actionview 7.2.3.1 → 8.0.5

data/lib/action_view/helpers/rendering_helper.rb

@@ -1,32 +1,140 @@
 # frozen_string_literal: true
 
+# :markup: markdown
+
 module ActionView
   module Helpers # :nodoc:
-    # = Action View \Rendering \Helpers
+    # # Action View Rendering Helpers
     #
-    # Implements methods that allow rendering from a view context.
-    # In order to use this module, all you need is to implement
-    # view_renderer that returns an ActionView::Renderer object.
+    # Implements methods that allow rendering from a view context. In order to use
+    # this module, all you need is to implement view_renderer that returns an
+    # ActionView::Renderer object.
     module RenderingHelper
-      # Returns the result of a render that's dictated by the options hash. The primary options are:
+      # Renders a template and returns the result.
+      #
+      # Pass the template to render as the first argument. This is shorthand
+      # syntax for partial rendering, so the template filename should be
+      # prefixed with an underscore. The partial renderer looks for the partial
+      # template in the directory of the calling template first.
+      #
+      #     <% # app/views/posts/new.html.erb %>
+      #     <%= render "form" %>
+      #     # => renders app/views/posts/_form.html.erb
+      #
+      # Use the complete view path to render a partial from another directory.
+      #
+      #     <% # app/views/posts/show.html.erb %>
+      #     <%= render "comments/form" %>
+      #     # => renders app/views/comments/_form.html.erb
+      #
+      # Without the rendering mode, the second argument can be a Hash of local
+      # variable assignments for the template.
+      #
+      #     <% # app/views/posts/new.html.erb %>
+      #     <%= render "form", post: Post.new %>
+      #     # => renders app/views/posts/_form.html.erb
+      #
+      # If the first argument responds to `render_in`, the template will be rendered
+      # by calling `render_in` with the current view context.
+      #
+      #     class Greeting
+      #       def render_in(view_context)
+      #         view_context.render html: "<h1>Hello, World</h1>"
+      #       end
+      #
+      #       def format
+      #         :html
+      #       end
+      #     end
+      #
+      #     <%= render Greeting.new %>
+      #     # => "<h1>Hello, World</h1>"
+      #
+      # #### Rendering Mode
+      #
+      # Pass the rendering mode as first argument to override it.
+      #
+      # `:partial`
+      # :   See ActionView::PartialRenderer for details.
+      #
+      #         <%= render partial: "form", locals: { post: Post.new } %>
+      #         # => renders app/views/posts/_form.html.erb
+      #
+      # `:file`
+      # :   Renders the contents of a file. This option should **not** be used with
+      #     unsanitized user input.
+      #
+      #         <%= render file: "/path/to/some/file" %>
+      #         # => renders /path/to/some/file
+      #
+      # `:inline`
+      # :   Renders an ERB template string.
+      #
+      #         <% name = "World" %>
+      #         <%= render inline: "<h1>Hello, <%= name %>!</h1>" %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      # `:body`
+      # :   Renders the provided text, and sets the format as `:text`.
+      #
+      #         <%= render body: "Hello, World!" %>
+      #         # => renders "Hello, World!"
+      #
+      # `:plain`
+      # :   Renders the provided text, and sets the format as `:text`.
+      #
+      #         <%= render plain: "Hello, World!" %>
+      #         # => renders "Hello, World!"
+      #
+      # `:html`
+      # :   Renders the provided HTML string, and sets the format as
+      #     `:html`. If the string is not `html_safe?`, performs HTML escaping on
+      #     the string before rendering.
+      #
+      #         <%= render html: "<h1>Hello, World!</h1>".html_safe %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      #         <%= render html: "<h1>Hello, World!</h1>" %>
+      #         # => renders "&lt;h1&gt;Hello, World!&lt;/h1&gt;"
+      #
+      # `:renderable`
+      # :   Renders the provided object by calling `render_in` with the current view
+      #     context. The format is determined by calling `format` on the
+      #     renderable if it responds to `format`, falling back to `:html` by
+      #     default.
+      #
+      #         <%= render renderable: Greeting.new %>
+      #         # => renders "<h1>Hello, World</h1>"
+      #
+      #
+      # #### Options
+      #
+      # `:locals`
+      # :   Hash of local variable assignments for the template.
+      #
+      #         <%= render inline: "<h1>Hello, <%= name %>!</h1>", locals: { name: "World" } %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      # `:formats`
+      # :   Override the current format to render a template for a different format.
+      #
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", formats: [:text] %>
+      #         # => renders app/views/posts/content.text.erb
       #
-      # * <tt>:partial</tt> - See ActionView::PartialRenderer.
-      # * <tt>:file</tt> - Renders an explicit template file (this used to be the old default), add +:locals+ to pass in those.
-      # * <tt>:inline</tt> - Renders an inline template similar to how it's done in the controller.
-      # * <tt>:plain</tt> - Renders the text passed in out. Setting the content
-      #   type as <tt>text/plain</tt>.
-      # * <tt>:html</tt> - Renders the HTML safe string passed in out, otherwise
-      #   performs HTML escape on the string first. Setting the content type as
-      #   <tt>text/html</tt>.
-      # * <tt>:body</tt> - Renders the text passed in, and inherits the content
-      #   type of <tt>text/plain</tt> from ActionDispatch::Response object.
+      # `:variants`
+      # :   Render a template for a different variant.
       #
-      # If no <tt>options</tt> hash is passed or if <tt>:update</tt> is specified, then:
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", variants: [:tablet] %>
+      #         # => renders app/views/posts/content.html+tablet.erb
       #
-      # If an object responding to +render_in+ is passed, +render_in+ is called on the object,
-      # passing in the current view context.
+      # `:handlers`
+      # :   Render a template for a different handler.
       #
-      # Otherwise, a partial is rendered using the second parameter as the locals hash.
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", handlers: [:builder] %>
+      #         # => renders app/views/posts/content.html.builder
       def render(options = {}, locals = {}, &block)
         case options
         when Hash
@@ -47,52 +155,54 @@ module ActionView
       end
 
       # Overrides _layout_for in the context object so it supports the case a block is
-      # passed to a partial. Returns the contents that are yielded to a layout, given a
-      # name or a block.
+      # passed to a partial. Returns the contents that are yielded to a layout, given
+      # a name or a block.
       #
-      # You can think of a layout as a method that is called with a block. If the user calls
-      # <tt>yield :some_name</tt>, the block, by default, returns <tt>content_for(:some_name)</tt>.
-      # If the user calls simply +yield+, the default block returns <tt>content_for(:layout)</tt>.
+      # You can think of a layout as a method that is called with a block. If the user
+      # calls `yield :some_name`, the block, by default, returns
+      # `content_for(:some_name)`. If the user calls simply `yield`, the default block
+      # returns `content_for(:layout)`.
       #
       # The user can override this default by passing a block to the layout:
       #
-      #   # The template
-      #   <%= render layout: "my_layout" do %>
-      #     Content
-      #   <% end %>
+      #     # The template
+      #     <%= render layout: "my_layout" do %>
+      #       Content
+      #     <% end %>
       #
-      #   # The layout
-      #   <html>
-      #     <%= yield %>
-      #   </html>
+      #     # The layout
+      #     <html>
+      #       <%= yield %>
+      #     </html>
       #
-      # In this case, instead of the default block, which would return <tt>content_for(:layout)</tt>,
-      # this method returns the block that was passed in to <tt>render :layout</tt>, and the response
+      # In this case, instead of the default block, which would return `content_for(:layout)`,
+      # this method returns the block that was passed in to `render :layout`, and the response
       # would be
       #
-      #   <html>
-      #     Content
-      #   </html>
+      #     <html>
+      #       Content
+      #     </html>
       #
-      # Finally, the block can take block arguments, which can be passed in by +yield+:
+      # Finally, the block can take block arguments, which can be passed in by
+      # `yield`:
       #
-      #   # The template
-      #   <%= render layout: "my_layout" do |customer| %>
-      #     Hello <%= customer.name %>
-      #   <% end %>
+      #     # The template
+      #     <%= render layout: "my_layout" do |customer| %>
+      #       Hello <%= customer.name %>
+      #     <% end %>
       #
-      #   # The layout
-      #   <html>
-      #     <%= yield Struct.new(:name).new("David") %>
-      #   </html>
+      #     # The layout
+      #     <html>
+      #       <%= yield Struct.new(:name).new("David") %>
+      #     </html>
       #
-      # In this case, the layout would receive the block passed into <tt>render :layout</tt>,
+      # In this case, the layout would receive the block passed into `render :layout`,
       # and the struct specified would be passed into the block as an argument. The result
       # would be
       #
-      #   <html>
-      #     Hello David
-      #   </html>
+      #     <html>
+      #       Hello David
+      #     </html>
       #
       def _layout_for(*args, &block)
         name = args.first

data/lib/action_view/helpers/sanitize_helper.rb

@@ -24,6 +24,12 @@ module ActionView
       #
       # Custom sanitization rules can also be provided.
       #
+      # <b>Warning</b>: Adding disallowed tags or attributes to the allowlists may introduce
+      # vulnerabilities into your application. Please rely on the default allowlists whenever
+      # possible, because they are curated to maintain security and safety. If you think that the
+      # default allowlists should be expanded, please {open an issue on the rails-html-sanitizer
+      # project}[https://github.com/rails/rails-html-sanitizer/issues].
+      #
       # Please note that sanitizing user-provided text does not guarantee that the
       # resulting markup is valid or even well-formed.
       #

data/lib/action_view/helpers/tag_helper.rb

@@ -4,7 +4,6 @@ require "active_support/code_generator"
 require "active_support/core_ext/enumerable"
 require "active_support/core_ext/string/output_safety"
 require "active_support/core_ext/string/inflections"
-require "set"
 require "action_view/helpers/capture_helper"
 require "action_view/helpers/output_safety_helper"
 
@@ -48,48 +47,36 @@ module ActionView
         include CaptureHelper
         include OutputSafetyHelper
 
-        def self.define_element(name, code_generator:, method_name: name.to_s.underscore)
-          code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
-            batch.push(<<~RUBY) unless instance_methods.include?(method_name.to_sym)
-              def #{method_name}(content = nil, escape: true, **options, &block)
-                tag_string("#{name}", content, options, escape: escape, &block)
-              end
-            RUBY
+        def self.define_element(name, code_generator:, method_name: name)
+          return if method_defined?(name)
+
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(content = nil, escape: true, **options, &block)" <<
+              "  tag_string(#{name.inspect}, content, options, escape: escape, &block)" <<
+              "end"
           end
         end
 
-        def self.define_void_element(name, code_generator:, method_name: name.to_s.underscore)
-          code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
-            batch.push(<<~RUBY)
-              def #{method_name}(content = nil, escape: true, **options, &block)
-                if content || block
-                  ActionView.deprecator.warn <<~TEXT
-                    Putting content inside a void element (#{name}) is invalid
-                    according to the HTML5 spec, and so it is being deprecated
-                    without replacement. In Rails 8.0, passing content as a
-                    positional argument will raise, and using a block will have
-                    no effect.
-                  TEXT
-                  tag_string("#{name}", content, options, escape: escape, &block)
-                else
-                  self_closing_tag_string("#{name}", options, escape, ">")
-                end
-              end
-            RUBY
+        def self.define_void_element(name, code_generator:, method_name: name)
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(escape: true, **options, &block)" <<
+              "  self_closing_tag_string(#{name.inspect}, options, escape, '>')" <<
+              "end"
           end
         end
 
-        def self.define_self_closing_element(name, code_generator:, method_name: name.to_s.underscore)
-          code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
-            batch.push(<<~RUBY)
-              def #{method_name}(content = nil, escape: true, **options, &block)
-                if content || block
-                  tag_string("#{name}", content, options, escape: escape, &block)
-                else
-                  self_closing_tag_string("#{name}", options, escape)
-                end
-              end
-            RUBY
+        def self.define_self_closing_element(name, code_generator:, method_name: name)
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(content = nil, escape: true, **options, &block)" <<
+              "  if content || block" <<
+              "    tag_string(#{name.inspect}, content, options, escape: escape, &block)" <<
+              "  else" <<
+              "   self_closing_tag_string(#{name.inspect}, options, escape)" <<
+              "  end" <<
+              "end"
           end
         end
 
@@ -110,8 +97,8 @@ module ActionView
           define_void_element :wbr, code_generator: code_generator
 
           define_self_closing_element :animate, code_generator: code_generator
-          define_self_closing_element :animateMotion, code_generator: code_generator
-          define_self_closing_element :animateTransform, code_generator: code_generator
+          define_self_closing_element :animateMotion, code_generator: code_generator, method_name: :animate_motion
+          define_self_closing_element :animateTransform, code_generator: code_generator, method_name: :animate_transform
           define_self_closing_element :circle, code_generator: code_generator
           define_self_closing_element :ellipse, code_generator: code_generator
           define_self_closing_element :line, code_generator: code_generator

data/lib/action_view/helpers/tags/base.rb

@@ -80,30 +80,32 @@ module ActionView
             end
           end
 
-          def add_default_name_and_id_for_value(tag_value, options)
+          def add_default_name_and_field_for_value(tag_value, options, field = "id")
             if tag_value.nil?
-              add_default_name_and_id(options)
+              add_default_name_and_field(options, field)
             else
-              specified_id = options["id"]
-              add_default_name_and_id(options)
+              specified_field = options[field]
+              add_default_name_and_field(options, field)
 
-              if specified_id.blank? && options["id"].present?
-                options["id"] += "_#{sanitized_value(tag_value)}"
+              if specified_field.blank? && options[field].present?
+                options[field] += "_#{sanitized_value(tag_value)}"
               end
             end
           end
+          alias_method :add_default_name_and_id_for_value, :add_default_name_and_field_for_value
 
-          def add_default_name_and_id(options)
+          def add_default_name_and_field(options, field = "id")
             index = name_and_id_index(options)
             options["name"] = options.fetch("name") { tag_name(options["multiple"], index) }
 
             if generate_ids?
-              options["id"] = options.fetch("id") { tag_id(index, options.delete("namespace")) }
+              options[field] = options.fetch(field) { tag_id(index, options.delete("namespace")) }
               if namespace = options.delete("namespace")
-                options["id"] = options["id"] ? "#{namespace}_#{options['id']}" : namespace
+                options[field] = options[field] ? "#{namespace}_#{options[field]}" : namespace
               end
             end
           end
+          alias_method :add_default_name_and_id, :add_default_name_and_field
 
           def tag_name(multiple = false, index = nil)
             @template_object.field_name(@object_name, sanitized_method_name, multiple: multiple, index: index)

data/lib/action_view/helpers/tags/check_box.rb

@@ -21,10 +21,10 @@ module ActionView
           options["checked"] = "checked" if input_checked?(options)
 
           if options["multiple"]
-            add_default_name_and_id_for_value(@checked_value, options)
+            add_default_name_and_field_for_value(@checked_value, options)
             options.delete("multiple")
           else
-            add_default_name_and_id(options)
+            add_default_name_and_field(options)
           end
 
           include_hidden = options.delete("include_hidden") { true }

data/lib/action_view/helpers/tags/collection_check_boxes.rb

@@ -10,12 +10,13 @@ module ActionView
         include FormOptionsHelper
 
         class CheckBoxBuilder < Builder # :nodoc:
-          def check_box(extra_html_options = {})
+          def checkbox(extra_html_options = {})
             html_options = extra_html_options.merge(@input_html_options)
             html_options[:multiple] = true
             html_options[:skip_default_ids] = false
-            @template_object.check_box(@object_name, @method_name, html_options, @value, nil)
+            @template_object.checkbox(@object_name, @method_name, html_options, @value, nil)
           end
+          alias_method :check_box, :checkbox
         end
 
         def render(&block)
@@ -24,7 +25,7 @@ module ActionView
 
         private
           def render_component(builder)
-            builder.check_box + builder.label
+            builder.checkbox + builder.label
           end
 
           def hidden_field_name

data/lib/action_view/helpers/tags/file_field.rb

@@ -6,8 +6,11 @@ module ActionView
       class FileField < TextField # :nodoc:
         def render
           include_hidden = @options.delete(:include_hidden)
+          if @options[:accept].is_a?(Array)
+            @options[:accept] = @options[:accept].join(",")
+          end
           options = @options.stringify_keys
-          add_default_name_and_id(options)
+          add_default_name_and_field(options)
 
           if options["multiple"] && include_hidden
             hidden_field_for_multiple_file(options) + super

data/lib/action_view/helpers/tags/label.rb

@@ -48,18 +48,11 @@ module ActionView
         def render(&block)
           options = @options.stringify_keys
           tag_value = options.delete("value")
-          name_and_id = options.dup
 
-          if name_and_id["for"]
-            name_and_id["id"] = name_and_id["for"]
-          else
-            name_and_id.delete("id")
-          end
-
-          add_default_name_and_id_for_value(tag_value, name_and_id)
+          add_default_name_and_field_for_value(tag_value, options, "for")
           options.delete("index")
+          options.delete("name")
           options.delete("namespace")
-          options["for"] = name_and_id["id"] unless options.key?("for")
 
           builder = LabelBuilder.new(@template_object, @object_name, @method_name, @object, tag_value)
 
@@ -71,7 +64,7 @@ module ActionView
             render_component(builder)
           end
 
-          label_tag(name_and_id["id"], content, options)
+          label_tag(options["for"], content, options)
         end
 
         private

data/lib/action_view/helpers/tags/radio_button.rb

@@ -18,7 +18,7 @@ module ActionView
           options["type"]     = "radio"
           options["value"]    = @tag_value
           options["checked"] = "checked" if input_checked?(options)
-          add_default_name_and_id_for_value(@tag_value, options)
+          add_default_name_and_field_for_value(@tag_value, options)
           tag("input", options)
         end
 

data/lib/action_view/helpers/tags/select_renderer.rb

@@ -11,7 +11,7 @@ module ActionView
               html_options[prop.to_s] = options.delete(prop) if options.key?(prop) && !html_options.key?(prop.to_s)
             end
 
-            add_default_name_and_id(html_options)
+            add_default_name_and_field(html_options)
 
             if placeholder_required?(html_options)
               raise ArgumentError, "include_blank cannot be false for a required field." if options[:include_blank] == false

data/lib/action_view/helpers/tags/text_area.rb

@@ -10,7 +10,7 @@ module ActionView
 
         def render
           options = @options.stringify_keys
-          add_default_name_and_id(options)
+          add_default_name_and_field(options)
 
           if size = options.delete("size")
             options["cols"], options["rows"] = size.split("x") if size.respond_to?(:split)

data/lib/action_view/helpers/tags/text_field.rb

@@ -13,7 +13,7 @@ module ActionView
           options["size"] = options["maxlength"] unless options.key?("size")
           options["type"] ||= field_type
           options["value"] = options.fetch("value") { value_before_type_cast } unless field_type == "file"
-          add_default_name_and_id(options)
+          add_default_name_and_field(options)
           tag("input", options)
         end
 

data/lib/action_view/helpers/url_helper.rb

@@ -500,8 +500,6 @@ module ActionView
         content_tag("a", name || email_address, html_options, &block)
       end
 
-      RFC2396_PARSER = defined?(URI::RFC2396_PARSER) ? URI::RFC2396_PARSER : URI::RFC2396_Parser.new
-
       # True if the current request URI was generated by the given +options+.
       #
       # ==== Examples
@@ -558,14 +556,14 @@ module ActionView
 
         options ||= options_as_kwargs
         check_parameters ||= options.is_a?(Hash) && options.delete(:check_parameters)
-        url_string = RFC2396_PARSER.unescape(url_for(options)).force_encoding(Encoding::BINARY)
+        url_string = URI::RFC2396_PARSER.unescape(url_for(options)).force_encoding(Encoding::BINARY)
 
         # We ignore any extra parameters in the request_uri if the
         # submitted URL doesn't have any either. This lets the function
         # work with things like ?order=asc
         # the behavior can be disabled with check_parameters: true
         request_uri = url_string.index("?") || check_parameters ? request.fullpath : request.path
-        request_uri = RFC2396_PARSER.unescape(request_uri).force_encoding(Encoding::BINARY)
+        request_uri = URI::RFC2396_PARSER.unescape(request_uri).force_encoding(Encoding::BINARY)
 
         if %r{^\w+://}.match?(url_string)
           request_uri = +"#{request.protocol}#{request.host_with_port}#{request_uri}"

data/lib/action_view/layouts.rb

@@ -347,7 +347,7 @@ module ActionView
         end
     end
 
-    def _normalize_options(options) # :nodoc:
+    def _process_render_template_options(options) # :nodoc:
       super
 
       if _include_layout?(options)

data/lib/action_view/record_identifier.rb

@@ -11,7 +11,7 @@ module ActionView
   #
   # Consider for example the following code that form of post:
   #
-  #   <%= form_for(post) do |f| %>
+  #   <%= form_with(model: post) do |f| %>
   #     <%= f.text_field :body %>
   #   <% end %>
   #

data/lib/action_view/render_parser/prism_render_parser.rb

@@ -97,9 +97,21 @@ module ActionView
         def render_call_template(node)
           object_template = false
           template =
-            if node.is_a?(Prism::StringNode)
+            case node.type
+            when :string_node
               path = node.unescaped
               path.include?("/") ? path : "#{directory}/#{path}"
+            when :interpolated_string_node
+              node.parts.map do |node|
+                case node.type
+                when :string_node
+                  node.unescaped
+                when :embedded_statements_node
+                  "*"
+                else
+                  return
+                end
+              end.join("")
             else
               dependency =
                 case node.type

data/lib/action_view/render_parser/ripper_render_parser.rb

@@ -66,7 +66,16 @@ module ActionView
 
         def to_string
           raise unless string?
-          self[0][0][0]
+
+          # s(:string_literal, s(:string_content, map))
+          self[0].map do |node|
+            case node.type
+            when :@tstring_content
+              node[0]
+            when :string_embexpr
+              "*"
+            end
+          end.join("")
         end
 
         def hash?

data/lib/action_view/renderer/partial_renderer/collection_caching.rb

@@ -111,7 +111,11 @@ module ActionView
         end
 
         unless entries_to_write.empty?
-          collection_cache.write_multi(entries_to_write)
+          if @options[:cached].is_a?(Hash) && @options[:cached].key?(:expires_in)
+            collection_cache.write_multi(entries_to_write, expires_in: @options[:cached][:expires_in])
+          else
+            collection_cache.write_multi(entries_to_write)
+          end
         end
 
         keyed_partials

data/lib/action_view/renderer/streaming_template_renderer.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "fiber"
 
 module ActionView
   # == TODO
@@ -26,6 +25,13 @@ module ActionView
         self
       end
 
+      # Returns the complete body as a string.
+      def body
+        buffer = String.new
+        each { |part| buffer << part }
+        buffer
+      end
+
       private
         # This is the same logging logic as in ShowExceptions middleware.
         def log_error(exception)
@@ -43,7 +49,7 @@ module ActionView
     # object that responds to each. This object is initialized with a block
     # that knows how to render the template.
     def render_template(view, template, layout_name = nil, locals = {}) # :nodoc:
-      return [super.body] unless layout_name && template.supports_streaming?
+      return [super.body] unless template.supports_streaming?
 
       locals ||= {}
       layout   = find_layout(layout_name, locals.keys, [formats.first])