actionview 7.0.8.4 → 7.1.0.beta1

data/lib/action_view/helpers/tags/time_field.rb

@@ -10,7 +10,7 @@ module ActionView
         end
 
         private
-          def format_date(value)
+          def format_datetime(value)
             if @include_seconds
               value&.strftime("%T.%L")
             else

data/lib/action_view/helpers/tags/time_zone_select.rb

@@ -4,6 +4,9 @@ module ActionView
   module Helpers
     module Tags # :nodoc:
       class TimeZoneSelect < Base # :nodoc:
+        include SelectRenderer
+        include FormOptionsHelper
+
         def initialize(object_name, method_name, template_object, priority_zones, options, html_options)
           @priority_zones = priority_zones
           @html_options   = html_options

data/lib/action_view/helpers/tags/week_field.rb

@@ -5,7 +5,7 @@ module ActionView
     module Tags # :nodoc:
       class WeekField < DatetimeField # :nodoc:
         private
-          def format_date(value)
+          def format_datetime(value)
             value&.strftime("%Y-W%V")
           end
       end

data/lib/action_view/helpers/tags/weekday_select.rb

@@ -4,6 +4,9 @@ module ActionView
   module Helpers
     module Tags # :nodoc:
       class WeekdaySelect < Base # :nodoc:
+        include SelectRenderer
+        include FormOptionsHelper
+
         def initialize(object_name, method_name, template_object, options, html_options)
           @html_options = html_options
 

data/lib/action_view/helpers/tags.rb

@@ -5,6 +5,8 @@ module ActionView
     module Tags # :nodoc:
       extend ActiveSupport::Autoload
 
+      autoload :SelectRenderer
+
       eager_autoload do
         autoload :Base
         autoload :Translator

data/lib/action_view/helpers/text_helper.rb

@@ -8,8 +8,9 @@ require "action_view/helpers/tag_helper"
 require "action_view/helpers/output_safety_helper"
 
 module ActionView
-  # = Action View Text Helpers
   module Helpers # :nodoc:
+    # = Action View Text \Helpers
+    #
     # The TextHelper module provides a set of methods for filtering, formatting
     # and transforming strings, which can reduce the amount of inline Ruby code in
     # your views. These helper methods extend Action View making them callable
@@ -139,16 +140,19 @@ module ActionView
         if text.blank? || phrases.blank?
           text || ""
         else
-          match = Array(phrases).map do |p|
-            Regexp === p ? p.to_s : Regexp.escape(p)
-          end.join("|")
-
-          if block_given?
-            text.gsub(/(#{match})(?![^<]*?>)/i, &block)
-          else
-            highlighter = options.fetch(:highlighter, '<mark>\1</mark>')
-            text.gsub(/(#{match})(?![^<]*?>)/i, highlighter)
-          end
+          patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
+          pattern = /(#{patterns.join("|")})/i
+          highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block
+
+          text.scan(/<[^>]*|[^<]+/).each do |segment|
+            if !segment.start_with?("<")
+              if block
+                segment.gsub!(pattern, &block)
+              else
+                segment.gsub!(pattern, highlighter)
+              end
+            end
+          end.join
         end.html_safe
       end
 
@@ -262,9 +266,17 @@ module ActionView
       #   word_wrap('Once upon a time', line_width: 1, break_sequence: "\r\n")
       #   # => Once\r\nupon\r\na\r\ntime
       def word_wrap(text, line_width: 80, break_sequence: "\n")
-        text.split("\n").collect! do |line|
-          line.length > line_width ? line.gsub(/(.{1,#{line_width}})(\s+|$)/, "\\1#{break_sequence}").rstrip : line
-        end * break_sequence
+        # Match up to `line_width` characters, followed by one of
+        #   (1) non-newline whitespace plus an optional newline
+        #   (2) the end of the string, ignoring any trailing newlines
+        #   (3) a newline
+        #
+        # -OR-
+        #
+        # Match an empty line
+        pattern = /(.{1,#{line_width}})(?:[^\S\n]+\n?|\n*\Z|\n)|\n/
+
+        text.gsub(pattern, "\\1#{break_sequence}").chomp!(break_sequence)
       end
 
       # Returns +text+ transformed into HTML using simple formatting rules.
@@ -279,6 +291,7 @@ module ActionView
       #
       # ==== Options
       # * <tt>:sanitize</tt> - If +false+, does not sanitize +text+.
+      # * <tt>:sanitize_options</tt> - Any extra options you want appended to the sanitize.
       # * <tt>:wrapper_tag</tt> - String representing the wrapper tag, defaults to <tt>"p"</tt>
       #
       # ==== Examples
@@ -303,10 +316,13 @@ module ActionView
       #
       #   simple_format("<blink>Blinkable!</blink> It's true.", {}, sanitize: false)
       #   # => "<p><blink>Blinkable!</blink> It's true.</p>"
+      #
+      #   simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
+      #   # => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
       def simple_format(text, html_options = {}, options = {})
-        wrapper_tag = options.fetch(:wrapper_tag, :p)
+        wrapper_tag = options[:wrapper_tag] || "p"
 
-        text = sanitize(text) if options.fetch(:sanitize, true)
+        text = sanitize(text, options.fetch(:sanitize_options, {})) if options.fetch(:sanitize, true)
         paragraphs = split_paragraphs(text)
 
         if paragraphs.empty?

data/lib/action_view/helpers/translation_helper.rb

@@ -4,14 +4,14 @@ require "action_view/helpers/tag_helper"
 require "active_support/html_safe_translation"
 
 module ActionView
-  # = Action View Translation Helpers
   module Helpers # :nodoc:
+    # = Action View Translation \Helpers
     module TranslationHelper
       extend ActiveSupport::Concern
 
       include TagHelper
 
-      # Specify whether an error should be raised for missing translations
+      # Specify whether an error should be raised for missing translations.
       singleton_class.attr_accessor :raise_on_missing_translations
 
       included do
@@ -93,7 +93,7 @@ module ActionView
           break translated unless translated == MISSING_TRANSLATION
 
           if alternatives.present? && !alternatives.first.is_a?(Symbol)
-            break alternatives.first && I18n.translate(**options, default: alternatives)
+            break alternatives.first && I18n.translate(nil, **options, default: alternatives)
           end
 
           first_key ||= key

data/lib/action_view/helpers/url_helper.rb

@@ -3,11 +3,13 @@
 require "active_support/core_ext/array/access"
 require "active_support/core_ext/hash/keys"
 require "active_support/core_ext/string/output_safety"
+require "action_view/helpers/content_exfiltration_prevention_helper"
 require "action_view/helpers/tag_helper"
 
 module ActionView
-  # = Action View URL Helpers
   module Helpers # :nodoc:
+    # = Action View URL \Helpers
+    #
     # Provides a set of methods for making links and getting URLs that
     # depend on the routing subsystem (see ActionDispatch::Routing).
     # This allows you to use the same format for links in views
@@ -22,6 +24,7 @@ module ActionView
       extend ActiveSupport::Concern
 
       include TagHelper
+      include ContentExfiltrationPreventionHelper
 
       module ClassMethods
         def _url_for_modules
@@ -93,7 +96,7 @@ module ActionView
       # ==== Examples
       #
       # Because it relies on +url_for+, +link_to+ supports both older-style controller/action/id arguments
-      # and newer RESTful routes. Current Rails style favors RESTful routes whenever possible, so base
+      # and newer RESTful routes. Current \Rails style favors RESTful routes whenever possible, so base
       # your application on resources and use
       #
       #   link_to "Profile", profile_path(@profile)
@@ -170,9 +173,31 @@ module ActionView
       #   link_to "External link", "http://www.rubyonrails.org/", target: "_blank", rel: "nofollow"
       #   # => <a href="http://www.rubyonrails.org/" target="_blank" rel="nofollow">External link</a>
       #
-      # ==== Deprecated: Rails UJS Attributes
+      # ==== Turbo
       #
-      # Prior to Rails 7, Rails shipped with a JavaScript library called <tt>@rails/ujs</tt> on by default. Following Rails 7,
+      # Rails 7 ships with Turbo enabled by default. Turbo provides the following +:data+ options:
+      #
+      # * <tt>turbo_method: symbol of HTTP verb</tt> - Performs a Turbo link visit
+      #   with the given HTTP verb. Forms are recommended when performing non-+GET+ requests.
+      #   Only use <tt>data-turbo-method</tt> where a form is not possible.
+      #
+      # * <tt>turbo_confirm: "question?"</tt> - Adds a confirmation dialog to the link with the
+      #   given value.
+      #
+      # {Consult the Turbo Handbook for more information on the options
+      # above.}[https://turbo.hotwired.dev/handbook/drive#performing-visits-with-a-different-method]
+      #
+      # ===== \Examples
+      #
+      #   link_to "Delete profile", @profile, data: { turbo_method: :delete }
+      #   # => <a href="/profiles/1" data-turbo-method="delete">Delete profile</a>
+      #
+      #   link_to "Visit Other Site", "https://rubyonrails.org/", data: { turbo_confirm: "Are you sure?" }
+      #   # => <a href="https://rubyonrails.org/" data-turbo-confirm="Are you sure?">Visit Other Site</a>
+      #
+      # ==== Deprecated: \Rails UJS Attributes
+      #
+      # Prior to \Rails 7, \Rails shipped with a JavaScript library called <tt>@rails/ujs</tt> on by default. Following \Rails 7,
       # this library is no longer on by default. This library integrated with the following options:
       #
       # * <tt>method: symbol of HTTP verb</tt> - This modifier will dynamically
@@ -198,7 +223,7 @@ module ActionView
       # * <tt>:disable_with</tt> - Value of this parameter will be used as the
       #   name for a disabled version of the link.
       #
-      # ===== Rails UJS Examples
+      # ===== \Rails UJS Examples
       #
       #   link_to "Remove Profile", profile_path(@profile), method: :delete
       #   # => <a href="/profiles/1" rel="nofollow" data-method="delete">Remove Profile</a>
@@ -221,9 +246,6 @@ module ActionView
       # Generates a form containing a single button that submits to the URL created
       # by the set of +options+. This is the safest method to ensure links that
       # cause changes to your data are not triggered by search bots or accelerators.
-      # If the HTML button does not work with your layout, you can also consider
-      # using the +link_to+ method with the <tt>:method</tt> modifier as described in
-      # the +link_to+ documentation.
       #
       # You can control the form and button behavior with +html_options+. Most
       # values in +html_options+ are passed through to the button element. For
@@ -237,6 +259,10 @@ module ActionView
       # The form submits a POST request by default. You can specify a different
       # HTTP verb via the +:method+ option within +html_options+.
       #
+      # If the HTML button generated from +button_to+ does not work with your layout, you can
+      # consider using the +link_to+ method with the +data-turbo-method+
+      # attribute as described in the +link_to+ documentation.
+      #
       # ==== Options
       # The +options+ hash accepts the same options as +url_for+. To generate a
       # <tt><form></tt> element without an <tt>[action]</tt> attribute, pass
@@ -302,9 +328,9 @@ module ActionView
       #   #      <input name="authenticity_token" type="hidden" value="10f2163b45388899ad4d5ae948988266befcb6c3d1b2451cf657a0c293d605a6"  autocomplete="off"/>
       #   #    </form>"
       #
-      # ==== Deprecated: Rails UJS Attributes
+      # ==== Deprecated: \Rails UJS Attributes
       #
-      # Prior to Rails 7, Rails shipped with a JavaScript library called <tt>@rails/ujs</tt> on by default. Following Rails 7,
+      # Prior to \Rails 7, \Rails shipped with a JavaScript library called <tt>@rails/ujs</tt> on by default. Following \Rails 7,
       # this library is no longer on by default. This library integrated with the following options:
       #
       # * <tt>:remote</tt> -  If set to true, will allow <tt>@rails/ujs</tt> to control the
@@ -320,7 +346,7 @@ module ActionView
       #   used as the value for a disabled version of the submit
       #   button when the form is submitted.
       #
-      # ===== Rails UJS Examples
+      # ===== \Rails UJS Examples
       #
       #   <%= button_to "Create", { action: "create" }, remote: true, form: { "data-type" => "json" } %>
       #   # => "<form method="post" action="/images/create" class="button_to" data-remote="true" data-type="json">
@@ -380,7 +406,8 @@ module ActionView
                                        autocomplete: "off")
           end
         end
-        content_tag("form", inner_tags, form_options)
+        html = content_tag("form", inner_tags, form_options)
+        prevent_content_exfiltration(html)
       end
 
       # Creates a link tag of the given +name+ using a URL created by the set of
@@ -495,7 +522,7 @@ module ActionView
       # * <tt>:reply_to</tt> - Preset the +Reply-To+ field of the email.
       #
       # ==== Obfuscation
-      # Prior to Rails 4.0, +mail_to+ provided options for encoding the address
+      # Prior to \Rails 4.0, +mail_to+ provided options for encoding the address
       # in order to hinder email harvesters.  To take advantage of these options,
       # install the +actionview-encoded_mail_to+ gem.
       #
@@ -595,7 +622,7 @@ module ActionView
         # We ignore any extra parameters in the request_uri if the
         # submitted URL doesn't have any either. This lets the function
         # work with things like ?order=asc
-        # the behaviour can be disabled with check_parameters: true
+        # the behavior can be disabled with check_parameters: true
         request_uri = url_string.index("?") || check_parameters ? request.fullpath : request.path
         request_uri = URI::DEFAULT_PARSER.unescape(request_uri).force_encoding(Encoding::BINARY)
 

data/lib/action_view/helpers.rb

@@ -12,6 +12,7 @@ require "action_view/helpers/asset_tag_helper"
 require "action_view/helpers/asset_url_helper"
 require "action_view/helpers/atom_feed_helper"
 require "action_view/helpers/cache_helper"
+require "action_view/helpers/content_exfiltration_prevention_helper"
 require "action_view/helpers/controller_helper"
 require "action_view/helpers/csp_helper"
 require "action_view/helpers/csrf_helper"
@@ -45,6 +46,7 @@ module ActionView # :nodoc:
     include AtomFeedHelper
     include CacheHelper
     include CaptureHelper
+    include ContentExfiltrationPreventionHelper
     include ControllerHelper
     include CspHelper
     include CsrfHelper

data/lib/action_view/layouts.rb

@@ -4,6 +4,8 @@ require "action_view/rendering"
 require "active_support/core_ext/module/redefine_method"
 
 module ActionView
+  # = Action View \Layouts
+  #
   # Layouts reverse the common pattern of including shared headers and footers in many templates to isolate changes in
   # repeated setups. The inclusion pattern has pages that look like this:
   #
@@ -210,9 +212,9 @@ module ActionView
       class_attribute :_layout_conditions, instance_accessor: false, default: {}
 
       _write_layout_method
-    end
 
-    delegate :_layout_conditions, to: :class
+      delegate :_layout_conditions, to: :class
+    end
 
     module ClassMethods
       def inherited(klass) # :nodoc:

data/lib/action_view/log_subscriber.rb

@@ -5,7 +5,7 @@ require "active_support/log_subscriber"
 module ActionView
   # = Action View Log Subscriber
   #
-  # Provides functionality so that Rails can output logs from Action View.
+  # Provides functionality so that \Rails can output logs from Action View.
   class LogSubscriber < ActiveSupport::LogSubscriber
     VIEWS_PATTERN = /^app\/views\//
 
@@ -21,6 +21,7 @@ module ActionView
         message << " (Duration: #{event.duration.round(1)}ms | Allocations: #{event.allocations})"
       end
     end
+    subscribe_log_level :render_template, :debug
 
     def render_partial(event)
       debug do
@@ -31,6 +32,7 @@ module ActionView
         message
       end
     end
+    subscribe_log_level :render_partial, :debug
 
     def render_layout(event)
       info do
@@ -38,6 +40,7 @@ module ActionView
         message << " (Duration: #{event.duration.round(1)}ms | Allocations: #{event.allocations})"
       end
     end
+    subscribe_log_level :render_layout, :info
 
     def render_collection(event)
       identifier = event.payload[:identifier] || "templates"
@@ -49,29 +52,60 @@ module ActionView
         message
       end
     end
+    subscribe_log_level :render_collection, :debug
 
-    def start(name, id, payload)
-      log_rendering_start(payload, name)
+    module Utils # :nodoc:
+      def logger
+        ActionView::Base.logger
+      end
 
-      super
-    end
+    private
+      def from_rails_root(string)
+        string = string.sub(rails_root, "")
+        string.sub!(VIEWS_PATTERN, "")
+        string
+      end
 
-    def logger
-      ActionView::Base.logger
+      def rails_root # :doc:
+        @root ||= "#{Rails.root}/"
+      end
     end
 
-  private
-    EMPTY = ""
-    def from_rails_root(string) # :doc:
-      string = string.sub(rails_root, EMPTY)
-      string.sub!(VIEWS_PATTERN, EMPTY)
-      string
+    include Utils
+
+    class Start # :nodoc:
+      include Utils
+
+      def start(name, id, payload)
+        return unless logger
+        logger.debug do
+          qualifier =
+            if name == "render_template.action_view"
+              ""
+            elsif name == "render_layout.action_view"
+              "layout "
+            end
+
+          return unless qualifier
+
+          message = +"  Rendering #{qualifier}#{from_rails_root(payload[:identifier])}"
+          message << " within #{from_rails_root(payload[:layout])}" if payload[:layout]
+          message
+        end
+      end
+
+      def finish(name, id, payload)
+      end
     end
 
-    def rails_root # :doc:
-      @root ||= "#{Rails.root}/"
+    def self.attach_to(*)
+      ActiveSupport::Notifications.subscribe("render_template.action_view", ActionView::LogSubscriber::Start.new)
+      ActiveSupport::Notifications.subscribe("render_layout.action_view", ActionView::LogSubscriber::Start.new)
+
+      super
     end
 
+  private
     def render_count(payload) # :doc:
       if payload[:cache_hits]
         "[#{payload[:cache_hits]} / #{payload[:count]} cache hits]"
@@ -88,23 +122,6 @@ module ActionView
         "[cache miss]"
       end
     end
-
-    def log_rendering_start(payload, name)
-      debug do
-        qualifier =
-          if name == "render_template.action_view"
-            ""
-          elsif name == "render_layout.action_view"
-            "layout "
-          end
-
-        return unless qualifier
-
-        message = +"  Rendering #{qualifier}#{from_rails_root(payload[:identifier])}"
-        message << " within #{from_rails_root(payload[:layout])}" if payload[:layout]
-        message
-      end
-    end
   end
 end
 

data/lib/action_view/lookup_context.rb

@@ -13,7 +13,7 @@ module ActionView
   # view paths, used in the resolver cache lookup. Since this key is generated
   # only once during the request, it speeds up all cache accesses.
   class LookupContext # :nodoc:
-    attr_accessor :prefixes, :rendered_format
+    attr_accessor :prefixes
 
     singleton_class.attr_accessor :registered_details
     self.registered_details = []
@@ -63,16 +63,20 @@ module ActionView
       end
 
       def self.details_cache_key(details)
-        if details[:formats]
-          details = details.dup
-          details[:formats] &= Template::Types.symbols
+        @details_keys.fetch(details) do
+          if formats = details[:formats]
+            unless Template::Types.valid_symbols?(formats)
+              details = details.dup
+              details[:formats] &= Template::Types.symbols
+            end
+          end
+          @details_keys[details] ||= TemplateDetails::Requested.new(**details)
         end
-        @details_keys[details] ||= TemplateDetails::Requested.new(**details)
       end
 
       def self.clear
-        ActionView::ViewPaths.all_view_paths.each do |path_set|
-          path_set.each(&:clear_cache)
+        ActionView::PathRegistry.all_resolvers.each do |resolver|
+          resolver.clear_cache
         end
         @view_context_class = nil
         @details_keys.clear
@@ -83,9 +87,9 @@ module ActionView
         @digest_cache.values
       end
 
-      def self.view_context_class(klass)
+      def self.view_context_class
         @view_context_mutex.synchronize do
-          @view_context_class ||= klass.with_empty_template_cache
+          @view_context_class ||= ActionView::Base.with_empty_template_cache
         end
       end
     end
@@ -148,11 +152,23 @@ module ActionView
       end
       alias :any_templates? :any?
 
+      def append_view_paths(paths)
+        @view_paths = build_view_paths(@view_paths.to_a + paths)
+      end
+
+      def prepend_view_paths(paths)
+        @view_paths = build_view_paths(paths + @view_paths.to_a)
+      end
+
     private
       # Whenever setting view paths, makes a copy so that we can manipulate them in
       # instance objects as we wish.
       def build_view_paths(paths)
-        ActionView::PathSet.new(Array(paths))
+        if ActionView::PathSet === paths
+          paths
+        else
+          ActionView::PathSet.new(Array(paths))
+        end
       end
 
       # Compute details hash and key according to user options (e.g. passed from #render).
@@ -250,12 +266,12 @@ module ActionView
         values.concat(default_formats) if values.delete "*/*"
         values.uniq!
 
-        invalid_values = (values - Template::Types.symbols)
-        unless invalid_values.empty?
+        unless Template::Types.valid_symbols?(values)
+          invalid_values = values - Template::Types.symbols
           raise ArgumentError, "Invalid formats: #{invalid_values.map(&:inspect).join(", ")}"
         end
 
-        if values == [:js]
+        if (values.length == 1) && (values[0] == :js)
           values << :html
           @html_fallback_for_js = true
         end

data/lib/action_view/path_registry.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module ActionView # :nodoc:
+  module PathRegistry # :nodoc:
+    @view_paths_by_class = {}
+    @file_system_resolvers = {}
+    @file_system_resolver_mutex = Mutex.new
+    @file_system_resolver_hooks = []
+
+    class << self
+      attr_reader :file_system_resolver_hooks
+    end
+
+    def self.get_view_paths(klass)
+      @view_paths_by_class[klass] || get_view_paths(klass.superclass)
+    end
+
+    def self.set_view_paths(klass, paths)
+      @view_paths_by_class[klass] = paths
+    end
+
+    def self.cast_file_system_resolvers(paths)
+      paths = Array(paths)
+
+      @file_system_resolver_mutex.synchronize do
+        built_resolver = false
+        paths = paths.map do |path|
+          case path
+          when String, Pathname
+            path = File.expand_path(path)
+            @file_system_resolvers[path] ||=
+              begin
+                built_resolver = true
+                FileSystemResolver.new(path)
+              end
+          else
+            path
+          end
+        end
+
+        file_system_resolver_hooks.each(&:call) if built_resolver
+      end
+
+      paths
+    end
+
+    def self.all_resolvers
+      resolvers = [all_file_system_resolvers]
+      resolvers.concat @view_paths_by_class.values.map(&:to_a)
+      resolvers.flatten.uniq
+    end
+
+    def self.all_file_system_resolvers
+      @file_system_resolvers.values
+    end
+  end
+end