actionview 7.0.8.7 → 7.2.2.1

data/lib/action_view/helpers/form_options_helper.rb

@@ -8,8 +8,9 @@ require "active_support/core_ext/array/wrap"
 require "action_view/helpers/text_helper"
 
 module ActionView
-  # = Action View Form Option Helpers
   module Helpers # :nodoc:
+    # = Action View Form Option \Helpers
+    #
     # Provides a number of methods for turning different kinds of containers into a set of option tags.
     #
     # The <tt>collection_select</tt>, <tt>select</tt> and <tt>time_zone_select</tt> methods take an <tt>options</tt> parameter, a hash:

data/lib/action_view/helpers/form_tag_helper.rb

@@ -1,14 +1,16 @@
 # frozen_string_literal: true
 
 require "cgi"
+require "action_view/helpers/content_exfiltration_prevention_helper"
 require "action_view/helpers/url_helper"
 require "action_view/helpers/text_helper"
 require "active_support/core_ext/string/output_safety"
 require "active_support/core_ext/module/attribute_accessors"
 
 module ActionView
-  # = Action View Form Tag Helpers
   module Helpers # :nodoc:
+    # = Action View Form Tag \Helpers
+    #
     # Provides a number of methods for creating form tags that don't rely on an Active Record object assigned to the template like
     # FormHelper does. Instead, you provide the names and values manually.
     #
@@ -19,6 +21,7 @@ module ActionView
 
       include UrlHelper
       include TextHelper
+      include ContentExfiltrationPreventionHelper
 
       mattr_accessor :embed_authenticity_token_in_remote_forms
       self.embed_authenticity_token_in_remote_forms = nil
@@ -88,11 +91,11 @@ module ActionView
       # attribute name.
       #
       #   <%= label_tag :post, :title %>
-      #   <%= text_field_tag :post, :title, aria: { describedby: field_id(:post, :title, :error) } %>
+      #   <%= text_field :post, :title, aria: { describedby: field_id(:post, :title, :error) } %>
       #   <%= tag.span("is blank", id: field_id(:post, :title, :error) %>
       #
       # In the example above, the <tt><input type="text"></tt> element built by
-      # the call to <tt>text_field_tag</tt> declares an
+      # the call to <tt>text_field</tt> declares an
       # <tt>aria-describedby</tt> attribute referencing the <tt><span></tt>
       # element, sharing a common <tt>id</tt> root (<tt>post_title</tt>, in this
       # case).
@@ -120,11 +123,11 @@ module ActionView
       # Return the value generated by the <tt>FormBuilder</tt> for the given
       # attribute name.
       #
-      #   <%= text_field_tag :post, :title, name: field_name(:post, :title, :subtitle) %>
-      #   <%# => <input type="text" name="post[title][subtitle]">
+      #   <%= text_field :post, :title, name: field_name(:post, :title, :subtitle) %>
+      #   <%# => <input type="text" name="post[title][subtitle]"> %>
       #
-      #   <%= text_field_tag :post, :tag, name: field_name(:post, :tag, multiple: true) %>
-      #   <%# => <input type="text" name="post[tag][]">
+      #   <%= text_field :post, :tag, name: field_name(:post, :tag, multiple: true) %>
+      #   <%# => <input type="text" name="post[tag][]"> %>
       #
       def field_name(object_name, method_name, *method_names, multiple: false, index: nil)
         names = method_names.map! { |name| "[#{name}]" }.join
@@ -420,9 +423,17 @@ module ActionView
         content_tag :textarea, content.to_s.html_safe, { "name" => name, "id" => sanitize_to_id(name) }.update(options)
       end
 
+      ##
+      # :call-seq:
+      #   check_box_tag(name, options = {})
+      #   check_box_tag(name, value, options = {})
+      #   check_box_tag(name, value, checked, options = {})
+      #
       # Creates a check box form input tag.
       #
       # ==== Options
+      # * <tt>:value</tt> - The value of the input. Defaults to <tt>"1"</tt>.
+      # * <tt>:checked</tt> - If set to true, the checkbox will be checked by default.
       # * <tt>:disabled</tt> - If set to true, the user will not be able to use this input.
       # * Any other key creates standard HTML options for the tag.
       #
@@ -441,16 +452,27 @@ module ActionView
       #
       #   check_box_tag 'eula', 'accepted', false, disabled: true
       #   # => <input disabled="disabled" id="eula" name="eula" type="checkbox" value="accepted" />
-      def check_box_tag(name, value = "1", checked = false, options = {})
+      def check_box_tag(name, *args)
+        if args.length >= 4
+          raise ArgumentError, "wrong number of arguments (given #{args.length + 1}, expected 1..4)"
+        end
+        options = args.extract_options!
+        value, checked = args.empty? ? ["1", false] : [*args, false]
         html_options = { "type" => "checkbox", "name" => name, "id" => sanitize_to_id(name), "value" => value }.update(options.stringify_keys)
         html_options["checked"] = "checked" if checked
         tag :input, html_options
       end
 
+      ##
+      # :call-seq:
+      #   radio_button_tag(name, value, options = {})
+      #   radio_button_tag(name, value, checked, options = {})
+      #
       # Creates a radio button; use groups of radio buttons named the same to allow users to
       # select from a group of options.
       #
       # ==== Options
+      # * <tt>:checked</tt> - If set to true, the radio button will be selected by default.
       # * <tt>:disabled</tt> - If set to true, the user will not be able to use this input.
       # * Any other key creates standard HTML options for the tag.
       #
@@ -466,7 +488,12 @@ module ActionView
       #
       #   radio_button_tag 'color', "green", true, class: "color_input"
       #   # => <input checked="checked" class="color_input" id="color_green" name="color" type="radio" value="green" />
-      def radio_button_tag(name, value, checked = false, options = {})
+      def radio_button_tag(name, value, *args)
+        if args.length >= 3
+          raise ArgumentError, "wrong number of arguments (given #{args.length + 2}, expected 2..4)"
+        end
+        options = args.extract_options!
+        checked = args.empty? ? false : args.first
         html_options = { "type" => "radio", "name" => name, "id" => "#{sanitize_to_id(name)}_#{sanitize_to_id(value)}", "value" => value }.update(options.stringify_keys)
         html_options["checked"] = "checked" if checked
         tag :input, html_options
@@ -495,25 +522,6 @@ module ActionView
       #   submit_tag "Edit", class: "edit_button"
       #   # => <input class="edit_button" data-disable-with="Edit" name="commit" type="submit" value="Edit" />
       #
-      # ==== Deprecated: Rails UJS attributes
-      #
-      # Prior to Rails 7, Rails shipped with the JavaScript library called @rails/ujs on by default. Following Rails 7,
-      # this library is no longer on by default. This library integrated with the following options:
-      #
-      # * <tt>confirm: 'question?'</tt> - If present the unobtrusive JavaScript
-      #   drivers will provide a prompt with the question specified. If the user accepts,
-      #   the form is processed normally, otherwise no action is taken.
-      # * <tt>:disable_with</tt> - Value of this parameter will be used as the value for a
-      #   disabled version of the submit button when the form is submitted. This feature is
-      #   provided by the unobtrusive JavaScript driver. To disable this feature for a single submit tag
-      #   pass <tt>:data => { disable_with: false }</tt> Defaults to value attribute.
-      #
-      #   submit_tag "Complete sale", data: { disable_with: "Submitting..." }
-      #   # => <input name="commit" data-disable-with="Submitting..." type="submit" value="Complete sale" />
-      #
-      #   submit_tag "Save", data: { confirm: "Are you sure?" }
-      #   # => <input name='commit' type='submit' value='Save' data-disable-with="Save" data-confirm="Are you sure?" />
-      #
       def submit_tag(value = "Save changes", options = {})
         options = options.deep_stringify_keys
         tag_options = { "type" => "submit", "name" => "commit", "value" => value }.update(options)
@@ -555,26 +563,6 @@ module ActionView
       #   #     <strong>Ask me!</strong>
       #   #    </button>
       #
-      # ==== Deprecated: Rails UJS attributes
-      #
-      # Prior to Rails 7, Rails shipped with a JavaScript library called @rails/ujs on by default. Following Rails 7,
-      # this library is no longer on by default. This library integrated with the following options:
-      #
-      # * <tt>confirm: 'question?'</tt> - If present, the
-      #   unobtrusive JavaScript drivers will provide a prompt with
-      #   the question specified. If the user accepts, the form is
-      #   processed normally, otherwise no action is taken.
-      # * <tt>:disable_with</tt> - Value of this parameter will be
-      #   used as the value for a disabled version of the submit
-      #   button when the form is submitted. This feature is provided
-      #   by the unobtrusive JavaScript driver.
-      #
-      #   button_tag "Save", data: { confirm: "Are you sure?" }
-      #   # => <button name="button" type="submit" data-confirm="Are you sure?">Save</button>
-      #
-      #   button_tag "Checkout", data: { disable_with: "Please wait..." }
-      #   # => <button data-disable-with="Please wait..." name="button" type="submit">Checkout</button>
-      #
       def button_tag(content_or_options = nil, options = nil, &block)
         if content_or_options.is_a? Hash
           options = content_or_options
@@ -648,11 +636,13 @@ module ActionView
       #   <% end %>
       #   # => <fieldset class="format"><p><input id="name" name="name" type="text" /></p></fieldset>
       def field_set_tag(legend = nil, options = nil, &block)
-        output = tag(:fieldset, options, true)
-        output.safe_concat(content_tag("legend", legend)) unless legend.blank?
-        output.concat(capture(&block)) if block_given?
-        output.safe_concat("</fieldset>")
+        content = []
+        content << content_tag("legend", legend) unless legend.blank?
+        content << capture(&block) if block_given?
+
+        content_tag(:fieldset, safe_join(content), options)
       end
+      alias_method :fieldset_tag, :field_set_tag
 
       # Creates a text field of type "color".
       #
@@ -735,14 +725,14 @@ module ActionView
       #   date_field_tag 'name'
       #   # => <input id="name" name="name" type="date" />
       #
-      #   date_field_tag 'date', '01/01/2014'
-      #   # => <input id="date" name="date" type="date" value="01/01/2014" />
+      #   date_field_tag 'date', '2014-12-31'
+      #   # => <input id="date" name="date" type="date" value="2014-12-31" />
       #
       #   date_field_tag 'date', nil, class: 'special_input'
       #   # => <input class="special_input" id="date" name="date" type="date" />
       #
-      #   date_field_tag 'date', '01/01/2014', class: 'special_input', disabled: true
-      #   # => <input disabled="disabled" class="special_input" id="date" name="date" type="date" value="01/01/2014" />
+      #   date_field_tag 'date', '2014-12-31', class: 'special_input', disabled: true
+      #   # => <input disabled="disabled" class="special_input" id="date" name="date" type="date" value="2014-12-31" />
       def date_field_tag(name, value = nil, options = {})
         text_field_tag(name, value, options.merge(type: :date))
       end
@@ -757,6 +747,23 @@ module ActionView
       # * <tt>:max</tt> - The maximum acceptable value.
       # * <tt>:step</tt> - The acceptable value granularity.
       # * <tt>:include_seconds</tt> - Include seconds and ms in the output timestamp format (true by default).
+      #
+      # ==== Examples
+      #
+      #   time_field_tag 'name'
+      #   # => <input id="name" name="name" type="time" />
+      #
+      #   time_field_tag 'time', '01:01'
+      #   # => <input id="time" name="time" type="time" value="01:01" />
+      #
+      #   time_field_tag 'time', nil, class: 'special_input'
+      #   # => <input class="special_input" id="time" name="time" type="time" />
+      #
+      #   time_field_tag 'time', '01:01', include_seconds: true
+      #   # => <input id="time" name="time" type="time" value="01:01:00.000" />
+      #
+      #   time_field_tag 'time', '01:01', min: '00:00', max: '23:59', step: 1
+      #   # => <input id="time" max="23:59" min="00:00" name="time" step="1" type="time" value="01:01" />
       def time_field_tag(name, value = nil, options = {})
         text_field_tag(name, value, options.merge(type: :time))
       end
@@ -770,6 +777,21 @@ module ActionView
       # * <tt>:min</tt> - The minimum acceptable value.
       # * <tt>:max</tt> - The maximum acceptable value.
       # * <tt>:step</tt> - The acceptable value granularity.
+      # * <tt>:include_seconds</tt> - Include seconds in the output timestamp format (true by default).
+      #
+      # ==== Examples
+      #
+      #   datetime_field_tag 'name'
+      #   # => <input id="name" name="name" type="datetime-local" />
+      #
+      #   datetime_field_tag 'datetime', '2014-01-01T01:01'
+      #   # => <input id="datetime" name="datetime" type="datetime-local" value="2014-01-01T01:01" />
+      #
+      #   datetime_field_tag 'datetime', nil, class: 'special_input'
+      #   # => <input class="special_input" id="datetime" name="datetime" type="datetime-local" />
+      #
+      #   datetime_field_tag 'datetime', '2014-01-01T01:01', class: 'special_input', disabled: true
+      #   # => <input disabled="disabled" class="special_input" id="datetime" name="datetime" type="datetime-local" value="2014-01-01T01:01" />
       def datetime_field_tag(name, value = nil, options = {})
         text_field_tag(name, value, options.merge(type: "datetime-local"))
       end
@@ -785,6 +807,20 @@ module ActionView
       # * <tt>:min</tt> - The minimum acceptable value.
       # * <tt>:max</tt> - The maximum acceptable value.
       # * <tt>:step</tt> - The acceptable value granularity.
+      #
+      # ==== Examples
+      #
+      #   month_field_tag 'name'
+      #   # => <input id="name" name="name" type="month" />
+      #
+      #   month_field_tag 'month', '2014-01'
+      #   # => <input id="month" name="month" type="month" value="2014-01" />
+      #
+      #   month_field_tag 'month', nil, class: 'special_input'
+      #   # => <input class="special_input" id="month" name="month" type="month" />
+      #
+      #   month_field_tag 'month', '2014-01', class: 'special_input', disabled: true
+      #   # => <input disabled="disabled" class="special_input" id="month" name="month" type="month" value="2014-01" />
       def month_field_tag(name, value = nil, options = {})
         text_field_tag(name, value, options.merge(type: :month))
       end
@@ -798,6 +834,20 @@ module ActionView
       # * <tt>:min</tt> - The minimum acceptable value.
       # * <tt>:max</tt> - The maximum acceptable value.
       # * <tt>:step</tt> - The acceptable value granularity.
+      #
+      # ==== Examples
+      #
+      #   week_field_tag 'name'
+      #   # => <input id="name" name="name" type="week" />
+      #
+      #   week_field_tag 'week', '2014-W01'
+      #   # => <input id="week" name="week" type="week" value="2014-W01" />
+      #
+      #   week_field_tag 'week', nil, class: 'special_input'
+      #   # => <input class="special_input" id="week" name="week" type="week" />
+      #
+      #   week_field_tag 'week', '2014-W01', class: 'special_input', disabled: true
+      #   # => <input disabled="disabled" class="special_input" id="week" name="week" type="week" value="2014-W01" />
       def week_field_tag(name, value = nil, options = {})
         text_field_tag(name, value, options.merge(type: :week))
       end
@@ -906,6 +956,17 @@ module ActionView
       # ==== Options
       #
       # Supports the same options as #number_field_tag.
+      #
+      # ==== Examples
+      #
+      #   range_field_tag 'quantity', '1'
+      #   # => <input id="quantity" name="quantity" type="range" value="1" />
+      #
+      #   range_field_tag 'quantity', in: 1...10
+      #   # => <input id="quantity" name="quantity" min="1" max="9" type="range" />
+      #
+      #   range_field_tag 'quantity', min: 1, max: 10, step: 2
+      #   # => <input id="quantity" name="quantity" min="1" max="10" step="2" type="range"
       def range_field_tag(name, value = nil, options = {})
         number_field_tag(name, value, options.merge(type: :range))
       end
@@ -979,7 +1040,8 @@ module ActionView
 
         def form_tag_html(html_options)
           extra_tags = extra_tags_for_form(html_options)
-          tag(:form, html_options, true) + extra_tags
+          html = tag(:form, html_options, true) + extra_tags
+          prevent_content_exfiltration(html)
         end
 
         def form_tag_with_body(html_options, content)
@@ -1009,9 +1071,14 @@ module ActionView
         end
 
         def convert_direct_upload_option_to_url(options)
-          if options.delete(:direct_upload) && respond_to?(:rails_direct_uploads_url)
+          return options unless options.delete(:direct_upload)
+
+          if respond_to?(:rails_direct_uploads_url)
             options["data-direct-upload-url"] = rails_direct_uploads_url
+          elsif respond_to?(:main_app) && main_app.respond_to?(:rails_direct_uploads_url)
+            options["data-direct-upload-url"] = main_app.rails_direct_uploads_url
           end
+
           options
         end
     end

data/lib/action_view/helpers/javascript_helper.rb

@@ -2,6 +2,7 @@
 
 module ActionView
   module Helpers # :nodoc:
+    # = Action View JavaScript \Helpers
     module JavaScriptHelper
       JS_ESCAPE_MAP = {
         "\\"    => "\\\\",