actionview 5.1.7 → 5.2.4.3

data/lib/action_view/template/handlers/raw.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActionView
   module Template::Handlers
     class Raw

data/lib/action_view/template/html.rb

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 module ActionView #:nodoc:
   # = Action View HTML Template
-  class Template
+  class Template #:nodoc:
     class HTML #:nodoc:
       attr_accessor :type
 

data/lib/action_view/template/resolver.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "pathname"
 require "active_support/core_ext/class"
 require "active_support/core_ext/module/attribute_accessors"
@@ -14,7 +16,7 @@ module ActionView
       alias_method :partial?, :partial
 
       def self.build(name, prefix, partial)
-        virtual = ""
+        virtual = "".dup
         virtual << "#{prefix}/" unless prefix.empty?
         virtual << (partial ? "_#{name}" : name)
         new name, prefix, partial, virtual
@@ -125,8 +127,7 @@ module ActionView
         end
     end
 
-    cattr_accessor :caching
-    self.caching = true
+    cattr_accessor :caching, default: true
 
     class << self
       alias :caching? :caching
@@ -309,13 +310,13 @@ module ActionView
   # ==== Examples
   #
   # Default pattern, loads views the same way as previous versions of rails, eg. when you're
-  # looking for `users/new` it will produce query glob: `users/new{.{en},}{.{html,js},}{.{erb,haml},}`
+  # looking for <tt>users/new</tt> it will produce query glob: <tt>users/new{.{en},}{.{html,js},}{.{erb,haml},}</tt>
   #
   #   FileSystemResolver.new("/path/to/views", ":prefix/:action{.:locale,}{.:formats,}{+:variants,}{.:handlers,}")
   #
   # This one allows you to keep files with different formats in separate subdirectories,
-  # eg. `users/new.html` will be loaded from `users/html/new.erb` or `users/new.html.erb`,
-  # `users/new.js` from `users/js/new.erb` or `users/new.js.erb`, etc.
+  # eg. <tt>users/new.html</tt> will be loaded from <tt>users/html/new.erb</tt> or <tt>users/new.html.erb</tt>,
+  # <tt>users/new.js</tt> from <tt>users/js/new.erb</tt> or <tt>users/new.js.erb</tt>, etc.
   #
   #   FileSystemResolver.new("/path/to/views", ":prefix/{:formats/,}:action{.:locale,}{.:formats,}{+:variants,}{.:handlers,}")
   #

data/lib/action_view/template/text.rb

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 module ActionView #:nodoc:
   # = Action View Text Template
-  class Template
+  class Template #:nodoc:
     class Text #:nodoc:
       attr_accessor :type
 

data/lib/action_view/template/types.rb

@@ -1,7 +1,9 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/module/attribute_accessors"
 
 module ActionView
-  class Template
+  class Template #:nodoc:
     class Types
       class Type
         SET = Struct.new(:symbols).new([ :html, :text, :js, :css, :xml, :json ])

data/lib/action_view/test_case.rb

@@ -1,4 +1,6 @@
-require "active_support/core_ext/module/remove_method"
+# frozen_string_literal: true
+
+require "active_support/core_ext/module/redefine_method"
 require "action_controller"
 require "action_controller/test_case"
 require "action_view"
@@ -71,7 +73,7 @@ module ActionView
         def helper_method(*methods)
           # Almost a duplicate from ActionController::Helpers
           methods.flatten.each do |method|
-            _helpers.module_eval <<-end_eval
+            _helpers.module_eval <<-end_eval, __FILE__, __LINE__ + 1
               def #{method}(*args, &block)                    # def current_user(*args, &block)
                 _test_case.send(%(#{method}), *args, &block)  #   _test_case.send(%(current_user), *args, &block)
               end                                             # end
@@ -101,10 +103,11 @@ module ActionView
       def setup_with_controller
         @controller = ActionView::TestCase::TestController.new
         @request = @controller.request
+        @view_flow = ActionView::OutputFlow.new
         # empty string ensures buffer has UTF-8 encoding as
         # new without arguments returns ASCII-8BIT encoded buffer like String#new
         @output_buffer = ActiveSupport::SafeBuffer.new ""
-        @rendered = ""
+        @rendered = "".dup
 
         make_test_case_available_to_view!
         say_no_to_protect_against_forgery!
@@ -168,7 +171,7 @@ module ActionView
 
       def say_no_to_protect_against_forgery!
         _helpers.module_eval do
-          remove_possible_method :protect_against_forgery?
+          silence_redefinition_of_method :protect_against_forgery?
           def protect_against_forgery?
             false
           end
@@ -244,6 +247,7 @@ module ActionView
         :@test_passed,
         :@view,
         :@view_context_class,
+        :@view_flow,
         :@_subscribers,
         :@html_document
       ]
@@ -266,7 +270,7 @@ module ActionView
         begin
           routes = @controller.respond_to?(:_routes) && @controller._routes
         rescue
-          # Dont call routes, if there is an error on _routes call
+          # Don't call routes, if there is an error on _routes call
         end
 
         if routes &&
@@ -277,6 +281,18 @@ module ActionView
           super
         end
       end
+
+      def respond_to_missing?(name, include_private = false)
+        begin
+          routes = @controller.respond_to?(:_routes) && @controller._routes
+        rescue
+          # Don't call routes, if there is an error on _routes call
+        end
+
+        routes &&
+          (routes.named_routes.route_defined?(name) ||
+           routes.mounted_helpers.method_defined?(name))
+      end
     end
 
     include Behavior

data/lib/action_view/testing/resolvers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "action_view/template/resolver"
 
 module ActionView #:nodoc:
@@ -20,7 +22,7 @@ module ActionView #:nodoc:
     private
 
       def query(path, exts, _, _)
-        query = ""
+        query = "".dup
         EXTENSIONS.each_key do |ext|
           query << "(" << exts[ext].map { |e| e && Regexp.escape(".#{e}") }.join("|") << "|)"
         end

data/lib/action_view/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "gem_version"
 
 module ActionView

data/lib/action_view/view_paths.rb

@@ -1,11 +1,11 @@
+# frozen_string_literal: true
+
 module ActionView
   module ViewPaths
     extend ActiveSupport::Concern
 
     included do
-      class_attribute :_view_paths
-      self._view_paths = ActionView::PathSet.new
-      _view_paths.freeze
+      class_attribute :_view_paths, default: ActionView::PathSet.new.freeze
     end
 
     delegate :template_exists?, :any_templates?, :view_paths, :formats, :formats=,

data/lib/assets/compiled/rails-ujs.js

@@ -2,7 +2,7 @@
 Unobtrusive JavaScript
 https://github.com/rails/rails/blob/master/actionview/app/assets/javascripts
 Released under the MIT license
- */
+ */;
 
 (function() {
   var context = this;
@@ -31,6 +31,21 @@ Released under the MIT license
   var Rails = context.Rails;
 
   (function() {
+    (function() {
+      var nonce;
+
+      nonce = null;
+
+      Rails.loadCSPNonce = function() {
+        var ref;
+        return nonce = (ref = document.querySelector("meta[name=csp-nonce]")) != null ? ref.content : void 0;
+      };
+
+      Rails.cspNonce = function() {
+        return nonce != null ? nonce : Rails.loadCSPNonce();
+      };
+
+    }).call(this);
     (function() {
       var expando, m;
 
@@ -101,7 +116,7 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var CustomEvent, fire, matches;
+      var CustomEvent, fire, matches, preventDefault;
 
       matches = Rails.matches;
 
@@ -115,6 +130,19 @@ Released under the MIT license
           return evt;
         };
         CustomEvent.prototype = window.Event.prototype;
+        preventDefault = CustomEvent.prototype.preventDefault;
+        CustomEvent.prototype.preventDefault = function() {
+          var result;
+          result = preventDefault.call(this);
+          if (this.cancelable && !this.defaultPrevented) {
+            Object.defineProperty(this, 'defaultPrevented', {
+              get: function() {
+                return true;
+              }
+            });
+          }
+          return result;
+        };
       }
 
       fire = Rails.fire = function(obj, name, data) {
@@ -151,9 +179,9 @@ Released under the MIT license
 
     }).call(this);
     (function() {
-      var AcceptHeaders, CSRFProtection, createXHR, fire, prepareOptions, processResponse;
+      var AcceptHeaders, CSRFProtection, createXHR, cspNonce, fire, prepareOptions, processResponse;
 
-      CSRFProtection = Rails.CSRFProtection, fire = Rails.fire;
+      cspNonce = Rails.cspNonce, CSRFProtection = Rails.CSRFProtection, fire = Rails.fire;
 
       AcceptHeaders = {
         '*': '*/*',
@@ -168,8 +196,8 @@ Released under the MIT license
         var xhr;
         options = prepareOptions(options);
         xhr = createXHR(options, function() {
-          var response;
-          response = processResponse(xhr.response, xhr.getResponseHeader('Content-Type'));
+          var ref, response;
+          response = processResponse((ref = xhr.response) != null ? ref : xhr.responseText, xhr.getResponseHeader('Content-Type'));
           if (Math.floor(xhr.status / 100) === 2) {
             if (typeof options.success === "function") {
               options.success(response, xhr.statusText, xhr);
@@ -181,7 +209,7 @@ Released under the MIT license
           }
           return typeof options.complete === "function" ? options.complete(xhr, xhr.statusText) : void 0;
         });
-        if (!(typeof options.beforeSend === "function" ? options.beforeSend(xhr, options) : void 0)) {
+        if ((options.beforeSend != null) && !options.beforeSend(xhr, options)) {
           return false;
         }
         if (xhr.readyState === XMLHttpRequest.OPENED) {
@@ -219,8 +247,8 @@ Released under the MIT license
         }
         if (!options.crossDomain) {
           xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
+          CSRFProtection(xhr);
         }
-        CSRFProtection(xhr);
         xhr.withCredentials = !!options.withCredentials;
         xhr.onreadystatechange = function() {
           if (xhr.readyState === XMLHttpRequest.DONE) {
@@ -239,6 +267,7 @@ Released under the MIT license
             } catch (error) {}
           } else if (type.match(/\b(?:java|ecma)script\b/)) {
             script = document.createElement('script');
+            script.setAttribute('nonce', cspNonce());
             script.text = response;
             document.head.appendChild(script).parentNode.removeChild(script);
           } else if (type.match(/\b(xml|html|svg)\b/)) {
@@ -592,24 +621,29 @@ Released under the MIT license
         return setData(form, 'ujs:submit-button-formmethod', button.getAttribute('formmethod'));
       };
 
-      Rails.handleMetaClick = function(e) {
-        var data, link, metaClick, method;
+      Rails.preventInsignificantClick = function(e) {
+        var data, insignificantMetaClick, link, metaClick, method, nonPrimaryMouseClick;
         link = this;
         method = (link.getAttribute('data-method') || 'GET').toUpperCase();
         data = link.getAttribute('data-params');
         metaClick = e.metaKey || e.ctrlKey;
-        if (metaClick && method === 'GET' && !data) {
+        insignificantMetaClick = metaClick && method === 'GET' && !data;
+        nonPrimaryMouseClick = (e.button != null) && e.button !== 0;
+        if (nonPrimaryMouseClick || insignificantMetaClick) {
           return e.stopImmediatePropagation();
         }
       };
 
     }).call(this);
     (function() {
-      var $, CSRFProtection, delegate, disableElement, enableElement, fire, formSubmitButtonClick, getData, handleConfirm, handleDisabledElement, handleMetaClick, handleMethod, handleRemote, refreshCSRFTokens;
+      var $, CSRFProtection, delegate, disableElement, enableElement, fire, formSubmitButtonClick, getData, handleConfirm, handleDisabledElement, handleMethod, handleRemote, loadCSPNonce, preventInsignificantClick, refreshCSRFTokens;
 
-      fire = Rails.fire, delegate = Rails.delegate, getData = Rails.getData, $ = Rails.$, refreshCSRFTokens = Rails.refreshCSRFTokens, CSRFProtection = Rails.CSRFProtection, enableElement = Rails.enableElement, disableElement = Rails.disableElement, handleDisabledElement = Rails.handleDisabledElement, handleConfirm = Rails.handleConfirm, handleRemote = Rails.handleRemote, formSubmitButtonClick = Rails.formSubmitButtonClick, handleMetaClick = Rails.handleMetaClick, handleMethod = Rails.handleMethod;
+      fire = Rails.fire, delegate = Rails.delegate, getData = Rails.getData, $ = Rails.$, refreshCSRFTokens = Rails.refreshCSRFTokens, CSRFProtection = Rails.CSRFProtection, loadCSPNonce = Rails.loadCSPNonce, enableElement = Rails.enableElement, disableElement = Rails.disableElement, handleDisabledElement = Rails.handleDisabledElement, handleConfirm = Rails.handleConfirm, preventInsignificantClick = Rails.preventInsignificantClick, handleRemote = Rails.handleRemote, formSubmitButtonClick = Rails.formSubmitButtonClick, handleMethod = Rails.handleMethod;
 
-      if ((typeof jQuery !== "undefined" && jQuery !== null) && (jQuery.ajax != null) && !jQuery.rails) {
+      if ((typeof jQuery !== "undefined" && jQuery !== null) && (jQuery.ajax != null)) {
+        if (jQuery.rails) {
+          throw new Error('If you load both jquery_ujs and rails-ujs, use rails-ujs only.');
+        }
         jQuery.rails = Rails;
         jQuery.ajaxPrefilter(function(options, originalOptions, xhr) {
           if (!options.crossDomain) {
@@ -638,12 +672,13 @@ Released under the MIT license
         delegate(document, Rails.linkDisableSelector, 'ajax:stopped', enableElement);
         delegate(document, Rails.buttonDisableSelector, 'ajax:complete', enableElement);
         delegate(document, Rails.buttonDisableSelector, 'ajax:stopped', enableElement);
+        delegate(document, Rails.linkClickSelector, 'click', preventInsignificantClick);
         delegate(document, Rails.linkClickSelector, 'click', handleDisabledElement);
         delegate(document, Rails.linkClickSelector, 'click', handleConfirm);
-        delegate(document, Rails.linkClickSelector, 'click', handleMetaClick);
         delegate(document, Rails.linkClickSelector, 'click', disableElement);
         delegate(document, Rails.linkClickSelector, 'click', handleRemote);
         delegate(document, Rails.linkClickSelector, 'click', handleMethod);
+        delegate(document, Rails.buttonClickSelector, 'click', preventInsignificantClick);
         delegate(document, Rails.buttonClickSelector, 'click', handleDisabledElement);
         delegate(document, Rails.buttonClickSelector, 'click', handleConfirm);
         delegate(document, Rails.buttonClickSelector, 'click', disableElement);
@@ -661,10 +696,12 @@ Released under the MIT license
         });
         delegate(document, Rails.formSubmitSelector, 'ajax:send', disableElement);
         delegate(document, Rails.formSubmitSelector, 'ajax:complete', enableElement);
+        delegate(document, Rails.formInputClickSelector, 'click', preventInsignificantClick);
         delegate(document, Rails.formInputClickSelector, 'click', handleDisabledElement);
         delegate(document, Rails.formInputClickSelector, 'click', handleConfirm);
         delegate(document, Rails.formInputClickSelector, 'click', formSubmitButtonClick);
         document.addEventListener('DOMContentLoaded', refreshCSRFTokens);
+        document.addEventListener('DOMContentLoaded', loadCSPNonce);
         return window._rails_loaded = true;
       };
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 5.1.7
+  version: 5.2.4.3
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-03-28 00:00:00.000000000 Z
+date: 2020-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.7
+        version: 5.2.4.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.7
+        version: 5.2.4.3
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.7
+        version: 5.2.4.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.7
+        version: 5.2.4.3
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.7
+        version: 5.2.4.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.1.7
+        version: 5.2.4.3
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -139,6 +139,7 @@ files:
 - lib/action_view/helpers/cache_helper.rb
 - lib/action_view/helpers/capture_helper.rb
 - lib/action_view/helpers/controller_helper.rb
+- lib/action_view/helpers/csp_helper.rb
 - lib/action_view/helpers/csrf_helper.rb
 - lib/action_view/helpers/date_helper.rb
 - lib/action_view/helpers/debug_helper.rb
@@ -213,9 +214,7 @@ files:
 - lib/action_view/template/handlers.rb
 - lib/action_view/template/handlers/builder.rb
 - lib/action_view/template/handlers/erb.rb
-- lib/action_view/template/handlers/erb/deprecated_erubis.rb
 - lib/action_view/template/handlers/erb/erubi.rb
-- lib/action_view/template/handlers/erb/erubis.rb
 - lib/action_view/template/handlers/html.rb
 - lib/action_view/template/handlers/raw.rb
 - lib/action_view/template/html.rb
@@ -231,8 +230,8 @@ homepage: http://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v5.1.7/actionview
-  changelog_uri: https://github.com/rails/rails/blob/v5.1.7/actionview/CHANGELOG.md
+  source_code_uri: https://github.com/rails/rails/tree/v5.2.4.3/actionview
+  changelog_uri: https://github.com/rails/rails/blob/v5.2.4.3/actionview/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -249,7 +248,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.0.1
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).