public
Fork of halorgium/mephisto
Description: A mirror of the mephisto code-base
Homepage: http://mephistoblog.com/
Clone URL: git://github.com/technoweenie/mephisto.git
Click here to lend your support to: mephisto and make a donation at www.pledgie.com !
fix bug where textile content was double encoded in atom feeds. sanitize 
atom feed content also

git-svn-id: http://svn.techno-weenie.net/projects/mephisto/trunk@1969 
567b1171-46fb-0310-a4c9-b4bef9110e78
technoweenie (author)
Fri Sep 01 00:42:11 -0700 2006
commit  3c92159f8b1e8c436de48ec605384ab65bc79d14
tree    f5b9ef1fb2b58506af99db586db15574c50e1bb5
parent  c5e8a3ae2f4452ba0ba275ab8bf2028e63322723
...
1
2
 
 
 
 
 
 
3
4
5
...
1
2
3
4
5
6
7
8
9
10
11
0
@@ -1,5 +1,11 @@
0
 * SVN *
0
 
0
+* Fix bug where atom feed content from textile was double encoded
0
+
0
+* sanitize atom feed content
0
+
0
+* 0.6 *
0
+
0
 * Change conversion scripts to use Mephisto.convert_from instead:
0
 
0
   Mephisto.convert_from :typo
...
1
 
 
 
 
 
 
 
2
...
1
2
3
4
5
6
7
8
9
0
@@ -1,2 +1,9 @@
0
 module FeedHelper
0
+ def sanitize_content(html)
0
+ returning h(sanitize(html)) do |html|
0
+ html.gsub! /&(#\d+);/ do |s|
0
+ "&#{$1};"
0
+ end
0
+ end
0
+ end
0
 end
...
10
11
12
13
14
 
 
 
 
 
 
15
16
...
10
11
12
 
 
13
14
15
16
17
18
19
20
0
@@ -10,6 +10,10 @@ xm.entry do
0
   end
0
   xm.link "rel" => "alternate", "type" => "text/html", "href" => article_url(article.hash_for_permalink)
0
   xm.title strip_tags(article.title)
0
- xm.summary article.excerpt_html, 'type' => 'html' unless article.excerpt_html.blank?
0
- xm.content article.body_html, 'type' => 'html' unless article.body_html.blank?
0
+ unless article.excerpt_html.blank?
0
+ xm << %{<summary type="html">#{sanitize_content article.excerpt_html}</summary>}
0
+ end
0
+ unless article.body_html.blank?
0
+ xm << %{<content type="html">#{sanitize_content article.body_html}</content>}
0
+ end
0
 end
0
\ No newline at end of file
...
12
13
14
15
16
 
 
17
18
19
...
40
41
42
43
44
 
 
45
46
47
...
12
13
14
 
 
15
16
17
18
19
...
40
41
42
 
 
43
44
45
46
47
0
@@ -12,8 +12,8 @@ welcome:
0
   permalink: welcome-to-mephisto
0
   excerpt: welcome summary
0
   excerpt_html: welcome summary
0
- body: welcome description
0
- body_html: welcome description
0
+ body: "quentin's \"welcome\" *description* <script>hi</script><a onclick=\"foo\" href=\"#\">linkage</a>"
0
+ body_html: "<p>quentin&#8217;s &#8220;welcome&#8221; <strong>description</strong> <script>hi</script><a onclick=\"foo\" href=\"#\">linkage</a></p>"
0
   created_at: <%= 5.days.ago.to_s(:db) %>
0
   updated_at: <%= 5.days.ago.to_s(:db) %>
0
   published_at: <%= 3.days.ago.to_s(:db) %>
0
@@ -40,8 +40,8 @@ welcome_comment:
0
   id: 3
0
   site_id: 1
0
   article_id: 1
0
- body: This blogging tool rocks.
0
- body_html: This blogging tool rocks.
0
+ body: "rico's evil <script>hi</script> and <a onclick=\"foo\" href=\"#\">linkage</a>"
0
+ body_html: "<p>rico&#8217;s evil <script>hi</script> and <a onclick=\"foo\" href=\"#\">linkage</a></p>"
0
   created_at: <%= 3.days.ago.to_s(:db) %>
0
   updated_at: <%= 3.days.ago.to_s(:db) %>
0
   published_at: <%= (3.days + 55.minutes).ago.to_s(:db) %>
...
13
14
15
16
17
18
19
20
 
21
22
23
...
25
26
27
 
28
29
30
...
32
33
34
 
35
36
37
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
38
...
13
14
15
 
16
17
18
19
20
21
22
23
...
25
26
27
28
29
30
31
...
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
0
@@ -13,11 +13,11 @@ class FeedControllerTest < Test::Unit::TestCase
0
     @response = ActionController::TestResponse.new
0
   end
0
 
0
- # Replace this with your real tests.
0
   def test_feed_assigns
0
     get :feed, :sections => ['about']
0
     assert_equal sections(:about), assigns(:section)
0
     assert_equal [contents(:welcome), contents(:about), contents(:site_map)], assigns(:articles)
0
+ assert_atom_entries_size 3
0
   end
0
   
0
   def test_feed_comes_from_site
0
@@ -25,6 +25,7 @@ class FeedControllerTest < Test::Unit::TestCase
0
     get :feed, :sections => ['about']
0
     assert_equal sections(:cupcake_about), assigns(:section)
0
     assert_equal [contents(:cupcake_welcome)], assigns(:articles)
0
+ assert_atom_entries_size 1
0
   end
0
   
0
   def test_site_in_feed_links
0
@@ -32,6 +33,36 @@ class FeedControllerTest < Test::Unit::TestCase
0
     get :feed, :sections => []
0
     assert_models_equal [sections(:cupcake_home)], [assigns(:section)]
0
     assert_models_equal [contents(:cupcake_welcome)], assigns(:articles)
0
+ assert_atom_entries_size 1
0
     assert_tag 'link', :attributes => {:href => 'http://cupcake.com/'}
0
   end
0
 end
0
+
0
+context "Home Section Feed" do
0
+ fixtures :contents, :sections, :assigned_sections, :sites
0
+ def setup
0
+ @controller = FeedController.new
0
+ @request = ActionController::TestRequest.new
0
+ @response = ActionController::TestResponse.new
0
+ get :feed, :sections => []
0
+ @contents = get_xpath '//entry/content'
0
+ end
0
+
0
+ specify "should show titles" do
0
+ assert_xpath '/feed/entry[title="Welcome to Mephisto"]'
0
+ assert_xpath '/feed/entry[title="Another Welcome to Mephisto"]'
0
+ end
0
+
0
+ specify "should not double escape html" do
0
+ text = @contents.first.get_text.to_s
0
+ assert text.starts_with("&lt;p&gt;quentin&#8217;s &#8220;welcome&#8221;"), "'#{text.inspect}' was double escaped"
0
+ end
0
+
0
+ specify "should sanitize content" do
0
+ text = @contents.first.get_text.to_s
0
+ evil = "<script>hi</script><a onclick=\"foo\" href=\"#\">linkage</a></p>"
0
+ good = "&lt;script>hi&lt;/script><a href='#'>linkage</a></p>"
0
+ assert !text.ends_with(CGI::escapeHTML(evil)), "'#{text.inspect}' was not sanitized"
0
+ assert text.ends_with(CGI::escapeHTML(good)), "'#{text.inspect}' was not sanitized"
0
+ end
0
+end
0
\ No newline at end of file
...
102
103
104
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
105
106
107
...
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
0
@@ -102,6 +102,27 @@ class Test::Unit::TestCase
0
     assert File.file?(file), message
0
   end
0
 
0
+ def get_xpath(xpath)
0
+ if @rexml.nil?
0
+ @rexml = REXML::Document.new(@response.body)
0
+ assert @rexml
0
+ end
0
+
0
+ REXML::XPath.match(@rexml, xpath)
0
+ end
0
+
0
+ def assert_xpath(xpath, msg=nil)
0
+ assert !(get_xpath(xpath).empty?), "XPath '#{xpath}' was not matched: #{msg}"
0
+ end
0
+
0
+ def assert_not_xpath(xpath, msg=nil)
0
+ assert get_xpath(xpath).empty?, "XPath '#{xpath}' was matched: #{msg}"
0
+ end
0
+
0
+ def assert_atom_entries_size(entries)
0
+ assert_equal 1, get_xpath(%{/feed[@xmlns="http://www.w3.org/2005/Atom" and count(child::entry)=#{entries}]}).size, "Atom 1.0 feed has wrong number of feed/entry nodes"
0
+ end
0
+
0
   # Sets the current user in the session from the user fixtures.
0
   def login_as(user)
0
     @request.session[:user] = user ? users(user).id : nil

Comments

    No one has commented yet.