Home Explore Help
Register Sign In
J1X
/
huginn
Watch 2
Star 0
Fork 0

Browse Source
Merge branch 'master' into human_task_agent

Andrew Cantino 11 years ago
parent
d766eb6cd3 63e0147dd6
commit
e24f940ac8
6 changed files with 44 additions and 10 deletions
Show Diff Stats
  1. 3 3
      app/views/agents/agent_views/peak_detector_agent/_show.html.erb
  2. 2 2
      app/views/agents/agent_views/twitter_stream_agent/_show.html.erb
  3. 2 2
      app/views/agents/show.html.erb
  4. 1 1
      app/views/events/show.html.erb
  5. 14 2
      lib/utils.rb
  6. 22 0
      spec/lib/utils_spec.rb

+ 3 - 3
app/views/agents/agent_views/peak_detector_agent/_show.html.erb
View File 

@@ -17,9 +17,9 @@
17 17 
       <script>
18 18 
         $(function() {
19 19 
           var $chart = $(".chart-container.group-<%= index.to_s %>").last();
20 
-          var data = <%= data.map {|count, time| { :x => time.to_i, :y => count.to_i } }.to_json.html_safe %>;
21 
-          var peaks = <%= ((@agent.memory[:peaks] && @agent.memory[:peaks][group_name]) || []).to_json.html_safe %>;
22 
-          var name = <%= group_name.to_json.html_safe %>;
20 
+          var data = <%= Utils.jsonify(data.map {|count, time| { :x => time.to_i, :y => count.to_i } }) %>;
21 
+          var peaks = <%= Utils.jsonify((@agent.memory[:peaks] && @agent.memory[:peaks][group_name]) || []) %>;
22 
+          var name = <%= Utils.jsonify(group_name) %>;
23 23
24 24 
           renderGraph($chart, data, peaks, name);
25 25 
         });

+ 2 - 2
app/views/agents/agent_views/twitter_stream_agent/_show.html.erb
View File 

@@ -35,8 +35,8 @@
35 35 
         <script>
36 36 
           $(function() {
37 37 
             var $chart = $(".chart-container.group-<%= index.to_s %>").last();
38 
-            var data = <%= group.select {|e| e.payload[:count].present? }.sort_by {|e| e.payload[:time] }.map {|e| { :x => e.payload[:time].to_i, :y => e.payload[:count].to_i } }.to_json.html_safe %>;
39 
-            var name = <%= filter.to_json.html_safe %>;
38 
+            var data = <%= Utils.jsonify(group.select {|e| e.payload[:count].present? }.sort_by {|e| e.payload[:time] }.map {|e| { :x => e.payload[:time].to_i, :y => e.payload[:count].to_i } }) %>;
39 
+            var name = <%= Utils.jsonify(filter) %>;
40 40
41 41 
             renderGraph($chart, data, [], name);
42 42 
           });

+ 2 - 2
app/views/agents/show.html.erb
View File 

@@ -132,12 +132,12 @@
132 132
133 133 
             <p>
134 134 
               <b>Options:</b>
135 
-              <pre><%= JSON.pretty_generate @agent.options || {} %></pre>
135 
+              <pre><%= Utils.pretty_jsonify @agent.options || {} %></pre>
136 136 
             </p>
137 137
138 138 
             <p>
139 139 
               <b>Memory:</b>
140 
-              <pre><%= JSON.pretty_generate @agent.memory || {} %></pre>
140 
+              <pre><%= Utils.pretty_jsonify @agent.memory || {} %></pre>
141 141 
             </p>
142 142 
           </div>
143 143 
         </div>

+ 1 - 1
app/views/events/show.html.erb
View File 

@@ -7,7 +7,7 @@
7 7
8 8 
       <p>
9 9 
         <b>Payload:</b>
10 
-        <pre><%= JSON.pretty_generate @event.payload || {} %></pre>
10 
+        <pre><%= Utils.pretty_jsonify @event.payload || {} %></pre>
11 11 
       </p>
12 12
13 13 
       <% if @event.lat && @event.lng %>

+ 14 - 2
lib/utils.rb
View File 

@@ -71,7 +71,19 @@ module Utils
71 71 
     end
72 72 
   end
73 73
74 
-  def self.jsonify(thing)
75 
-    thing.to_json.gsub('</', '<\/').html_safe
74 
+  # Output JSON that is ready for inclusion into HTML.  If you simply use to_json on an object, the
75 
+  # presence of </script> in the valid JSON can break the page and allow XSS attacks.
76 
+  # Optionally, pass `:skip_safe => true` to not call html_safe on the output.
77 
+  def self.jsonify(thing, options = {})
78 
+    json = thing.to_json.gsub('</', '<\/')
79 
+    if !options[:skip_safe]
80 
+      json.html_safe
81 
+    else
82 
+      json
83 
+    end
84 
+  end
85 
+
86 
+  def self.pretty_jsonify(thing)
87 
+    JSON.pretty_generate(thing).gsub('</', '<\/')
76 88 
   end
77 89 
 end

+ 22 - 0
spec/lib/utils_spec.rb
View File 

@@ -85,4 +85,26 @@ describe Utils do
85 85 
       Utils.values_at({ :foo => { :bar => "escape this!?" }}, "escape $.foo.bar").should == ["escape+this%21%3F"]
86 86 
     end
87 87 
   end
88 
+
89 
+  describe "#jsonify" do
90 
+    it "escapes </script> tags in the output JSON" do
91 
+      cleaned_json = Utils.jsonify(:foo => "bar", :xss => "</script><script>alert('oh no!')</script>")
92 
+      cleaned_json.should_not include("</script>")
93 
+      cleaned_json.should include("<\\/script>")
94 
+    end
95 
+
96 
+    it "html_safes the output unless :skip_safe is passed in" do
97 
+      Utils.jsonify({:foo => "bar"}).should be_html_safe
98 
+      Utils.jsonify({:foo => "bar"}, :skip_safe => false).should be_html_safe
99 
+      Utils.jsonify({:foo => "bar"}, :skip_safe => true).should_not be_html_safe
100 
+    end
101 
+  end
102 
+
103 
+  describe "#pretty_jsonify" do
104 
+    it "escapes </script> tags in the output JSON" do
105 
+      cleaned_json = Utils.pretty_jsonify(:foo => "bar", :xss => "</script><script>alert('oh no!')</script>")
106 
+      cleaned_json.should_not include("</script>")
107 
+      cleaned_json.should include("<\\/script>")
108 
+    end
109 
+  end
88 110 
 end