actionview 8.1.4 → 8.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bdc26346ea4cdff80ced71eaf5b63f7ab95815f92d4944ca5b554f5dc2092c98
-  data.tar.gz: 148985bc4e994851ecef0b9a3cb80fd3e7701b4da44739952797a137863e7148
+  metadata.gz: 4ad9b7f3e9b8677cd772d696b4056bda5f44b3cb2074877698060d83eeb8f501
+  data.tar.gz: 6d484d054ced5d8990d0ae4b8134879eb192fea59540f8c6f1dd112ed946ec06
 SHA512:
-  metadata.gz: 15f9fac8e9a8deea4e2ee57df40cd968a36c483e4701a3983e0bb078a2bfcbc5b561d20b5c40fb9cc70977489730f2f77fa377d8332df146d74030feb07ff5ac
-  data.tar.gz: b40f142e9d6f4597f42f66d2fcb2395e882f2eabcab216ef53c013f0c245e2c6b9e9d8fb5efae7b89b9efd20a1cef6e0611b9574c79035959e14247c99ef0240
+  metadata.gz: 47f094fac7bbc29736cf46dcaa570b42d25cdee803cdd522ae81e37a8351f029991b82099a3d4b64c253ae396412e1f112feb509f2e941f4bf806bcab4a95272
+  data.tar.gz: 07ee062127ab3554407ea34d293611e347789e5cd65012340302b7a690e18b01ce6630d85483be9eb5e575869df10a3808891ebd98d14ceb674499acdf904594

data/CHANGELOG.md

@@ -1,3 +1,59 @@
+## Rails 8.1.4.1 (November 03, 2026) ##
+
+*   Skip attribute names in tag helpers that are blank once converted to a
+    string.
+
+    A Symbol such as `:" "` is not blank, because `Symbol#blank?` is
+    `Symbol#empty?`, so it reached the escaping step and produced an attribute
+    with no name. The asset helpers symbolize their keys, so an ordinary String
+    key reached the same place.
+
+    [GHSA-68p9-83h6-5wpj]
+
+    *Mike Dalessio*
+
+*   Fix `strip_tags` to encode `"` and `'` in its output.
+
+    `strip_tags` returns an `html_safe` string, but was not encoding quotation
+    marks. The method now encodes all five HTML-significant characters (`&`,
+    `<`, `>`, `"`, `'`), consistent with the existing `html_safe` convention.
+
+    Output used outside HTML, such as in a text template or JSON, now contains
+    `&quot;` and `&#39;` where it contained `"` and `'`. `CGI.unescapeHTML`
+    decodes them.
+
+    [GHSA-rq8q-p985-fjq7]
+
+    *Mike Dalessio*
+
+*   Escape the matched phrase before substituting it into `highlight`'s
+    `:highlighter`.
+
+    A match was copied into each `\1` of the highlighter as it appeared in
+    the sanitized text, which keeps `"` and `'` as they are, so a match
+    containing a quote ended a quoted attribute value such as the
+    documented `'<a href="search?q=\1">\1</a>'` and added attributes of
+    its own. Each substituted group now goes through
+    `ERB::Util.html_escape_once`, so quotes in a match render as `&quot;`
+    and `&#39;`. Only the numbered placeholders `\0` to `\9` are expanded,
+    and a match never replaces the `>` that closes a tag.
+
+    [GHSA-v6rj-xm57-3p59]
+
+    *Jeremy Daer*
+
+*   Require rails-html-sanitizer 1.7.2 or later.
+
+    With the HTML5 sanitizer, Nokogiri before 1.19.5 left `<` and `>`
+    unescaped in attribute values. `highlight` and `simple_format`, which
+    edit the sanitized HTML as a string, could then turn markup inside an
+    attribute value into live elements. rails-html-sanitizer 1.7.2 requires
+    Loofah 2.25.3, which requires Nokogiri 1.19.5.
+
+    [GHSA-2p2f-4rq4-gjwc]
+
+    *Mike Dalessio*
+
 ## Rails 8.1.4 (September 24, 2026) ##
 
 *   Fix non-ASCII strict locals defaults rendering as mojibake.

data/lib/action_view/gem_version.rb

@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 8
     MINOR = 1
     TINY  = 4
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/helpers/sanitize_helper.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/string/output_safety"
 require "rails-html-sanitizer"
 
 module ActionView
@@ -33,6 +34,9 @@ module ActionView
       # Please note that sanitizing user-provided text does not guarantee that the
       # resulting markup is valid or even well-formed.
       #
+      # The output is markup, which is safe only as element content. Do not use it in an attribute
+      # value; use +strip_tags+ or a tag helper such as <tt>tag.a(title: ...)</tt> instead.
+      #
       # ==== Options
       #
       # [+:tags+]
@@ -137,7 +141,8 @@ module ActionView
       #   strip_tags("> A quote from Smith & Wesson")
       #   # => &gt; A quote from Smith &amp; Wesson
       def strip_tags(html)
-        self.class.full_sanitizer.sanitize(html)&.html_safe
+        stripped = self.class.full_sanitizer.sanitize(html)
+        ERB::Util.html_escape_once(stripped) if stripped
       end
 
       # Strips all link tags from +html+ leaving just the link text.

data/lib/action_view/helpers/tag_helper.rb

@@ -239,18 +239,27 @@ module ActionView
           options.each_pair do |key, value|
             next if key.blank?
 
+            name = Symbol === key ? key.name : key.to_s
+            next if name.blank?
+
             type = TAG_TYPES[key]
             if type == :data && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :aria && value.is_a?(Hash)
               value.each_pair do |k, v|
                 next if k.blank? || v.nil?
 
+                nested_name = Symbol === k ? k.name : k.to_s
+                next if nested_name.blank?
+
                 case v
                 when Array, Hash
                   tokens = TagHelper.build_tag_values(v)
@@ -262,16 +271,16 @@ module ActionView
                 end
 
                 output << sep
-                output << prefix_tag_option(key, k, v, escape)
+                output << prefix_tag_option(name, nested_name, v, escape)
               end
             elsif type == :boolean
               if value
                 output << sep
-                output << boolean_tag_option(key)
+                output << boolean_tag_option(name)
               end
             elsif !value.nil?
               output << sep
-              output << tag_option(key, value, escape)
+              output << tag_option(name, value, escape)
             end
           end
           output unless output.empty?

data/lib/action_view/helpers/text_helper.rb

@@ -143,8 +143,15 @@ module ActionView
       #
       # [+:highlighter+]
       #   The highlighter string. Uses <tt>\1</tt> as the placeholder for a
-      #   phrase, similar to +String#sub+. Defaults to <tt>"<mark>\1</mark>"</tt>.
-      #   This option is ignored if a block is specified.
+      #   phrase. Defaults to <tt>"<mark>\1</mark>"</tt>. The numbered placeholders
+      #   <tt>\0</tt> to <tt>\9</tt> are expanded; other +String#sub+ replacement escapes
+      #   are not. The phrase is HTML escaped, quotes included. This option
+      #   is ignored if a block is specified.
+      #
+      #   WARNING: Put a placeholder only in element content or inside a
+      #   quoted attribute value. HTML escaping does not make the phrase safe
+      #   in an unquoted attribute value, in a URL, JavaScript or CSS
+      #   context, or in an attribute whose value is HTML, such as +srcdoc+.
       #
       # [+:sanitize+]
       #   Whether to sanitize +text+ before highlighting. Defaults to true.
@@ -163,8 +170,8 @@ module ActionView
       #   highlight('You searched for: rails', ['for', 'rails'], highlighter: '<em>\1</em>')
       #   # => "You searched <em>for</em>: <em>rails</em>"
       #
-      #   highlight('You searched for: rails', 'rails', highlighter: '<a href="search?q=\1">\1</a>')
-      #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
+      #   highlight('You searched for: rails', 'rails', highlighter: '<mark title="\1">\1</mark>')
+      #   # => "You searched for: <mark title=\"rails\">rails</mark>"
       #
       #   highlight('You searched for: rails', 'rails') { |match| link_to(search_path(q: match)) }
       #   # => "You searched for: <a href=\"search?q=rails\">rails</a>"
@@ -179,14 +186,23 @@ module ActionView
         else
           patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
           pattern = /(#{patterns.join("|")})/i
+          # The text after a tag begins with the ">" that closes it. Leave it
+          # in the segment so phrases can see it as context, but keep it out
+          # of the match so the highlighter can't take the place of the ">".
+          pattern_after_tag = /(?!\A)#{pattern}/
           highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block
 
-          text.scan(/<[^>]*|[^<]+/).each do |segment|
+          text.scan(/<[^>]*|[^<]+/).each_with_index do |segment, index|
             if !segment.start_with?("<")
+              segment_pattern = index > 0 ? pattern_after_tag : pattern
+
               if block
-                segment.gsub!(pattern, &block)
+                segment.gsub!(segment_pattern, &block)
               else
-                segment.gsub!(pattern, highlighter)
+                segment.gsub!(segment_pattern) do
+                  match = Regexp.last_match
+                  highlighter.gsub(/\\(\d)/) { ERB::Util.html_escape_once(match[$1.to_i]) }
+                end
               end
             end
           end.join

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 8.1.4
+  version: 8.1.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -58,6 +58,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -65,6 +68,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.2
 - !ruby/object:Gem::Dependency
   name: rails-dom-testing
   requirement: !ruby/object:Gem::Requirement
@@ -85,28 +91,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -247,10 +253,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.4/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.4/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.4.1/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.4/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.4.1/actionview
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: