actionview 7.2.3.1 → 8.1.4.1

data/lib/action_view/helpers/rendering_helper.rb

@@ -1,32 +1,140 @@
 # frozen_string_literal: true
 
+# :markup: markdown
+
 module ActionView
   module Helpers # :nodoc:
-    # = Action View \Rendering \Helpers
+    # # Action View Rendering Helpers
     #
-    # Implements methods that allow rendering from a view context.
-    # In order to use this module, all you need is to implement
-    # view_renderer that returns an ActionView::Renderer object.
+    # Implements methods that allow rendering from a view context. In order to use
+    # this module, all you need is to implement view_renderer that returns an
+    # ActionView::Renderer object.
     module RenderingHelper
-      # Returns the result of a render that's dictated by the options hash. The primary options are:
+      # Renders a template and returns the result.
+      #
+      # Pass the template to render as the first argument. This is shorthand
+      # syntax for partial rendering, so the template filename should be
+      # prefixed with an underscore. The partial renderer looks for the partial
+      # template in the directory of the calling template first.
+      #
+      #     <% # app/views/posts/new.html.erb %>
+      #     <%= render "form" %>
+      #     # => renders app/views/posts/_form.html.erb
+      #
+      # Use the complete view path to render a partial from another directory.
+      #
+      #     <% # app/views/posts/show.html.erb %>
+      #     <%= render "comments/form" %>
+      #     # => renders app/views/comments/_form.html.erb
+      #
+      # Without the rendering mode, the second argument can be a Hash of local
+      # variable assignments for the template.
+      #
+      #     <% # app/views/posts/new.html.erb %>
+      #     <%= render "form", post: Post.new %>
+      #     # => renders app/views/posts/_form.html.erb
+      #
+      # If the first argument responds to `render_in`, the template will be rendered
+      # by calling `render_in` with the current view context.
+      #
+      #     class Greeting
+      #       def render_in(view_context)
+      #         view_context.render html: "<h1>Hello, World</h1>"
+      #       end
+      #
+      #       def format
+      #         :html
+      #       end
+      #     end
+      #
+      #     <%= render Greeting.new %>
+      #     # => "<h1>Hello, World</h1>"
+      #
+      # #### Rendering Mode
+      #
+      # Pass the rendering mode as first argument to override it.
+      #
+      # `:partial`
+      # :   See ActionView::PartialRenderer for details.
+      #
+      #         <%= render partial: "form", locals: { post: Post.new } %>
+      #         # => renders app/views/posts/_form.html.erb
+      #
+      # `:file`
+      # :   Renders the contents of a file. This option should **not** be used with
+      #     unsanitized user input.
+      #
+      #         <%= render file: "/path/to/some/file" %>
+      #         # => renders /path/to/some/file
+      #
+      # `:inline`
+      # :   Renders an ERB template string.
+      #
+      #         <% name = "World" %>
+      #         <%= render inline: "<h1>Hello, <%= name %>!</h1>" %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      # `:body`
+      # :   Renders the provided text, and sets the format as `:text`.
+      #
+      #         <%= render body: "Hello, World!" %>
+      #         # => renders "Hello, World!"
+      #
+      # `:plain`
+      # :   Renders the provided text, and sets the format as `:text`.
+      #
+      #         <%= render plain: "Hello, World!" %>
+      #         # => renders "Hello, World!"
+      #
+      # `:html`
+      # :   Renders the provided HTML string, and sets the format as
+      #     `:html`. If the string is not `html_safe?`, performs HTML escaping on
+      #     the string before rendering.
+      #
+      #         <%= render html: "<h1>Hello, World!</h1>".html_safe %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      #         <%= render html: "<h1>Hello, World!</h1>" %>
+      #         # => renders "&lt;h1&gt;Hello, World!&lt;/h1&gt;"
+      #
+      # `:renderable`
+      # :   Renders the provided object by calling `render_in` with the current view
+      #     context. The format is determined by calling `format` on the
+      #     renderable if it responds to `format`, falling back to `:html` by
+      #     default.
+      #
+      #         <%= render renderable: Greeting.new %>
+      #         # => renders "<h1>Hello, World</h1>"
+      #
+      #
+      # #### Options
+      #
+      # `:locals`
+      # :   Hash of local variable assignments for the template.
+      #
+      #         <%= render inline: "<h1>Hello, <%= name %>!</h1>", locals: { name: "World" } %>
+      #         # => renders "<h1>Hello, World!</h1>"
+      #
+      # `:formats`
+      # :   Override the current format to render a template for a different format.
+      #
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", formats: [:text] %>
+      #         # => renders app/views/posts/content.text.erb
       #
-      # * <tt>:partial</tt> - See ActionView::PartialRenderer.
-      # * <tt>:file</tt> - Renders an explicit template file (this used to be the old default), add +:locals+ to pass in those.
-      # * <tt>:inline</tt> - Renders an inline template similar to how it's done in the controller.
-      # * <tt>:plain</tt> - Renders the text passed in out. Setting the content
-      #   type as <tt>text/plain</tt>.
-      # * <tt>:html</tt> - Renders the HTML safe string passed in out, otherwise
-      #   performs HTML escape on the string first. Setting the content type as
-      #   <tt>text/html</tt>.
-      # * <tt>:body</tt> - Renders the text passed in, and inherits the content
-      #   type of <tt>text/plain</tt> from ActionDispatch::Response object.
+      # `:variants`
+      # :   Render a template for a different variant.
       #
-      # If no <tt>options</tt> hash is passed or if <tt>:update</tt> is specified, then:
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", variants: [:tablet] %>
+      #         # => renders app/views/posts/content.html+tablet.erb
       #
-      # If an object responding to +render_in+ is passed, +render_in+ is called on the object,
-      # passing in the current view context.
+      # `:handlers`
+      # :   Render a template for a different handler.
       #
-      # Otherwise, a partial is rendered using the second parameter as the locals hash.
+      #         <% # app/views/posts/show.html.erb %>
+      #         <%= render template: "posts/content", handlers: [:builder] %>
+      #         # => renders app/views/posts/content.html.builder
       def render(options = {}, locals = {}, &block)
         case options
         when Hash
@@ -47,52 +155,54 @@ module ActionView
       end
 
       # Overrides _layout_for in the context object so it supports the case a block is
-      # passed to a partial. Returns the contents that are yielded to a layout, given a
-      # name or a block.
+      # passed to a partial. Returns the contents that are yielded to a layout, given
+      # a name or a block.
       #
-      # You can think of a layout as a method that is called with a block. If the user calls
-      # <tt>yield :some_name</tt>, the block, by default, returns <tt>content_for(:some_name)</tt>.
-      # If the user calls simply +yield+, the default block returns <tt>content_for(:layout)</tt>.
+      # You can think of a layout as a method that is called with a block. If the user
+      # calls `yield :some_name`, the block, by default, returns
+      # `content_for(:some_name)`. If the user calls simply `yield`, the default block
+      # returns `content_for(:layout)`.
       #
       # The user can override this default by passing a block to the layout:
       #
-      #   # The template
-      #   <%= render layout: "my_layout" do %>
-      #     Content
-      #   <% end %>
+      #     # The template
+      #     <%= render layout: "my_layout" do %>
+      #       Content
+      #     <% end %>
       #
-      #   # The layout
-      #   <html>
-      #     <%= yield %>
-      #   </html>
+      #     # The layout
+      #     <html>
+      #       <%= yield %>
+      #     </html>
       #
-      # In this case, instead of the default block, which would return <tt>content_for(:layout)</tt>,
-      # this method returns the block that was passed in to <tt>render :layout</tt>, and the response
+      # In this case, instead of the default block, which would return `content_for(:layout)`,
+      # this method returns the block that was passed in to `render :layout`, and the response
       # would be
       #
-      #   <html>
-      #     Content
-      #   </html>
+      #     <html>
+      #       Content
+      #     </html>
       #
-      # Finally, the block can take block arguments, which can be passed in by +yield+:
+      # Finally, the block can take block arguments, which can be passed in by
+      # `yield`:
       #
-      #   # The template
-      #   <%= render layout: "my_layout" do |customer| %>
-      #     Hello <%= customer.name %>
-      #   <% end %>
+      #     # The template
+      #     <%= render layout: "my_layout" do |customer| %>
+      #       Hello <%= customer.name %>
+      #     <% end %>
       #
-      #   # The layout
-      #   <html>
-      #     <%= yield Struct.new(:name).new("David") %>
-      #   </html>
+      #     # The layout
+      #     <html>
+      #       <%= yield Struct.new(:name).new("David") %>
+      #     </html>
       #
-      # In this case, the layout would receive the block passed into <tt>render :layout</tt>,
+      # In this case, the layout would receive the block passed into `render :layout`,
       # and the struct specified would be passed into the block as an argument. The result
       # would be
       #
-      #   <html>
-      #     Hello David
-      #   </html>
+      #     <html>
+      #       Hello David
+      #     </html>
       #
       def _layout_for(*args, &block)
         name = args.first

data/lib/action_view/helpers/sanitize_helper.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/string/output_safety"
 require "rails-html-sanitizer"
 
 module ActionView
@@ -24,9 +25,18 @@ module ActionView
       #
       # Custom sanitization rules can also be provided.
       #
+      # <b>Warning</b>: Adding disallowed tags or attributes to the allowlists may introduce
+      # vulnerabilities into your application. Please rely on the default allowlists whenever
+      # possible, because they are curated to maintain security and safety. If you think that the
+      # default allowlists should be expanded, please {open an issue on the rails-html-sanitizer
+      # project}[https://github.com/rails/rails-html-sanitizer/issues].
+      #
       # Please note that sanitizing user-provided text does not guarantee that the
       # resulting markup is valid or even well-formed.
       #
+      # The output is markup, which is safe only as element content. Do not use it in an attribute
+      # value; use +strip_tags+ or a tag helper such as <tt>tag.a(title: ...)</tt> instead.
+      #
       # ==== Options
       #
       # [+:tags+]
@@ -131,7 +141,8 @@ module ActionView
       #   strip_tags("> A quote from Smith & Wesson")
       #   # => &gt; A quote from Smith &amp; Wesson
       def strip_tags(html)
-        self.class.full_sanitizer.sanitize(html)&.html_safe
+        stripped = self.class.full_sanitizer.sanitize(html)
+        ERB::Util.html_escape_once(stripped) if stripped
       end
 
       # Strips all link tags from +html+ leaving just the link text.

data/lib/action_view/helpers/tag_helper.rb

@@ -4,7 +4,6 @@ require "active_support/code_generator"
 require "active_support/core_ext/enumerable"
 require "active_support/core_ext/string/output_safety"
 require "active_support/core_ext/string/inflections"
-require "set"
 require "action_view/helpers/capture_helper"
 require "action_view/helpers/output_safety_helper"
 
@@ -45,51 +44,36 @@ module ActionView
       PRE_CONTENT_STRINGS["textarea"] = "\n"
 
       class TagBuilder # :nodoc:
-        include CaptureHelper
-        include OutputSafetyHelper
-
-        def self.define_element(name, code_generator:, method_name: name.to_s.underscore)
-          code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
-            batch.push(<<~RUBY) unless instance_methods.include?(method_name.to_sym)
-              def #{method_name}(content = nil, escape: true, **options, &block)
-                tag_string("#{name}", content, options, escape: escape, &block)
-              end
-            RUBY
+        def self.define_element(name, code_generator:, method_name: name)
+          return if method_defined?(name)
+
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(content = nil, escape: true, **options, &block)" <<
+              "  tag_string(#{name.inspect}, content, options, escape: escape, &block)" <<
+              "end"
           end
         end
 
-        def self.define_void_element(name, code_generator:, method_name: name.to_s.underscore)
-          code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
-            batch.push(<<~RUBY)
-              def #{method_name}(content = nil, escape: true, **options, &block)
-                if content || block
-                  ActionView.deprecator.warn <<~TEXT
-                    Putting content inside a void element (#{name}) is invalid
-                    according to the HTML5 spec, and so it is being deprecated
-                    without replacement. In Rails 8.0, passing content as a
-                    positional argument will raise, and using a block will have
-                    no effect.
-                  TEXT
-                  tag_string("#{name}", content, options, escape: escape, &block)
-                else
-                  self_closing_tag_string("#{name}", options, escape, ">")
-                end
-              end
-            RUBY
+        def self.define_void_element(name, code_generator:, method_name: name)
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(escape: true, **options, &block)" <<
+              "  self_closing_tag_string(#{name.inspect}, options, escape, '>')" <<
+              "end"
           end
         end
 
-        def self.define_self_closing_element(name, code_generator:, method_name: name.to_s.underscore)
-          code_generator.define_cached_method(method_name, namespace: :tag_builder) do |batch|
-            batch.push(<<~RUBY)
-              def #{method_name}(content = nil, escape: true, **options, &block)
-                if content || block
-                  tag_string("#{name}", content, options, escape: escape, &block)
-                else
-                  self_closing_tag_string("#{name}", options, escape)
-                end
-              end
-            RUBY
+        def self.define_self_closing_element(name, code_generator:, method_name: name)
+          code_generator.class_eval do |batch|
+            batch << "\n" <<
+              "def #{method_name}(content = nil, escape: true, **options, &block)" <<
+              "  if content || block" <<
+              "    tag_string(#{name.inspect}, content, options, escape: escape, &block)" <<
+              "  else" <<
+              "   self_closing_tag_string(#{name.inspect}, options, escape)" <<
+              "  end" <<
+              "end"
           end
         end
 
@@ -110,8 +94,8 @@ module ActionView
           define_void_element :wbr, code_generator: code_generator
 
           define_self_closing_element :animate, code_generator: code_generator
-          define_self_closing_element :animateMotion, code_generator: code_generator
-          define_self_closing_element :animateTransform, code_generator: code_generator
+          define_self_closing_element :animateMotion, code_generator: code_generator, method_name: :animate_motion
+          define_self_closing_element :animateTransform, code_generator: code_generator, method_name: :animate_transform
           define_self_closing_element :circle, code_generator: code_generator
           define_self_closing_element :ellipse, code_generator: code_generator
           define_self_closing_element :line, code_generator: code_generator
@@ -239,17 +223,7 @@ module ActionView
           tag_options(attributes.to_h).to_s.strip.html_safe
         end
 
-        def tag_string(name, content = nil, options, escape: true, &block)
-          content = @view_context.capture(self, &block) if block
-
-          content_tag_string(name, content, options, escape)
-        end
-
-        def self_closing_tag_string(name, options, escape = true, tag_suffix = " />")
-          "<#{name}#{tag_options(options, escape)}#{tag_suffix}".html_safe
-        end
-
-        def content_tag_string(name, content, options, escape = true)
+        def content_tag_string(name, content, options, escape = true) # :nodoc:
           tag_options = tag_options(options, escape) if options
 
           if escape && content.present?
@@ -258,73 +232,92 @@ module ActionView
           "<#{name}#{tag_options}>#{PRE_CONTENT_STRINGS[name]}#{content}</#{name}>".html_safe
         end
 
-        def tag_options(options, escape = true)
+        def tag_options(options, escape = true) # :nodoc:
           return if options.blank?
           output = +""
           sep    = " "
           options.each_pair do |key, value|
             next if key.blank?
 
+            name = Symbol === key ? key.name : key.to_s
+            next if name.blank?
+
             type = TAG_TYPES[key]
             if type == :data && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :aria && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 case v
                 when Array, Hash
                   tokens = TagHelper.build_tag_values(v)
                   next if tokens.none?
 
-                  v = safe_join(tokens, " ")
+                  v = @view_context.safe_join(tokens, " ")
                 else
                   v = v.to_s
                 end
 
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :boolean
               if value
                 output << sep
-                output << boolean_tag_option(key)
+                output << boolean_tag_option(name)
               end
             elsif !value.nil?
               output << sep
-              output << tag_option(key, value, escape)
+              output << tag_option(name, value, escape)
             end
           end
           output unless output.empty?
         end
 
-        def boolean_tag_option(key)
-          %(#{key}="#{key}")
-        end
+        private
+          def tag_string(name, content = nil, options, escape: true, &block)
+            content = @view_context.capture(self, &block) if block
 
-        def tag_option(key, value, escape)
-          key = ERB::Util.xml_name_escape(key) if escape
-
-          case value
-          when Array, Hash
-            value = TagHelper.build_tag_values(value) if key.to_s == "class"
-            value = escape ? safe_join(value, " ") : value.join(" ")
-          when Regexp
-            value = escape ? ERB::Util.unwrapped_html_escape(value.source) : value.source
-          else
-            value = escape ? ERB::Util.unwrapped_html_escape(value) : value.to_s
+            content_tag_string(name, content, options, escape)
           end
-          value = value.gsub('"', "&quot;") if value.include?('"')
 
-          %(#{key}="#{value}")
-        end
+          def self_closing_tag_string(name, options, escape = true, tag_suffix = " />")
+            "<#{name}#{tag_options(options, escape)}#{tag_suffix}".html_safe
+          end
+
+          def boolean_tag_option(key)
+            %(#{key}="#{key}")
+          end
+
+          def tag_option(key, value, escape)
+            key = ERB::Util.xml_name_escape(key) if escape
+
+            case value
+            when Array, Hash
+              value = TagHelper.build_tag_values(value) if key.to_s == "class"
+              value = escape ? @view_context.safe_join(value, " ") : value.join(" ")
+            when Regexp
+              value = escape ? ERB::Util.unwrapped_html_escape(value.source) : value.source
+            else
+              value = escape ? ERB::Util.unwrapped_html_escape(value) : value.to_s
+            end
+            value = value.gsub('"', "&quot;") if value.include?('"')
+
+            %(#{key}="#{value}")
+          end
 
-        private
           def prefix_tag_option(prefix, key, value, escape)
             key = "#{prefix}-#{key.to_s.dasherize}"
             unless value.is_a?(String) || value.is_a?(Symbol) || value.is_a?(BigDecimal)

data/lib/action_view/helpers/tags/base.rb

@@ -80,30 +80,32 @@ module ActionView
             end
           end
 
-          def add_default_name_and_id_for_value(tag_value, options)
+          def add_default_name_and_field_for_value(tag_value, options, field = "id")
             if tag_value.nil?
-              add_default_name_and_id(options)
+              add_default_name_and_field(options, field)
             else
-              specified_id = options["id"]
-              add_default_name_and_id(options)
+              specified_field = options[field]
+              add_default_name_and_field(options, field)
 
-              if specified_id.blank? && options["id"].present?
-                options["id"] += "_#{sanitized_value(tag_value)}"
+              if specified_field.blank? && options[field].present?
+                options[field] += "_#{sanitized_value(tag_value)}"
               end
             end
           end
+          alias_method :add_default_name_and_id_for_value, :add_default_name_and_field_for_value
 
-          def add_default_name_and_id(options)
+          def add_default_name_and_field(options, field = "id")
             index = name_and_id_index(options)
             options["name"] = options.fetch("name") { tag_name(options["multiple"], index) }
 
             if generate_ids?
-              options["id"] = options.fetch("id") { tag_id(index, options.delete("namespace")) }
+              options[field] = options.fetch(field) { tag_id(index, options.delete("namespace")) }
               if namespace = options.delete("namespace")
-                options["id"] = options["id"] ? "#{namespace}_#{options['id']}" : namespace
+                options[field] = options[field] ? "#{namespace}_#{options[field]}" : namespace
               end
             end
           end
+          alias_method :add_default_name_and_id, :add_default_name_and_field
 
           def tag_name(multiple = false, index = nil)
             @template_object.field_name(@object_name, sanitized_method_name, multiple: multiple, index: index)

data/lib/action_view/helpers/tags/check_box.rb

@@ -21,10 +21,10 @@ module ActionView
           options["checked"] = "checked" if input_checked?(options)
 
           if options["multiple"]
-            add_default_name_and_id_for_value(@checked_value, options)
+            add_default_name_and_field_for_value(@checked_value, options)
             options.delete("multiple")
           else
-            add_default_name_and_id(options)
+            add_default_name_and_field(options)
           end
 
           include_hidden = options.delete("include_hidden") { true }
@@ -57,7 +57,13 @@ module ActionView
           end
 
           def hidden_field_for_checkbox(options)
-            @unchecked_value ? tag("input", options.slice("name", "disabled", "form").merge!("type" => "hidden", "value" => @unchecked_value, "autocomplete" => "off")) : "".html_safe
+            if @unchecked_value
+              tag_options = options.slice("name", "disabled", "form").merge!("type" => "hidden", "value" => @unchecked_value)
+              tag_options["autocomplete"] = "off" unless ActionView::Base.remove_hidden_field_autocomplete
+              tag("input", tag_options)
+            else
+              "".html_safe
+            end
           end
       end
     end

data/lib/action_view/helpers/tags/collection_check_boxes.rb

@@ -10,12 +10,13 @@ module ActionView
         include FormOptionsHelper
 
         class CheckBoxBuilder < Builder # :nodoc:
-          def check_box(extra_html_options = {})
+          def checkbox(extra_html_options = {})
             html_options = extra_html_options.merge(@input_html_options)
             html_options[:multiple] = true
             html_options[:skip_default_ids] = false
-            @template_object.check_box(@object_name, @method_name, html_options, @value, nil)
+            @template_object.checkbox(@object_name, @method_name, html_options, @value, nil)
           end
+          alias_method :check_box, :checkbox
         end
 
         def render(&block)
@@ -24,7 +25,7 @@ module ActionView
 
         private
           def render_component(builder)
-            builder.check_box + builder.label
+            builder.checkbox + builder.label
           end
 
           def hidden_field_name

data/lib/action_view/helpers/tags/collection_helpers.rb

@@ -68,8 +68,18 @@ module ActionView
             html_options
           end
 
+          # Sanitize the attribute name used for the label's `for` attribute
+          # in collection helpers. When the value is nil or results in an
+          # empty sanitized string, skip the trailing underscore to match the
+          # id generated by add_default_name_and_id_for_value.
           def sanitize_attribute_name(value)
-            "#{sanitized_method_name}_#{sanitized_value(value)}"
+            sanitized = sanitized_value(value)
+
+            if sanitized.empty?
+              sanitized_method_name.dup
+            else
+              "#{sanitized_method_name}_#{sanitized}"
+            end
           end
 
           def render_collection

data/lib/action_view/helpers/tags/datetime_field.rb

@@ -6,7 +6,7 @@ module ActionView
       class DatetimeField < TextField # :nodoc:
         def render
           options = @options.stringify_keys
-          options["value"] = datetime_value(options["value"] || value)
+          options["value"] = datetime_value(options.fetch("value", value))
           options["min"] = format_datetime(parse_datetime(options["min"]))
           options["max"] = format_datetime(parse_datetime(options["max"]))
           @options = options