comfy/comfortable-mexican-sofa — pull request #141 by holli (2012-01-27 22:23:54+00:00)
Title: Helper tag security, injection attack fixes

This fixes issue #140 (https://github.com/comfy/comfortable-mexican-sofa/issues/140) concerning injection attacs in helper or partial.

## Config

Config has two more options:

```
# Allowing only specific helpers. Only used if not nil
# Default is nil. Good value coupld be e.g. /^number|^t|^link|^h|url|path/
@allowed_helpers = nil

# Disabling specific helpers, used only if allow_irb=false and no allowed_helpers given
# Default is /eval|puts|print/
@disabled_helpers = /eval|puts|print/
```

@allowed_helpers is for more security concerned users. With only @disabled_helpers there can be some weird possibilities and at least you can access all variables (call session, view_context, etc). I suspect that @disabled_helper regexp should be more extensive and in the long run migrating to only allowed helpers could be a good move.

## Tests

Added tests for cases I could figure out. E.g. ` '{{cms:helper:eval:"User.first.inspect"}}'`, `'{{cms:helper:session-eval:"User.first.inspect"}}'`

Also tests for param sanitization for helper and partials `'{{cms:helper:h:"\'+User.first.inspect+\'"}}'`