From 28f2c6f4037081da0a82104a3f473165ed4ed2ce Mon Sep 17 00:00:00 2001 From: Santiago Pastorino Date: Tue, 31 Jul 2012 22:25:54 -0300 Subject: html_escape should escape single quotes https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content Closes #7215 Conflicts: actionpack/test/template/erb_util_test.rb actionpack/test/template/form_tag_helper_test.rb actionpack/test/template/text_helper_test.rb actionpack/test/template/url_helper_test.rb activesupport/lib/active_support/core_ext/string/output_safety.rb --- actionpack/test/template/asset_tag_helper_test.rb | 16 ++++++++-------- actionpack/test/template/erb_util_test.rb | 10 +++++----- actionpack/test/template/form_options_helper_test.rb | 6 +++--- actionpack/test/template/form_tag_helper_test.rb | 2 +- actionpack/test/template/javascript_helper_test.rb | 10 +++++----- actionpack/test/template/template_test.rb | 2 +- actionpack/test/template/url_helper_test.rb | 10 +++++----- 7 files changed, 28 insertions(+), 28 deletions(-) (limited to 'actionpack/test/template') diff --git a/actionpack/test/template/asset_tag_helper_test.rb b/actionpack/test/template/asset_tag_helper_test.rb index 8000625310..6a0fdf0590 100644 --- a/actionpack/test/template/asset_tag_helper_test.rb +++ b/actionpack/test/template/asset_tag_helper_test.rb @@ -162,8 +162,8 @@ class AssetTagHelperTest < ActionView::TestCase %(image_tag(".pdf.png")) => %(.pdf), %(image_tag("http://www.rubyonrails.com/images/rails.png")) => %(Rails), %(image_tag("//www.rubyonrails.com/images/rails.png")) => %(Rails), - %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(Mouse), - %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(Mouse), + %(image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) => %(Mouse), + %(image_tag("mouse.png", :mouseover => image_path("mouse_over.png"))) => %(Mouse), %(image_tag("mouse.png", :alt => nil)) => %(), %(image_tag("data:image/gif;base64,R0lGODlhAQABAID/AMDAwAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==", :alt => nil)) => %(), %(image_tag("")) => %() @@ -1105,8 +1105,8 @@ class AssetTagHelperNonVhostTest < ActionView::TestCase assert_dom_equal(%(/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr")) assert_dom_equal(%(/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style")) assert_dom_equal(%(/collaboration/hieraki/images/xml.png), image_path("xml.png")) - assert_dom_equal(%(Mouse), image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) - assert_dom_equal(%(Mouse2), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png"))) + assert_dom_equal(%(Mouse), image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) + assert_dom_equal(%(Mouse2), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png"))) end def test_should_ignore_relative_root_path_on_complete_url @@ -1119,8 +1119,8 @@ class AssetTagHelperNonVhostTest < ActionView::TestCase assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr")) assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style")) assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png")) - assert_dom_equal(%(Mouse), image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) - assert_dom_equal(%(Mouse2), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png"))) + assert_dom_equal(%(Mouse), image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) + assert_dom_equal(%(Mouse2), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png"))) end def test_should_compute_proper_path_with_asset_host_and_default_protocol @@ -1129,8 +1129,8 @@ class AssetTagHelperNonVhostTest < ActionView::TestCase assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/javascripts/xmlhr.js), javascript_path("xmlhr")) assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/stylesheets/style.css), stylesheet_path("style")) assert_dom_equal(%(gopher://assets.example.com/collaboration/hieraki/images/xml.png), image_path("xml.png")) - assert_dom_equal(%(Mouse), image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) - assert_dom_equal(%(Mouse2), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png"))) + assert_dom_equal(%(Mouse), image_tag("mouse.png", :mouseover => "/images/mouse_over.png")) + assert_dom_equal(%(Mouse2), image_tag("mouse2.png", :mouseover => image_path("mouse_over2.png"))) end def test_should_ignore_asset_host_on_complete_url diff --git a/actionpack/test/template/erb_util_test.rb b/actionpack/test/template/erb_util_test.rb index 790ab1c74c..e311989dea 100644 --- a/actionpack/test/template/erb_util_test.rb +++ b/actionpack/test/template/erb_util_test.rb @@ -8,11 +8,11 @@ class ErbUtilTest < Test::Unit::TestCase define_method "test_html_escape_#{expected.gsub(/\W/, '')}" do assert_equal expected, html_escape(given) end + end - unless given == '"' - define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do - assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given) - end + ERB::Util::JSON_ESCAPE.each do |given, expected| + define_method "test_json_escape_#{expected.gsub(/\W/, '')}" do + assert_equal ERB::Util::JSON_ESCAPE[given], json_escape(given) end end @@ -40,7 +40,7 @@ class ErbUtilTest < Test::Unit::TestCase def test_rest_in_ascii (0..127).to_a.map {|int| int.chr }.each do |chr| - next if chr.in?('&"<>') + next if chr.in?('&"<>\'') assert_equal chr, html_escape(chr) end end diff --git a/actionpack/test/template/form_options_helper_test.rb b/actionpack/test/template/form_options_helper_test.rb index 09b1bd3884..3009fa5330 100644 --- a/actionpack/test/template/form_options_helper_test.rb +++ b/actionpack/test/template/form_options_helper_test.rb @@ -1011,7 +1011,7 @@ class FormOptionsHelperTest < ActionView::TestCase def test_options_for_select_with_element_attributes assert_dom_equal( - "\n\n\n", + "\n\n\n", options_for_select([ [ "", { :class => 'bold' } ], [ "USA", { :onclick => "alert('Hello World');" } ], [ "Sweden" ], "Germany" ]) ) end @@ -1047,13 +1047,13 @@ class FormOptionsHelperTest < ActionView::TestCase def test_option_html_attributes_with_multiple_element_hash output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy', 'onclick' => "alert('Hello World');" } ]) assert output.include?(" class=\"fancy\"") - assert output.include?(" onclick=\"alert('Hello World');\"") + assert output.include?(" onclick=\"alert('Hello World');\"") end def test_option_html_attributes_with_multiple_hashes output = option_html_attributes([ 'foo', 'bar', { :class => 'fancy' }, { 'onclick' => "alert('Hello World');" } ]) assert output.include?(" class=\"fancy\"") - assert output.include?(" onclick=\"alert('Hello World');\"") + assert output.include?(" onclick=\"alert('Hello World');\"") end def test_option_html_attributes_with_special_characters diff --git a/actionpack/test/template/form_tag_helper_test.rb b/actionpack/test/template/form_tag_helper_test.rb index dcc6dd0411..68dfceef07 100644 --- a/actionpack/test/template/form_tag_helper_test.rb +++ b/actionpack/test/template/form_tag_helper_test.rb @@ -368,7 +368,7 @@ class FormTagHelperTest < ActionView::TestCase def test_submit_tag assert_dom_equal( - %(), + %(), submit_tag("Save", :disable_with => "Saving...", :onclick => "alert('hello!')") ) end diff --git a/actionpack/test/template/javascript_helper_test.rb b/actionpack/test/template/javascript_helper_test.rb index 4b9c3c97b1..80a7744a1e 100644 --- a/actionpack/test/template/javascript_helper_test.rb +++ b/actionpack/test/template/javascript_helper_test.rb @@ -46,12 +46,12 @@ class JavaScriptHelperTest < ActionView::TestCase end def test_button_to_function - assert_dom_equal %(), + assert_dom_equal %(), button_to_function("Greeting", "alert('Hello world!')") end def test_button_to_function_with_onclick - assert_dom_equal "", + assert_dom_equal "", button_to_function("Greeting", "alert('Hello world!')", :onclick => "alert('Goodbye World :(')") end @@ -61,17 +61,17 @@ class JavaScriptHelperTest < ActionView::TestCase end def test_link_to_function - assert_dom_equal %(Greeting), + assert_dom_equal %(Greeting), link_to_function("Greeting", "alert('Hello world!')") end def test_link_to_function_with_existing_onclick - assert_dom_equal %(Greeting), + assert_dom_equal %(Greeting), link_to_function("Greeting", "alert('Hello world!')", :onclick => "confirm('Sanity!')") end def test_function_with_href - assert_dom_equal %(Greeting), + assert_dom_equal %(Greeting), link_to_function("Greeting", "alert('Hello world!')", :href => 'http://example.com/') end diff --git a/actionpack/test/template/template_test.rb b/actionpack/test/template/template_test.rb index dd45a08b01..5880eb2bd4 100644 --- a/actionpack/test/template/template_test.rb +++ b/actionpack/test/template/template_test.rb @@ -79,7 +79,7 @@ class TestERBTemplate < ActiveSupport::TestCase def test_locals @template = new_template("<%= my_local %>") @template.locals = [:my_local] - assert_equal "I'm a local", render(:my_local => "I'm a local") + assert_equal "I am a local", render(:my_local => "I am a local") end def test_restores_buffer diff --git a/actionpack/test/template/url_helper_test.rb b/actionpack/test/template/url_helper_test.rb index f0e33404af..d55b1fd2bd 100644 --- a/actionpack/test/template/url_helper_test.rb +++ b/actionpack/test/template/url_helper_test.rb @@ -194,7 +194,7 @@ class UrlHelperTest < ActiveSupport::TestCase def test_link_tag_with_custom_onclick link = link_to("Hello", "http://www.example.com", :onclick => "alert('yay!')") - expected = %{Hello} + expected = %{Hello} assert_dom_equal expected, link end @@ -204,12 +204,12 @@ class UrlHelperTest < ActiveSupport::TestCase link_to("Hello", "http://www.example.com", :confirm => "Are you sure?") ) assert_dom_equal( - "Hello", - link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure, can you?") + "Hello", + link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure, can you?") ) assert_dom_equal( - "Hello", - link_to("Hello", "http://www.example.com", :confirm => "You can't possibly be sure,\n can you?") + "Hello", + link_to("Hello", "http://www.example.com", :confirm => "You cant possibly be sure,\n can you?") ) end -- cgit v1.2.3