{"action":"created","comment":{"url":"https://api.github.com/repos/publify/publify/pulls/comments/225414002","pull_request_review_id":165004508,"id":225414002,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIyNTQxNDAwMg==","diff_hunk":"@@ -0,0 +1,261 @@\n+# frozen_string_literal: true\n+\n+require 'rails_helper'\n+\n+RSpec.describe 'comments/_comment.html.erb', type: :view do\n+  shared_examples_for 'CommentSanitization' do\n+    let(:blog) { build_stubbed(:blog) }\n+    let(:article) { build_stubbed(:article, created_at: Time.zone.now, published_at: Time.zone.now, blog: blog) }\n+    let(:base_options) do\n+      {\n+        body: 'test foo <script>do_evil();</script>',\n+        author: 'Bob',\n+        article: article,\n+        created_at: Time.zone.now\n+      }\n+    end\n+\n+    before do\n+      blog.plugin_avatar = ''\n+      blog.lang = 'en_US'\n+\n+      @comment = Comment.new base_options.merge(comment_options)\n+\n+      allow(@comment).to receive(:id).and_return(1)\n+      assign(:comment, @comment)\n+    end\n+\n+    with_each_theme do |theme, view_path|\n+      context \"with theme #{theme}\" do\n+        before do\n+          blog.theme = theme\n+        end\n+\n+        ['', 'markdown', 'textile', 'smartypants', 'markdown smartypants'].each do |value|\n+          it \"sanitizes content rendered with the #{value} textfilter\" do\n+            blog.comment_text_filter = value\n+            create(value.empty? ? 'none' : value)\n+\n+            render partial: 'comments/comment', locals: { comment: @comment }\n+            expect(rendered).to have_selector('.content')\n+            expect(rendered).to have_selector('.author')\n+\n+            expect(rendered).not_to have_selector('.content script')\n+            expect(rendered).not_to have_selector('.content a:not([rel=nofollow])')\n+            # No links with javascript\n+            expect(rendered).not_to have_selector('.content a[onclick]')\n+            expect(rendered).not_to have_selector('.content a[href^=\"javascript:\"]')\n+\n+            expect(rendered).not_to have_selector('.author script')\n+            expect(rendered).not_to have_selector('.author a:not([rel=nofollow])')\n+            # No links with javascript\n+            expect(rendered).not_to have_selector('.author a[onclick]')\n+            expect(rendered).not_to have_selector('.author a[href^=\"javascript:\"]')\n+          end\n+        end\n+      end\n+    end\n+  end\n+\n+  describe 'First dodgy comment', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: 'test foo <script>do_evil();</script>' }\n+    end\n+  end\n+\n+  describe 'Second dodgy comment', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: 'link to [spammy goodness](http://spammer.example.com)' }\n+    end\n+  end\n+\n+  describe 'Dodgy comment #3', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: 'link to <a href=\"spammer.com\">spammy goodness</a>' }\n+    end\n+  end\n+\n+  describe 'Extra Dodgy comment', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: '<a href=\"http://spam.org\">spam</a>',\n+        author: '<a href=\"http://spamme.com>spamme</a>',\n+        email: '<a href=\"http://itsallspam.com/\">its all spam</a>' }\n+    end\n+  end\n+\n+  describe 'XSS1', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: %{Have you ever <script lang=\"javascript\">alert(\"foo\");</script> been hacked?} }\n+    end\n+  end\n+\n+  describe 'XSS2', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+    def comment_options\n+      { body: %(<a href=\"#\" onclick=\"javascript\">bad link</a>) }\n+    end\n+  end\n+\n+  describe 'XSS2', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: %(<a href=\"javascript:bad\">bad link</a>) }\n+    end\n+  end\n+\n+  describe 'Comment with bare http URL', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: %(http://www.example.com) }\n+    end\n+  end\n+\n+  describe 'Comment with bare email address', type: :view do\n+    it_behaves_like 'CommentSanitization'\n+\n+    def comment_options\n+      { body: %(foo@example.com) }\n+    end\n+  end\n+\n+  shared_examples_for 'CommentSanitizationWithDofollow' do\n+    let(:blog) { create(:blog) }\n+    let(:article) { create(:article, created_at: Time.zone.now, published_at: Time.zone.now, blog: blog) }\n+    let(:base_options) do\n+      {\n+        body: 'test foo <script>do_evil();</script>',\n+        author: 'Bob',\n+        article: article,\n+        created_at: Time.zone.now\n+      }\n+    end\n+\n+    before do\n+      blog.plugin_avatar = ''\n+      blog.lang = 'en_US'\n+      blog.dofollowify = true\n+      blog.save\n+\n+      @comment = Comment.new base_options.merge(comment_options)\n+\n+      allow(@comment).to receive(:id).and_return(1)\n+      assign(:comment, @comment)\n+    end\n+\n+    with_each_theme do |theme, view_path|","path":"spec/views/comments/html_sanitization_spec.rb","position":157,"original_position":157,"commit_id":"bfba0db9f6c971a6868e3ea7295f172cf061978d","original_commit_id":"bfba0db9f6c971a6868e3ea7295f172cf061978d","user":{"login":"houndci-bot","id":6697940,"node_id":"MDQ6VXNlcjY2OTc5NDA=","avatar_url":"https://avatars0.githubusercontent.com/u/6697940?v=4","gravatar_id":"","url":"https://api.github.com/users/houndci-bot","html_url":"https://github.com/houndci-bot","followers_url":"https://api.github.com/users/houndci-bot/followers","following_url":"https://api.github.com/users/houndci-bot/following{/other_user}","gists_url":"https://api.github.com/users/houndci-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/houndci-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/houndci-bot/subscriptions","organizations_url":"https://api.github.com/users/houndci-bot/orgs","repos_url":"https://api.github.com/users/houndci-bot/repos","events_url":"https://api.github.com/users/houndci-bot/events{/privacy}","received_events_url":"https://api.github.com/users/houndci-bot/received_events","type":"User","site_admin":false},"body":"Lint/UnusedBlockArgument: Unused block argument - view_path. If it's necessary, use _ or _view_path as an argument name to indicate that it won't be used.","created_at":"2018-10-16T06:43:28Z","updated_at":"2018-10-16T06:43:29Z","html_url":"https://github.com/publify/publify/pull/909#discussion_r225414002","pull_request_url":"https://api.github.com/repos/publify/publify/pulls/909","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/publify/publify/pulls/comments/225414002"},"html":{"href":"https://github.com/publify/publify/pull/909#discussion_r225414002"},"pull_request":{"href":"https://api.github.com/repos/publify/publify/pulls/909"}}},"pull_request":{"url":"https://api.github.com/repos/publify/publify/pulls/909","id":222843185,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIyODQzMTg1","html_url":"https://github.com/publify/publify/pull/909","diff_url":"https://github.com/publify/publify/pull/909.diff","patch_url":"https://github.com/publify/publify/pull/909.patch","issue_url":"https://api.github.com/repos/publify/publify/issues/909","number":909,"state":"open","locked":false,"title":"WIP: Unify build","user":{"login":"mvz","id":10898,"node_id":"MDQ6VXNlcjEwODk4","avatar_url":"https://avatars3.githubusercontent.com/u/10898?v=4","gravatar_id":"","url":"https://api.github.com/users/mvz","html_url":"https://github.com/mvz","followers_url":"https://api.github.com/users/mvz/followers","following_url":"https://api.github.com/users/mvz/following{/other_user}","gists_url":"https://api.github.com/users/mvz/gists{/gist_id}","starred_url":"https://api.github.com/users/mvz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mvz/subscriptions","organizations_url":"https://api.github.com/users/mvz/orgs","repos_url":"https://api.github.com/users/mvz/repos","events_url":"https://api.github.com/users/mvz/events{/privacy}","received_events_url":"https://api.github.com/users/mvz/received_events","type":"User","site_admin":false},"body":"Unify Publify's build so the default Rake task will check everything.\r\n\r\n* Moves view and controller tests that are affected by theme selection to main project, so all themes are tested.\r\n* Makes core RSpec helpers available for inclusion in other projects.\r\n* Makes FactoryBot factories available for inclusion in other projects.\r\n* Add tasks to run specs and manifest checks in sub-projects from the main Rakefile.\r\n* Builds only the main project on Travis.\r\n\r\nTODO:\r\n* [x] Clean up commits.\r\n* [ ] Move comment sanitation specs to main project as well.\r\n* [ ] Loop over themes for all relevant specs.","created_at":"2018-10-15T09:45:12Z","updated_at":"2018-10-16T06:43:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"515a0981a2936e303b21df7e01d832138b279939","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/publify/publify/pulls/909/commits","review_comments_url":"https://api.github.com/repos/publify/publify/pulls/909/comments","review_comment_url":"https://api.github.com/repos/publify/publify/pulls/comments{/number}","comments_url":"https://api.github.com/repos/publify/publify/issues/909/comments","statuses_url":"https://api.github.com/repos/publify/publify/statuses/bfba0db9f6c971a6868e3ea7295f172cf061978d","head":{"label":"publify:unify-build","ref":"unify-build","sha":"bfba0db9f6c971a6868e3ea7295f172cf061978d","user":{"login":"publify","id":6576968,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY1NzY5Njg=","avatar_url":"https://avatars1.githubusercontent.com/u/6576968?v=4","gravatar_id":"","url":"https://api.github.com/users/publify","html_url":"https://github.com/publify","followers_url":"https://api.github.com/users/publify/followers","following_url":"https://api.github.com/users/publify/following{/other_user}","gists_url":"https://api.github.com/users/publify/gists{/gist_id}","starred_url":"https://api.github.com/users/publify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/publify/subscriptions","organizations_url":"https://api.github.com/users/publify/orgs","repos_url":"https://api.github.com/users/publify/repos","events_url":"https://api.github.com/users/publify/events{/privacy}","received_events_url":"https://api.github.com/users/publify/received_events","type":"Organization","site_admin":false},"repo":{"id":66801,"node_id":"MDEwOlJlcG9zaXRvcnk2NjgwMQ==","name":"publify","full_name":"publify/publify","private":false,"owner":{"login":"publify","id":6576968,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY1NzY5Njg=","avatar_url":"https://avatars1.githubusercontent.com/u/6576968?v=4","gravatar_id":"","url":"https://api.github.com/users/publify","html_url":"https://github.com/publify","followers_url":"https://api.github.com/users/publify/followers","following_url":"https://api.github.com/users/publify/following{/other_user}","gists_url":"https://api.github.com/users/publify/gists{/gist_id}","starred_url":"https://api.github.com/users/publify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/publify/subscriptions","organizations_url":"https://api.github.com/users/publify/orgs","repos_url":"https://api.github.com/users/publify/repos","events_url":"https://api.github.com/users/publify/events{/privacy}","received_events_url":"https://api.github.com/users/publify/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/publify/publify","description":"A self hosted Web publishing platform on Rails.","fork":false,"url":"https://api.github.com/repos/publify/publify","forks_url":"https://api.github.com/repos/publify/publify/forks","keys_url":"https://api.github.com/repos/publify/publify/keys{/key_id}","collaborators_url":"https://api.github.com/repos/publify/publify/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/publify/publify/teams","hooks_url":"https://api.github.com/repos/publify/publify/hooks","issue_events_url":"https://api.github.com/repos/publify/publify/issues/events{/number}","events_url":"https://api.github.com/repos/publify/publify/events","assignees_url":"https://api.github.com/repos/publify/publify/assignees{/user}","branches_url":"https://api.github.com/repos/publify/publify/branches{/branch}","tags_url":"https://api.github.com/repos/publify/publify/tags","blobs_url":"https://api.github.com/repos/publify/publify/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/publify/publify/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/publify/publify/git/refs{/sha}","trees_url":"https://api.github.com/repos/publify/publify/git/trees{/sha}","statuses_url":"https://api.github.com/repos/publify/publify/statuses/{sha}","languages_url":"https://api.github.com/repos/publify/publify/languages","stargazers_url":"https://api.github.com/repos/publify/publify/stargazers","contributors_url":"https://api.github.com/repos/publify/publify/contributors","subscribers_url":"https://api.github.com/repos/publify/publify/subscribers","subscription_url":"https://api.github.com/repos/publify/publify/subscription","commits_url":"https://api.github.com/repos/publify/publify/commits{/sha}","git_commits_url":"https://api.github.com/repos/publify/publify/git/commits{/sha}","comments_url":"https://api.github.com/repos/publify/publify/comments{/number}","issue_comment_url":"https://api.github.com/repos/publify/publify/issues/comments{/number}","contents_url":"https://api.github.com/repos/publify/publify/contents/{+path}","compare_url":"https://api.github.com/repos/publify/publify/compare/{base}...{head}","merges_url":"https://api.github.com/repos/publify/publify/merges","archive_url":"https://api.github.com/repos/publify/publify/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/publify/publify/downloads","issues_url":"https://api.github.com/repos/publify/publify/issues{/number}","pulls_url":"https://api.github.com/repos/publify/publify/pulls{/number}","milestones_url":"https://api.github.com/repos/publify/publify/milestones{/number}","notifications_url":"https://api.github.com/repos/publify/publify/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/publify/publify/labels{/name}","releases_url":"https://api.github.com/repos/publify/publify/releases{/id}","deployments_url":"https://api.github.com/repos/publify/publify/deployments","created_at":"2008-10-23T14:45:23Z","updated_at":"2018-10-15T10:56:02Z","pushed_at":"2018-10-16T06:43:07Z","git_url":"git://github.com/publify/publify.git","ssh_url":"git@github.com:publify/publify.git","clone_url":"https://github.com/publify/publify.git","svn_url":"https://github.com/publify/publify","homepage":"http://publify.github.io/","size":30930,"stargazers_count":1730,"watchers_count":1730,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3828,"mirror_url":null,"archived":false,"open_issues_count":83,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":3828,"open_issues":83,"watchers":1730,"default_branch":"master"}},"base":{"label":"publify:master","ref":"master","sha":"73517b15a52c633c3252e1c3c69133b62b49b30a","user":{"login":"publify","id":6576968,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY1NzY5Njg=","avatar_url":"https://avatars1.githubusercontent.com/u/6576968?v=4","gravatar_id":"","url":"https://api.github.com/users/publify","html_url":"https://github.com/publify","followers_url":"https://api.github.com/users/publify/followers","following_url":"https://api.github.com/users/publify/following{/other_user}","gists_url":"https://api.github.com/users/publify/gists{/gist_id}","starred_url":"https://api.github.com/users/publify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/publify/subscriptions","organizations_url":"https://api.github.com/users/publify/orgs","repos_url":"https://api.github.com/users/publify/repos","events_url":"https://api.github.com/users/publify/events{/privacy}","received_events_url":"https://api.github.com/users/publify/received_events","type":"Organization","site_admin":false},"repo":{"id":66801,"node_id":"MDEwOlJlcG9zaXRvcnk2NjgwMQ==","name":"publify","full_name":"publify/publify","private":false,"owner":{"login":"publify","id":6576968,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY1NzY5Njg=","avatar_url":"https://avatars1.githubusercontent.com/u/6576968?v=4","gravatar_id":"","url":"https://api.github.com/users/publify","html_url":"https://github.com/publify","followers_url":"https://api.github.com/users/publify/followers","following_url":"https://api.github.com/users/publify/following{/other_user}","gists_url":"https://api.github.com/users/publify/gists{/gist_id}","starred_url":"https://api.github.com/users/publify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/publify/subscriptions","organizations_url":"https://api.github.com/users/publify/orgs","repos_url":"https://api.github.com/users/publify/repos","events_url":"https://api.github.com/users/publify/events{/privacy}","received_events_url":"https://api.github.com/users/publify/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/publify/publify","description":"A self hosted Web publishing platform on Rails.","fork":false,"url":"https://api.github.com/repos/publify/publify","forks_url":"https://api.github.com/repos/publify/publify/forks","keys_url":"https://api.github.com/repos/publify/publify/keys{/key_id}","collaborators_url":"https://api.github.com/repos/publify/publify/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/publify/publify/teams","hooks_url":"https://api.github.com/repos/publify/publify/hooks","issue_events_url":"https://api.github.com/repos/publify/publify/issues/events{/number}","events_url":"https://api.github.com/repos/publify/publify/events","assignees_url":"https://api.github.com/repos/publify/publify/assignees{/user}","branches_url":"https://api.github.com/repos/publify/publify/branches{/branch}","tags_url":"https://api.github.com/repos/publify/publify/tags","blobs_url":"https://api.github.com/repos/publify/publify/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/publify/publify/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/publify/publify/git/refs{/sha}","trees_url":"https://api.github.com/repos/publify/publify/git/trees{/sha}","statuses_url":"https://api.github.com/repos/publify/publify/statuses/{sha}","languages_url":"https://api.github.com/repos/publify/publify/languages","stargazers_url":"https://api.github.com/repos/publify/publify/stargazers","contributors_url":"https://api.github.com/repos/publify/publify/contributors","subscribers_url":"https://api.github.com/repos/publify/publify/subscribers","subscription_url":"https://api.github.com/repos/publify/publify/subscription","commits_url":"https://api.github.com/repos/publify/publify/commits{/sha}","git_commits_url":"https://api.github.com/repos/publify/publify/git/commits{/sha}","comments_url":"https://api.github.com/repos/publify/publify/comments{/number}","issue_comment_url":"https://api.github.com/repos/publify/publify/issues/comments{/number}","contents_url":"https://api.github.com/repos/publify/publify/contents/{+path}","compare_url":"https://api.github.com/repos/publify/publify/compare/{base}...{head}","merges_url":"https://api.github.com/repos/publify/publify/merges","archive_url":"https://api.github.com/repos/publify/publify/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/publify/publify/downloads","issues_url":"https://api.github.com/repos/publify/publify/issues{/number}","pulls_url":"https://api.github.com/repos/publify/publify/pulls{/number}","milestones_url":"https://api.github.com/repos/publify/publify/milestones{/number}","notifications_url":"https://api.github.com/repos/publify/publify/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/publify/publify/labels{/name}","releases_url":"https://api.github.com/repos/publify/publify/releases{/id}","deployments_url":"https://api.github.com/repos/publify/publify/deployments","created_at":"2008-10-23T14:45:23Z","updated_at":"2018-10-15T10:56:02Z","pushed_at":"2018-10-16T06:43:07Z","git_url":"git://github.com/publify/publify.git","ssh_url":"git@github.com:publify/publify.git","clone_url":"https://github.com/publify/publify.git","svn_url":"https://github.com/publify/publify","homepage":"http://publify.github.io/","size":30930,"stargazers_count":1730,"watchers_count":1730,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3828,"mirror_url":null,"archived":false,"open_issues_count":83,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":3828,"open_issues":83,"watchers":1730,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/publify/publify/pulls/909"},"html":{"href":"https://github.com/publify/publify/pull/909"},"issue":{"href":"https://api.github.com/repos/publify/publify/issues/909"},"comments":{"href":"https://api.github.com/repos/publify/publify/issues/909/comments"},"review_comments":{"href":"https://api.github.com/repos/publify/publify/pulls/909/comments"},"review_comment":{"href":"https://api.github.com/repos/publify/publify/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/publify/publify/pulls/909/commits"},"statuses":{"href":"https://api.github.com/repos/publify/publify/statuses/bfba0db9f6c971a6868e3ea7295f172cf061978d"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"houndci-bot"}}