active_scaffold 4.4.5 → 4.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53bf726d56ef1da11ee5ecdf4bc039b59ef10e74dd1ac9d31e2723e3e27716e1
-  data.tar.gz: 625f6798df882567a08bac210c6af4c9dbb246364ba739fc0a68bdad695c7b94
+  metadata.gz: 2475af8fa6929537031a900309db3ff1c3b91bcb9e911ccd61676aa06bf3009f
+  data.tar.gz: 0df3c5893800ffc86159e1a9c73e0b022f5b70a64afcc39e6da59266540f37ba
 SHA512:
-  metadata.gz: 1948177220ec25858dc4d4a19e0313db67f8cafc544ab6bfdf5129bbd418918c9d6f4e4af1f134213e39cc97fb2da485972feca80628547f7fcbc9ad1687e2b9
-  data.tar.gz: 21308ad93ecc7bed4293d82dc4b011eb516e43171d9283ea26fdf24fd67f3283f280ba2c11033c3fdd1008194fef34821a9b134b2c672c8159611eb1b73eac59
+  metadata.gz: e37f5f28f8bade8de9c86d69e68166a0ed7d12acde4c0e908c6c92626505b24511578cfb8394d238393659162ef7cc1dcb3916e693630a9192d03ea5acd8fa3e
+  data.tar.gz: 2aaae36010f59a87cf009a2ddca97c1f45f620d0493d100ff997f185d732592514acce727b1a929c2411028e6964e20de9007673f874deec8f2eb191a97cb1ae

data/CHANGELOG.rdoc

@@ -1,3 +1,28 @@
+= 4.4.6
+- Execute iframe responses by injecting a nonce-aware script into the parent document, avoiding +eval()+ under a strict Content Security Policy
+- Use RecordSelect's named callback registry for the add-existing subform link when available, avoiding +eval()+ under a strict Content Security Policy while retaining compatibility with older RecordSelect releases.
+- Add named callback registries for datepicker and TinyMCE configuration. Inline JavaScript remains supported in 4.4, but successful evaluation emits a browser deprecation warning because support will be removed in ActiveScaffold 4.5.
+
+  Define callbacks in an application JavaScript file:
+
+    ActiveScaffold.datepickerCallbacks.availableDate = function(date) {
+      return [date.getDay() !== 0, ''];
+    };
+    ActiveScaffold.tinymceCallbacks.configureEditor = function(editor) {
+      editor.on('init', function() { /* ... */ });
+    };
+
+  Reference their names from configuration instead of embedding function source:
+
+    config.columns[:starts_on].options[:data] = {beforeshowday: 'availableDate'}
+
+    # config/tinymce.yml
+    default:
+      setup: configureEditor
+
+  Migrate warnings before upgrading to 4.5. Non-callback datepicker settings should use JSON-compatible values.
+- Add explicit HTML translations to +as_+. Move translations containing markup from +key+ to +key.html+. Interpolation follows Rails' HTML translation behavior, escaping unsafe values and preserving already HTML-safe values. Legacy HTML translations remain HTML-safe in 4.4 but emit one deprecation warning per key and scope; ordinary translations will no longer be marked HTML-safe in ActiveScaffold 4.5
+
 = 4.4.5
 - Authorize the PaperTrail deleted-records action and allow overriding its version query with +deleted_records_query+
 - Deprecate passing optional boolean arguments positionally; keyword arguments will be required in 4.5.

data/app/assets/javascripts/active_scaffold/callback_registry.js

@@ -0,0 +1,67 @@
+(function(global) {
+  var ActiveScaffold = global.ActiveScaffold = global.ActiveScaffold || {};
+  var warned = {};
+
+  ActiveScaffold.datepickerCallbacks = ActiveScaffold.datepickerCallbacks || {};
+  ActiveScaffold.tinymceCallbacks = ActiveScaffold.tinymceCallbacks || {};
+
+  function warnOnce(key, message) {
+    if (warned[key]) return;
+
+    warned[key] = true;
+    if (global.console && typeof global.console.warn === 'function') {
+      global.console.warn(message);
+    }
+  }
+
+  function evaluateLegacy(value, description, wrap) {
+    try {
+      var evaluated = global.eval(wrap ? '(' + value + ')' : value);
+      warnOnce(description + ':' + value,
+        'DEPRECATION WARNING: JavaScript in ' + description + ' is deprecated and will be removed in ActiveScaffold 4.5. ' +
+        'Register callbacks by name and use JSON-compatible values instead.');
+      return {success: true, value: evaluated};
+    } catch (error) {
+      return {success: false};
+    }
+  }
+
+  ActiveScaffold.resolveCallback = function(registryName, value, description) {
+    if (typeof value === 'function' || typeof value !== 'string') return value;
+
+    var registry = ActiveScaffold[registryName] || {};
+    if (Object.prototype.hasOwnProperty.call(registry, value)) {
+      if (typeof registry[value] === 'function') return registry[value];
+
+      throw new TypeError('ActiveScaffold.' + registryName + '.' + value + ' must be a function');
+    }
+
+    var legacy = evaluateLegacy(value, description, true);
+    if (legacy.success) return legacy.value;
+
+    throw new Error(description + ' references unknown callback ' + value +
+      '. Register it in ActiveScaffold.' + registryName + '.');
+  };
+
+  var datepickerCallbackOptions = {
+    afterInject: true,
+    beforeShow: true,
+    beforeShowDay: true,
+    calculateWeek: true,
+    onChangeMonthYear: true,
+    onClose: true,
+    onSelect: true,
+    onUpdateDatepicker: true
+  };
+
+  ActiveScaffold.resolveDatepickerSetting = function(option, value) {
+    if (typeof value !== 'string') return value;
+
+    if (datepickerCallbackOptions[option]) {
+      return ActiveScaffold.resolveCallback('datepickerCallbacks', value, 'datepicker option ' + option);
+    }
+
+    var legacy = evaluateLegacy(value, 'datepicker option ' + option, false);
+    return legacy.success ? legacy.value : value;
+  };
+})(window);

data/app/assets/javascripts/active_scaffold/date_picker_bridge.js

@@ -6,11 +6,7 @@ jQuery.extend(Object.getPrototypeOf(jQuery.datepicker), {
       if(this._defaults.hasOwnProperty(attrName)){
         var attrValue = $target.data(attrName.toLowerCase());
         if (attrValue !== undefined) {
-          try {
-            inlineSettings[attrName] = eval(attrValue);
-          } catch (err) {
-            inlineSettings[attrName] = attrValue;
-          }
+          inlineSettings[attrName] = ActiveScaffold.resolveDatepickerSetting(attrName, attrValue);
         }
       }
     }
@@ -46,4 +42,4 @@ jQuery(document).on('change', 'input.datetime_picker', function(e) {
     $this.data('first-event', true);
     e.stopImmediatePropagation();
   }
-});
+});

data/app/assets/javascripts/active_scaffold/load.js

@@ -8,6 +8,8 @@
 
   // Load dependencies based on configuration
   const loadDependencies = async () => {
+    await loadScript(RAILS_ASSET_URL('/active_scaffold/callback_registry.js'));
+
     // Always load these
     await loadScript(RAILS_ASSET_URL('/jquery.ba-throttle-debounce.js'));
     await loadScript(RAILS_ASSET_URL('/jquery.visible.min.js'));

data/app/assets/javascripts/active_scaffold/record_select_bridge.js

@@ -0,0 +1,9 @@
+(function(global) {
+  global.RecordSelect.registerCallback('active_scaffold.add_existing', function(id) {
+    global.ActiveScaffold.record_select_onselect(
+      this.obj.attr('data-edit-associated-url'),
+      this.obj.attr('data-active-scaffold-id'),
+      id
+    );
+  });
+})(window);

data/app/assets/javascripts/active_scaffold/tiny_mce_bridge.js

@@ -40,7 +40,7 @@
     var id = jQuery(this).attr('id');
     if (tinymce && tinymce.majorVersion >= 6) {
       settings.selector = '#' + id;
-      var userSetup = settings.setup ? eval(settings.setup) : function () {};
+      var userSetup = settings.setup ? ActiveScaffold.resolveCallback('tinymceCallbacks', settings.setup, 'TinyMCE setup') : function () {};
       settings.setup = function(editor) {
         userSetup(editor);                  // run what the user already had
 

data/lib/active_scaffold/assets.rb

@@ -7,6 +7,7 @@ module ActiveScaffold
     autoload :JqueryUiThemeGenerator, 'active_scaffold/assets/jquery_ui_theme_generator'
 
     CORE_STYLESHEETS = ['active_scaffold/core'].freeze
+    CALLBACK_REGISTRY_JAVASCRIPT = 'active_scaffold/callback_registry'
     CORE_JAVASCRIPTS = ['jquery.ba-throttle-debounce', 'jquery.visible.min', 'active_scaffold/jquery.editinplace', 'active_scaffold/active_scaffold'].freeze
 
     class << self
@@ -34,17 +35,17 @@ module ActiveScaffold
       def active_scaffold_javascripts(load = :all)
         case load
         when :all
-          jquery_ui_javascripts + CORE_JAVASCRIPTS + ActiveScaffold.javascripts + bridge_javascripts
+          [CALLBACK_REGISTRY_JAVASCRIPT] + jquery_ui_javascripts + CORE_JAVASCRIPTS + ActiveScaffold.javascripts + bridge_javascripts
         when :deps
-          jquery_ui_javascripts + ActiveScaffold.javascripts + bridge_javascripts
+          [CALLBACK_REGISTRY_JAVASCRIPT] + jquery_ui_javascripts + ActiveScaffold.javascripts + bridge_javascripts
         when :core
-          CORE_JAVASCRIPTS
+          [CALLBACK_REGISTRY_JAVASCRIPT] + CORE_JAVASCRIPTS
         when :plugins
           ActiveScaffold.javascripts
         when :bridges
           bridge_javascripts
         when :jquery_ui
-          jquery_ui_javascripts
+          [CALLBACK_REGISTRY_JAVASCRIPT] + jquery_ui_javascripts
         else
           raise ArgumentError, "Unknown load mode: #{load.inspect}"
         end

data/lib/active_scaffold/bridges/record_select.rb

@@ -10,6 +10,12 @@ class ActiveScaffold::Bridges::RecordSelect < ActiveScaffold::DataStructures::Br
   end
 
   def self.javascripts
-    'record_select'
+    assets = ['record_select']
+    assets << 'active_scaffold/record_select_bridge' if callback_registry?
+    assets
+  end
+
+  def self.callback_registry?
+    defined?(::RecordSelect) && ::RecordSelect.respond_to?(:callback_registry?) && ::RecordSelect.callback_registry?
   end
 end

data/lib/active_scaffold/extensions/localize.rb

@@ -1,12 +1,26 @@
 # frozen_string_literal: true
 
+require 'active_support/html_safe_translation'
+require 'active_scaffold/translation_html_safety'
+
 class Object
   def as_(key, options = {})
     if key.present?
-      scope = [:active_scaffold, *options.delete(:scope)]
-      options = options.reverse_merge(scope: scope, default: key.is_a?(String) ? key : key.to_s.titleize)
-      text = I18n.t(key.to_s, **options).html_safe
-      # text = nil if text.include?('translation missing:')
+      options = options.merge(scope: [:active_scaffold, *options[:scope]])
+      options[:default] = key.is_a?(String) ? key : key.to_s.titleize unless options.key?(:default)
+
+      missing_html_translation = Object.new
+      html = ActiveSupport::HtmlSafeTranslation.translate(
+        "#{key}.html", **options, default: missing_html_translation
+      )
+      text =
+        if html.equal?(missing_html_translation)
+          translation = I18n.t(key.to_s, **options)
+          ActiveScaffold::TranslationHtmlSafety.check_once(key, options[:scope], translation) if translation.is_a?(String)
+          translation.html_safe # rubocop:disable Rails/OutputSafety
+        else
+          html
+        end
     end
     text || key
   end

data/lib/active_scaffold/helpers/association_helpers.rb

@@ -128,7 +128,22 @@ module ActiveScaffold
       end
 
       def record_select_params_for_add_existing(association, edit_associated_url_options, record)
-        {onselect: "ActiveScaffold.record_select_onselect(#{url_for(edit_associated_url_options).to_json}, #{active_scaffold_id.to_json}, id);"}
+        if ActiveScaffold::Bridges::RecordSelect.callback_registry?
+          {
+            onselect: 'active_scaffold.add_existing',
+            html: {
+              data: {
+                edit_associated_url: url_for(edit_associated_url_options),
+                active_scaffold_id: active_scaffold_id
+              }
+            }
+          }
+        else
+          {
+            onselect: "ActiveScaffold.record_select_onselect(#{url_for(edit_associated_url_options).to_json}, " \
+                      "#{active_scaffold_id.to_json}, id);"
+          }
+        end
       end
     end
   end

data/lib/active_scaffold/responds_to_parent.rb

@@ -19,16 +19,10 @@ module ActiveScaffold
         end
       response.status = 200 if (300...400).cover? response.status
 
-      # Eval in parent scope and replace document location of this frame
-      # so back button doesn't replay action on targeted forms
-      # loc = document.location to be set after parent is updated for IE
-      # with(window.parent) - pull in variables from parent window
-      # setTimeout - scope the execution in the windows parent for safari
-      # window.eval - legal eval for Opera
-      script = "<html><body><script type='text/javascript' charset='utf-8'>
-        var loc = document.location;
-        with(window.parent) { setTimeout(function() { window.eval('#{self.class.helpers.escape_javascript script}'); window.loc && loc.replace('about:blank'); }, 1) }
-      </script></body></html>"
+      # Inject the response into the parent document so it executes in the parent scope.
+      # Reuse its CSP nonce when one is available, then replace the frame location so the
+      # back button doesn't replay the action on targeted forms.
+      script = responds_to_parent_html(script)
 
       # Clear out the previous render to prevent double render and then render
       if respond_to?(:erase_results, true)
@@ -41,5 +35,24 @@ module ActiveScaffold
       render html: script.html_safe, content_type: 'text/html' # rubocop:disable Rails/OutputSafety
     end
     alias respond_to_parent responds_to_parent
+
+    private
+
+    def responds_to_parent_html(response_javascript)
+      escaped_response = self.class.helpers.escape_javascript(response_javascript)
+      "<html><body><script type='text/javascript' charset='utf-8'>
+        var loc = document.location;
+        var responseJavaScript = '#{escaped_response}';
+        var parentDocument = window.parent.document;
+        var script = parentDocument.createElement('script');
+        var nonceSource = parentDocument.querySelector('script[nonce]');
+
+        if (nonceSource) script.nonce = nonceSource.nonce;
+        script.text = responseJavaScript;
+        parentDocument.head.appendChild(script);
+        script.remove();
+        loc.replace('about:blank');
+      </script></body></html>"
+    end
   end
 end

data/lib/active_scaffold/translation_html_safety.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'concurrent/map'
+
+module ActiveScaffold
+  module TranslationHtmlSafety
+    HTML_PATTERN = /<[^>]+>|&(?:[a-z][a-z0-9]+|#\d+|#x[0-9a-f]+);/i
+
+    @checked_translations = Concurrent::Map.new
+
+    class << self
+      def check_once(key, scope, translation)
+        translation_key_parts = [*scope, key].freeze
+        return unless @checked_translations.put_if_absent(translation_key_parts, true).nil?
+        return unless translation.match?(HTML_PATTERN)
+
+        translation_key = translation_key_parts.join('.')
+        ActiveScaffold.deprecator.warn(
+          "HTML in translation #{translation_key} is deprecated. Move it to #{translation_key}.html. " \
+          'Ordinary translations will no longer be marked HTML-safe in ActiveScaffold 4.5.'
+        )
+      end
+    end
+  end
+end

data/lib/active_scaffold/version.rb

@@ -4,7 +4,7 @@ module ActiveScaffold
   module Version
     MAJOR = 4
     MINOR = 4
-    PATCH = 5
+    PATCH = 6
     FIX = nil
 
     STRING = [MAJOR, MINOR, PATCH, FIX].compact.join('.')

data/vendor/assets/javascripts/jquery-ui-timepicker-addon.js

@@ -176,11 +176,7 @@
 				if (this._defaults.hasOwnProperty(attrName)) {
 					var attrValue = $input.data(attrName.toLowerCase());
 					if (attrValue !== undefined) {
-						try {
-							inlineSettings[attrName] = eval(attrValue);
-						} catch (err) {
-							inlineSettings[attrName] = attrValue;
-						}
+						inlineSettings[attrName] = ActiveScaffold.resolveDatepickerSetting(attrName, attrValue);
 					}
 				}
 			}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_scaffold
 version: !ruby/object:Gem::Version
-  version: 4.4.5
+  version: 4.4.6
 platform: ruby
 authors:
 - Many, see README
@@ -110,10 +110,12 @@ files:
 - app/assets/javascripts/active_scaffold.js.erb
 - app/assets/javascripts/active_scaffold/active_scaffold.js
 - app/assets/javascripts/active_scaffold/active_scaffold_chosen.js
+- app/assets/javascripts/active_scaffold/callback_registry.js
 - app/assets/javascripts/active_scaffold/date_picker_bridge.js
 - app/assets/javascripts/active_scaffold/draggable_lists.js
 - app/assets/javascripts/active_scaffold/jquery.editinplace.js
 - app/assets/javascripts/active_scaffold/load.js
+- app/assets/javascripts/active_scaffold/record_select_bridge.js
 - app/assets/javascripts/active_scaffold/tiny_mce_bridge.js
 - app/assets/stylesheets/active_scaffold-ie.scss
 - app/assets/stylesheets/active_scaffold.scss.erb
@@ -360,6 +362,7 @@ files:
 - lib/active_scaffold/responds_to_parent.rb
 - lib/active_scaffold/tableless.rb
 - lib/active_scaffold/testing/assert_embedded_load.rb
+- lib/active_scaffold/translation_html_safety.rb
 - lib/active_scaffold/version.rb
 - lib/generators/active_scaffold/controller/USAGE
 - lib/generators/active_scaffold/controller/controller_generator.rb