Merge branch 'hotfix/0.7.4.1'

Changelog.md

@@ -1,3 +1,7 @@
+# 0.7.4.1
+
+Fixes a possible cross-site scripting issue with maliciously crafted OpenGraph metadata.
+
 # 0.7.4.0
 
 ## Refactor

app/assets/javascripts/app/helpers/truncate.js

@@ -1,14 +1,11 @@
 (function() {
   app.helpers.truncate = function(passedString, length) {
-    if (passedString === null || passedString === undefined) {
+    if (passedString === null || passedString === undefined || passedString.length < length) {
       return passedString;
     }
 
-    if (passedString.length > length) {
-      var lastBlank = passedString.lastIndexOf(' ', length);
-      var trimstring = passedString.substring(0, Math.min(length, lastBlank));
-      return new Handlebars.SafeString(trimstring + " ...");
-    }
-    return new Handlebars.SafeString(passedString);
+    var lastBlank = passedString.lastIndexOf(" ", length);
+    var trimstring = passedString.substring(0, Math.min(length, lastBlank));
+    return trimstring + " ...";
   };
 })();

config/defaults.yml

@@ -4,7 +4,7 @@
 
 defaults:
   version:
-    number: "0.7.4.0" # Do not touch unless doing a release, do not backport the version number that's in master
+    number: "0.7.4.1" # Do not touch unless doing a release, do not backport the version number that's in master
   heroku: false
   environment:
     url: "http://localhost:3000/"

spec/javascripts/app/helpers/truncate_spec.js

@@ -6,4 +6,16 @@ describe("app.helpers.truncate", function() {
   it("handles undefined", function() {
     expect(app.helpers.truncate(undefined, 123)).toEqual(undefined);
   });
+
+  it("returns a short string", function() {
+    expect(app.helpers.truncate("Some text", 10)).toEqual("Some text");
+  });
+
+  it("trims a long string at a space", function() {
+    expect(app.helpers.truncate("Some very long text", 10)).toEqual("Some very ...");
+  });
+
+  it("returns a string", function() {
+    expect(typeof app.helpers.truncate("Some very long text", 10)).toEqual("string");
+  });
 });