escape_utils-1.2.1/ 0000755 0000041 0000041 00000000000 12706333543 014231 5 ustar www-data www-data escape_utils-1.2.1/Rakefile 0000644 0000041 0000041 00000000627 12706333543 015703 0 ustar www-data www-data require 'rake/testtask'
Rake::TestTask.new do |t|
t.pattern = "test/**/*_test.rb"
end
task :default => :test
gem 'rake-compiler', '>= 0.7.5'
require "rake/extensiontask"
Rake::ExtensionTask.new('escape_utils') do |ext|
ext.cross_compile = true
ext.cross_platform = ['x86-mingw32', 'x86-mswin32-60']
ext.lib_dir = File.join 'lib', 'escape_utils'
end
Rake::Task[:test].prerequisites << :compile
escape_utils-1.2.1/Gemfile 0000644 0000041 0000041 00000000047 12706333543 015525 0 ustar www-data www-data source 'https://rubygems.org'
gemspec
escape_utils-1.2.1/script/ 0000755 0000041 0000041 00000000000 12706333543 015535 5 ustar www-data www-data escape_utils-1.2.1/script/testsuite 0000755 0000041 0000041 00000000341 12706333543 017512 0 ustar www-data www-data #!/bin/sh
set -e
cd "$(dirname "$0")/.."
# run entire test suite
ruby --version 1>&2
exec ruby -I. -rubygems \
-r "$(pwd)/test/helper" \
-e "ARGV.each { |f| require(f) }" \
-- ${*:-`find test -name '*_test.rb'`}
escape_utils-1.2.1/script/bootstrap 0000755 0000041 0000041 00000000114 12706333543 017474 0 ustar www-data www-data bundle install --path vendor/gems --binstubs
bin/rake clobber clean compile
escape_utils-1.2.1/.travis.yml 0000644 0000041 0000041 00000000106 12706333543 016337 0 ustar www-data www-data language: ruby
rvm:
- 1.9.3
- 2.0.0
- 2.1.0
- 2.2.0
- 2.3.0
escape_utils-1.2.1/benchmark/ 0000755 0000041 0000041 00000000000 12706333543 016163 5 ustar www-data www-data escape_utils-1.2.1/benchmark/html_unescape.rb 0000644 0000041 0000041 00000001366 12706333543 021345 0 ustar www-data www-data # encoding: utf-8
require 'rubygems'
require 'bundler/setup'
require 'benchmark/ips'
require 'cgi'
require 'haml'
require 'escape_utils'
module HamlBench
extend Haml::Helpers
end
url = "https://en.wikipedia.org/wiki/Succession_to_the_British_throne"
html = `curl -s #{url}`
html = html.force_encoding('binary') if html.respond_to?(:force_encoding)
escaped_html = EscapeUtils.escape_html(html)
puts "Unescaping #{escaped_html.bytesize} bytes of escaped html, from #{url}"
Benchmark.ips do |x|
x.report "CGI.unescapeHTML" do |times|
times.times do
CGI.unescapeHTML(escaped_html)
end
end
x.report "EscapeUtils.unescape_html" do |times|
times.times do
EscapeUtils.unescape_html(escaped_html)
end
end
x.compare!
end
escape_utils-1.2.1/benchmark/xml_escape.rb 0000644 0000041 0000041 00000001116 12706333543 020627 0 ustar www-data www-data # encoding: utf-8
require 'rubygems'
require 'bundler/setup'
require 'benchmark/ips'
require 'fast_xs'
require 'escape_utils'
url = "http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml"
xml = `curl -s #{url}`
xml = xml.force_encoding('binary') if xml.respond_to?(:force_encoding)
puts "Escaping #{xml.bytesize} bytes of xml, from #{url}"
Benchmark.ips do |x|
x.report "fast_xs" do |times|
times.times do
xml.fast_xs
end
end
x.report "EscapeUtils.escape_xml" do |times|
times.times do
EscapeUtils.escape_xml(xml)
end
end
x.compare!
end
escape_utils-1.2.1/benchmark/javascript_escape.rb 0000644 0000041 0000041 00000001475 12706333543 022205 0 ustar www-data www-data # encoding: utf-8
require 'rubygems'
require 'bundler/setup'
require 'benchmark/ips'
require 'action_view'
require 'escape_utils'
class ActionPackBench
extend ActionView::Helpers::JavaScriptHelper
end
url = "http://ajax.googleapis.com/ajax/libs/dojo/1.4.3/dojo/dojo.xd.js.uncompressed.js"
javascript = `curl -s #{url}`
javascript = javascript.force_encoding('utf-8') if javascript.respond_to?(:force_encoding)
puts "Escaping #{javascript.bytesize} bytes of javascript, from #{url}"
Benchmark.ips do |x|
x.report "ActionView::Helpers::JavaScriptHelper#escape_javascript" do |times|
times.times do
ActionPackBench.escape_javascript(javascript)
end
end
x.report "EscapeUtils.escape_javascript" do |times|
times.times do
EscapeUtils.escape_javascript(javascript)
end
end
x.compare!
end
escape_utils-1.2.1/benchmark/html_escape.rb 0000644 0000041 0000041 00000002562 12706333543 021001 0 ustar www-data www-data # encoding: utf-8
require 'rubygems'
require 'bundler/setup'
require 'benchmark/ips'
require 'rack'
require 'erb'
require 'cgi'
require 'haml'
require 'fast_xs_extra'
require 'escape_utils'
module HamlBench
extend Haml::Helpers
end
url = "https://en.wikipedia.org/wiki/Succession_to_the_British_throne"
html = `curl -s #{url}`
html = html.force_encoding('utf-8') if html.respond_to?(:force_encoding)
puts "Escaping #{html.bytesize} bytes of html from #{url}"
Benchmark.ips do |x|
x.report "Rack::Utils.escape_html" do |times|
times.times do
Rack::Utils.escape_html(html)
end
end
x.report "Haml::Helpers.html_escape" do |times|
times.times do
HamlBench.html_escape(html)
end
end
x.report "ERB::Util.html_escape" do |times|
times.times do
ERB::Util.html_escape(html)
end
end
x.report "CGI.escapeHTML" do |times|
times.times do
CGI.escapeHTML(html)
end
end
x.report "String#gsub" do |times|
html_escape = { '&' => '&', '>' => '>', '<' => '<', '"' => '"', "'" => ''' }
times.times do
html.gsub(/[&"'><]/, html_escape)
end
end
x.report "fast_xs_extra#fast_xs_html" do |times|
times.times do
html.fast_xs_html
end
end
x.report "EscapeUtils.escape_html" do |times|
times.times do
EscapeUtils.escape_html(html)
end
end
x.compare!
end
escape_utils-1.2.1/benchmark/url_unescape.rb 0000644 0000041 0000041 00000002111 12706333543 021170 0 ustar www-data www-data # encoding: utf-8
require 'rubygems'
require 'bundler/setup'
require 'benchmark/ips'
require 'rack'
require 'cgi'
require 'url_escape'
require 'fast_xs_extra'
require 'escape_utils'
url = "https://www.yourmom.com/cgi-bin/session.cgi?sess_args=mYHcEA dh435dqUs0moGHeeAJTSLLbdbcbd9ef----,574b95600e9ab7d27eb0bf524ac68c27----"
url = url.force_encoding('us-ascii') if url.respond_to?(:force_encoding)
escaped_url = EscapeUtils.escape_url(url)
puts "Escaping a #{url.bytesize} byte URL"
Benchmark.ips do |x|
x.report "Rack::Utils.unescape" do |times|
times.times do
Rack::Utils.unescape(escaped_url)
end
end
x.report "CGI.unescape" do |times|
times.times do
CGI.unescape(escaped_url)
end
end
x.report "URLEscape#unescape" do |times|
times.times do
URLEscape.unescape(escaped_url)
end
end
x.report "fast_xs_extra#fast_uxs_cgi" do |times|
times.times do
url.fast_uxs_cgi
end
end
x.report "EscapeUtils.unescape_url" do |times|
times.times do
EscapeUtils.unescape_url(escaped_url)
end
end
x.compare!
end
escape_utils-1.2.1/benchmark/javascript_unescape.rb 0000644 0000041 0000041 00000001172 12706333543 022542 0 ustar www-data www-data # encoding: utf-8
require 'rubygems'
require 'bundler/setup'
require 'benchmark/ips'
require 'escape_utils'
url = "http://ajax.googleapis.com/ajax/libs/dojo/1.4.3/dojo/dojo.xd.js.uncompressed.js"
javascript = `curl -s #{url}`
javascript = javascript.force_encoding('utf-8') if javascript.respond_to?(:force_encoding)
escaped_javascript = EscapeUtils.escape_javascript(javascript)
puts "Escaping #{escaped_javascript.bytesize} bytes of javascript, from #{url}"
Benchmark.ips do |x|
x.report "EscapeUtils.escape_javascript" do |times|
times.times do
EscapeUtils.unescape_javascript(escaped_javascript)
end
end
end
escape_utils-1.2.1/benchmark/url_escape.rb 0000644 0000041 0000041 00000002160 12706333543 020631 0 ustar www-data www-data # encoding: utf-8
require 'rubygems'
require 'bundler/setup'
require 'benchmark/ips'
require 'rack'
require 'erb'
require 'cgi'
require 'url_escape'
require 'fast_xs_extra'
require 'escape_utils'
url = "https://www.yourmom.com/cgi-bin/session.cgi?sess_args=mYHcEA dh435dqUs0moGHeeAJTSLLbdbcbd9ef----,574b95600e9ab7d27eb0bf524ac68c27----"
url = url.force_encoding('us-ascii') if url.respond_to?(:force_encoding)
puts "Escaping a #{url.bytesize} byte URL times"
Benchmark.ips do |x|
x.report "ERB::Util.url_encode" do |times|
times.times do
ERB::Util.url_encode(url)
end
end
x.report "Rack::Utils.escape" do |times|
times.times do
Rack::Utils.escape(url)
end
end
x.report "CGI.escape" do |times|
times.times do
CGI.escape(url)
end
end
x.report "URLEscape#escape" do |times|
times.times do
URLEscape.escape(url)
end
end
x.report "fast_xs_extra#fast_xs_url" do |times|
times.times do
url.fast_xs_url
end
end
x.report "EscapeUtils.escape_url" do |times|
times.times do
EscapeUtils.escape_url(url)
end
end
x.compare!
end
escape_utils-1.2.1/lib/ 0000755 0000041 0000041 00000000000 12706333543 014777 5 ustar www-data www-data escape_utils-1.2.1/lib/escape_utils.rb 0000644 0000041 0000041 00000001504 12706333543 020004 0 ustar www-data www-data require 'escape_utils/escape_utils'
require 'escape_utils/version' unless defined? EscapeUtils::VERSION
module EscapeUtils
extend self
# turn on/off the escaping of the '/' character during HTML escaping
# Escaping '/' is recommended by the OWASP - http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
# This is because quotes around HTML attributes are optional in most/all modern browsers at the time of writing (10/15/2010)
def self.html_secure
@html_secure
end
self.html_secure = true
# Default String class to return from HTML escaping
def self.html_safe_string_class
@html_safe_string_class
end
self.html_safe_string_class = String
autoload :HtmlSafety, 'escape_utils/html_safety'
end escape_utils-1.2.1/lib/escape_utils/ 0000755 0000041 0000041 00000000000 12706333543 017457 5 ustar www-data www-data escape_utils-1.2.1/lib/escape_utils/html/ 0000755 0000041 0000041 00000000000 12706333543 020423 5 ustar www-data www-data escape_utils-1.2.1/lib/escape_utils/html/rack.rb 0000644 0000041 0000041 00000000220 12706333543 021662 0 ustar www-data www-data module Rack
module Utils
include ::EscapeUtils::HtmlSafety
alias escape_html _escape_html
module_function :escape_html
end
end
escape_utils-1.2.1/lib/escape_utils/html/erb.rb 0000644 0000041 0000041 00000000273 12706333543 021522 0 ustar www-data www-data class ERB
module Util
include ::EscapeUtils::HtmlSafety
alias html_escape _escape_html
alias h html_escape
module_function :h
module_function :html_escape
end
end escape_utils-1.2.1/lib/escape_utils/html/haml.rb 0000644 0000041 0000041 00000000160 12706333543 021666 0 ustar www-data www-data module Haml
module Helpers
include ::EscapeUtils::HtmlSafety
alias html_escape _escape_html
end
end escape_utils-1.2.1/lib/escape_utils/html/cgi.rb 0000644 0000041 0000041 00000000262 12706333543 021512 0 ustar www-data www-data class CGI
extend ::EscapeUtils::HtmlSafety
class << self
alias escapeHTML _escape_html
def unescapeHTML(s)
EscapeUtils.unescape_html(s.to_s)
end
end
end escape_utils-1.2.1/lib/escape_utils/javascript/ 0000755 0000041 0000041 00000000000 12706333543 021625 5 ustar www-data www-data escape_utils-1.2.1/lib/escape_utils/javascript/action_view.rb 0000644 0000041 0000041 00000000250 12706333543 024456 0 ustar www-data www-data module ActionView
module Helpers
module JavaScriptHelper
def escape_javascript(s)
EscapeUtils.escape_javascript(s.to_s)
end
end
end
end
escape_utils-1.2.1/lib/escape_utils/version.rb 0000644 0000041 0000041 00000000053 12706333543 021467 0 ustar www-data www-data module EscapeUtils
VERSION = "1.2.1"
end
escape_utils-1.2.1/lib/escape_utils/xml/ 0000755 0000041 0000041 00000000000 12706333543 020257 5 ustar www-data www-data escape_utils-1.2.1/lib/escape_utils/xml/builder.rb 0000644 0000041 0000041 00000000210 12706333543 022223 0 ustar www-data www-data module Builder
class XmlBase < BlankSlate
private
def _escape(text)
EscapeUtils.escape_xml(text.to_s)
end
end
end
escape_utils-1.2.1/lib/escape_utils/url/ 0000755 0000041 0000041 00000000000 12706333543 020261 5 ustar www-data www-data escape_utils-1.2.1/lib/escape_utils/url/rack.rb 0000644 0000041 0000041 00000000351 12706333543 021525 0 ustar www-data www-data module Rack
module Utils
def escape(url)
EscapeUtils.escape_url(url.to_s)
end
def unescape(url)
EscapeUtils.unescape_url(url.to_s)
end
module_function :escape
module_function :unescape
end
end
escape_utils-1.2.1/lib/escape_utils/url/uri.rb 0000644 0000041 0000041 00000000232 12706333543 021402 0 ustar www-data www-data module URI
def self.escape(s, unsafe=nil)
EscapeUtils.escape_uri(s.to_s)
end
def self.unescape(s)
EscapeUtils.unescape_uri(s.to_s)
end
end escape_utils-1.2.1/lib/escape_utils/url/erb.rb 0000644 0000041 0000041 00000000262 12706333543 021356 0 ustar www-data www-data class ERB
module Util
def url_encode(s)
EscapeUtils.escape_url(s.to_s)
end
alias u url_encode
module_function :u
module_function :url_encode
end
end escape_utils-1.2.1/lib/escape_utils/url/cgi.rb 0000644 0000041 0000041 00000000215 12706333543 021346 0 ustar www-data www-data class CGI
def self.escape(s)
EscapeUtils.escape_url(s.to_s)
end
def self.unescape(s)
EscapeUtils.unescape_url(s.to_s)
end
end escape_utils-1.2.1/lib/escape_utils/html_safety.rb 0000644 0000041 0000041 00000000524 12706333543 022324 0 ustar www-data www-data module EscapeUtils
module HtmlSafety
if "".respond_to? :html_safe?
def _escape_html(s)
if s.html_safe?
s.to_s.html_safe
else
EscapeUtils.escape_html(s.to_s).html_safe
end
end
else
def _escape_html(s)
EscapeUtils.escape_html(s.to_s)
end
end
end
end
escape_utils-1.2.1/test/ 0000755 0000041 0000041 00000000000 12706333543 015210 5 ustar www-data www-data escape_utils-1.2.1/test/html/ 0000755 0000041 0000041 00000000000 12706333543 016154 5 ustar www-data www-data escape_utils-1.2.1/test/html/escape_test.rb 0000644 0000041 0000041 00000010244 12706333543 021001 0 ustar www-data www-data require File.expand_path("../../helper", __FILE__)
class MyCustomHtmlSafeString < String
end
class HtmlEscapeTest < Minitest::Test
def test_escape_source_encoding_is_maintained
source = 'foobar'
str = EscapeUtils.escape_html_as_html_safe(source)
assert_equal source.encoding, str.encoding
end
def test_escape_binary_encoding_is_maintained
source = 'foobar'.b
str = EscapeUtils.escape_html_as_html_safe(source)
assert_equal source.encoding, str.encoding
end
def test_escape_uft8_encoding_is_maintained
source = 'foobar'.encode 'UTF-8'
str = EscapeUtils.escape_html_as_html_safe(source)
assert_equal source.encoding, str.encoding
end
def test_escape_us_ascii_encoding_is_maintained
source = 'foobar'.encode 'US-ASCII'
str = EscapeUtils.escape_html_as_html_safe(source)
assert_equal source.encoding, str.encoding
end
def test_escape_basic_html_with_secure
assert_equal "<some_tag/>", EscapeUtils.escape_html("")
secure_before = EscapeUtils.html_secure
EscapeUtils.html_secure = true
assert_equal "<some_tag/>", EscapeUtils.escape_html("")
EscapeUtils.html_secure = secure_before
end
def test_escape_basic_html_without_secure
assert_equal "<some_tag/>", EscapeUtils.escape_html("", false)
secure_before = EscapeUtils.html_secure
EscapeUtils.html_secure = false
assert_equal "<some_tag/>", EscapeUtils.escape_html("")
EscapeUtils.html_secure = secure_before
end
def test_escape_double_quotes
assert_equal "<some_tag some_attr="some value"/>", EscapeUtils.escape_html("")
end
def test_escape_single_quotes
assert_equal "<some_tag some_attr='some value'/>", EscapeUtils.escape_html("")
end
def test_escape_ampersand
assert_equal "<b>Bourbon & Branch</b>", EscapeUtils.escape_html("Bourbon & Branch")
end
def test_returns_original_if_not_escaped
str = 'foobar'
assert_equal str.object_id, EscapeUtils.escape_html(str).object_id
end
def test_html_safe_escape_default_works
str = EscapeUtils.escape_html_as_html_safe('foobar')
assert_equal 'foobar', str
end
def test_returns_custom_string_class
klass_before = EscapeUtils.html_safe_string_class
EscapeUtils.html_safe_string_class = MyCustomHtmlSafeString
str = EscapeUtils.escape_html_as_html_safe('foobar')
assert_equal 'foobar', str
assert_equal MyCustomHtmlSafeString, str.class
assert_equal true, str.instance_variable_get(:@html_safe)
ensure
EscapeUtils.html_safe_string_class = klass_before
end
def test_returns_custom_string_class_when_string_requires_escaping
klass_before = EscapeUtils.html_safe_string_class
EscapeUtils.html_safe_string_class = MyCustomHtmlSafeString
str = EscapeUtils.escape_html_as_html_safe("