actionview 7.2.3.1 → 8.1.4.1

data/lib/action_view/helpers/tags/file_field.rb

@@ -6,8 +6,11 @@ module ActionView
       class FileField < TextField # :nodoc:
         def render
           include_hidden = @options.delete(:include_hidden)
+          if @options[:accept].is_a?(Array)
+            @options[:accept] = @options[:accept].join(",")
+          end
           options = @options.stringify_keys
-          add_default_name_and_id(options)
+          add_default_name_and_field(options)
 
           if options["multiple"] && include_hidden
             hidden_field_for_multiple_file(options) + super
@@ -18,7 +21,9 @@ module ActionView
 
         private
           def hidden_field_for_multiple_file(options)
-            tag("input", "name" => options["name"], "type" => "hidden", "value" => "", "autocomplete" => "off")
+            tag_options = { "name" => options["name"], "type" => "hidden", "value" => "" }
+            tag_options["autocomplete"] = "off" unless ActionView::Base.remove_hidden_field_autocomplete
+            tag("input", tag_options)
           end
       end
     end

data/lib/action_view/helpers/tags/hidden_field.rb

@@ -5,7 +5,7 @@ module ActionView
     module Tags # :nodoc:
       class HiddenField < TextField # :nodoc:
         def render
-          @options[:autocomplete] = "off"
+          @options.reverse_merge!(autocomplete: "off") unless ActionView::Base.remove_hidden_field_autocomplete
           super
         end
       end

data/lib/action_view/helpers/tags/label.rb

@@ -48,18 +48,11 @@ module ActionView
         def render(&block)
           options = @options.stringify_keys
           tag_value = options.delete("value")
-          name_and_id = options.dup
 
-          if name_and_id["for"]
-            name_and_id["id"] = name_and_id["for"]
-          else
-            name_and_id.delete("id")
-          end
-
-          add_default_name_and_id_for_value(tag_value, name_and_id)
+          add_default_name_and_field_for_value(tag_value, options, "for")
           options.delete("index")
+          options.delete("name")
           options.delete("namespace")
-          options["for"] = name_and_id["id"] unless options.key?("for")
 
           builder = LabelBuilder.new(@template_object, @object_name, @method_name, @object, tag_value)
 
@@ -71,7 +64,7 @@ module ActionView
             render_component(builder)
           end
 
-          label_tag(name_and_id["id"], content, options)
+          label_tag(options["for"], content, options)
         end
 
         private

data/lib/action_view/helpers/tags/radio_button.rb

@@ -18,7 +18,7 @@ module ActionView
           options["type"]     = "radio"
           options["value"]    = @tag_value
           options["checked"] = "checked" if input_checked?(options)
-          add_default_name_and_id_for_value(@tag_value, options)
+          add_default_name_and_field_for_value(@tag_value, options)
           tag("input", options)
         end
 

data/lib/action_view/helpers/tags/select.rb

@@ -37,7 +37,12 @@ module ActionView
           #   [nil, []]
           #   { nil => [] }
           def grouped_choices?
-            !@choices.blank? && @choices.first.respond_to?(:second) && Array === @choices.first.second
+            return false if @choices.blank?
+
+            first_choice = @choices.first
+            return false unless first_choice.is_a?(Enumerable)
+
+            first_choice.second.is_a?(Array)
           end
       end
     end

data/lib/action_view/helpers/tags/select_renderer.rb

@@ -11,7 +11,7 @@ module ActionView
               html_options[prop.to_s] = options.delete(prop) if options.key?(prop) && !html_options.key?(prop.to_s)
             end
 
-            add_default_name_and_id(html_options)
+            add_default_name_and_field(html_options)
 
             if placeholder_required?(html_options)
               raise ArgumentError, "include_blank cannot be false for a required field." if options[:include_blank] == false
@@ -22,7 +22,9 @@ module ActionView
             select = content_tag("select", add_options(option_tags, options, value), html_options)
 
             if html_options["multiple"] && options.fetch(:include_hidden, true)
-              tag("input", disabled: html_options["disabled"], name: html_options["name"], type: "hidden", value: "", autocomplete: "off") + select
+              tag_options = { disabled: html_options["disabled"], name: html_options["name"], type: "hidden", value: "" }
+              tag_options[:autocomplete] = "off" unless ActionView::Base.remove_hidden_field_autocomplete
+              tag("input", tag_options) + select
             else
               select
             end
@@ -37,7 +39,7 @@ module ActionView
             if options[:include_blank]
               content = (options[:include_blank] if options[:include_blank].is_a?(String))
               label = (" " unless content)
-              option_tags = tag_builder.content_tag_string("option", content, value: "", label: label) + "\n" + option_tags
+              option_tags = tag_builder.option(content, value: "", label: label) + "\n" + option_tags
             end
 
             if value.blank? && options[:prompt]
@@ -45,7 +47,7 @@ module ActionView
                 prompt_opts[:disabled] = true if options[:disabled] == ""
                 prompt_opts[:selected] = true if options[:selected] == ""
               end
-              option_tags = tag_builder.content_tag_string("option", prompt_text(options[:prompt]), tag_options) + "\n" + option_tags
+              option_tags = tag_builder.option(prompt_text(options[:prompt]), **tag_options) + "\n" + option_tags
             end
 
             option_tags

data/lib/action_view/helpers/tags/text_area.rb

@@ -10,7 +10,7 @@ module ActionView
 
         def render
           options = @options.stringify_keys
-          add_default_name_and_id(options)
+          add_default_name_and_field(options)
 
           if size = options.delete("size")
             options["cols"], options["rows"] = size.split("x") if size.respond_to?(:split)

data/lib/action_view/helpers/tags/text_field.rb

@@ -13,7 +13,7 @@ module ActionView
           options["size"] = options["maxlength"] unless options.key?("size")
           options["type"] ||= field_type
           options["value"] = options.fetch("value") { value_before_type_cast } unless field_type == "file"
-          add_default_name_and_id(options)
+          add_default_name_and_field(options)
           tag("input", options)
         end
 

data/lib/action_view/helpers/tags/week_field.rb

@@ -6,7 +6,7 @@ module ActionView
       class WeekField < DatetimeField # :nodoc:
         private
           def format_datetime(value)
-            value&.strftime("%Y-W%V")
+            value&.strftime("%G-W%V")
           end
       end
     end

data/lib/action_view/helpers/text_helper.rb

@@ -143,8 +143,15 @@ module ActionView
       #
       # [+:highlighter+]
       #   The highlighter string. Uses <tt>\1</tt> as the placeholder for a
-      #   phrase, similar to +String#sub+. Defaults to <tt>"<mark>\1</mark>"</tt>.
-      #   This option is ignored if a block is specified.
+      #   phrase. Defaults to <tt>"<mark>\1</mark>"</tt>. The numbered placeholders
+      #   <tt>\0</tt> to <tt>\9</tt> are expanded; other +String#sub+ replacement escapes
+      #   are not. The phrase is HTML escaped, quotes included. This option
+      #   is ignored if a block is specified.
+      #
+      #   WARNING: Put a placeholder only in element content or inside a
+      #   quoted attribute value. HTML escaping does not make the phrase safe
+      #   in an unquoted attribute value, in a URL, JavaScript or CSS
+      #   context, or in an attribute whose value is HTML, such as +srcdoc+.
       #
       # [+:sanitize+]
       #   Whether to sanitize +text+ before highlighting. Defaults to true.
@@ -163,8 +170,8 @@ module ActionView
       #   highlight('You searched for: rails', ['for', 'rails'], highlighter: '<em>\1</em>')
       #   # => "You searched <em>for</em>: <em>rails</em>"
       #
-      #   highlight('You searched for: rails', 'rails', highlighter: '<a href="search?q=\1">\1</a>')
-      #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
+      #   highlight('You searched for: rails', 'rails', highlighter: '<mark title="\1">\1</mark>')
+      #   # => "You searched for: <mark title=\"rails\">rails</mark>"
       #
       #   highlight('You searched for: rails', 'rails') { |match| link_to(search_path(q: match)) }
       #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
@@ -179,14 +186,23 @@ module ActionView
         else
           patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
           pattern = /(#{patterns.join("|")})/i
+          # The text after a tag begins with the ">" that closes it. Leave it
+          # in the segment so phrases can see it as context, but keep it out
+          # of the match so the highlighter can't take the place of the ">".
+          pattern_after_tag = /(?!\A)#{pattern}/
           highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block
 
-          text.scan(/<[^>]*|[^<]+/).each do |segment|
+          text.scan(/<[^>]*|[^<]+/).each_with_index do |segment, index|
             if !segment.start_with?("<")
+              segment_pattern = index > 0 ? pattern_after_tag : pattern
+
               if block
-                segment.gsub!(pattern, &block)
+                segment.gsub!(segment_pattern, &block)
               else
-                segment.gsub!(pattern, highlighter)
+                segment.gsub!(segment_pattern) do
+                  match = Regexp.last_match
+                  highlighter.gsub(/\\(\d)/) { ERB::Util.html_escape_once(match[$1.to_i]) }
+                end
               end
             end
           end.join

data/lib/action_view/helpers/translation_helper.rb

@@ -140,7 +140,12 @@ module ActionView
         end
 
         def missing_translation(key, options)
-          keys = I18n.normalize_keys(options[:locale] || I18n.locale, key, options[:scope])
+          locale = options[:locale] || I18n.locale
+
+          i18n_exception = I18n::MissingTranslation.new(locale, key, options)
+          I18n.exception_handler.call(i18n_exception, locale, key, options)
+
+          keys = I18n.normalize_keys(locale, key, options[:scope])
 
           title = +"translation missing: #{keys.join(".")}"
 

data/lib/action_view/helpers/url_helper.rb

@@ -341,8 +341,9 @@ module ActionView
         inner_tags = method_tag.safe_concat(button).safe_concat(request_token_tag)
         if params
           to_form_params(params).each do |param|
-            inner_tags.safe_concat tag(:input, type: "hidden", name: param[:name], value: param[:value],
-                                       autocomplete: "off")
+            options = { type: "hidden", name: param[:name], value: param[:value] }
+            options[:autocomplete] = "off" unless ActionView::Base.remove_hidden_field_autocomplete
+            inner_tags.safe_concat tag(:input, **options)
           end
         end
         html = content_tag("form", inner_tags, form_options)
@@ -500,8 +501,6 @@ module ActionView
         content_tag("a", name || email_address, html_options, &block)
       end
 
-      RFC2396_PARSER = defined?(URI::RFC2396_PARSER) ? URI::RFC2396_PARSER : URI::RFC2396_Parser.new
-
       # True if the current request URI was generated by the given +options+.
       #
       # ==== Examples
@@ -540,32 +539,55 @@ module ActionView
       #   current_page?('http://www.example.com/shop/checkout?order=desc&page=1')
       #   # => true
       #
-      # Let's say we're in the <tt>http://www.example.com/products</tt> action with method POST in case of invalid product.
+      # Different actions may share the same URL path but have a different HTTP method. Let's say we
+      # sent a POST to <tt>http://www.example.com/products</tt> and rendered a validation error.
       #
       #   current_page?(controller: 'product', action: 'index')
       #   # => false
       #
+      #   current_page?(controller: 'product', action: 'create')
+      #   # => false
+      #
+      #   current_page?(controller: 'product', action: 'create', method: :post)
+      #   # => true
+      #
+      #   current_page?(controller: 'product', action: 'index', method: [:get, :post])
+      #   # => true
+      #
       # We can also pass in the symbol arguments instead of strings.
       #
-      def current_page?(options = nil, check_parameters: false, **options_as_kwargs)
+      def current_page?(options = nil, check_parameters: false, method: :get, **options_as_kwargs)
         unless request
           raise "You cannot use helpers that need to determine the current " \
                 "page unless your view context provides a Request object " \
                 "in a #request method"
         end
 
-        return false unless request.get? || request.head?
+        if options.is_a?(Hash)
+          check_parameters = options.delete(:check_parameters) { check_parameters }
+          method = options.delete(:method) { method }
+        else
+          options ||= options_as_kwargs
+        end
+
+        method_matches = case method
+        when :get
+          request.get? || request.head?
+        when Array
+          method.include?(request.method_symbol) || (method.include?(:get) && request.head?)
+        else
+          method == request.method_symbol
+        end
+        return false unless method_matches
 
-        options ||= options_as_kwargs
-        check_parameters ||= options.is_a?(Hash) && options.delete(:check_parameters)
-        url_string = RFC2396_PARSER.unescape(url_for(options)).force_encoding(Encoding::BINARY)
+        url_string = URI::RFC2396_PARSER.unescape(url_for(options)).force_encoding(Encoding::BINARY)
 
         # We ignore any extra parameters in the request_uri if the
         # submitted URL doesn't have any either. This lets the function
         # work with things like ?order=asc
         # the behavior can be disabled with check_parameters: true
         request_uri = url_string.index("?") || check_parameters ? request.fullpath : request.path
-        request_uri = RFC2396_PARSER.unescape(request_uri).force_encoding(Encoding::BINARY)
+        request_uri = URI::RFC2396_PARSER.unescape(request_uri).force_encoding(Encoding::BINARY)
 
         if %r{^\w+://}.match?(url_string)
           request_uri = +"#{request.protocol}#{request.host_with_port}#{request_uri}"
@@ -753,14 +775,18 @@ module ActionView
               else
                 token
               end
-            tag(:input, type: "hidden", name: request_forgery_protection_token.to_s, value: token, autocomplete: "off")
+            options = { type: "hidden", name: request_forgery_protection_token.to_s, value: token }
+            options[:autocomplete] = "off" unless ActionView::Base.remove_hidden_field_autocomplete
+            tag(:input, **options)
           else
             ""
           end
         end
 
         def method_tag(method)
-          tag("input", type: "hidden", name: "_method", value: method.to_s, autocomplete: "off")
+          options = { type: "hidden", name: "_method", value: method.to_s }
+          options[:autocomplete] = "off" unless ActionView::Base.remove_hidden_field_autocomplete
+          tag("input", **options)
         end
 
         # Returns an array of hashes each containing :name and :value keys

data/lib/action_view/layouts.rb

@@ -347,7 +347,7 @@ module ActionView
         end
     end
 
-    def _normalize_options(options) # :nodoc:
+    def _process_render_template_options(options) # :nodoc:
       super
 
       if _include_layout?(options)

data/lib/action_view/locale/en.yml

@@ -43,6 +43,9 @@
       hour:   "Hour"
       minute: "Minute"
       second: "Seconds"
+    relative:
+      future: "in %{time}"
+      past: "%{time} ago"
 
   helpers:
     select:

data/lib/action_view/log_subscriber.rb

@@ -3,10 +3,7 @@
 require "active_support/log_subscriber"
 
 module ActionView
-  # = Action View Log Subscriber
-  #
-  # Provides functionality so that \Rails can output logs from Action View.
-  class LogSubscriber < ActiveSupport::LogSubscriber
+  class LogSubscriber < ActiveSupport::LogSubscriber # :nodoc:
     VIEWS_PATTERN = /^app\/views\//
 
     def initialize

data/lib/action_view/railtie.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require "action_view"
 require "rails"
+require "action_view"
 
 module ActionView
   # = Action View Railtie
@@ -71,9 +71,16 @@ module ActionView
       ActionView::Helpers::AssetTagHelper.apply_stylesheet_media_default = app.config.action_view.delete(:apply_stylesheet_media_default)
     end
 
+    config.after_initialize do |app|
+      ActionView::Helpers::AssetTagHelper.auto_include_nonce_for_scripts = app.config.content_security_policy_nonce_auto && app.config.content_security_policy_nonce_directives.intersect?(["script-src", "script-src-elem", "script-src-attr"]) && app.config.content_security_policy_nonce_generator.present?
+      ActionView::Helpers::AssetTagHelper.auto_include_nonce_for_styles = app.config.content_security_policy_nonce_auto && app.config.content_security_policy_nonce_directives.intersect?(["style-src", "style-src-elem", "style-src-attr"]) && app.config.content_security_policy_nonce_generator.present?
+      ActionView::Helpers::JavaScriptHelper.auto_include_nonce = app.config.content_security_policy_nonce_auto && app.config.content_security_policy_nonce_directives.intersect?(["script-src", "script-src-elem", "script-src-attr"]) && app.config.content_security_policy_nonce_generator.present?
+    end
+
     config.after_initialize do |app|
       ActiveSupport.on_load(:action_view) do
         app.config.action_view.each do |k, v|
+          next if k == :render_tracker
           send "#{k}=", v
         end
       end
@@ -95,6 +102,10 @@ module ActionView
       end
     end
 
+    initializer "action_view.set_render_tracker" do |app|
+      ActionView.render_tracker = app.config.action_view.render_tracker
+    end
+
     initializer "action_view.setup_action_pack" do |app|
       ActiveSupport.on_load(:action_controller) do
         ActionView::RoutingUrlFor.include(ActionDispatch::Routing::UrlFor)

data/lib/action_view/record_identifier.rb

@@ -11,7 +11,7 @@ module ActionView
   #
   # Consider for example the following code that form of post:
   #
-  #   <%= form_for(post) do |f| %>
+  #   <%= form_with(model: post) do |f| %>
   #     <%= f.text_field :body %>
   #   <% end %>
   #
@@ -101,6 +101,27 @@ module ActionView
       end
     end
 
+    # The DOM target convention is to concatenate any number of parameters into a string.
+    # Records are passed through dom_id, while string and symbols are retained.
+    #
+    #   dom_target(Post.find(45))                  # => "post_45"
+    #   dom_target(Post.find(45), :edit)           # => "post_45_edit"
+    #   dom_target(Post.find(45), :edit, :special) # => "post_45_edit_special"
+    #   dom_target(Post.find(45), Comment.find(1)) # => "post_45_comment_1"
+    def dom_target(*objects)
+      objects.map! do |object|
+        case object
+        when Symbol, String
+          object
+        when Class
+          dom_class(object)
+        else
+          dom_id(object)
+        end
+      end
+      objects.join(JOIN)
+    end
+
   private
     # Returns a string representation of the key attribute(s) that is suitable for use in an HTML DOM id.
     # This can be overwritten to customize the default generated string representation if desired.

data/lib/action_view/render_parser/prism_render_parser.rb

@@ -97,9 +97,21 @@ module ActionView
         def render_call_template(node)
           object_template = false
           template =
-            if node.is_a?(Prism::StringNode)
+            case node.type
+            when :string_node
               path = node.unescaped
               path.include?("/") ? path : "#{directory}/#{path}"
+            when :interpolated_string_node
+              node.parts.map do |node|
+                case node.type
+                when :string_node
+                  node.unescaped
+                when :embedded_statements_node
+                  "*"
+                else
+                  return
+                end
+              end.join("")
             else
               dependency =
                 case node.type

data/lib/action_view/render_parser/ripper_render_parser.rb

@@ -66,7 +66,16 @@ module ActionView
 
         def to_string
           raise unless string?
-          self[0][0][0]
+
+          # s(:string_literal, s(:string_content, map))
+          self[0].map do |node|
+            case node.type
+            when :@tstring_content
+              node[0]
+            when :string_embexpr
+              "*"
+            end
+          end.join("")
         end
 
         def hash?

data/lib/action_view/renderer/partial_renderer/collection_caching.rb

@@ -111,7 +111,11 @@ module ActionView
         end
 
         unless entries_to_write.empty?
-          collection_cache.write_multi(entries_to_write)
+          if @options[:cached].is_a?(Hash) && @options[:cached].key?(:expires_in)
+            collection_cache.write_multi(entries_to_write, expires_in: @options[:cached][:expires_in])
+          else
+            collection_cache.write_multi(entries_to_write)
+          end
         end
 
         keyed_partials

data/lib/action_view/renderer/partial_renderer.rb

@@ -48,6 +48,22 @@ module ActionView
   #
   #   <%= render partial: "account", locals: { user: @buyer } %>
   #
+  # == \Rendering variants of a partial
+  #
+  # The <tt>:variants</tt> option can be used to render a different template variant of a partial. For instance:
+  #
+  #   <%= render partial: "account", variants: :mobile %>
+  #
+  # This will render <tt>_account.html+mobile.erb</tt>. This option also accepts multiple variants
+  # like so:
+  #
+  #   <%= render partial: "account", variants: [:desktop, :mobile] %>
+  #
+  # This will look for the following templates and render the first one that exists:
+  # * <tt>_account.html+desktop.erb</tt>
+  # * <tt>_account.html+mobile.erb</tt>
+  # * <tt>_account.html.erb</tt>
+  #
   # == \Rendering a collection of partials
   #
   # The example of partial use describes a familiar pattern where a template needs to iterate over an array and

data/lib/action_view/renderer/streaming_template_renderer.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "fiber"
 
 module ActionView
   # == TODO
@@ -26,6 +25,13 @@ module ActionView
         self
       end
 
+      # Returns the complete body as a string.
+      def body
+        buffer = String.new
+        each { |part| buffer << part }
+        buffer
+      end
+
       private
         # This is the same logging logic as in ShowExceptions middleware.
         def log_error(exception)
@@ -43,7 +49,7 @@ module ActionView
     # object that responds to each. This object is initialized with a block
     # that knows how to render the template.
     def render_template(view, template, layout_name = nil, locals = {}) # :nodoc:
-      return [super.body] unless layout_name && template.supports_streaming?
+      return [super.body] unless template.supports_streaming?
 
       locals ||= {}
       layout   = find_layout(layout_name, locals.keys, [formats.first])

data/lib/action_view/rendering.rb

@@ -118,6 +118,7 @@ module ActionView
 
     def render_to_body(options = {})
       _process_options(options)
+      _process_render_template_options(options)
       _render_template(options)
     end
 
@@ -173,8 +174,7 @@ module ActionView
       end
 
       # Normalize options.
-      def _normalize_options(options)
-        options = super(options)
+      def _process_render_template_options(options)
         if options[:partial] == true
           options[:partial] = action_name
         end
@@ -184,7 +184,6 @@ module ActionView
         end
 
         options[:template] ||= (options[:action] || action_name).to_s
-        options
       end
   end
 end