Merge pull request itmammoth#40 from itmammoth/use_message_verifier

[itmammoth#30] Use message_verifier to prevent html from tampering

app/controllers/sortable_controller.rb

@@ -1,11 +1,18 @@
 class SortableController < ApplicationController
+
+  VERIFIER = Rails.application.message_verifier(:rails_sortable_generate_sortable_id)
+
   #
-  # post /sortable/reorder, rails_sortable: [{ klass: "Item", id: "3" }, { klass: "Item", id: "2" }, { klass: "Item", id: "1" }]
+  # post /sortable/reorder, rails_sortable: [
+  #   "BAhJIhVjbGFzcz1JdGVtLGlkPTUwBjoGRVQ=--b48adfad6d6d7764e4106c44fc090fcad15d721e",
+  #   "BAhJIhVjbGFzcz1JdGVtLGlkPTQxBjoGRVQ=--ac1c2d3b8eae8dd72e49fae302005e5ae4fc00a4", ...]
+  # Param `rails_sorable` is an array object containing encoded tokens,
+  # and each token must be able to be decoded with VERIFIER to a string formatted as "class={CLASS_NAME},id={ID}".
   #
   def reorder
     ActiveRecord::Base.transaction do
-      params['rails_sortable'].each_with_index do |klass_to_id, new_sort|
-        model = find_model(klass_to_id)
+      params['rails_sortable'].each_with_index do |token, new_sort|
+        model = find_model(token)
         current_sort = model.read_attribute(model.class.sort_attribute)
         model.update_sort!(new_sort) if current_sort != new_sort
       end
@@ -16,8 +23,8 @@ def reorder
 
 private
 
-  def find_model(klass_to_id)
-    klass, id = klass_to_id.values_at('klass', 'id')
+  def find_model(token)
+    klass, id = VERIFIER.verify(token).match(/class=(.+),id=(.+)/)[1..2]
     klass.constantize.find(id.to_i)
   end
 end

app/models/rails_sortable/model.rb

@@ -30,7 +30,7 @@ def update_sort!(new_value)
     end
 
     def sortable_id
-      "#{self.class}_#{self.id}"
+      SortableController::VERIFIER.generate("class=#{self.class},id=#{self.id}")
     end
 
   protected

spec/controllers/sortable_controller_spec.rb

@@ -1,5 +1,9 @@
 require 'spec_helper'
 
+def create_token(klass, id)
+  return SortableController::VERIFIER.generate("class=#{klass},id=#{id}")
+end
+
 describe SortableController, type: :controller do
   describe 'POST reorder' do
     before do
@@ -9,9 +13,9 @@
     end
     it 'should reorder models' do
       data = [
-        { klass: 'Item', id: @item1.to_param },
-        { klass: 'Item', id: @item3.to_param },
-        { klass: 'Item', id: @item2.to_param },
+        create_token('Item', @item1.to_param),
+        create_token('Item', @item3.to_param),
+        create_token('Item', @item2.to_param),
       ]
       if Gem::Version.new(Rails.version) < Gem::Version.new(5)
         post :reorder, rails_sortable: data
@@ -34,10 +38,10 @@
     end
     it 'should reorder models' do
       data = [
-        { klass: 'SecondItem', id: @second_item2.to_param },
-        { klass: 'FirstItem', id: @first_item2.to_param },
-        { klass: 'FirstItem', id: @first_item1.to_param },
-        { klass: 'SecondItem', id: @second_item1.to_param },
+        create_token('SecondItem', @second_item2.to_param),
+        create_token('FirstItem', @first_item2.to_param),
+        create_token('FirstItem', @first_item1.to_param),
+        create_token('SecondItem', @second_item1.to_param),
       ]
       if Gem::Version.new(Rails.version) < Gem::Version.new(5)
         post :reorder, rails_sortable: data

spec/helpers/sortable_helper_spec.rb

@@ -13,7 +13,7 @@
         new_item = Item.create!
         sortable_fetch([ new_item ]) do |item, id|
           expect(item).to eq new_item
-          expect(id).to eq "Item_#{new_item.id}"
+          expect(id).to eq SortableController::VERIFIER.generate("class=Item,id=#{new_item.id}")
         end
       end
     end

spec/models/rails_sortable/model_spec.rb

@@ -56,16 +56,16 @@
   describe "sortable_id" do
     it "should return a correct sortable_id" do
       item = Item.create!
-      expect(item.sortable_id).to eq("Item_#{item.id}") 
+      expect(item.sortable_id).to eq(SortableController::VERIFIER.generate("class=Item,id=#{item.to_param}"))
     end
   end
 
   describe "each_with_sortable_id" do
     it "should make models iterable with sortable ids" do
       items = 2.times.map { |i| Item.create! sort: i }
       expect { |b| Item.order(:sort).each_with_sortable_id(&b) }.to yield_successive_args(
-        [items[0], "Item_#{items[0].id}"],
-        [items[1], "Item_#{items[1].id}"],
+        [items[0], SortableController::VERIFIER.generate("class=Item,id=#{items[0].to_param}")],
+        [items[1], SortableController::VERIFIER.generate("class=Item,id=#{items[1].to_param}")],
       )
     end
   end

vendor/assets/javascripts/plugin.js

@@ -14,18 +14,12 @@
         url: '/sortable/reorder',
         dataType: 'json',
         contentType: 'application/json',
-        data: JSON.stringify(makePostData($(this))),
+        data: JSON.stringify({
+          rails_sortable: $(this).sortable('toArray'),
+        }),
       });
     }
 
     this.sortable(settings);
   };
-
-  var makePostData = function($sortable) {
-    var data = $.map($sortable.sortable('toArray'), function(sortableId) {
-      klassAndId = sortableId.split(/[-=_]/);
-      return { klass: klassAndId[0], id: klassAndId[1] };
-    });
-    return { rails_sortable: data };
-  };
 })(jQuery);