actionview 7.1.2 → 8.0.2

data/lib/action_view/helpers/rendering_helper.rb

@@ -1,32 +1,140 @@
 # frozen_string_literal: true
 
+# :markup: markdown
+
 module ActionView
   module Helpers # :nodoc:
-    # = Action View \Rendering \Helpers
+    # # Action View Rendering Helpers
     #
-    # Implements methods that allow rendering from a view context.
-    # In order to use this module, all you need is to implement
-    # view_renderer that returns an ActionView::Renderer object.
+    # Implements methods that allow rendering from a view context. In order to use
+    # this module, all you need is to implement view_renderer that returns an
+    # ActionView::Renderer object.
     module RenderingHelper
-      # Returns the result of a render that's dictated by the options hash. The primary options are:
+      # Renders a template and returns the result.
+      #
+      # Pass the template to render as the first argument. This is shorthand
+      # syntax for partial rendering, so the template filename should be
+      # prefixed with an underscore. The partial renderer looks for the partial
+      # template in the directory of the calling template first.
+      #
+      #     <% # app/views/posts/new.html.erb %>
+      #     <%= render "form" %>
+      #     # => renders app/views/posts/_form.html.erb
+      #
+      # Use the complete view path to render a partial from another directory.
+      #
+      #     <% # app/views/posts/show.html.erb %>
+      #     <%= render "comments/form" %>
+      #     # => renders app/views/comments/_form.html.erb
+      #
+      # Without the rendering mode, the second argument can be a Hash of local
+      # variable assignments for the template.
+      #
+      #     <% # app/views/posts/new.html.erb %>
+      #     <%= render "form", post: Post.new %>
+      #     # => renders app/views/posts/_form.html.erb
+      #
+      # If the first argument responds to `render_in`, the template will be rendered
+      # by calling `render_in` with the current view context.
+      #
+      #     class Greeting
+      #       def render_in(view_context)
+      #         view_context.render html: "<h1>Hello, World</h1>"
+      #       end
+      #
+      #       def format
+      #         :html
+      #       end
+      #     end
+      #
+      #     <%= render Greeting.new %>
+      #     # => "<h1>Hello, World</h1>"
+      #
+      # #### Rendering Mode
+      #
+      # Pass the rendering mode as first argument to override it.
+      #
+      # `:partial`
+      # :   See ActionView::PartialRenderer for details.
+      #
+      #         <%= render partial: "form", locals: { post: Post.new } %>
+      #         # => renders app/views/posts/_form.html.erb
+      #
+      # `:file`
+      # :   Renders the contents of a file. This option should **not** be used with
+      #     unsanitized user input.
+      #
+      #         <%= render file: "/path/to/some/file" %>
+      #         # => renders /path/to/some/file
+      #
+      # `:inline`
+      # :   Renders an ERB template string.
+      #
+      #         <% name = "World" %>
+      #         <%= render inline: "<h1>Hello, <%= name %>!</h1>" %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      # `:body`
+      # :   Renders the provided text, and sets the format as `:text`.
+      #
+      #         <%= render body: "Hello, World!" %>
+      #         # => renders "Hello, World!"
+      #
+      # `:plain`
+      # :   Renders the provided text, and sets the format as `:text`.
+      #
+      #         <%= render plain: "Hello, World!" %>
+      #         # => renders "Hello, World!"
+      #
+      # `:html`
+      # :   Renders the provided HTML string, and sets the format as
+      #     `:html`. If the string is not `html_safe?`, performs HTML escaping on
+      #     the string before rendering.
+      #
+      #         <%= render html: "<h1>Hello, World!</h1>".html_safe %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      #         <%= render html: "<h1>Hello, World!</h1>" %>
+      #         # => renders "&lt;h1&gt;Hello, World!&lt;/h1&gt;"
+      #
+      # `:renderable`
+      # :   Renders the provided object by calling `render_in` with the current view
+      #     context. The format is determined by calling `format` on the
+      #     renderable if it responds to `format`, falling back to `:html` by
+      #     default.
+      #
+      #         <%= render renderable: Greeting.new %>
+      #         # => renders "<h1>Hello, World</h1>"
+      #
+      #
+      # #### Options
+      #
+      # `:locals`
+      # :   Hash of local variable assignments for the template.
+      #
+      #         <%= render inline: "<h1>Hello, <%= name %>!</h1>", locals: { name: "World" } %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      # `:formats`
+      # :   Override the current format to render a template for a different format.
+      #
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", formats: [:text] %>
+      #         # => renders app/views/posts/content.text.erb
       #
-      # * <tt>:partial</tt> - See ActionView::PartialRenderer.
-      # * <tt>:file</tt> - Renders an explicit template file (this used to be the old default), add +:locals+ to pass in those.
-      # * <tt>:inline</tt> - Renders an inline template similar to how it's done in the controller.
-      # * <tt>:plain</tt> - Renders the text passed in out. Setting the content
-      #   type as <tt>text/plain</tt>.
-      # * <tt>:html</tt> - Renders the HTML safe string passed in out, otherwise
-      #   performs HTML escape on the string first. Setting the content type as
-      #   <tt>text/html</tt>.
-      # * <tt>:body</tt> - Renders the text passed in, and inherits the content
-      #   type of <tt>text/plain</tt> from ActionDispatch::Response object.
+      # `:variants`
+      # :   Render a template for a different variant.
       #
-      # If no <tt>options</tt> hash is passed or if <tt>:update</tt> is specified, then:
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", variants: [:tablet] %>
+      #         # => renders app/views/posts/content.html+tablet.erb
       #
-      # If an object responding to +render_in+ is passed, +render_in+ is called on the object,
-      # passing in the current view context.
+      # `:handlers`
+      # :   Render a template for a different handler.
       #
-      # Otherwise, a partial is rendered using the second parameter as the locals hash.
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", handlers: [:builder] %>
+      #         # => renders app/views/posts/content.html.builder
       def render(options = {}, locals = {}, &block)
         case options
         when Hash
@@ -47,52 +155,54 @@ module ActionView
       end
 
       # Overrides _layout_for in the context object so it supports the case a block is
-      # passed to a partial. Returns the contents that are yielded to a layout, given a
-      # name or a block.
+      # passed to a partial. Returns the contents that are yielded to a layout, given
+      # a name or a block.
       #
-      # You can think of a layout as a method that is called with a block. If the user calls
-      # <tt>yield :some_name</tt>, the block, by default, returns <tt>content_for(:some_name)</tt>.
-      # If the user calls simply +yield+, the default block returns <tt>content_for(:layout)</tt>.
+      # You can think of a layout as a method that is called with a block. If the user
+      # calls `yield :some_name`, the block, by default, returns
+      # `content_for(:some_name)`. If the user calls simply `yield`, the default block
+      # returns `content_for(:layout)`.
       #
       # The user can override this default by passing a block to the layout:
       #
-      #   # The template
-      #   <%= render layout: "my_layout" do %>
-      #     Content
-      #   <% end %>
+      #     # The template
+      #     <%= render layout: "my_layout" do %>
+      #       Content
+      #     <% end %>
       #
-      #   # The layout
-      #   <html>
-      #     <%= yield %>
-      #   </html>
+      #     # The layout
+      #     <html>
+      #       <%= yield %>
+      #     </html>
       #
-      # In this case, instead of the default block, which would return <tt>content_for(:layout)</tt>,
-      # this method returns the block that was passed in to <tt>render :layout</tt>, and the response
+      # In this case, instead of the default block, which would return `content_for(:layout)`,
+      # this method returns the block that was passed in to `render :layout`, and the response
       # would be
       #
-      #   <html>
-      #     Content
-      #   </html>
+      #     <html>
+      #       Content
+      #     </html>
       #
-      # Finally, the block can take block arguments, which can be passed in by +yield+:
+      # Finally, the block can take block arguments, which can be passed in by
+      # `yield`:
       #
-      #   # The template
-      #   <%= render layout: "my_layout" do |customer| %>
-      #     Hello <%= customer.name %>
-      #   <% end %>
+      #     # The template
+      #     <%= render layout: "my_layout" do |customer| %>
+      #       Hello <%= customer.name %>
+      #     <% end %>
       #
-      #   # The layout
-      #   <html>
-      #     <%= yield Struct.new(:name).new("David") %>
-      #   </html>
+      #     # The layout
+      #     <html>
+      #       <%= yield Struct.new(:name).new("David") %>
+      #     </html>
       #
-      # In this case, the layout would receive the block passed into <tt>render :layout</tt>,
+      # In this case, the layout would receive the block passed into `render :layout`,
       # and the struct specified would be passed into the block as an argument. The result
       # would be
       #
-      #   <html>
-      #     Hello David
-      #   </html>
+      #     <html>
+      #       Hello David
+      #     </html>
       #
       def _layout_for(*args, &block)
         name = args.first

data/lib/action_view/helpers/sanitize_helper.rb

@@ -15,38 +15,49 @@ module ActionView
 
       # Sanitizes HTML input, stripping all but known-safe tags and attributes.
       #
-      # It also strips href/src attributes with unsafe protocols like <tt>javascript:</tt>, while
+      # It also strips +href+ / +src+ attributes with unsafe protocols like +javascript:+, while
       # also protecting against attempts to use Unicode, ASCII, and hex character references to work
       # around these protocol filters.
       #
-      # The default sanitizer is Rails::HTML5::SafeListSanitizer. See {Rails HTML
+      # The default sanitizer is +Rails::HTML5::SafeListSanitizer+. See {Rails HTML
       # Sanitizers}[https://github.com/rails/rails-html-sanitizer] for more information.
       #
       # Custom sanitization rules can also be provided.
       #
+      # <b>Warning</b>: Adding disallowed tags or attributes to the allowlists may introduce
+      # vulnerabilities into your application. Please rely on the default allowlists whenever
+      # possible, because they are curated to maintain security and safety. If you think that the
+      # default allowlists should be expanded, please {open an issue on the rails-html-sanitizer
+      # project}[https://github.com/rails/rails-html-sanitizer/issues].
+      #
       # Please note that sanitizing user-provided text does not guarantee that the
       # resulting markup is valid or even well-formed.
       #
       # ==== Options
       #
-      # * <tt>:tags</tt> - An array of allowed tags.
-      # * <tt>:attributes</tt> - An array of allowed attributes.
-      # * <tt>:scrubber</tt> - A {Rails::HTML scrubber}[https://github.com/rails/rails-html-sanitizer]
+      # [+:tags+]
+      #   An array of allowed tags.
+      #
+      # [+:attributes+]
+      #   An array of allowed attributes.
+      #
+      # [+:scrubber+]
+      #   A {Rails::HTML scrubber}[https://github.com/rails/rails-html-sanitizer]
       #   or {Loofah::Scrubber}[https://github.com/flavorjones/loofah] object that
       #   defines custom sanitization rules. A custom scrubber takes precedence over
       #   custom tags and attributes.
       #
       # ==== Examples
       #
-      # Normal use:
+      # ===== Normal use
       #
       #   <%= sanitize @comment.body %>
       #
-      # Providing custom lists of permitted tags and attributes:
+      # ===== Providing custom lists of permitted tags and attributes
       #
       #   <%= sanitize @comment.body, tags: %w(strong em a), attributes: %w(href) %>
       #
-      # Providing a custom Rails::HTML scrubber:
+      # ===== Providing a custom +Rails::HTML+ scrubber
       #
       #   class CommentScrubber < Rails::HTML::PermitScrubber
       #     def initialize
@@ -60,21 +71,27 @@ module ActionView
       #     end
       #   end
       #
+      # <code></code>
+      #
       #   <%= sanitize @comment.body, scrubber: CommentScrubber.new %>
       #
       # See {Rails HTML Sanitizer}[https://github.com/rails/rails-html-sanitizer] for
-      # documentation about Rails::HTML scrubbers.
+      # documentation about +Rails::HTML+ scrubbers.
       #
-      # Providing a custom Loofah::Scrubber:
+      # ===== Providing a custom +Loofah::Scrubber+
       #
       #   scrubber = Loofah::Scrubber.new do |node|
       #     node.remove if node.name == 'script'
       #   end
       #
+      # <code></code>
+      #
       #   <%= sanitize @comment.body, scrubber: scrubber %>
       #
       # See {Loofah's documentation}[https://github.com/flavorjones/loofah] for more
-      # information about defining custom Loofah::Scrubber objects.
+      # information about defining custom +Loofah::Scrubber+ objects.
+      #
+      # ==== Global Configuration
       #
       # To set the default allowed tags or attributes across your application:
       #
@@ -95,13 +112,13 @@ module ActionView
       #   # In config/application.rb
       #   config.action_view.sanitizer_vendor = Rails::HTML5::Sanitizer
       #
-      # NOTE: Rails::HTML5::Sanitizer is not supported on JRuby, so on JRuby platforms \Rails will
-      # fall back to use Rails::HTML4::Sanitizer.
+      # NOTE: +Rails::HTML5::Sanitizer+ is not supported on JRuby, so on JRuby platforms \Rails will
+      # fall back to using +Rails::HTML4::Sanitizer+.
       def sanitize(html, options = {})
         self.class.safe_list_sanitizer.sanitize(html, options)&.html_safe
       end
 
-      # Sanitizes a block of CSS code. Used by +sanitize+ when it comes across a style attribute.
+      # Sanitizes a block of CSS code. Used by #sanitize when it comes across a style attribute.
       def sanitize_css(style)
         self.class.safe_list_sanitizer.sanitize_css(style)
       end

data/lib/action_view/helpers/tag_helper.rb

@@ -1,8 +1,9 @@
 # frozen_string_literal: true
 
+require "active_support/code_generator"
 require "active_support/core_ext/enumerable"
 require "active_support/core_ext/string/output_safety"
-require "set"
+require "active_support/core_ext/string/inflections"
 require "action_view/helpers/capture_helper"
 require "action_view/helpers/output_safety_helper"
 
@@ -46,8 +47,171 @@ module ActionView
         include CaptureHelper
         include OutputSafetyHelper
 
-        HTML_VOID_ELEMENTS = %i(area base br col embed hr img input keygen link meta param source track wbr).to_set
-        SVG_SELF_CLOSING_ELEMENTS = %i(animate animateMotion animateTransform circle ellipse line path polygon polyline rect set stop use view).to_set
+        def self.define_element(name, code_generator:, method_name: name)
+          return if method_defined?(name)
+
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(content = nil, escape: true, **options, &block)" <<
+              "  tag_string(#{name.inspect}, content, options, escape: escape, &block)" <<
+              "end"
+          end
+        end
+
+        def self.define_void_element(name, code_generator:, method_name: name)
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(escape: true, **options, &block)" <<
+              "  self_closing_tag_string(#{name.inspect}, options, escape, '>')" <<
+              "end"
+          end
+        end
+
+        def self.define_self_closing_element(name, code_generator:, method_name: name)
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(content = nil, escape: true, **options, &block)" <<
+              "  if content || block" <<
+              "    tag_string(#{name.inspect}, content, options, escape: escape, &block)" <<
+              "  else" <<
+              "   self_closing_tag_string(#{name.inspect}, options, escape)" <<
+              "  end" <<
+              "end"
+          end
+        end
+
+        ActiveSupport::CodeGenerator.batch(self, __FILE__, __LINE__) do |code_generator|
+          define_void_element :area, code_generator: code_generator
+          define_void_element :base, code_generator: code_generator
+          define_void_element :br, code_generator: code_generator
+          define_void_element :col, code_generator: code_generator
+          define_void_element :embed, code_generator: code_generator
+          define_void_element :hr, code_generator: code_generator
+          define_void_element :img, code_generator: code_generator
+          define_void_element :input, code_generator: code_generator
+          define_void_element :keygen, code_generator: code_generator
+          define_void_element :link, code_generator: code_generator
+          define_void_element :meta, code_generator: code_generator
+          define_void_element :source, code_generator: code_generator
+          define_void_element :track, code_generator: code_generator
+          define_void_element :wbr, code_generator: code_generator
+
+          define_self_closing_element :animate, code_generator: code_generator
+          define_self_closing_element :animateMotion, code_generator: code_generator, method_name: :animate_motion
+          define_self_closing_element :animateTransform, code_generator: code_generator, method_name: :animate_transform
+          define_self_closing_element :circle, code_generator: code_generator
+          define_self_closing_element :ellipse, code_generator: code_generator
+          define_self_closing_element :line, code_generator: code_generator
+          define_self_closing_element :path, code_generator: code_generator
+          define_self_closing_element :polygon, code_generator: code_generator
+          define_self_closing_element :polyline, code_generator: code_generator
+          define_self_closing_element :rect, code_generator: code_generator
+          define_self_closing_element :set, code_generator: code_generator
+          define_self_closing_element :stop, code_generator: code_generator
+          define_self_closing_element :use, code_generator: code_generator
+          define_self_closing_element :view, code_generator: code_generator
+
+          define_element :a, code_generator: code_generator
+          define_element :abbr, code_generator: code_generator
+          define_element :address, code_generator: code_generator
+          define_element :article, code_generator: code_generator
+          define_element :aside, code_generator: code_generator
+          define_element :audio, code_generator: code_generator
+          define_element :b, code_generator: code_generator
+          define_element :bdi, code_generator: code_generator
+          define_element :bdo, code_generator: code_generator
+          define_element :blockquote, code_generator: code_generator
+          define_element :body, code_generator: code_generator
+          define_element :button, code_generator: code_generator
+          define_element :canvas, code_generator: code_generator
+          define_element :caption, code_generator: code_generator
+          define_element :cite, code_generator: code_generator
+          define_element :code, code_generator: code_generator
+          define_element :colgroup, code_generator: code_generator
+          define_element :data, code_generator: code_generator
+          define_element :datalist, code_generator: code_generator
+          define_element :dd, code_generator: code_generator
+          define_element :del, code_generator: code_generator
+          define_element :details, code_generator: code_generator
+          define_element :dfn, code_generator: code_generator
+          define_element :dialog, code_generator: code_generator
+          define_element :div, code_generator: code_generator
+          define_element :dl, code_generator: code_generator
+          define_element :dt, code_generator: code_generator
+          define_element :em, code_generator: code_generator
+          define_element :fieldset, code_generator: code_generator
+          define_element :figcaption, code_generator: code_generator
+          define_element :figure, code_generator: code_generator
+          define_element :footer, code_generator: code_generator
+          define_element :form, code_generator: code_generator
+          define_element :h1, code_generator: code_generator
+          define_element :h2, code_generator: code_generator
+          define_element :h3, code_generator: code_generator
+          define_element :h4, code_generator: code_generator
+          define_element :h5, code_generator: code_generator
+          define_element :h6, code_generator: code_generator
+          define_element :head, code_generator: code_generator
+          define_element :header, code_generator: code_generator
+          define_element :hgroup, code_generator: code_generator
+          define_element :html, code_generator: code_generator
+          define_element :i, code_generator: code_generator
+          define_element :iframe, code_generator: code_generator
+          define_element :ins, code_generator: code_generator
+          define_element :kbd, code_generator: code_generator
+          define_element :label, code_generator: code_generator
+          define_element :legend, code_generator: code_generator
+          define_element :li, code_generator: code_generator
+          define_element :main, code_generator: code_generator
+          define_element :map, code_generator: code_generator
+          define_element :mark, code_generator: code_generator
+          define_element :menu, code_generator: code_generator
+          define_element :meter, code_generator: code_generator
+          define_element :nav, code_generator: code_generator
+          define_element :noscript, code_generator: code_generator
+          define_element :object, code_generator: code_generator
+          define_element :ol, code_generator: code_generator
+          define_element :optgroup, code_generator: code_generator
+          define_element :option, code_generator: code_generator
+          define_element :output, code_generator: code_generator
+          define_element :p, code_generator: code_generator
+          define_element :picture, code_generator: code_generator
+          define_element :portal, code_generator: code_generator
+          define_element :pre, code_generator: code_generator
+          define_element :progress, code_generator: code_generator
+          define_element :q, code_generator: code_generator
+          define_element :rp, code_generator: code_generator
+          define_element :rt, code_generator: code_generator
+          define_element :ruby, code_generator: code_generator
+          define_element :s, code_generator: code_generator
+          define_element :samp, code_generator: code_generator
+          define_element :script, code_generator: code_generator
+          define_element :search, code_generator: code_generator
+          define_element :section, code_generator: code_generator
+          define_element :select, code_generator: code_generator
+          define_element :slot, code_generator: code_generator
+          define_element :small, code_generator: code_generator
+          define_element :span, code_generator: code_generator
+          define_element :strong, code_generator: code_generator
+          define_element :style, code_generator: code_generator
+          define_element :sub, code_generator: code_generator
+          define_element :summary, code_generator: code_generator
+          define_element :sup, code_generator: code_generator
+          define_element :table, code_generator: code_generator
+          define_element :tbody, code_generator: code_generator
+          define_element :td, code_generator: code_generator
+          define_element :template, code_generator: code_generator
+          define_element :textarea, code_generator: code_generator
+          define_element :tfoot, code_generator: code_generator
+          define_element :th, code_generator: code_generator
+          define_element :thead, code_generator: code_generator
+          define_element :time, code_generator: code_generator
+          define_element :title, code_generator: code_generator
+          define_element :tr, code_generator: code_generator
+          define_element :u, code_generator: code_generator
+          define_element :ul, code_generator: code_generator
+          define_element :var, code_generator: code_generator
+          define_element :video, code_generator: code_generator
+        end
 
         def initialize(view_context)
           @view_context = view_context
@@ -62,28 +226,22 @@ module ActionView
           tag_options(attributes.to_h).to_s.strip.html_safe
         end
 
-        def p(*arguments, **options, &block)
-          tag_string(:p, *arguments, **options, &block)
+        def tag_string(name, content = nil, options, escape: true, &block)
+          content = @view_context.capture(self, &block) if block
+
+          content_tag_string(name, content, options, escape)
         end
 
-        def tag_string(name, content = nil, escape: true, **options, &block)
-          content = @view_context.capture(self, &block) if block_given?
-          self_closing = SVG_SELF_CLOSING_ELEMENTS.include?(name)
-          if (HTML_VOID_ELEMENTS.include?(name) || self_closing) && content.nil?
-            "<#{name.to_s.dasherize}#{tag_options(options, escape)}#{self_closing ? " />" : ">"}".html_safe
-          else
-            content_tag_string(name.to_s.dasherize, content || "", options, escape)
-          end
+        def self_closing_tag_string(name, options, escape = true, tag_suffix = " />")
+          "<#{name}#{tag_options(options, escape)}#{tag_suffix}".html_safe
         end
 
         def content_tag_string(name, content, options, escape = true)
           tag_options = tag_options(options, escape) if options
 
-          if escape
-            name = ERB::Util.xml_name_escape(name)
+          if escape && content.present?
             content = ERB::Util.unwrapped_html_escape(content)
           end
-
           "<#{name}#{tag_options}>#{PRE_CONTENT_STRINGS[name]}#{content}</#{name}>".html_safe
         end
 
@@ -163,8 +321,12 @@ module ActionView
             true
           end
 
-          def method_missing(called, *args, **options, &block)
-            tag_string(called, *args, **options, &block)
+          def method_missing(called, *args, escape: true, **options, &block)
+            name = called.name.dasherize
+
+            TagHelper.ensure_valid_html5_tag_name(name)
+
+            tag_string(name, *args, options, escape: escape, &block)
           end
       end
 
@@ -245,6 +407,14 @@ module ActionView
       #   # A void element:
       #   tag.br  # => <br>
       #
+      # Note that when using the block form options should be wrapped in
+      # parenthesis.
+      #
+      #   <%= tag.a(href: "/about", class: "font-bold") do %>
+      #     About the author
+      #   <% end %>
+      #   # => <a href="/about" class="font-bold">About the author</a>
+      #
       # === Building HTML attributes
       #
       # Transforms a Hash into HTML attributes, ready to be interpolated into
@@ -310,7 +480,7 @@ module ActionView
         if name.nil?
           tag_builder
         else
-          name = ERB::Util.xml_name_escape(name) if escape
+          ensure_valid_html5_tag_name(name)
           "<#{name}#{tag_builder.tag_options(options, escape) if options}#{open ? ">" : " />"}".html_safe
         end
       end
@@ -344,6 +514,8 @@ module ActionView
       #   <% end -%>
       #    # => <div class="strong">Hello world!</div>
       def content_tag(name, content_or_options_with_block = nil, options = nil, escape = true, &block)
+        ensure_valid_html5_tag_name(name)
+
         if block_given?
           options = content_or_options_with_block if content_or_options_with_block.is_a?(Hash)
           tag_builder.content_tag_string(name, capture(&block), options, escape)
@@ -400,6 +572,11 @@ module ActionView
       end
 
       private
+        def ensure_valid_html5_tag_name(name)
+          raise ArgumentError, "Invalid HTML5 tag name: #{name.inspect}" unless /\A[a-zA-Z][^\s\/>]*\z/.match?(name)
+        end
+        module_function :ensure_valid_html5_tag_name
+
         def build_tag_values(*args)
           tag_values = []
 

data/lib/action_view/helpers/tags/collection_check_boxes.rb

@@ -10,12 +10,13 @@ module ActionView
         include FormOptionsHelper
 
         class CheckBoxBuilder < Builder # :nodoc:
-          def check_box(extra_html_options = {})
+          def checkbox(extra_html_options = {})
             html_options = extra_html_options.merge(@input_html_options)
             html_options[:multiple] = true
             html_options[:skip_default_ids] = false
-            @template_object.check_box(@object_name, @method_name, html_options, @value, nil)
+            @template_object.checkbox(@object_name, @method_name, html_options, @value, nil)
           end
+          alias_method :check_box, :checkbox
         end
 
         def render(&block)
@@ -24,7 +25,7 @@ module ActionView
 
         private
           def render_component(builder)
-            builder.check_box + builder.label
+            builder.checkbox + builder.label
           end
 
           def hidden_field_name

data/lib/action_view/helpers/tags/collection_helpers.rb

@@ -106,7 +106,8 @@ module ActionView
 
           def hidden_field
             hidden_name = @html_options[:name] || hidden_field_name
-            @template_object.hidden_field_tag(hidden_name, "", id: nil)
+            options = { id: nil, form: @html_options[:form] }
+            @template_object.hidden_field_tag(hidden_name, "", options)
           end
 
           def hidden_field_name