actionview 8.0.5.1 → 8.0.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6becd57141c14751ac9c81523a74a89deeec51e5a78cefc6c1586867ff7a248
-  data.tar.gz: a862b25aeb7af37f1527e75eeff3e7f8fc849bb9dd1d292cbeb6126bdae5cbe5
+  metadata.gz: 9e3471ef52672292ca9950c0497300061713104fb75abdef2eaa69c392dce1e3
+  data.tar.gz: 1d2084723d63c509f943eb60763e877fa0f3a0ef4926142ffdda8f40fae7b05a
 SHA512:
-  metadata.gz: 2e1c60bbfcdd1890aa638dfb91d0d23c9dbb96e9e8e3cb25c0f5fcaf1a515aa8742533b1b1a7118e0fa72aedac4684b4983ffb9e7e0a9a15f0ba71a31e99d2e8
-  data.tar.gz: bcef9b6b3e9a471418abe8d92608ddee030953fd903a93c9fb3b2aba1c7e8e7da03f10fd927944961eb1fcd0cc4047afaac7f13f99a8dfa1f304a2bc8cdf9828
+  metadata.gz: 9ba7329d06db4fc19fbd97773acbe78a9355a8d6977067d7a4d08c088eaa39d35c8574ebedce3b83955583fd82d6694b503b2383ab870dfd3504506ea2b88bfb
+  data.tar.gz: 27c64c7e736a6ce282011a1e61230856d40a191fb7cce7f6a3095570ad9c309c6b25dbfc5241156ea9214f063f5d5da16eeae2e8e62f1f673365df6db5af7683

data/CHANGELOG.md

@@ -1,3 +1,59 @@
+## Rails 8.0.5.2 (November 03, 2026) ##
+
+*   Skip attribute names in tag helpers that are blank once converted to a
+    string.
+
+    A Symbol such as `:" "` is not blank, because `Symbol#blank?` is
+    `Symbol#empty?`, so it reached the escaping step and produced an attribute
+    with no name. The asset helpers symbolize their keys, so an ordinary String
+    key reached the same place.
+
+    [GHSA-68p9-83h6-5wpj]
+
+    *Mike Dalessio*
+
+*   Fix `strip_tags` to encode `"` and `'` in its output.
+
+    `strip_tags` returns an `html_safe` string, but was not encoding quotation
+    marks. The method now encodes all five HTML-significant characters (`&`,
+    `<`, `>`, `"`, `'`), consistent with the existing `html_safe` convention.
+
+    Output used outside HTML, such as in a text template or JSON, now contains
+    `&quot;` and `&#39;` where it contained `"` and `'`. `CGI.unescapeHTML`
+    decodes them.
+
+    [GHSA-rq8q-p985-fjq7]
+
+    *Mike Dalessio*
+
+*   Escape the matched phrase before substituting it into `highlight`'s
+    `:highlighter`.
+
+    A match was copied into each `\1` of the highlighter as it appeared in
+    the sanitized text, which keeps `"` and `'` as they are, so a match
+    containing a quote ended a quoted attribute value such as the
+    documented `'<a href="search?q=\1">\1</a>'` and added attributes of
+    its own. Each substituted group now goes through
+    `ERB::Util.html_escape_once`, so quotes in a match render as `&quot;`
+    and `&#39;`. Only the numbered placeholders `\0` to `\9` are expanded,
+    and a match never replaces the `>` that closes a tag.
+
+    [GHSA-v6rj-xm57-3p59]
+
+    *Jeremy Daer*
+
+*   Require rails-html-sanitizer 1.7.2 or later.
+
+    With the HTML5 sanitizer, Nokogiri before 1.19.5 left `<` and `>`
+    unescaped in attribute values. `highlight` and `simple_format`, which
+    edit the sanitized HTML as a string, could then turn markup inside an
+    attribute value into live elements. rails-html-sanitizer 1.7.2 requires
+    Loofah 2.25.3, which requires Nokogiri 1.19.5.
+
+    [GHSA-2p2f-4rq4-gjwc]
+
+    *Mike Dalessio*
+
 ## Rails 8.0.5.1 (July 29, 2026) ##
 
 *   No changes.

data/lib/action_view/gem_version.rb

@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 8
     MINOR = 0
     TINY  = 5
-    PRE   = "1"
+    PRE   = "2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/helpers/sanitize_helper.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/string/output_safety"
 require "rails-html-sanitizer"
 
 module ActionView
@@ -33,6 +34,9 @@ module ActionView
       # Please note that sanitizing user-provided text does not guarantee that the
       # resulting markup is valid or even well-formed.
       #
+      # The output is markup, which is safe only as element content. Do not use it in an attribute
+      # value; use +strip_tags+ or a tag helper such as <tt>tag.a(title: ...)</tt> instead.
+      #
       # ==== Options
       #
       # [+:tags+]
@@ -137,7 +141,8 @@ module ActionView
       #   strip_tags("> A quote from Smith & Wesson")
       #   # => &gt; A quote from Smith &amp; Wesson
       def strip_tags(html)
-        self.class.full_sanitizer.sanitize(html)&.html_safe
+        stripped = self.class.full_sanitizer.sanitize(html)
+        ERB::Util.html_escape_once(stripped) if stripped
       end
 
       # Strips all link tags from +html+ leaving just the link text.

data/lib/action_view/helpers/tag_helper.rb

@@ -252,18 +252,27 @@ module ActionView
           options.each_pair do |key, value|
             next if key.blank?
 
+            name = Symbol === key ? key.name : key.to_s
+            next if name.blank?
+
             type = TAG_TYPES[key]
             if type == :data && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :aria && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 case v
                 when Array, Hash
                   tokens = TagHelper.build_tag_values(v)
@@ -275,16 +284,16 @@ module ActionView
                 end
 
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :boolean
               if value
                 output << sep
-                output << boolean_tag_option(key)
+                output << boolean_tag_option(name)
               end
             elsif !value.nil?
               output << sep
-              output << tag_option(key, value, escape)
+              output << tag_option(name, value, escape)
             end
           end
           output unless output.empty?

data/lib/action_view/helpers/text_helper.rb

@@ -143,8 +143,15 @@ module ActionView
       #
       # [+:highlighter+]
       #   The highlighter string. Uses <tt>\1</tt> as the placeholder for a
-      #   phrase, similar to +String#sub+. Defaults to <tt>"<mark>\1</mark>"</tt>.
-      #   This option is ignored if a block is specified.
+      #   phrase. Defaults to <tt>"<mark>\1</mark>"</tt>. The numbered placeholders
+      #   <tt>\0</tt> to <tt>\9</tt> are expanded; other +String#sub+ replacement escapes
+      #   are not. The phrase is HTML escaped, quotes included. This option
+      #   is ignored if a block is specified.
+      #
+      #   WARNING: Put a placeholder only in element content or inside a
+      #   quoted attribute value. HTML escaping does not make the phrase safe
+      #   in an unquoted attribute value, in a URL, JavaScript or CSS
+      #   context, or in an attribute whose value is HTML, such as +srcdoc+.
       #
       # [+:sanitize+]
       #   Whether to sanitize +text+ before highlighting. Defaults to true.
@@ -163,8 +170,8 @@ module ActionView
       #   highlight('You searched for: rails', ['for', 'rails'], highlighter: '<em>\1</em>')
       #   # => "You searched <em>for</em>: <em>rails</em>"
       #
-      #   highlight('You searched for: rails', 'rails', highlighter: '<a href="search?q=\1">\1</a>')
-      #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
+      #   highlight('You searched for: rails', 'rails', highlighter: '<mark title="\1">\1</mark>')
+      #   # => "You searched for: <mark title=\"rails\">rails</mark>"
       #
       #   highlight('You searched for: rails', 'rails') { |match| link_to(search_path(q: match)) }
       #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
@@ -179,14 +186,23 @@ module ActionView
         else
           patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
           pattern = /(#{patterns.join("|")})/i
+          # The text after a tag begins with the ">" that closes it. Leave it
+          # in the segment so phrases can see it as context, but keep it out
+          # of the match so the highlighter can't take the place of the ">".
+          pattern_after_tag = /(?!\A)#{pattern}/
           highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block
 
-          text.scan(/<[^>]*|[^<]+/).each do |segment|
+          text.scan(/<[^>]*|[^<]+/).each_with_index do |segment, index|
             if !segment.start_with?("<")
+              segment_pattern = index > 0 ? pattern_after_tag : pattern
+
               if block
-                segment.gsub!(pattern, &block)
+                segment.gsub!(segment_pattern, &block)
               else
-                segment.gsub!(pattern, highlighter)
+                segment.gsub!(segment_pattern) do
+                  match = Regexp.last_match
+                  highlighter.gsub(/\\(\d)/) { ERB::Util.html_escape_once(match[$1.to_i]) }
+                end
               end
             end
           end.join

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 8.0.5.1
+  version: 8.0.5.2
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.5.1
+        version: 8.0.5.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.5.1
+        version: 8.0.5.2
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -58,6 +58,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -65,6 +68,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.2
 - !ruby/object:Gem::Dependency
   name: rails-dom-testing
   requirement: !ruby/object:Gem::Requirement
@@ -85,28 +91,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.5.1
+        version: 8.0.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.5.1
+        version: 8.0.5.2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.5.1
+        version: 8.0.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.0.5.1
+        version: 8.0.5.2
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -246,10 +252,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.0.5.1/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.0.5.1/
+  changelog_uri: https://github.com/rails/rails/blob/v8.0.5.2/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.0.5.2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.0.5.1/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v8.0.5.2/actionview
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -266,7 +272,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).
 test_files: []