From a42240b5a6e3920c72c340226962690967873929 Mon Sep 17 00:00:00 2001 From: chrniedz Date: Fri, 6 Jan 2017 16:58:18 -0600 Subject: [PATCH 1/6] Fixed XSS resulting from markdown() method --- spec/views/proposals/show.html.haml_spec.rb | 20 ++++++++++++++++++++ spec/views/users/show.html.haml_spec.rb | 17 +++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 spec/views/proposals/show.html.haml_spec.rb create mode 100644 spec/views/users/show.html.haml_spec.rb diff --git a/spec/views/proposals/show.html.haml_spec.rb b/spec/views/proposals/show.html.haml_spec.rb new file mode 100644 index 00000000..c62a513a --- /dev/null +++ b/spec/views/proposals/show.html.haml_spec.rb @@ -0,0 +1,20 @@ +require 'spec_helper' + +describe 'proposals/show' do + let!(:conference) { create(:conference) } + let!(:event) { create(:event_xss, program: conference.program, title: 'event1', language: 'English') } + let(:organizer_role) { Role.find_by(name: 'organizer', resource: conference) } + let(:organizer) { create(:user, name: 'test name', email: 'test@email.osem', role_ids: [organizer_role.id]) } + + it 'renders proposal information' do + sign_in organizer + + assign :conference, conference + assign :event, event + assign :speaker, organizer + + render template: 'proposals/show.html.haml' + + expect(rendered).to_not have_selector("#divInjectedElement") + end +end diff --git a/spec/views/users/show.html.haml_spec.rb b/spec/views/users/show.html.haml_spec.rb new file mode 100644 index 00000000..83d0d4b5 --- /dev/null +++ b/spec/views/users/show.html.haml_spec.rb @@ -0,0 +1,17 @@ +require 'spec_helper' + +describe 'users/show' do + let!(:conference) { create(:conference) } + let(:organizer_role) { Role.find_by(name: 'organizer', resource: conference) } + let(:organizer) { create(:user_xss, name: 'test name', email: 'test@email.osem', role_ids: [organizer_role.id]) } + + it 'renders proposal information' do + sign_in organizer + + assign :user, organizer + + render template: 'users/show.html.haml' + + expect(rendered).to_not have_selector("#divInjectedElement") + end +end From 436c4fd972e1fa48c5f26d6963484301756c898a Mon Sep 17 00:00:00 2001 From: chrniedz Date: Fri, 6 Jan 2017 17:06:21 -0600 Subject: [PATCH 2/6] Fixed XSS from markdown() --- app/helpers/application_helper.rb | 2 +- spec/factories/events.rb | 4 ++++ spec/factories/lodgings.rb | 4 ++++ spec/factories/users.rb | 5 +++++ 4 files changed, 14 insertions(+), 1 deletion(-) diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb index 6dcbd422..eae107cf 100644 --- a/app/helpers/application_helper.rb +++ b/app/helpers/application_helper.rb @@ -260,7 +260,7 @@ module ApplicationHelper space_after_headers: true, no_intra_emphasis: true } - markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML, options) + markdown = Redcarpet::Markdown.new(Redcarpet::Render::HTML.new(escape_html: true), options) markdown.render(text).html_safe end diff --git a/spec/factories/events.rb b/spec/factories/events.rb index c306cdf9..3012429d 100644 --- a/spec/factories/events.rb +++ b/spec/factories/events.rb @@ -35,4 +35,8 @@ FactoryGirl.define do end end end + + factory :event_xss, parent: :event do + abstract { "
" } + end end diff --git a/spec/factories/lodgings.rb b/spec/factories/lodgings.rb index 636d9060..59f9fdb1 100644 --- a/spec/factories/lodgings.rb +++ b/spec/factories/lodgings.rb @@ -6,4 +6,8 @@ FactoryGirl.define do description { Faker::Lorem.paragraph } website_link { Faker::Internet.url } end + + factory :lodging_xss, parent: :lodging do + description { "
" } + end end diff --git a/spec/factories/users.rb b/spec/factories/users.rb index c7ed7ca1..824b4f9a 100644 --- a/spec/factories/users.rb +++ b/spec/factories/users.rb @@ -45,4 +45,9 @@ FactoryGirl.define do end end end + + factory :user_xss, parent: :user do + biography "
" + end + end From 025f1752768114183bd2644e9583e66d4cfbf8ed Mon Sep 17 00:00:00 2001 From: chrniedz Date: Fri, 6 Jan 2017 17:15:50 -0600 Subject: [PATCH 3/6] Fixed XSS from markdown() --- spec/views/admin/lodgings/index.html.haml_spec.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/spec/views/admin/lodgings/index.html.haml_spec.rb b/spec/views/admin/lodgings/index.html.haml_spec.rb index 95f16be4..0c952f76 100644 --- a/spec/views/admin/lodgings/index.html.haml_spec.rb +++ b/spec/views/admin/lodgings/index.html.haml_spec.rb @@ -9,4 +9,14 @@ describe 'admin/lodgings/index' do render expect(rendered).to include(CGI.escapeHTML(@conference.lodgings.first.name)) end + + it 'prevents XSS in lodging description' do + @conference = create(:conference) + @conference.venue = create(:venue) + @conference.lodgings << create(:lodging_xss) + assign :venue, @conference.venue + render + expect(rendered).to_not have_selector("#divInjectedElement") + end + end From 3d8b7435632b5274706a817e58bba64396478c42 Mon Sep 17 00:00:00 2001 From: Chris Niedzwiedz Date: Sat, 7 Jan 2017 00:32:08 -0600 Subject: [PATCH 4/6] Updating quotes --- spec/factories/lodgings.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/factories/lodgings.rb b/spec/factories/lodgings.rb index 59f9fdb1..a4bbf73c 100644 --- a/spec/factories/lodgings.rb +++ b/spec/factories/lodgings.rb @@ -8,6 +8,6 @@ FactoryGirl.define do end factory :lodging_xss, parent: :lodging do - description { "
" } + description { '
' } end end From a0eaf75e9a35f8f01ee87666b077af724a508917 Mon Sep 17 00:00:00 2001 From: Chris Niedzwiedz Date: Sat, 7 Jan 2017 00:32:45 -0600 Subject: [PATCH 5/6] Updating quotes --- spec/factories/events.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/factories/events.rb b/spec/factories/events.rb index 3012429d..06d791e2 100644 --- a/spec/factories/events.rb +++ b/spec/factories/events.rb @@ -37,6 +37,6 @@ FactoryGirl.define do end factory :event_xss, parent: :event do - abstract { "
" } + abstract { '
' } end end From f49ebf634f2bd320fca80a98853ef8ff8d74812a Mon Sep 17 00:00:00 2001 From: Chris Niedzwiedz Date: Sat, 7 Jan 2017 00:33:37 -0600 Subject: [PATCH 6/6] Updating quotes --- spec/factories/users.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/factories/users.rb b/spec/factories/users.rb index 824b4f9a..346ddb80 100644 --- a/spec/factories/users.rb +++ b/spec/factories/users.rb @@ -47,7 +47,7 @@ FactoryGirl.define do end factory :user_xss, parent: :user do - biography "
" + biography '
' end end