diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 0000000..4cb2217 --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,25 @@ +// For format details, see https://aka.ms/devcontainer.json. For config options, see the +// README at: https://github.com/devcontainers/templates/tree/main/src/ruby +{ + "name": "Ruby", + // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile + "image": "mcr.microsoft.com/devcontainers/ruby:1-3.2-bullseye", + "features": { + "ghcr.io/devcontainers/features/github-cli:1": {} + }, + + // Features to add to the dev container. More info: https://containers.dev/features. + // "features": {}, + + // Use 'forwardPorts' to make a list of ports inside the container available locally. + // "forwardPorts": [], + + // Use 'postCreateCommand' to run commands after the container is created. + "postCreateCommand": "bundle install", + + // Configure tool-specific properties. + // "customizations": {}, + + // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. + // "remoteUser": "root" +} diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml index 231aaa2..44999ad 100644 --- a/.github/workflows/ruby.yml +++ b/.github/workflows/ruby.yml @@ -16,7 +16,7 @@ jobs: strategy: fail-fast: false matrix: - ruby: [3.1, '3.0', 2.7] + ruby: [3.2, 3.1, '3.0', 2.7] gemfile: - Gemfile - gemfiles/Gemfile-rails-6-0 @@ -24,7 +24,7 @@ jobs: env: BUNDLE_GEMFILE: ${{ matrix.gemfile }} steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 - name: Set up Ruby uses: ruby/setup-ruby@v1 with: @@ -32,11 +32,25 @@ jobs: bundler-cache: true - name: Run tests run: bundle exec rake + memcheck: + name: Memcheck + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + ruby-version: 3.2 + bundler-cache: true + - name: Install Valgrind + run: sudo apt-get install valgrind + - name: Run tests + run: bundle exec rake test:valgrind lint: runs-on: ubuntu-latest name: Lint steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 - name: Set up Ruby uses: ruby/setup-ruby@v1 with: diff --git a/Gemfile b/Gemfile index cf23ea4..6cc6c14 100644 --- a/Gemfile +++ b/Gemfile @@ -9,6 +9,7 @@ gem "minitest" gem "mocha" gem "rake" gem "rake-compiler" +gem "ruby_memcheck" group :deployment, :test do gem "pry-byebug" diff --git a/Gemfile.lock b/Gemfile.lock index a69ce16..5089419 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - better_html (2.0.1) + better_html (2.0.2) actionview (>= 6.0) activesupport (>= 6.0) ast (~> 2.0) @@ -12,13 +12,13 @@ PATH GEM remote: https://rubygems.org/ specs: - actionview (7.0.3.1) - activesupport (= 7.0.3.1) + actionview (7.0.5) + activesupport (= 7.0.5) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activesupport (7.0.3.1) + activesupport (7.0.5) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 1.6, < 2) minitest (>= 5.1) @@ -27,21 +27,21 @@ GEM builder (3.2.4) byebug (9.1.0) coderay (1.1.2) - concurrent-ruby (1.1.10) + concurrent-ruby (1.2.2) crass (1.0.6) - erubi (1.11.0) - i18n (1.12.0) + erubi (1.12.0) + i18n (1.14.1) concurrent-ruby (~> 1.0) json (2.6.2) - loofah (2.18.0) + loofah (2.21.3) crass (~> 1.0.2) - nokogiri (>= 1.5.9) + nokogiri (>= 1.12.0) method_source (0.9.0) - mini_portile2 (2.8.0) + mini_portile2 (2.8.2) minitest (5.16.2) mocha (1.14.0) - nokogiri (1.13.8) - mini_portile2 (~> 2.8.0) + nokogiri (1.15.2) + mini_portile2 (~> 2.8.2) racc (~> 1.4) parallel (1.22.1) parser (3.1.2.1) @@ -52,12 +52,13 @@ GEM pry-byebug (3.5.0) byebug (~> 9.1) pry (~> 0.10) - racc (1.6.0) + racc (1.7.0) rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.4.3) - loofah (~> 2.3) + rails-html-sanitizer (1.6.0) + loofah (~> 2.21) + nokogiri (~> 1.14) rainbow (3.1.1) rake (13.0.6) rake-compiler (1.2.0) @@ -79,8 +80,10 @@ GEM rubocop-shopify (2.9.0) rubocop (~> 1.33) ruby-progressbar (1.11.0) + ruby_memcheck (1.3.2) + nokogiri smart_properties (1.17.0) - tzinfo (2.0.5) + tzinfo (2.0.6) concurrent-ruby (~> 1.0) unicode-display_width (2.2.0) @@ -96,6 +99,7 @@ DEPENDENCIES rake rake-compiler rubocop-shopify + ruby_memcheck BUNDLED WITH 2.2.22 diff --git a/Rakefile b/Rakefile index 5b30e52..964d04e 100644 --- a/Rakefile +++ b/Rakefile @@ -8,7 +8,9 @@ rescue LoadError end require "rake/extensiontask" +require "ruby_memcheck" +RubyMemcheck.config(binary_name: "better_html_ext") Rake::ExtensionTask.new("better_html_ext") require "rdoc/task" @@ -23,11 +25,15 @@ end require "rake/testtask" -Rake::TestTask.new(:test) do |t| +test_config = lambda do |t| t.libs << "lib" t.libs << "test" t.pattern = "test/**/*_test.rb" t.verbose = false end +Rake::TestTask.new(test: :compile, &test_config) +namespace :test do + RubyMemcheck::TestTask.new(valgrind: :compile, &test_config) +end task default: [:compile, :test] diff --git a/gemfiles/Gemfile-rails-6-0 b/gemfiles/Gemfile-rails-6-0 index f20ce95..7263fd8 100644 --- a/gemfiles/Gemfile-rails-6-0 +++ b/gemfiles/Gemfile-rails-6-0 @@ -9,6 +9,7 @@ gem "rake" gem "rake-compiler" gem "minitest" gem "mocha" +gem "ruby_memcheck" group :deployment, :test do gem "pry-byebug" diff --git a/gemfiles/Gemfile-rails-6-1 b/gemfiles/Gemfile-rails-6-1 index 3397a95..6746897 100644 --- a/gemfiles/Gemfile-rails-6-1 +++ b/gemfiles/Gemfile-rails-6-1 @@ -9,6 +9,7 @@ gem "rake" gem "rake-compiler" gem "minitest" gem "mocha" +gem "ruby_memcheck" group :deployment, :test do gem "pry-byebug" diff --git a/lib/better_html/test_helper/safe_erb/allowed_script_type.rb b/lib/better_html/test_helper/safe_erb/allowed_script_type.rb index a41249c..b822808 100644 --- a/lib/better_html/test_helper/safe_erb/allowed_script_type.rb +++ b/lib/better_html/test_helper/safe_erb/allowed_script_type.rb @@ -6,7 +6,7 @@ module BetterHtml module TestHelper module SafeErb class AllowedScriptType < Base - VALID_JAVASCRIPT_TAG_TYPES = ["application/ld+json", "text/javascript", "text/template", "text/html"] + VALID_JAVASCRIPT_TAG_TYPES = ["application/ld+json", "text/javascript", "text/template", "text/html", "module"] def validate script_tags.each do |tag, _| diff --git a/lib/better_html/test_helper/safe_lodash_tester.rb b/lib/better_html/test_helper/safe_lodash_tester.rb index db980eb..b83ac7e 100644 --- a/lib/better_html/test_helper/safe_lodash_tester.rb +++ b/lib/better_html/test_helper/safe_lodash_tester.rb @@ -35,7 +35,7 @@ def assert_lodash_safety(data, **options) buffer.source = data tester = Tester.new(buffer, **options) - message = "" + message = +"" tester.errors.each do |error| message << <<~EOL On line #{error.location.line} diff --git a/lib/better_html/version.rb b/lib/better_html/version.rb index 7a86e2b..d668fa8 100644 --- a/lib/better_html/version.rb +++ b/lib/better_html/version.rb @@ -1,5 +1,5 @@ # frozen_string_literal: true module BetterHtml - VERSION = "2.0.1" + VERSION = "2.0.2" end diff --git a/test/better_html/test_helper/safe_lodash_tester_test.rb b/test/better_html/test_helper/safe_lodash_tester_test.rb index 94e38cf..0d61e46 100644 --- a/test/better_html/test_helper/safe_lodash_tester_test.rb +++ b/test/better_html/test_helper/safe_lodash_tester_test.rb @@ -6,6 +6,8 @@ module BetterHtml module TestHelper class SafeLodashTesterTest < ActiveSupport::TestCase + include SafeLodashTester + test "interpolate in attribute not allowed" do errors = parse(<<-EOF).errors
@@ -83,6 +85,43 @@ class SafeLodashTesterTest < ActiveSupport::TestCase assert_equal "javascript statement not allowed here; did you mean '[%=' ?", errors.first.message end + test "assertion failure" do + error = assert_raises(Minitest::Assertion) do + assert_lodash_safety(<<-EOF) +
+ EOF + end + + assert_equal <<~MESSAGE.chomp, error.message + On line 1 + javascript statement not allowed here; did you mean '[%=' ? +
+ ^^^^^^^^^^^^^^ + + ----------- + + The javascript snippets listed above do not appear to be escaped properly + in their context. Here are some tips: + + Always use lodash's escape syntax inside a html tag: + + ^^^^ + + Always use JSON.stringify() for html attributes which contain javascript, like 'onclick', + or twine attributes like 'data-define', 'data-context', 'data-eval', 'data-bind', etc: +
+ ^^^^^^^^^^^^^^ + + Never use