Sanitize user fields, posts comments, and meta values against XSS attacks

.rspec

@@ -1 +1 @@
---require spec_helper
+--require rails_helper

Gemfile

@@ -7,6 +7,7 @@ gem 'rails', '~> 8.0.1'
 gem 'selenium-webdriver'
 gem 'sprockets-rails', '>= 3.5.2'
 
+gem 'capybara-lockstep'
 gem 'capybara-screenshot'
 
 gem 'rspec_junit_formatter'

Gemfile.lock

@@ -145,6 +145,11 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
+    capybara-lockstep (2.2.2)
+      activesupport (>= 4.2)
+      capybara (>= 3.0)
+      ruby2_keywords
+      selenium-webdriver (>= 4.0)
     capybara-screenshot (1.0.26)
       capybara (>= 1.0, < 4)
       launchy
@@ -414,6 +419,7 @@ DEPENDENCIES
   byebug
   camaleon_cms!
   capybara
+  capybara-lockstep
   capybara-screenshot
   factory_bot_rails
   faker

app/models/camaleon_cms/meta.rb

@@ -2,5 +2,24 @@ module CamaleonCms
   class Meta < CamaleonRecord
     self.table_name = "#{PluginRoutes.static_system_info['db_prefix']}metas"
     # attr_accessible :objectid, :key, :value, :object_class
+
+    # TODO: Remove the 1st branch when support will be dropped of Rails < 7.1
+    if ::Rails::VERSION::STRING < '7.1.0'
+      before_validation(on: %i[create update]) do
+        %i[value].each do |attr|
+          next unless new_record? || attribute_changed?(attr)
+
+          self[attr] = ActionController::Base.helpers.sanitize(
+            __send__(attr)&.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
+          )&.gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+        end
+      end
+    else
+      normalizes :value, with: lambda { |field|
+        ActionController::Base.helpers.sanitize(
+          field.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
+        ).gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+      }
+    end
   end
 end

app/models/camaleon_cms/post_comment.rb

@@ -21,6 +21,24 @@ class PostComment < CamaleonRecord
     scope :comment_parent, -> { where(comment_parent: 'is not null') }
     scope :approveds, -> { where(approved: 'approved') }
 
+    # TODO: Remove the 1st branch when support will be dropped of Rails < 7.1
+    if ::Rails::VERSION::STRING < '7.1.0'
+      before_validation(on: %i[create update]) do
+        %i[content].each do |attr|
+          next unless new_record? || attribute_changed?(attr)
+
+          self[attr] = ActionController::Base.helpers.sanitize(
+            __send__(attr)&.gsub(TRANSLATION_TAG_HIDE_REGEX, TRANSLATION_TAG_HIDE_MAP)
+          )&.gsub(TRANSLATION_TAG_RESTORE_REGEX, TRANSLATION_TAG_RESTORE_MAP)
+        end
+      end
+    else
+      normalizes :content, with: lambda { |field|
+        ActionController::Base.helpers.sanitize(field.gsub(TRANSLATION_TAG_HIDE_REGEX, TRANSLATION_TAG_HIDE_MAP))
+                              .gsub(TRANSLATION_TAG_RESTORE_REGEX, TRANSLATION_TAG_RESTORE_MAP)
+      }
+    end
+
     validates :content, presence: true
     validates_presence_of :author, :author_email, if: proc { |c| c.is_anonymous.present? }
     after_create :update_counter

app/models/camaleon_cms/term_taxonomy.rb

@@ -3,12 +3,6 @@ class TermTaxonomy < CamaleonRecord
     include CamaleonCms::Metas
     include CamaleonCms::CustomFieldsRead
 
-    TRANSLATION_TAG_HIDE_MAP = { '<!--' => '!--', '-->' => '--!' }.freeze
-    TRANSLATION_TAG_HIDE_REGEX = Regexp.new(TRANSLATION_TAG_HIDE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
-    TRANSLATION_TAG_RESTORE_MAP = { '--!' => '-->', '!--' => '<!--' }.freeze
-    TRANSLATION_TAG_RESTORE_REGEX =
-      Regexp.new(TRANSLATION_TAG_RESTORE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
-
     def self.inherited(subclass)
       super
 

app/models/camaleon_record.rb

@@ -1,6 +1,12 @@
 # frozen_string_literal: true
 
 class CamaleonRecord < ActiveRecord::Base
+  TRANSLATION_TAG_HIDE_MAP = { '<!--' => '!--', '-->' => '--!' }.freeze
+  TRANSLATION_TAG_HIDE_REGEX = Regexp.new(TRANSLATION_TAG_HIDE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
+  TRANSLATION_TAG_RESTORE_MAP = { '--!' => '-->', '!--' => '<!--' }.freeze
+  TRANSLATION_TAG_RESTORE_REGEX =
+    Regexp.new(TRANSLATION_TAG_RESTORE_MAP.keys.map { |x| Regexp.escape(x) }.join('|')).freeze
+
   include ActiveRecordExtras::Relation
 
   self.abstract_class = true

app/models/concerns/camaleon_cms/custom_fields_read.rb

@@ -95,9 +95,7 @@ def get_field_values(_key, group_number = 0)
           f.custom_field_slug == _key && f.group_number == group_number
         end.map(&:value)
       else
-        custom_field_values.where(
-          custom_field_slug: _key, group_number: group_number
-        ).pluck(:value)
+        custom_field_values.where(custom_field_slug: _key, group_number: group_number).pluck(:value)
       end
     end
     alias get_fields get_field_values
@@ -304,7 +302,9 @@ def set_field_value(key, value, args = {})
     private
 
     def fix_meta_value(value)
-      value = value.to_json if value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(ActionController::Parameters)
+      return value.to_json if value.is_a?(ActionController::Parameters)
+      return JSON.fast_generate(value) if value.is_a?(Array) || value.is_a?(Hash)
+
       value
     end
 

app/models/concerns/camaleon_cms/metas.rb

@@ -19,8 +19,7 @@ def set_meta(key, value)
     end
 
     # return value of meta with key: key,
-    # if meta not exist, return default
-    # return default if meta value == ""
+    # if meta not exist, or its value == "", return default
     def get_meta(key, default = nil)
       key_str = key.is_a?(Symbol) ? key.to_s : key
       cama_fetch_cache("meta_#{key_str}") do
@@ -70,8 +69,7 @@ def set_option(key, value = nil, meta_key = '_default')
 
     # return configuration for current object
     # key: attribute name
-    # default: if attribute not exist, return default
-    # return default if option value == ""
+    # default: if the attribute doesn't exist, or its value == "", return default
     # return value for attribute
     def get_option(key = nil, default = nil, meta_key = '_default')
       values = cama_options(meta_key)
@@ -133,8 +131,14 @@ def save_metas_options
 
     # fix to parse value
     def fix_meta_value(value)
-      value = value.to_json if value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(ActionController::Parameters)
-      fix_meta_var(value)
+      changed_value = if value.is_a?(ActionController::Parameters)
+                        value.to_json
+                      elsif value.is_a?(Array) || value.is_a?(Hash)
+                        JSON.fast_generate(value)
+                      else
+                        value
+                      end
+      fix_meta_var(changed_value)
     end
 
     # fix to detect type of the variable

app/models/concerns/camaleon_cms/user_methods.rb

@@ -12,11 +12,31 @@ module UserMethods
                                       message: I18n.t('camaleon_cms.admin.users.message.requires_different_email', default: 'Requires different email')
 
       # callbacks
+      #
+      # TODO: Remove the 1st branch when support will be dropped of Rails < 7.1
+      if ::Rails::VERSION::STRING < '7.1.0'
+        before_validation(on: %i[create update]) do
+          %i[first_name last_name username].each do |attr|
+            next unless new_record? || attribute_changed?(attr)
+
+            self[attr] = ActionController::Base.helpers.sanitize(
+              __send__(attr)&.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
+            )&.gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+          end
+        end
+      else
+        normalizes(*%i[first_name last_name username], with: lambda { |field|
+          ActionController::Base.helpers.sanitize(
+            field.gsub(CamaleonRecord::TRANSLATION_TAG_HIDE_REGEX, CamaleonRecord::TRANSLATION_TAG_HIDE_MAP)
+          ).gsub(CamaleonRecord::TRANSLATION_TAG_RESTORE_REGEX, CamaleonRecord::TRANSLATION_TAG_RESTORE_MAP)
+        })
+      end
+
       before_validation :cama_before_validation
       before_destroy :reassign_posts
       after_destroy :reassign_comments
       before_create { generate_token(:auth_token) }
-      # invaliidate sessions when changing password
+      # invalidate sessions when changing password
       before_update { generate_token :auth_token if will_save_change_to_password_digest? }
 
       # relations
@@ -117,7 +137,7 @@ def set_all_sites
 
     # reassign all posts of this user to first admin
     # reassign all comments of this user to first admin
-    # if doesn't exist any other administrator, this will cancel the user destroy
+    # if it doesn't exist any other administrator, this will cancel the user destroy
     def reassign_posts
       all_posts.each do |p|
         s = p.post_type.site

app/views/camaleon_cms/admin/settings/custom_fields/form.html.erb

@@ -126,7 +126,11 @@
                     <div class="panel-body padding-0">
                         <% fields =  @field_group.new_record? ? [] : @field_group.fields %>
                         <ul id="sortable-fields" class="clear list-unstyled">
-                            <% fields.each do |field| @item_value = field; @item_options_value = field.options; @key = field.options[:field_key] %>
+                            <% fields.each do |field|
+                              @item_value = field
+                              @item_options_value = field.options
+                              @key = field.options['field_key']
+                            %>
                                 <li class="item">
                                     <%= render "get_items" %>
                                 </li>
@@ -162,6 +166,3 @@
         <% end %>
     </div>
 </div>
-
-
-

app/views/layouts/camaleon_cms/admin.html.erb

@@ -6,6 +6,7 @@
     <title><%= raw cama_admin_title_draw %></title>
     <meta http-equiv="X-UA-Compatible" content="IE=edge"/>
     <meta name="viewport" content="width=device-width, initial-scale=1"/>
+    <%= capybara_lockstep if defined?(Capybara::Lockstep) %>
     <%= stylesheet_link_tag "camaleon_cms/admin/admin-manifest", media: "all" %>
     <script>
         var root_url = '<%= cama_root_url(locale: nil) %>';

gemfiles/rails_6_1.gemfile

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'cancancan', '~> 3.0'
+gem 'capybara-lockstep'
 gem 'capybara-screenshot'
 gem 'drb'
 gem 'factory_bot_rails'

gemfiles/rails_7_0.gemfile

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'cancancan', '~> 3.0'
+gem 'capybara-lockstep'
 gem 'capybara-screenshot'
 gem 'drb'
 gem 'factory_bot_rails'

gemfiles/rails_7_1.gemfile

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'cancancan', '~> 3.0'
+gem 'capybara-lockstep'
 gem 'capybara-screenshot'
 gem 'factory_bot_rails'
 gem 'faker'

gemfiles/rails_7_2.gemfile

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'cancancan', '~> 3.0'
+gem 'capybara-lockstep'
 gem 'capybara-screenshot'
 gem 'factory_bot_rails'
 gem 'faker'

gemfiles/rails_8_0.gemfile

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'cancancan', '~> 3.0'
+gem 'capybara-lockstep'
 gem 'capybara-screenshot'
 gem 'factory_bot_rails'
 gem 'faker'

gemfiles/rails_edge.gemfile

@@ -3,6 +3,7 @@ source 'https://rubygems.org'
 gemspec path: '..'
 
 gem 'cancancan', '~> 3.0'
+gem 'capybara-lockstep'
 gem 'capybara-screenshot'
 gem 'factory_bot_rails'
 gem 'faker'

spec/decorators/application_decorator_spec.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'rails_helper'
-
 RSpec.describe CamaleonCms::SiteDecorator, type: :model do
   %i[post_type post site user].each do |klass|
     describe 'Marshal compatibility' do

spec/dummy/config/environments/test.rb

@@ -49,4 +49,5 @@
   # config.action_view.raise_on_missing_translations = true
 
   config.middleware.use RackSessionAccess::Middleware
+  config.middleware.insert_before 0, Capybara::Lockstep::Middleware
 end

spec/features/admin/categories_spec.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
-require 'rails_helper'
-
-describe 'the signin process', :js do
+RSpec.describe 'the signin process', :js do
   init_site
 
   it 'create new category' do

spec/features/admin/comments_spec.rb

@@ -1,24 +1,23 @@
 # frozen_string_literal: true
 
-require 'rails_helper'
-
-# add a new comment for a post
-def add_new_comment
-  visit "#{cama_root_relative_path}/admin/posts/#{@site.posts.last.id}/comments"
-  page.execute_script('$("#comments_answer_list .panel-heading .btn-primary").click()')
-  wait_for_ajax
-  within 'form#new_comment' do
-    fill_in 'comment_content', with: 'Test comment'
-    find('button[type="submit"]').click
-  end
-end
-
-describe 'the Comments', :js do
+RSpec.describe 'the Comments', :js do
   init_site
 
+  # add a new comment for a post
+  def add_new_comment
+    visit "#{cama_root_relative_path}/admin/posts/#{@site.posts.last.id}/comments"
+    page.execute_script('$("#comments_answer_list .panel-heading .btn-primary").click()')
+
+    within 'form#new_comment' do
+      fill_in 'comment_content', with: 'Test comment'
+      find('button[type="submit"]').click
+    end
+  end
+
   it 'Add Comment' do
     admin_sign_in
     add_new_comment
+
     expect(page).to have_css('.alert-success')
   end
 
@@ -42,9 +41,9 @@ def add_new_comment
     # answer comment
     within '#comments_answer_list' do
       first('.reply').click
-      wait_for_ajax
     end
-    within '#new_comment' do
+
+    within 'form#new_comment' do
       fill_in 'comment_content', with: 'test answer comment'
       find('button[type="submit"]').click
     end

spec/features/admin/contact_form_spec.rb

@@ -1,21 +1,19 @@
 # frozen_string_literal: true
 
-require 'rails_helper'
-
-# create a new form
-def create_form
-  visit "#{cama_root_relative_path}/admin/plugins/cama_contact_form/admin_forms"
-  expect(page).to have_content('Contact Form')
-  within('#new_plugins_cama_contact_form_cama_contact_form') do
-    fill_in 'plugins_cama_contact_form_cama_contact_form_name', with: 'Test form'
-    fill_in 'plugins_cama_contact_form_cama_contact_form_slug', with: 'test-form'
-    first('button[type="submit"]').click
-  end
-end
-
-describe 'the Contact Form', :js do
+RSpec.describe 'the Contact Form', :js do
   init_site
 
+  # create a new form
+  def create_form
+    visit "#{cama_root_relative_path}/admin/plugins/cama_contact_form/admin_forms"
+    expect(page).to have_content('Contact Form')
+    within('#new_plugins_cama_contact_form_cama_contact_form') do
+      fill_in 'plugins_cama_contact_form_cama_contact_form_name', with: 'Test form'
+      fill_in 'plugins_cama_contact_form_cama_contact_form_slug', with: 'test-form'
+      first('button[type="submit"]').click
+    end
+  end
+
   it 'create new contact form' do
     admin_sign_in
     create_form