ActionItem192: fixing xss_terminate plugin and some functionals tests

git-svn-id: https://svn.colivre.coop.br/svn/noosfero/trunk@1724 3f533792-8f58-4932-b0fe-aaf55b0a4547

ActionItem192: fixing xss_terminate plugin and some functionals tests
git-svn-id: https://svn.colivre.coop.br/svn/noosfero/trunk@1724 3f533792-8f58-4932-b0fe-aaf55b0a4547
JoenioCosta
1 parent 741b63db
Showing 22 changed files with 115 additions and 83 deletions Show diff stats
app/models/community.rb
app/models/create_enterprise.rb
app/models/organization_info.rb
app/models/text_article.rb
app/models/tiny_mce_article.rb
test/functional/admin_controller_test.rb
test/functional/catalog_controller_test.rb
test/functional/cms_controller_test.rb
test/functional/consumed_products_controller_test.rb
test/functional/content_viewer_controller_test.rb
test/functional/enterprise_editor_controller_test.rb
test/functional/enterprise_registration_controller_test.rb
test/functional/enterprise_validation_test.rb
test/functional/manage_products_controller_test.rb
test/functional/memberships_controller_test.rb
test/functional/my_profile_controller_test.rb
test/functional/profile_design_controller_test.rb
test/functional/profile_editor_controller_test.rb
test/functional/profile_members_controller_test.rb
test/functional/public_controller_test.rb
@@ -3,7 +3,7 @@ class Community &lt; Organization
   settings_items :description
-  xss_terminate :only => [ :description ]
+  xss_terminate :only => [ :name, :address, :contact_phone, :description ]
   def name=(value)
     super(value)
@@ -40,7 +40,7 @@ class CreateEnterprise &lt; Task
   # check for explanation when rejecting
   validates_presence_of :reject_explanation, :if => (lambda { |record| record.status == Task::Status::CANCELLED } )
-  xss_terminate :only => [ :acronym, :address, :contact_person, :contact_phone, :economic_activity, :foundation_year, :legal_form, :management_information, :name ], :on => 'validation'
+  xss_terminate :only => [ :acronym, :address, :contact_person, :contact_phone, :economic_activity, :legal_form, :management_information, :name ], :on => 'validation'
   def validate
     if self.region && self.target
@@ -5,9 +5,7 @@ class OrganizationInfo &lt; ActiveRecord::Base
   validates_format_of :contact_email, :with => Noosfero::Constants::EMAIL_FORMAT, :if => (lambda { |info| ! info.contact_email.nil? })
-  xss_terminate :only => [ :acronym, :contact_person, :contact_email, :foundation_year, :legal_form, :economic_activity, :management_information ]
-
-  #xss_terminate :only => [ :acronym, :contact_person, :contact_phone, :economic_activity, :foundation_year, :legal_form, :management_information, :address, :name ]
+  xss_terminate :only => [ :acronym, :contact_person, :contact_email, :legal_form, :economic_activity, :management_information ]
   def summary
     # FIXME diplays too few fields
 # a base class for all text article types.  
 class TextArticle < Article
+  xss_terminate :only => [ :name, :abstract, :body ]
+
 end
@@ -7,4 +7,8 @@ class TinyMceArticle &lt; TextArticle
   def self.description
     _('Not accessible for visually impaired users.')
   end
+  
+  xss_terminate :except => [ :abstract, :body ]
+  xss_terminate :only => [ :abstract, :body ], :with => 'white_list'
+
 end
@@ -11,16 +11,9 @@ class AdminControllerTest &lt; Test::Unit::TestCase
     @response   = ActionController::TestResponse.new
   end
-  def test_local_files_reference
-    assert_local_files_reference
-  end
-  
-  def test_valid_xhtml
-    assert_valid_xhtml
-  end
-  
   # Replace this with your real tests.
   def test_truth
     assert true
   end
+
 end
@@ -12,7 +12,8 @@ class CatalogControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    user = create_user('user_test').person
+    assert_local_files_reference :get, :index, :profile => user.identifier
   end
   def test_valid_xhtml
@@ -20,7 +20,7 @@ class CmsControllerTest &lt; Test::Unit::TestCase
   attr_reader :profile
   def test_local_files_reference
-    assert_local_files_reference
+    assert_local_files_reference :get, :index, :profile => profile.identifier
   end
   def test_valid_xhtml
@@ -267,5 +267,40 @@ class CmsControllerTest &lt; Test::Unit::TestCase
     assert_not_includes saved.categories, c2
     assert_includes saved.categories, c3
   end
+  
+  should 'filter html from textile article name' do
+    post :new, :type => 'TextileArticle', :profile => profile.identifier, :article => { :name => 'a <strong>test</strong> article', :body => 'the text of the article ...' }
+    assert_sanitized assigns(:article).name
+  end
+  
+  should 'filter html from textile article abstract' do
+    post :new, :type => 'TextileArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => '<strong>abstract</strong>', :body => 'the text of the article ...' }
+    assert_sanitized assigns(:article).abstract
+  end
+  
+  should 'filter html from textile article body' do
+    post :new, :type => 'TextileArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => 'abstract', :body => 'the <b>text</b> of <a href=#>the</a> article ...' }
+    assert_sanitized assigns(:article).body
+  end
+  
+  should 'filter html with white_list from tiny mce article name' do
+    post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => "<strong>test</strong>", :body => 'the text of the article ...' }
+    assert_equal "<strong>test</strong>", assigns(:article).name
+  end
+  
+  should 'filter html with white_list from tiny mce article abstract' do
+    post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => "<script>alert('test')</script> article", :body => 'the text of the article ...' }
+    assert_equal " article", assigns(:article).abstract
+  end
+  
+  should 'filter html with white_list from tiny mce article body' do
+    post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => 'abstract', :body => "the <script>alert('text')</script> of article ..." }
+    assert_equal "the  of article ...", assigns(:article).body
+  end
+  
+  should 'not filter html tags permitted from tiny mce article body' do
+    post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => 'abstract', :body => "<b>the</b> <script>alert('text')</script> <strong>of</strong> article ..." }
+    assert_equal "<b>the</b>  <strong>of</strong> article ...", assigns(:article).body
+  end
 end
@@ -18,7 +18,7 @@ class ConsumedProductsControllerTest &lt; Test::Unit::TestCase
   attr_reader :profile
   def test_local_files_reference
-    assert_local_files_reference
+    assert_local_files_reference :get, :index, :profile => profile.identifier
   end
   def test_valid_xhtml
@@ -18,7 +18,9 @@ class ContentViewerControllerTest &lt; Test::Unit::TestCase
   attr_reader :profile
   def test_local_files_reference
-    assert_local_files_reference
+    page = profile.articles.build(:name => 'test')
+    page.save!
+    assert_local_files_reference :get, :view_page, :profile => profile.identifier, :page => [ 'test' ]
   end
   def test_valid_xhtml
@@ -12,7 +12,8 @@ class EnterpriseEditorControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    user = create_user('test_user').person
+    assert_local_files_reference :get, :index, :profile => user.identifier
   end
   def test_valid_xhtml
@@ -119,11 +119,6 @@ all_fixtures
     assert_sanitized assigns(:create_enterprise).acronym
   end
-  should 'filter html from foundation_year' do
-    post :index, :create_enterprise => { 'name' => 'name', 'identifier' => 'mynew', :foundation_year => '<b>foundation_year</b>' }
-    assert_sanitized assigns(:create_enterprise).foundation_year
-  end
-
   should 'filter html from legal_form' do
     post :index, :create_enterprise => { 'name' => 'name', 'identifier' => 'mynew', :legal_form => '<b>legal_form</b>' }
     assert_sanitized assigns(:create_enterprise).legal_form
@@ -20,7 +20,7 @@ class EnterpriseValidationControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    assert_local_files_reference :get, :index, :profile => 'ze'
   end
   def test_valid_xhtml
@@ -16,7 +16,7 @@ class ManageProductsControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    assert_local_files_reference :get, :index, :profile => 'test_user'
   end
   def test_valid_xhtml
@@ -17,7 +17,7 @@ class MembershipsControllerTest &lt; Test::Unit::TestCase
   attr_reader :profile
   def test_local_files_reference
-    assert_local_files_reference
+    assert_local_files_reference :get, :index, :profile => profile.identifier
   end
   def test_valid_xhtml
@@ -21,7 +21,10 @@ class MyProfileControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    @controller = OnlyForPersonTestController.new
+    user = create_user('test_user').person
+    assert_local_files_reference :get, :index, :profile => user.identifier
+    #get :index, :profile => user.identifier
   end
   def test_valid_xhtml
@@ -63,7 +63,7 @@ class ProfileDesignControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    assert_local_files_reference :get, :index, :profile => 'ze'
   end
   def test_valid_xhtml
@@ -15,7 +15,7 @@ class ProfileEditorControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    assert_local_files_reference :get, :index, :profile => 'ze'
   end
   def test_valid_xhtml
@@ -12,7 +12,8 @@ class ProfileMembersControllerTest &lt; Test::Unit::TestCase
   end
   def test_local_files_reference
-    assert_local_files_reference
+    user = create_user('test_user').person
+    assert_local_files_reference :get, :index, :profile => user.identifier
   end
   def test_valid_xhtml
@@ -12,14 +12,6 @@ class PublicControllerTest &lt; Test::Unit::TestCase
     @response   = ActionController::TestResponse.new
   end
-  def test_local_files_reference
-    assert_local_files_reference
-  end
-  
-  def test_valid_xhtml
-    assert_valid_xhtml
-  end
-  
   # Replace this with your real tests.
   def test_truth
     assert true
@@ -11,14 +11,6 @@ class SystemControllerTest &lt; Test::Unit::TestCase
     @response   = ActionController::TestResponse.new
   end
-  def test_local_files_reference
-    assert_local_files_reference
-  end
-  
-  def test_valid_xhtml
-    assert_valid_xhtml
-  end
-  
   # Replace this with your real tests.
   def test_truth
     assert true
@@ -15,65 +15,78 @@ module XssTerminate
   module ClassMethods
     def xss_terminate(options = {})
+      options[:with] ||= 'full'
+      filter_with = 'sanitize_fields_with_' + options[:with]
       # :on is util when before_filter dont work for model
       case options[:on]
         when 'create'
-          before_create :sanitize_fields
+          before_create filter_with
         when 'validation'
-          before_validation :sanitize_fields
+          before_validation filter_with
         else
-          before_save :sanitize_fields
+          before_save filter_with
       end
-
-      sanitizer = case options[:with]
-        when 'html5lib'
-          HTML5libSanitize.new
-        when 'white_list'
-          RailsSanitize.white_list_sanitizer
-        else
-          RailsSanitize.full_sanitizer
-      end
-
-      write_inheritable_attribute(:xss_terminate_options, {
+      write_inheritable_attribute("xss_terminate_#{options[:with]}_options".to_sym, {
         :except => (options[:except] || []),
-        :only => (options[:only] || options[:sanitize] || []),
-        :sanitizer => sanitizer,
-
-        :html5lib_sanitize => (options[:html5lib_sanitize] || [])
+        :only => (options[:only] || options[:sanitize] || [])
       })
-
-      class_inheritable_reader :xss_terminate_options
-
+      class_inheritable_reader "xss_terminate_#{options[:with]}_options".to_sym
       include XssTerminate::InstanceMethods
     end
+
   end
   module InstanceMethods
-    def sanitize_fields
+    def sanitize_field(sanitizer, field, serialized = false)
+      field = field.to_sym
+      if serialized
+        puts field
+        self[field].each_key { |key|
+          key = key.to_sym
+          self[field][key] = sanitizer.sanitize(self[field][key])
+        }
+      else
+        if self[field]
+          self[field] = sanitizer.sanitize(self[field])
+        else
+          self.send("#{field}=", sanitizer.sanitize(self.send("#{field}")))
+        end
+      end
+    end
-      columns = self.class.columns.select{ |i| i.type == :string || i.type == :text }.map{ |i| i.name }
+    def sanitize_columns(with = :full)
       columns_serialized = self.class.serialized_attributes.keys
+      only = eval "xss_terminate_#{with}_options[:only]"
+      except = eval "xss_terminate_#{with}_options[:except]"
+      unless except.empty?
+        only.delete_if{ |i| except.include?( i.to_sym ) }
+      end
+      return only, columns_serialized
+    end
-      if !xss_terminate_options[:only].empty?
-        columns = columns.select{ |i| xss_terminate_options[:only].include?( i.to_sym ) }
-      elsif !xss_terminate_options[:except].empty?
-        columns.delete_if{ |i| xss_terminate_options[:except].include?( i.to_sym ) }
+    def sanitize_fields_with_full
+      sanitizer = RailsSanitize.full_sanitizer
+      columns, columns_serialized = sanitize_columns(:full)
+      columns.each do |column|
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
+    end
+    def sanitize_fields_with_white_list
+      sanitizer = RailsSanitize.white_list_sanitizer
+      columns, columns_serialized = sanitize_columns(:white_list)
       columns.each do |column|
-        field = column.to_sym
-        if columns_serialized.include?(column)
-          next unless self[field]
-          self[field].each_key { |key|
-            key = key.to_sym
-            self[field][key] = xss_terminate_options[:sanitizer].sanitize(self[field][key])
-          }
-        else
-          self[field] = xss_terminate_options[:sanitizer].sanitize(self[field])
-        end
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
       end
+    end
+    def sanitize_fields_with_html5lib
+      sanitizer = HTML5libSanitize.new
+      columns = sanitize_columns(:html5lib)
+      columns.each do |column|
+        sanitize_field(sanitizer, column.to_sym, columns_serialized.include?(column))
+      end
     end
   end
	@@ -3,7 +3,7 @@ class Community < Organization		@@ -3,7 +3,7 @@ class Community < Organization
3		3
4	settings_items :description	4	settings_items :description
5		5
6	- xss_terminate :only => [ :description ]	6	+ xss_terminate :only => [ :name, :address, :contact_phone, :description ]
7		7
8	def name=(value)	8	def name=(value)
9	super(value)	9	super(value)
	@@ -40,7 +40,7 @@ class CreateEnterprise < Task		@@ -40,7 +40,7 @@ class CreateEnterprise < Task
40	# check for explanation when rejecting	40	# check for explanation when rejecting
41	validates_presence_of :reject_explanation, :if => (lambda { \|record\| record.status == Task::Status::CANCELLED } )	41	validates_presence_of :reject_explanation, :if => (lambda { \|record\| record.status == Task::Status::CANCELLED } )
42		42
43	- xss_terminate :only => [ :acronym, :address, :contact_person, :contact_phone, :economic_activity, :foundation_year, :legal_form, :management_information, :name ], :on => 'validation'	43	+ xss_terminate :only => [ :acronym, :address, :contact_person, :contact_phone, :economic_activity, :legal_form, :management_information, :name ], :on => 'validation'
44		44
45	def validate	45	def validate
46	if self.region && self.target	46	if self.region && self.target
	@@ -5,9 +5,7 @@ class OrganizationInfo < ActiveRecord::Base		@@ -5,9 +5,7 @@ class OrganizationInfo < ActiveRecord::Base
5		5
6	validates_format_of :contact_email, :with => Noosfero::Constants::EMAIL_FORMAT, :if => (lambda { \|info\| ! info.contact_email.nil? })	6	validates_format_of :contact_email, :with => Noosfero::Constants::EMAIL_FORMAT, :if => (lambda { \|info\| ! info.contact_email.nil? })
7		7
8	- xss_terminate :only => [ :acronym, :contact_person, :contact_email, :foundation_year, :legal_form, :economic_activity, :management_information ]
9	-
10	- #xss_terminate :only => [ :acronym, :contact_person, :contact_phone, :economic_activity, :foundation_year, :legal_form, :management_information, :address, :name ]	8	+ xss_terminate :only => [ :acronym, :contact_person, :contact_email, :legal_form, :economic_activity, :management_information ]
11		9
12	def summary	10	def summary
13	# FIXME diplays too few fields	11	# FIXME diplays too few fields
1	# a base class for all text article types.	1	# a base class for all text article types.
2	class TextArticle < Article	2	class TextArticle < Article
3		3
		4	+ xss_terminate :only => [ :name, :abstract, :body ]
		5	+
4	end	6	end
	@@ -7,4 +7,8 @@ class TinyMceArticle < TextArticle		@@ -7,4 +7,8 @@ class TinyMceArticle < TextArticle
7	def self.description	7	def self.description
8	_('Not accessible for visually impaired users.')	8	_('Not accessible for visually impaired users.')
9	end	9	end
		10	+
		11	+ xss_terminate :except => [ :abstract, :body ]
		12	+ xss_terminate :only => [ :abstract, :body ], :with => 'white_list'
		13	+
10	end	14	end
	@@ -12,7 +12,8 @@ class CatalogControllerTest < Test::Unit::TestCase		@@ -12,7 +12,8 @@ class CatalogControllerTest < Test::Unit::TestCase
12	end	12	end
13		13
14	def test_local_files_reference	14	def test_local_files_reference
15	- assert_local_files_reference	15	+ user = create_user('user_test').person
		16	+ assert_local_files_reference :get, :index, :profile => user.identifier
16	end	17	end
17		18
18	def test_valid_xhtml	19	def test_valid_xhtml
	@@ -20,7 +20,7 @@ class CmsControllerTest < Test::Unit::TestCase		@@ -20,7 +20,7 @@ class CmsControllerTest < Test::Unit::TestCase
20	attr_reader :profile	20	attr_reader :profile
21		21
22	def test_local_files_reference	22	def test_local_files_reference
23	- assert_local_files_reference	23	+ assert_local_files_reference :get, :index, :profile => profile.identifier
24	end	24	end
25		25
26	def test_valid_xhtml	26	def test_valid_xhtml
	@@ -267,5 +267,40 @@ class CmsControllerTest < Test::Unit::TestCase		@@ -267,5 +267,40 @@ class CmsControllerTest < Test::Unit::TestCase
267	assert_not_includes saved.categories, c2	267	assert_not_includes saved.categories, c2
268	assert_includes saved.categories, c3	268	assert_includes saved.categories, c3
269	end	269	end
		270	+
		271	+ should 'filter html from textile article name' do
		272	+ post :new, :type => 'TextileArticle', :profile => profile.identifier, :article => { :name => 'a <strong>test</strong> article', :body => 'the text of the article ...' }
		273	+ assert_sanitized assigns(:article).name
		274	+ end
		275	+
		276	+ should 'filter html from textile article abstract' do
		277	+ post :new, :type => 'TextileArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => '<strong>abstract</strong>', :body => 'the text of the article ...' }
		278	+ assert_sanitized assigns(:article).abstract
		279	+ end
		280	+
		281	+ should 'filter html from textile article body' do
		282	+ post :new, :type => 'TextileArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => 'abstract', :body => 'the <b>text</b> of <a href=#>the</a> article ...' }
		283	+ assert_sanitized assigns(:article).body
		284	+ end
		285	+
		286	+ should 'filter html with white_list from tiny mce article name' do
		287	+ post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => "<strong>test</strong>", :body => 'the text of the article ...' }
		288	+ assert_equal "<strong>test</strong>", assigns(:article).name
		289	+ end
		290	+
		291	+ should 'filter html with white_list from tiny mce article abstract' do
		292	+ post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => "<script>alert('test')</script> article", :body => 'the text of the article ...' }
		293	+ assert_equal " article", assigns(:article).abstract
		294	+ end
		295	+
		296	+ should 'filter html with white_list from tiny mce article body' do
		297	+ post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => 'abstract', :body => "the <script>alert('text')</script> of article ..." }
		298	+ assert_equal "the of article ...", assigns(:article).body
		299	+ end
		300	+
		301	+ should 'not filter html tags permitted from tiny mce article body' do
		302	+ post :new, :type => 'TinyMceArticle', :profile => profile.identifier, :article => { :name => 'article', :abstract => 'abstract', :body => "<b>the</b> <script>alert('text')</script> <strong>of</strong> article ..." }
		303	+ assert_equal "<b>the</b> <strong>of</strong> article ...", assigns(:article).body
		304	+ end
270		305
271	end	306	end
	@@ -18,7 +18,7 @@ class ConsumedProductsControllerTest < Test::Unit::TestCase		@@ -18,7 +18,7 @@ class ConsumedProductsControllerTest < Test::Unit::TestCase
18	attr_reader :profile	18	attr_reader :profile
19		19
20	def test_local_files_reference	20	def test_local_files_reference
21	- assert_local_files_reference	21	+ assert_local_files_reference :get, :index, :profile => profile.identifier
22	end	22	end
23		23
24	def test_valid_xhtml	24	def test_valid_xhtml
	@@ -12,7 +12,8 @@ class EnterpriseEditorControllerTest < Test::Unit::TestCase		@@ -12,7 +12,8 @@ class EnterpriseEditorControllerTest < Test::Unit::TestCase
12	end	12	end
13		13
14	def test_local_files_reference	14	def test_local_files_reference
15	- assert_local_files_reference	15	+ user = create_user('test_user').person
		16	+ assert_local_files_reference :get, :index, :profile => user.identifier
16	end	17	end
17		18
18	def test_valid_xhtml	19	def test_valid_xhtml
	@@ -20,7 +20,7 @@ class EnterpriseValidationControllerTest < Test::Unit::TestCase		@@ -20,7 +20,7 @@ class EnterpriseValidationControllerTest < Test::Unit::TestCase
20	end	20	end
21		21
22	def test_local_files_reference	22	def test_local_files_reference
23	- assert_local_files_reference	23	+ assert_local_files_reference :get, :index, :profile => 'ze'
24	end	24	end
25		25
26	def test_valid_xhtml	26	def test_valid_xhtml