actionview 7.1.0 → 7.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32185e4d0d7cd6d977741871632481ac24d5e8dc510ffdd91738c704c6a7713f
-  data.tar.gz: 18f1a181d6ca4aa6f0572e269b79046384ce61a76eaa3a7d8c94535de1119d4c
+  metadata.gz: ee3c480e4d31e8f0993748f63f865fdc83fd933b17cc38cdcf40bb6f2f5a851f
+  data.tar.gz: 55cc85a03a85c26914ca1efcf502749f7d68d2c60ccb9ff1d7da04817f9d3abf
 SHA512:
-  metadata.gz: db7eeb976f3e336aec8472acd0a4a4cb9fbfb7aded98236c671d98d0c081fd1331be49a67127c619691931c7f8317b0fa7af0205bd26627f11d61dfe313f2bd4
-  data.tar.gz: abd1bff9bf3b89b81fb8008641cd77299892b856b19a2788bd25d913af2c2d78963bdda2157b14aa7c7ac03a3300ef41e6acdf2ac836580406df2710d08ee6e1
+  metadata.gz: 458e12bf5a056fa2302d7be0b8fe01ba73403a1d02e442adaecb9dc791400b08bf8ec8cc0107e221284c5836b811668a038a8e11246201bec2306b23a5059fa9
+  data.tar.gz: 85e8be0ed9174c2768d415360f00dfccf0a4d51df657581fd9407a2c9d5c7d91b1e19c604964ecc03b8f3300960f62e2baaf66f01c332b7fa927de67da4b214e

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## Rails 7.1.1 (October 11, 2023) ##
+
+*   Updated `@rails/ujs` files to ignore certain data-* attributes when element is contenteditable.
+
+    This fix was already landed in >= 7.0.4.3, < 7.1.0.
+    [[CVE-2023-23913](https://github.com/advisories/GHSA-xp5h-f8jf-rc8q)]
+
+    *Ryunosuke Sato*
+
+
 ## Rails 7.1.0 (October 05, 2023) ##
 
 *   No changes.

data/app/assets/javascripts/rails-ujs.esm.js

@@ -58,6 +58,18 @@ const setData = function(element, key, value) {
 
 const $ = selector => Array.prototype.slice.call(document.querySelectorAll(selector));
 
+const isContentEditable = function(element) {
+  var isEditable = false;
+  do {
+    if (element.isContentEditable) {
+      isEditable = true;
+      break;
+    }
+    element = element.parentElement;
+  } while (element);
+  return isEditable;
+};
+
 const csrfToken = () => {
   const meta = document.querySelector("meta[name=csrf-token]");
   return meta && meta.content;
@@ -336,6 +348,9 @@ const enableElement = e => {
   } else {
     element = e;
   }
+  if (isContentEditable(element)) {
+    return;
+  }
   if (matches(element, linkDisableSelector)) {
     return enableLinkElement(element);
   } else if (matches(element, buttonDisableSelector) || matches(element, formEnableSelector)) {
@@ -347,6 +362,9 @@ const enableElement = e => {
 
 const disableElement = e => {
   const element = e instanceof Event ? e.target : e;
+  if (isContentEditable(element)) {
+    return;
+  }
   if (matches(element, linkDisableSelector)) {
     return disableLinkElement(element);
   } else if (matches(element, buttonDisableSelector) || matches(element, formDisableSelector)) {
@@ -426,6 +444,9 @@ const handleMethodWithRails = rails => function(e) {
   if (!method) {
     return;
   }
+  if (isContentEditable(this)) {
+    return;
+  }
   const href = rails.href(link);
   const csrfToken$1 = csrfToken();
   const csrfParam$1 = csrfParam();
@@ -460,6 +481,10 @@ const handleRemoteWithRails = rails => function(e) {
     fire(element, "ajax:stopped");
     return false;
   }
+  if (isContentEditable(element)) {
+    fire(element, "ajax:stopped");
+    return false;
+  }
   const withCredentials = element.getAttribute("data-with-credentials");
   const dataType = element.getAttribute("data-type") || "script";
   if (matches(element, formSubmitSelector)) {
@@ -665,4 +690,4 @@ if (typeof exports !== "object" && typeof module === "undefined") {
   }
 }
 
-export default Rails;
+export { Rails as default };

data/app/assets/javascripts/rails-ujs.js

@@ -44,6 +44,17 @@ Released under the MIT license
     return element[EXPANDO][key] = value;
   };
   const $ = selector => Array.prototype.slice.call(document.querySelectorAll(selector));
+  const isContentEditable = function(element) {
+    var isEditable = false;
+    do {
+      if (element.isContentEditable) {
+        isEditable = true;
+        break;
+      }
+      element = element.parentElement;
+    } while (element);
+    return isEditable;
+  };
   const csrfToken = () => {
     const meta = document.querySelector("meta[name=csrf-token]");
     return meta && meta.content;
@@ -298,6 +309,9 @@ Released under the MIT license
     } else {
       element = e;
     }
+    if (isContentEditable(element)) {
+      return;
+    }
     if (matches(element, linkDisableSelector)) {
       return enableLinkElement(element);
     } else if (matches(element, buttonDisableSelector) || matches(element, formEnableSelector)) {
@@ -308,6 +322,9 @@ Released under the MIT license
   };
   const disableElement = e => {
     const element = e instanceof Event ? e.target : e;
+    if (isContentEditable(element)) {
+      return;
+    }
     if (matches(element, linkDisableSelector)) {
       return disableLinkElement(element);
     } else if (matches(element, buttonDisableSelector) || matches(element, formDisableSelector)) {
@@ -379,6 +396,9 @@ Released under the MIT license
     if (!method) {
       return;
     }
+    if (isContentEditable(this)) {
+      return;
+    }
     const href = rails.href(link);
     const csrfToken$1 = csrfToken();
     const csrfParam$1 = csrfParam();
@@ -411,6 +431,10 @@ Released under the MIT license
       fire(element, "ajax:stopped");
       return false;
     }
+    if (isContentEditable(element)) {
+      fire(element, "ajax:stopped");
+      return false;
+    }
     const withCredentials = element.getAttribute("data-with-credentials");
     const dataType = element.getAttribute("data-type") || "script";
     if (matches(element, formSubmitSelector)) {

data/lib/action_view/gem_version.rb

@@ -9,7 +9,7 @@ module ActionView
   module VERSION
     MAJOR = 7
     MINOR = 1
-    TINY  = 0
+    TINY  = 1
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 7.1.0
+  version: 7.1.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-10-05 00:00:00.000000000 Z
+date: 2023-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.1.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.1.1
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -86,28 +86,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.1.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.1.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.1.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.0
+        version: 7.1.1
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -246,10 +246,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.1.0/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.1.0/
+  changelog_uri: https://github.com/rails/rails/blob/v7.1.1/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.1.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.1.0/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v7.1.1/actionview
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []