actionview 7.0.8.1 → 7.2.2.1

data/lib/action_view/railtie.rb

@@ -13,6 +13,7 @@ module ActionView
     config.action_view.image_loading = nil
     config.action_view.image_decoding = nil
     config.action_view.apply_stylesheet_media_default = true
+    config.action_view.prepend_content_exfiltration_prevention = false
 
     config.eager_load_namespaces << ActionView
 
@@ -40,6 +41,17 @@ module ActionView
       end
     end
 
+    config.after_initialize do |app|
+      prepend_content_exfiltration_prevention = app.config.action_view.delete(:prepend_content_exfiltration_prevention)
+      ActionView::Helpers::ContentExfiltrationPreventionHelper.prepend_content_exfiltration_prevention = prepend_content_exfiltration_prevention
+    end
+
+    config.after_initialize do |app|
+      if klass = app.config.action_view.delete(:sanitizer_vendor)
+        ActionView::Helpers::SanitizeHelper.sanitizer_vendor = klass
+      end
+    end
+
     config.after_initialize do |app|
       button_to_generates_button_tag = app.config.action_view.delete(:button_to_generates_button_tag)
       unless button_to_generates_button_tag.nil?
@@ -67,6 +79,10 @@ module ActionView
       end
     end
 
+    initializer "action_view.deprecator", before: :load_environment_config do |app|
+      app.deprecators[:action_view] = ActionView.deprecator
+    end
+
     initializer "action_view.logger" do
       ActiveSupport.on_load(:action_view) { self.logger ||= Rails.logger }
     end
@@ -74,7 +90,7 @@ module ActionView
     initializer "action_view.caching" do |app|
       ActiveSupport.on_load(:action_view) do
         if app.config.action_view.cache_template_loading.nil?
-          ActionView::Resolver.caching = app.config.cache_classes
+          ActionView::Resolver.caching = !app.config.reloading_enabled?
         end
       end
     end
@@ -91,13 +107,19 @@ module ActionView
 
     config.after_initialize do |app|
       enable_caching = if app.config.action_view.cache_template_loading.nil?
-        app.config.cache_classes
+        !app.config.reloading_enabled?
       else
         app.config.action_view.cache_template_loading
       end
 
       unless enable_caching
-        app.executor.register_hook ActionView::CacheExpiry::Executor.new(watcher: app.config.file_watcher)
+        view_reloader = ActionView::CacheExpiry::ViewReloader.new(watcher: app.config.file_watcher)
+
+        app.reloaders << view_reloader
+        app.reloader.to_run do
+          require_unload_lock!
+          view_reloader.execute
+        end
       end
     end
 

data/lib/action_view/record_identifier.rb

@@ -4,6 +4,8 @@ require "active_support/core_ext/module"
 require "action_view/model_naming"
 
 module ActionView
+  # = Action View \Record \Identifier
+  #
   # RecordIdentifier encapsulates methods used by various ActionView helpers
   # to associate records with DOM elements.
   #
@@ -31,6 +33,8 @@ module ActionView
   # automatically generated, following naming conventions encapsulated by the
   # RecordIdentifier methods #dom_id and #dom_class:
   #
+  #   dom_id(Post)             # => "new_post"
+  #   dom_class(Post)          # => "post"
   #   dom_id(Post.new)         # => "new_post"
   #   dom_class(Post.new)      # => "post"
   #   dom_id(Post.find 42)     # => "post_42"
@@ -79,18 +83,21 @@ module ActionView
     # The DOM id convention is to use the singular form of an object or class with the id following an underscore.
     # If no id is found, prefix with "new_" instead.
     #
-    #   dom_id(Post.find(45))       # => "post_45"
-    #   dom_id(Post.new)            # => "new_post"
+    #   dom_id(Post.find(45)) # => "post_45"
+    #   dom_id(Post)          # => "new_post"
     #
     # If you need to address multiple instances of the same class in the same view, you can prefix the dom_id:
     #
     #   dom_id(Post.find(45), :edit) # => "edit_post_45"
-    #   dom_id(Post.new, :custom)    # => "custom_post"
-    def dom_id(record, prefix = nil)
-      if record_id = record_key_for_dom_id(record)
-        "#{dom_class(record, prefix)}#{JOIN}#{record_id}"
+    #   dom_id(Post, :custom)        # => "custom_post"
+    def dom_id(record_or_class, prefix = nil)
+      raise ArgumentError, "dom_id must be passed a record_or_class as the first argument, you passed #{record_or_class.inspect}" unless record_or_class
+
+      record_id = record_key_for_dom_id(record_or_class) unless record_or_class.is_a?(Class)
+      if record_id
+        "#{dom_class(record_or_class, prefix)}#{JOIN}#{record_id}"
       else
-        dom_class(record, prefix || NEW)
+        dom_class(record_or_class, prefix || NEW)
       end
     end
 
@@ -105,7 +112,7 @@ module ActionView
     # make sure yourself that your dom ids are valid, in case you override this method.
     def record_key_for_dom_id(record) # :doc:
       key = convert_to_model(record).to_key
-      key ? key.join(JOIN) : key
+      key && key.all? ? key.join(JOIN) : nil
     end
   end
 end

data/lib/action_view/render_parser/prism_render_parser.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+module ActionView
+  module RenderParser
+    class PrismRenderParser < Base # :nodoc:
+      def render_calls
+        queue = [Prism.parse(@code).value]
+        templates = []
+
+        while (node = queue.shift)
+          queue.concat(node.compact_child_nodes)
+          next unless node.is_a?(Prism::CallNode)
+
+          options = render_call_options(node)
+          next unless options
+
+          render_type = (options.keys & RENDER_TYPE_KEYS)[0]
+          template, object_template = render_call_template(options[render_type])
+          next unless template
+
+          if options.key?(:object) || options.key?(:collection) || object_template
+            next if options.key?(:object) && options.key?(:collection)
+            next unless options.key?(:partial)
+          end
+
+          if options[:spacer_template].is_a?(Prism::StringNode)
+            templates << partial_to_virtual_path(:partial, options[:spacer_template].unescaped)
+          end
+
+          templates << partial_to_virtual_path(render_type, template)
+
+          if render_type != :layout && options[:layout].is_a?(Prism::StringNode)
+            templates << partial_to_virtual_path(:layout, options[:layout].unescaped)
+          end
+        end
+
+        templates
+      end
+
+      private
+        # Accept a call node and return a hash of options for the render call.
+        # If it doesn't match the expected format, return nil.
+        def render_call_options(node)
+          # We are only looking for calls to render or render_to_string.
+          name = node.name.to_sym
+          return if name != :render && name != :render_to_string
+
+          # We are only looking for calls with arguments.
+          arguments = node.arguments
+          return unless arguments
+
+          arguments = arguments.arguments
+          length = arguments.length
+
+          # Get rid of any parentheses to get directly to the contents.
+          arguments.map! do |argument|
+            current = argument
+
+            while current.is_a?(Prism::ParenthesesNode) &&
+                  current.body.is_a?(Prism::StatementsNode) &&
+                  current.body.body.length == 1
+              current = current.body.body.first
+            end
+
+            current
+          end
+
+          # We are only looking for arguments that are either a string with an
+          # array of locals or a keyword hash with symbol keys.
+          options =
+            if (length == 1 || length == 2) && !arguments[0].is_a?(Prism::KeywordHashNode)
+              { partial: arguments[0], locals: arguments[1] }
+            elsif length == 1 &&
+                  arguments[0].is_a?(Prism::KeywordHashNode) &&
+                  arguments[0].elements.all? do |element|
+                    element.is_a?(Prism::AssocNode) && element.key.is_a?(Prism::SymbolNode)
+                  end
+              arguments[0].elements.to_h do |element|
+                [element.key.unescaped.to_sym, element.value]
+              end
+            end
+
+          return unless options
+
+          # Here we validate that the options have the keys we expect.
+          keys = options.keys
+          return if !keys.intersect?(RENDER_TYPE_KEYS)
+          return if (keys - ALL_KNOWN_KEYS).any?
+
+          # Finally, we can return a valid set of options.
+          options
+        end
+
+        # Accept the node that is being passed in the position of the template
+        # and return the template name and whether or not it is an object
+        # template.
+        def render_call_template(node)
+          object_template = false
+          template =
+            if node.is_a?(Prism::StringNode)
+              path = node.unescaped
+              path.include?("/") ? path : "#{directory}/#{path}"
+            else
+              dependency =
+                case node.type
+                when :class_variable_read_node
+                  node.slice[2..]
+                when :instance_variable_read_node
+                  node.slice[1..]
+                when :global_variable_read_node
+                  node.slice[1..]
+                when :local_variable_read_node
+                  node.slice
+                when :call_node
+                  node.name.to_s
+                else
+                  return
+                end
+
+              "#{dependency.pluralize}/#{dependency.singularize}"
+            end
+
+          [template, object_template]
+        end
+    end
+  end
+end

data/lib/action_view/render_parser/ripper_render_parser.rb

@@ -0,0 +1,341 @@
+# frozen_string_literal: true
+
+module ActionView
+  module RenderParser
+    class RipperRenderParser < Base # :nodoc:
+      class Node < ::Array # :nodoc:
+        attr_reader :type
+
+        def initialize(type, arr, opts = {})
+          @type = type
+          super(arr)
+        end
+
+        def children
+          to_a
+        end
+
+        def inspect
+          typeinfo = type && type != :list ? ":" + type.to_s + ", " : ""
+          "s(" + typeinfo + map(&:inspect).join(", ") + ")"
+        end
+
+        def fcall?
+          type == :command || type == :fcall
+        end
+
+        def fcall_named?(name)
+          fcall? &&
+            self[0].type == :@ident &&
+            self[0][0] == name
+        end
+
+        def argument_nodes
+          raise unless fcall?
+          return [] if self[1].nil?
+          if self[1].last == false || self[1].last.type == :vcall
+            self[1][0...-1]
+          else
+            self[1][0..-1]
+          end
+        end
+
+        def string?
+          type == :string_literal
+        end
+
+        def variable_reference?
+          type == :var_ref
+        end
+
+        def vcall?
+          type == :vcall
+        end
+
+        def call?
+          type == :call
+        end
+
+        def variable_name
+          self[0][0]
+        end
+
+        def call_method_name
+          self[2].first
+        end
+
+        def to_string
+          raise unless string?
+          self[0][0][0]
+        end
+
+        def hash?
+          type == :bare_assoc_hash || type == :hash
+        end
+
+        def to_hash
+          if type == :bare_assoc_hash
+            hash_from_body(self[0])
+          elsif type == :hash && self[0] == nil
+            {}
+          elsif type == :hash && self[0].type == :assoclist_from_args
+            hash_from_body(self[0][0])
+          end
+        end
+
+        def hash_from_body(body)
+          body.to_h do |hash_node|
+            return nil if hash_node.type != :assoc_new
+
+            [hash_node[0], hash_node[1]]
+          end
+        end
+
+        def symbol?
+          type == :@label || type == :symbol_literal
+        end
+
+        def to_symbol
+          if type == :@label && self[0] =~ /\A(.+):\z/
+            $1.to_sym
+          elsif type == :symbol_literal && self[0].type == :symbol && self[0][0].type == :@ident
+            self[0][0][0].to_sym
+          else
+            raise "not a symbol?: #{self.inspect}"
+          end
+        end
+      end
+
+      class NodeParser < ::Ripper # :nodoc:
+        PARSER_EVENTS.each do |event|
+          arity = PARSER_EVENT_TABLE[event]
+          if arity == 0 && event.to_s.end_with?("_new")
+            module_eval(<<-eof, __FILE__, __LINE__ + 1)
+            def on_#{event}(*args)
+              Node.new(:list, args, lineno: lineno(), column: column())
+            end
+            eof
+          elsif event.to_s.match?(/_add(_.+)?\z/)
+            module_eval(<<-eof, __FILE__, __LINE__ + 1)
+            begin; undef on_#{event}; rescue NameError; end
+            def on_#{event}(list, item)
+              list.push(item)
+              list
+            end
+            eof
+          else
+            module_eval(<<-eof, __FILE__, __LINE__ + 1)
+            begin; undef on_#{event}; rescue NameError; end
+            def on_#{event}(*args)
+              Node.new(:#{event}, args, lineno: lineno(), column: column())
+            end
+            eof
+          end
+        end
+
+        SCANNER_EVENTS.each do |event|
+          module_eval(<<-End, __FILE__, __LINE__ + 1)
+          def on_#{event}(tok)
+            Node.new(:@#{event}, [tok], lineno: lineno(), column: column())
+          end
+          End
+        end
+      end
+
+      class RenderCallExtractor < NodeParser # :nodoc:
+        attr_reader :render_calls
+
+        METHODS_TO_PARSE = %w(render render_to_string)
+
+        def initialize(*args)
+          super
+
+          @render_calls = []
+        end
+
+        private
+          def on_fcall(name, *args)
+            on_render_call(super)
+          end
+
+          def on_command(name, *args)
+            on_render_call(super)
+          end
+
+          def on_render_call(node)
+            METHODS_TO_PARSE.each do |method|
+              if node.fcall_named?(method)
+                @render_calls << [method, node]
+                return node
+              end
+            end
+            node
+          end
+
+          def on_arg_paren(content)
+            content
+          end
+
+          def on_paren(content)
+            content.size == 1 ? content.first : content
+          end
+      end
+
+      def render_calls
+        parser = RenderCallExtractor.new(@code)
+        parser.parse
+
+        parser.render_calls.group_by(&:first).to_h do |method, nodes|
+          [ method.to_sym, nodes.collect { |v| v[1] } ]
+        end.map do |method, nodes|
+          nodes.map { |n| parse_render(n) }
+        end.flatten.compact
+      end
+
+      private
+        def resolve_path_directory(path)
+          if path.include?("/")
+            path
+          else
+            "#{directory}/#{path}"
+          end
+        end
+
+        # Convert
+        #   render("foo", ...)
+        # into either
+        #   render(template: "foo", ...)
+        # or
+        #   render(partial: "foo", ...)
+        def normalize_args(string, options_hash)
+          if options_hash
+            { partial: string, locals: options_hash }
+          else
+            { partial: string }
+          end
+        end
+
+        def parse_render(node)
+          node = node.argument_nodes
+
+          if (node.length == 1 || node.length == 2) && !node[0].hash?
+            if node.length == 1
+              options = normalize_args(node[0], nil)
+            elsif node.length == 2
+              options = normalize_args(node[0], node[1])
+            end
+
+            return nil unless options
+
+            parse_render_from_options(options)
+          elsif node.length == 1 && node[0].hash?
+            options = parse_hash_to_symbols(node[0])
+
+            return nil unless options
+
+            parse_render_from_options(options)
+          else
+            nil
+          end
+        end
+
+        def parse_hash(node)
+          node.hash? && node.to_hash
+        end
+
+        def parse_hash_to_symbols(node)
+          hash = parse_hash(node)
+
+          return unless hash
+
+          hash.transform_keys do |key_node|
+            key = parse_sym(key_node)
+
+            return unless key
+
+            key
+          end
+        end
+
+        def parse_render_from_options(options_hash)
+          renders = []
+          keys = options_hash.keys
+
+          if (keys & RENDER_TYPE_KEYS).size < 1
+            # Must have at least one of render keys
+            return nil
+          end
+
+          if (keys - ALL_KNOWN_KEYS).any?
+            # de-opt in case of unknown option
+            return nil
+          end
+
+          render_type = (keys & RENDER_TYPE_KEYS)[0]
+
+          node = options_hash[render_type]
+
+          if node.string?
+            template = resolve_path_directory(node.to_string)
+          else
+            if node.variable_reference?
+              dependency = node.variable_name.sub(/\A(?:\$|@{1,2})/, "")
+            elsif node.vcall?
+              dependency = node.variable_name
+            elsif node.call?
+              dependency = node.call_method_name
+            else
+              return
+            end
+
+            object_template = true
+            template = "#{dependency.pluralize}/#{dependency.singularize}"
+          end
+
+          return unless template
+
+          if spacer_template = render_template_with_spacer?(options_hash)
+            virtual_path = partial_to_virtual_path(:partial, spacer_template)
+            renders << virtual_path
+          end
+
+          if options_hash.key?(:object) || options_hash.key?(:collection) || object_template
+            return nil if options_hash.key?(:object) && options_hash.key?(:collection)
+            return nil unless options_hash.key?(:partial)
+          end
+
+          virtual_path = partial_to_virtual_path(render_type, template)
+          renders << virtual_path
+
+          # Support for rendering multiple templates (i.e. a partial with a layout)
+          if layout_template = render_template_with_layout?(render_type, options_hash)
+            virtual_path = partial_to_virtual_path(:layout, layout_template)
+
+            renders << virtual_path
+          end
+
+          renders
+        end
+
+        def parse_str(node)
+          node.string? && node.to_string
+        end
+
+        def parse_sym(node)
+          node.symbol? && node.to_symbol
+        end
+
+        def render_template_with_layout?(render_type, options_hash)
+          if render_type != :layout && options_hash.key?(:layout)
+            parse_str(options_hash[:layout])
+          end
+        end
+
+        def render_template_with_spacer?(options_hash)
+          if options_hash.key?(:spacer_template)
+            parse_str(options_hash[:spacer_template])
+          end
+        end
+    end
+  end
+end