) {
-      params.push('scope='+scope);
-    }
+      // add cache buster
+      if (uncached) {
+        var d = new Date();
+        params.push(d.getTime());
+      }
 
-    // add cache buster
-    if (uncached) {
-      var d = new Date();
-      params.push(d.getTime());
-    }
+      // append params
+      if (params.length) {
+        if (url.indexOf('?') === -1) { url += '?'; }
+        url += params.join('&');
+      }
 
-    // append params
-    if (params.length) {
-      if (url.indexOf('?') === -1) { url += '?'; }
-      url += params.join('&');
+      return url;
     }
+  };
 
-    return url;
-  }
-};
-
-/**
- * Detect changes to document's location.
- *
- */
-$(function($){
-
-  // Detect changes of document.location and trigger loading.
+  /**
+   * Detect changes to document's location.
+   *
+   */
   $(window).bind('hashchange', function(e) {
     if (xssLoader.complete) {
       vidibus.xss.loadUrl();
@@ -308,12 +305,7 @@ $(function($){
   // to trigger the event now, to handle the hash the page may have
   // loaded with.
   $(window).trigger('hashchange');
-});
 
-/**
- * Extend XHR
- */
-$(function($) {
 
   /**
    * Extend xhr object to send credentials and force XMLHttpRequest.
@@ -328,7 +320,7 @@ $(function($) {
   };
 
   /**
-   * Extends xhr on beforeSend by binding to Rails' ajax:loading event.
+   * Extend xhr on beforeSend by binding to Rails' ajax:loading event.
    */
   $("body").bind('ajax:loading', function(e, xhr) {
     extendXhr(xhr);
@@ -342,4 +334,4 @@ $(function($) {
   $.ajaxSettings.beforeSend = function(xhr) {
     extendXhr(xhr);
   };
-});
+}(jQuery));

data/vidibus-xss.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{vidibus-xss}
-  s.version = "0.1.16"
+  s.version = "0.1.17"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andre Pankratz"]
-  s.date = %q{2011-01-11}
+  s.date = %q{2011-01-18}
   s.description = %q{Drop-in XSS support for remote applications.}
   s.email = %q{andre@vidibus.com}
   s.extra_rdoc_files = [

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: vidibus-xss
 version: !ruby/object:Gem::Version 
-  hash: 59
+  hash: 57
   prerelease: false
   segments: 
   - 0
   - 1
-  - 16
-  version: 0.1.16
+  - 17
+  version: 0.1.17
 platform: ruby
 authors: 
 - Andre Pankratz
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-01-11 00:00:00 +01:00
+date: 2011-01-18 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency