andromeda_cms 0.7.1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5bde1931ffa5be3d639889a72d5313207373205be6e8d29303bd3138241dfa79
-  data.tar.gz: ea3d032420f6e0b5ca7316c896581b5a038ccd73e9e924b00a223b5be07e13c1
+  metadata.gz: f5fcf2b6c7dc4e2ae34e6e729b2ce4c7b811c30b5ac1a330a371aa6bcf112114
+  data.tar.gz: b32192863c7a781f648e9ea4441f91841e21fbc792a33d7df2500df453a124f9
 SHA512:
-  metadata.gz: 312ddc99a1d8a3abd5b47c63ddbc8493ca18e51300bef3ae9743061bd44ca3ad4b952d174f6a0749cd2403ba33435c58f24adcd1b6ca7283966c240883ff3b47
-  data.tar.gz: 2fe047ea4e0dcf8fab1956f32546a014da39951956f277ebc72a73060787c8af4a5927b97f43fd9e64f2993c7f71d2ef5b655bf76b6b6b90930a25741ce8f155
+  metadata.gz: 376cc0430b6244ac65b3c6e112d4ed6e73a12c407af27a1cf3081f1bd352b17a3a7b2e861f6ec0b37f560bc25da5681120e931d20d47a679268eb643b9cea4ca
+  data.tar.gz: 6d0d3a7fe600e46a22a6165d317ff5186ba7028f5ed3f1fc0de7e13e0d1513580959582898b85b63aa992f86358abf9ff45108c9922562e1cbfd991cc89f4920

data/CHANGELOG.md

@@ -5,6 +5,55 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.0] - 2026-11-14
+
+### Changed
+
+- An MDX `import` now resolves only to a partial inside the components
+  directory (`Andromeda.config.components_path`). An import that points
+  anywhere else under `app/views`, such as a layout partial, is ignored and
+  the component falls back to its conventional partial, as an import that
+  does not resolve already did. Imported content could otherwise render
+  any partial in the application.
+- `rails g andromeda:import_astro` skips a collection whose name cannot
+  become a valid Ruby class, such as a `src/content/blog-posts` directory or
+  `const BEGIN = defineCollection(...)`, and lists it in the report. These
+  used to produce an entry class that failed to load.
+
+### Fixed
+
+- Security: `rails g andromeda:import_astro` no longer writes text from the
+  imported project into the generated entry classes as Ruby code. A
+  malicious Astro project could put code in a `.default(...)` value, a glob
+  `pattern`, a `reference(...)` name, a quoted field name or a schema
+  comment, and it ran every time the application loaded the class. Defaults
+  are now parsed into Ruby values, every imported value is written with
+  `inspect`, and text placed in comments is kept on one line. A default that
+  cannot be carried over is now noted in the class instead of silently
+  dropped.
+- Security: `rails g andromeda:import_astro` copies only files that are
+  inside the Astro project. A `glob({ base: ... })` pointing elsewhere (such
+  as `~/.ssh`) or a symlink to a file outside the project used to copy that
+  file into the application. A glob `pattern` that leaves the collection
+  directory is replaced with the default pattern.
+- `rails g andromeda:import_astro` generates a partial stub for every
+  component an MDX file uses, not only the first one, and none for
+  lowercase HTML tags.
+- `rails g andromeda:import_astro` no longer stops partway through on an
+  invalid component name, a content file that is not valid UTF-8, or a
+  malformed generated JSON Schema. A `content.config.ts` that is not valid
+  UTF-8 stops the import before anything is written.
+- `rails g andromeda:import_astro` no longer gives a collection the
+  schema of another collection whose name starts with the same text (`blog`
+  and `blogPosts`), and parses a config with many collections in linear
+  time.
+- Renaming frontmatter keys (`andromeda:fix` and the Astro import) no longer
+  corrupts a file whose frontmatter contains backslash sequences such as
+  `\0` or `\&`.
+- `rails g andromeda:component` turns a prop that is not a valid Ruby local
+  name (such as `class`, `a:b` or `content`) into a TODO comment instead of
+  writing a partial that fails to compile.
+
 ## [0.7.1] - 2026-11-08
 
 ### Changed
@@ -241,6 +290,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Generators: `andromeda:install`, `andromeda:collection`,
   `andromeda:component` and `andromeda:import_astro`.
 
+[0.8.0]: https://github.com/AndromedaCMS/andromeda_cms/releases/tag/v0.8.0
 [0.7.1]: https://github.com/AndromedaCMS/andromeda_cms/releases/tag/v0.7.1
 [0.7.0]: https://github.com/AndromedaCMS/andromeda_cms/releases/tag/v0.7.0
 [0.6.3]: https://github.com/AndromedaCMS/andromeda_cms/releases/tag/v0.6.3

data/lib/andromeda/components.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "pathname"
+
 require_relative "components/errors"
 require_relative "components/import_scanner"
 require_relative "components/static_expression"
@@ -163,11 +165,21 @@ module Andromeda
       end
 
       import_path = @imports[name]
-      return import_path if import_path && partial_exists?(import_path)
+      return import_path if import_path && within_components_path?(import_path) && partial_exists?(import_path)
 
       convention_partial(name)
     end
 
+    # An `import` is author-controlled text; without this it could make the
+    # renderer render any partial under app/views (a layout partial, an
+    # admin one). Imports resolve only inside the components directory, and
+    # anything else falls back to convention like an unresolvable import.
+    def within_components_path?(partial)
+      base = Andromeda.config.components_path.sub(%r{\Aapp/views/}, "")
+      normalized = Pathname.new(partial).cleanpath.to_s
+      normalized.start_with?("#{base}/")
+    end
+
     def convention_partial(name)
       base = Andromeda.config.components_path.sub(%r{\Aapp/views/}, "")
       "#{base}/#{self.class.underscore(name)}"

data/lib/andromeda/fix.rb

@@ -51,7 +51,9 @@ module Andromeda
         line.sub(KEY_LINE) { "#{match[1]}#{match[2]}#{snake}#{match[2]}#{match[4]}" }
       end.join
 
-      [source.sub(frontmatter, fixed_frontmatter), renames]
+      # Block form: a replacement string would interpret `\0`, `\&` and `\\`
+      # sequences in the frontmatter's own values and corrupt the file.
+      [source.sub(frontmatter) { fixed_frontmatter }, renames]
     end
 
     def snake_case(key)

data/lib/andromeda/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Andromeda
-  VERSION = "0.7.1"
+  VERSION = "0.8.0"
 end

data/lib/generators/andromeda/component/component_generator.rb

@@ -27,6 +27,17 @@ module Andromeda
               "#{Andromeda.config.components_path}/_#{name.underscore}.html.erb"
       end
 
+      # A prop becomes a Ruby local (`<%= title %>`, `locals: (title: nil)`),
+      # so it must be a plain identifier that is not a keyword. Props come
+      # from MDX attributes (`a:b`, `$x`, `class`), which are legal JSX but
+      # would produce a template that fails to compile.
+      LOCAL_NAME_RE = /\A[a-z_][a-zA-Z0-9_]*\z/
+      RESERVED_WORDS = %w[
+        __ENCODING__ __LINE__ __FILE__ BEGIN END alias and begin break case class def defined? do else elsif
+        end ensure false for if in module next nil not or redo rescue retry return self super then true undef
+        unless until when while yield
+      ].freeze
+
       def create_partial
         create_file "#{Andromeda.config.components_path}/_#{underscored_name}.html.erb", partial_content
       end
@@ -41,10 +52,32 @@ module Andromeda
         name.camelize
       end
 
+      # `content` is always declared for the tag's body (see
+      # `strict_locals`), so a prop of that name would be declared twice.
+      def valid_local?(prop)
+        local = prop.underscore
+        local.match?(LOCAL_NAME_RE) && !RESERVED_WORDS.include?(local) && local != "content"
+      end
+
+      def valid_props
+        props.select { |prop| valid_local?(prop) }
+      end
+
+      # Rejected props are not emitted as code; a comment tells the author
+      # to rename them by hand. The prop text is attacker-influenced (it
+      # comes from MDX), so it must not be able to close the ERB tag or
+      # start a new line.
+      def rejected_prop_lines
+        props.reject { |prop| valid_local?(prop) }.map do |prop|
+          safe = prop.gsub(/\s+/, " ").gsub("%>", "")
+          "<%# TODO: prop `#{safe}` is not a valid local name -- rename it by hand. %>"
+        end
+      end
+
       def partial_content
         <<~ERB
           #{usage_comment}
-          #{strict_locals}
+          #{([strict_locals] + rejected_prop_lines).join("\n")}
           <div class="#{underscored_name.dasherize}">
           #{prop_lines.join("\n")}#{"\n" unless prop_lines.empty?}  <%= content %>
           </div>
@@ -54,12 +87,12 @@ module Andromeda
       # Every prop is optional, and `content` is declared too: it is passed
       # even to a self-closing tag (`<Callout />`), where it is empty.
       def strict_locals
-        locals = props.map { |prop| "#{prop.underscore}: nil" } << "content: nil"
+        locals = valid_props.map { |prop| "#{prop.underscore}: nil" } << "content: nil"
         "<%# locals: (#{locals.join(', ')}) %>"
       end
 
       def prop_lines
-        props.map do |prop|
+        valid_props.map do |prop|
           local = prop.underscore
           "  <% if local_assigns[:#{local}] %><p class=\"#{underscored_name.dasherize}__#{local.dasherize}\">" \
             "<%= #{local} %></p><% end %>"
@@ -67,7 +100,7 @@ module Andromeda
       end
 
       def usage_comment
-        attrs = props.map { |prop| "#{prop.underscore.camelize(:lower)}=\"...\"" }.join(" ")
+        attrs = valid_props.map { |prop| "#{prop.underscore.camelize(:lower)}=\"...\"" }.join(" ")
         opening = attrs.empty? ? "<#{tag_name}>" : "<#{tag_name} #{attrs}>"
 
         <<~ERB.chomp

data/lib/generators/andromeda/import_astro/astro_schema_json.rb

@@ -66,7 +66,10 @@ module Andromeda
         def numeric_precision(schema_json, field_name)
           return nil unless schema_json.is_a?(Hash)
 
-          property = (schema_json["properties"] || {})[field_name]
+          properties = schema_json["properties"]
+          return nil unless properties.is_a?(Hash)
+
+          property = properties[field_name]
           return nil unless property.is_a?(Hash)
 
           case property["type"]

data/lib/generators/andromeda/import_astro/content_config_converter.rb

@@ -28,6 +28,8 @@ module Andromeda
 
         DEFAULT_PATTERN = "**/*.{md,mdx}"
 
+        COLLECTION_RE = /const\s+(\w+)\s*=\s*defineCollection\s*\(/.freeze
+
         # Bash-style extglob openers (`!(drafts)`, `@(a|b)`, ...), which
         # Astro's glob loader accepts but Ruby's `Dir.glob` does not.
         EXTGLOB_RE = /[!@+*?]\(/.freeze
@@ -37,11 +39,16 @@ module Andromeda
         # expression text) is always kept so the generator can turn it into
         # a TODO comment naming exactly what needs a human (per the
         # generator's "never a silent omission" requirement).
+        #
+        # `default` is an already-parsed Ruby value (never source text), and
+        # `has_default` says whether there is one at all -- `default: false`
+        # and "no default" must not collapse into the same nil.
         Attribute = Struct.new(
-          :name, :ruby_type, :required, :default, :of, :values, :collection, :source, :note,
+          :name, :ruby_type, :required, :default, :has_default, :of, :values, :collection, :source, :note,
           keyword_init: true
         ) do
           def unsupported? = ruby_type.nil?
+          def default? = has_default ? true : false
         end
 
         # Astro's own base Zod types. Order matters: more specific
@@ -55,7 +62,25 @@ module Andromeda
           [/\Az\.date\(\)\z/, :date]
         ].freeze
 
-        DEFAULT_LITERAL_RE = /\A(?:true|false|-?\d+(?:\.\d+)?|'[^']*'|"[^"]*"|\[[^\]]*\])\z/.freeze
+        # Returned by `parse_literal` for anything it does not recognize, so
+        # that a literal `nil`/`false` default stays distinguishable.
+        UNPARSEABLE = Object.new.freeze
+
+        # The JS string escapes `parse_js_string` decodes. Any other
+        # backslash sequence makes the whole literal unparseable rather
+        # than risk decoding it differently from JS.
+        JS_STRING_ESCAPES = {
+          "\\" => "\\", "'" => "'", '"' => '"', "/" => "/", "$" => "$",
+          "n" => "\n", "t" => "\t", "r" => "\r", "b" => "\b", "f" => "\f", "v" => "\v"
+        }.freeze
+
+        # `\xHH`, `\uHHHH` and `\u{H...}`; `\0` only when no digit follows
+        # (`\01` is a legacy octal escape, which is not decoded).
+        JS_CODE_ESCAPE_RE = /\G(?:x(\h{2})|u(\h{4})|u\{(\h{1,6})\}|0(?!\d))/.freeze
+
+        # The field names the generator can declare: after
+        # `Andromeda::Fix.snake_case` these become plain Ruby symbols.
+        FIELD_NAME_RE = /\A[A-Za-z_][A-Za-z0-9_-]*\z/.freeze
 
         module_function
 
@@ -64,13 +89,17 @@ module Andromeda
         #   to resolve a `loader: glob({ base: ... })` path.
         # @return [Array<Collection>]
         def parse(source, astro_root:)
-          source.scan(/const\s+(\w+)\s*=\s*defineCollection\s*\(/).flatten.map do |const_name|
-            open = source.index("defineCollection", source.index("const #{const_name}"))
-            paren = source.index("(", open)
+          # Each match's own position is used: looking the name up again
+          # with `index("const #{name}")` would find `const blog` inside
+          # `const blogPosts`, and rescanning from the top for every
+          # collection made a large file quadratic.
+          source.to_enum(:scan, COLLECTION_RE).filter_map do
+            match = Regexp.last_match
+            paren = match.end(0) - 1
             close = BalancedScanner.matching_close(source, paren)
-            body = source[(paren + 1)...close]
+            next unless close
 
-            build_collection(const_name, body, astro_root: astro_root)
+            build_collection(match[1], source[(paren + 1)...close], astro_root: astro_root)
           end
         end
 
@@ -79,6 +108,15 @@ module Andromeda
           base = extract_string(body, /base\s*:/) || "./src/content/#{name}"
           pattern, notes = extract_pattern(body)
 
+          # The pattern ends up in the generated class and is globbed from
+          # `app/content/<name>/` at runtime, so one that climbs out of it
+          # (`../../config/*`, `/etc/*`, `~/...`) is not carried over.
+          if escapes_base?(pattern)
+            notes << "pattern `#{pattern}` reaches outside the collection directory -- " \
+                     "replaced with `#{DEFAULT_PATTERN}`"
+            pattern = DEFAULT_PATTERN
+          end
+
           Collection.new(
             name: name,
             base: File.expand_path(base, astro_root),
@@ -131,6 +169,10 @@ module Andromeda
           [pattern, notes]
         end
 
+        def escapes_base?(pattern)
+          pattern.start_with?("/", "~") || pattern.split(%r{[/\\]}).include?("..")
+        end
+
         def backticked(elements)
           elements.map { |element| "`#{element}`" }.join(", ")
         end
@@ -168,13 +210,30 @@ module Andromeda
         end
 
         def build_attribute(key, expr)
-          expr, required, default = strip_modifiers(expr)
+          # A quoted key can hold anything (`"a; system('…')": ...`); only a
+          # name that is a plain identifier is declared, anything else goes
+          # to the TODO list.
+          unless key.match?(FIELD_NAME_RE)
+            return Attribute.new(
+              name: key, ruby_type: nil, required: false, source: expr,
+              note: "field name `#{key}` is not a valid attribute name"
+            )
+          end
+
+          expr, required, default, has_default, dropped_default = strip_modifiers(expr)
           type, extra = classify(expr)
 
+          notes = [extra[:note]]
+          if dropped_default
+            notes << "default `#{dropped_default}` is not a plain literal and was not carried over -- " \
+                     "set `default:` by hand"
+          end
+
           Attribute.new(
-            name: key, ruby_type: type, required: type.nil? ? false : required, default: default,
+            name: key, ruby_type: type, required: type.nil? ? false : required,
+            default: default, has_default: has_default,
             of: extra[:of], values: extra[:values], collection: extra[:collection],
-            source: expr, note: extra[:note]
+            source: expr, note: notes.compact.join("; ").then { |note| note.empty? ? nil : note }
           )
         end
 
@@ -186,6 +245,8 @@ module Andromeda
         def strip_modifiers(expr)
           required = true
           default = nil
+          has_default = false
+          dropped_default = nil
 
           loop do
             if expr.end_with?(".optional()")
@@ -195,7 +256,8 @@ module Andromeda
               expr = inner.strip
               required = false
             elsif (inner = suffix_call_argument(expr, ".default"))
-              default = literal_default(inner)
+              has_default, default = literal_default(inner)
+              dropped_default = has_default ? nil : inner.strip
               expr = expr[0...-(".default(#{inner})".length)].strip
               required = false
             else
@@ -203,7 +265,7 @@ module Andromeda
             end
           end
 
-          [expr, required, default]
+          [expr, required, default, has_default, dropped_default]
         end
 
         # @return [String, nil] the argument text of a trailing `.method(...)`
@@ -231,13 +293,77 @@ module Andromeda
           expr[(prefix.length + 1)...close]
         end
 
-        # Only a recognizable Ruby-literal-compatible default is carried
-        # over verbatim (JS and Ruby agree on `true`/`false`/numbers/quoted
-        # strings/arrays-of-those); anything else is dropped and the field
-        # falls back to being flagged unsupported by `classify` seeing an
-        # expression it was not built to trust the shape of.
+        # Parses a `.default(...)` argument into a Ruby value: `true`/`false`,
+        # an integer, a float, a quoted string, or an array of those.
+        # Anything else is dropped. The text itself is never carried over --
+        # the generator writes the value back out with `inspect`, so a JS
+        # string like `"#{system('…')}"` can never become Ruby code.
+        #
+        # @return [Array(Boolean, Object)] whether a default was recognized,
+        #   and its value.
         def literal_default(text)
-          text.strip.match?(DEFAULT_LITERAL_RE) ? text.strip : nil
+          value = parse_literal(text.strip, allow_array: true)
+          value.equal?(UNPARSEABLE) ? [false, nil] : [true, value]
+        end
+
+        def parse_literal(text, allow_array:)
+          case text
+          when "true" then true
+          when "false" then false
+          # A leading zero is left out: JS reads `0123` as legacy octal (83).
+          when /\A-?(?:0|[1-9]\d*)\z/ then Integer(text, 10)
+          when /\A-?(?:0|[1-9]\d*)\.\d+\z/
+            # A literal too large for a Float becomes `Infinity`, which
+            # `inspect` writes as an undefined constant.
+            value = Float(text)
+            value.finite? ? value : UNPARSEABLE
+          when /\A(['"]).*\1\z/m then parse_js_string(text)
+          when /\A\[.*\]\z/m
+            return UNPARSEABLE unless allow_array
+
+            values = BalancedScanner.split_top_level(text[1...-1]).map do |element|
+              parse_literal(element, allow_array: false)
+            end
+            values.any? { |value| value.equal?(UNPARSEABLE) } ? UNPARSEABLE : values
+          else
+            UNPARSEABLE
+          end
+        end
+
+        # Decodes a single- or double-quoted JS string literal (including
+        # its quotes). Returns UNPARSEABLE for an unescaped closing quote or
+        # newline inside it, or an escape outside JS_STRING_ESCAPES.
+        def parse_js_string(text)
+          quote = text[0]
+          body = text[1...-1]
+          result = +""
+          i = 0
+
+          while i < body.length
+            char = body[i]
+            if char == "\\"
+              if (decoded = JS_STRING_ESCAPES[body[i + 1]])
+                result << decoded
+                i += 2
+              elsif (code = JS_CODE_ESCAPE_RE.match(body, i + 1))
+                codepoint = (code[1] || code[2] || code[3] || "0").to_i(16)
+                # A lone surrogate half (`\uD83D`) has no UTF-8 encoding.
+                return UNPARSEABLE if codepoint > 0x10FFFF || (0xD800..0xDFFF).cover?(codepoint)
+
+                result << codepoint.chr(Encoding::UTF_8)
+                i = code.end(0)
+              else
+                return UNPARSEABLE
+              end
+            elsif char == quote || char == "\n"
+              return UNPARSEABLE
+            else
+              result << char
+              i += 1
+            end
+          end
+
+          result
         end
 
         # @return [Array(Symbol, Hash), Array(nil, Hash)] the Ruby attribute

data/lib/generators/andromeda/import_astro/import_astro_generator.rb

@@ -37,6 +37,12 @@ module Andromeda
       class_option :dry_run, type: :boolean, default: false,
                               desc: "Print the migration report without writing any files"
 
+      # A collection name becomes `collection :name` and, singularized and
+      # camelized, the class name in the generated Ruby.
+      COLLECTION_NAME_RE = /\A[A-Za-z][A-Za-z0-9_]*\z/.freeze
+      CLASS_NAME_RE = /\A[A-Z][A-Za-z0-9_]*\z/.freeze
+      RESERVED_CLASS_NAMES = %w[BEGIN END].freeze
+
       def import
         # Thor's own options Hash is frozen by the time a command runs, so
         # `--dry-run` is translated into Thor's built-in `--pretend`
@@ -71,15 +77,30 @@ module Andromeda
 
       # @return [Array<ImportAstro::ContentConfigConverter::Collection>]
       def load_collections
-        @collections =
+        collections =
           if File.file?(config_path)
-            ImportAstro::ContentConfigConverter.parse(File.read(config_path), astro_root: astro_root)
+            source = File.read(config_path)
+            # Checked before anything is written, so a bad file stops the
+            # import cleanly instead of halfway through.
+            raise Thor::Error, "src/content.config.ts is not valid UTF-8" unless source.valid_encoding?
+
+            ImportAstro::ContentConfigConverter.parse(source, astro_root: astro_root)
           else
             @report[:notes] << "no src/content.config.ts found -- falling back to every directory under " \
                                 "src/content/ with no schema"
             fallback_collections
           end
 
+        # Whether it came from `const <name> = defineCollection(...)` or a
+        # directory under src/content/, a name that cannot become valid
+        # Ruby (`blog-posts`, `BEGIN`, `_`, or `x; system('…') #` in a
+        # malicious theme) is skipped rather than written into code.
+        @collections, invalid = collections.partition { |collection| valid_collection_name?(collection.name) }
+        invalid.each do |collection|
+          @report[:notes] << "#{one_line(collection.name)}: skipped -- a collection name must be letters, digits " \
+                             "and underscores, starting with a letter, and must make a valid class name"
+        end
+
         @collections.each do |collection|
           refine_with_json_schema!(collection)
           collection.notes.each { |note| @report[:notes] << "#{collection.name}: #{note}" }
@@ -118,13 +139,46 @@ module Andromeda
         end
       end
 
+      def valid_collection_name?(name)
+        return false unless name.match?(COLLECTION_NAME_RE)
+
+        class_name = name.to_s.singularize.camelize
+        class_name.match?(CLASS_NAME_RE) && !RESERVED_CLASS_NAMES.include?(class_name)
+      end
+
+      # Only files whose real path is inside the Astro project are copied.
+      # `glob({ base: '~/.ssh' })`, `base: '../..'`, or a symlink such as
+      # `src/assets/key -> ~/.ssh/id_rsa` in a malicious theme would
+      # otherwise copy files from elsewhere on the machine into the app.
+      def inside_astro_root?(path)
+        @real_astro_root ||= File.realpath(astro_root)
+        real = File.realpath(path)
+        real == @real_astro_root || real.start_with?("#{@real_astro_root}#{File::SEPARATOR}")
+      rescue SystemCallError
+        false
+      end
+
+      def report_outside(path)
+        @report[:notes] << "#{one_line(path)}: not copied -- it resolves to a location outside the Astro project"
+      end
+
       def copy_collections
         @collections.each do |collection|
           next unless Dir.exist?(collection.base)
 
+          unless inside_astro_root?(collection.base)
+            report_outside(collection.base)
+            next
+          end
+
           Dir.glob(File.join(collection.base, "**/*")).sort.each do |src|
             next unless File.file?(src)
 
+            unless inside_astro_root?(src)
+              report_outside(src.delete_prefix("#{astro_root}/"))
+              next
+            end
+
             relative = src.delete_prefix("#{collection.base}/")
             dest = "app/content/#{collection.name}/#{relative}"
             copy_content_file(src, dest)
@@ -144,6 +198,13 @@ module Andromeda
         end
 
         source = File.read(src)
+        unless source.valid_encoding?
+          create_file dest, File.binread(src)
+          @report[:copied] << dest
+          @report[:notes] << "#{one_line(dest)}: not valid UTF-8 -- copied unchanged, without frontmatter or import rewrites"
+          return
+        end
+
         fixed, renames = Andromeda::Fix.fix_source(source)
         renames.each { |from, to| @report[:frontmatter_renames] << "#{dest}: #{from} -> #{to}" }
 
@@ -172,9 +233,19 @@ module Andromeda
         assets_root = File.join(astro_root, "src/assets")
         return unless Dir.exist?(assets_root)
 
+        unless inside_astro_root?(assets_root)
+          report_outside("src/assets")
+          return
+        end
+
         Dir.glob(File.join(assets_root, "**/*")).sort.each do |src|
           next unless File.file?(src)
 
+          unless inside_astro_root?(src)
+            report_outside(src.delete_prefix("#{astro_root}/"))
+            next
+          end
+
           relative = src.delete_prefix("#{assets_root}/")
           dest = "app/assets/#{relative}"
           create_file dest, File.binread(src)
@@ -198,17 +269,26 @@ module Andromeda
         return unless @component_usages
 
         @component_usages.each_value do |usage|
+          # A lowercase tag is plain HTML to the renderer, not a component.
+          next unless usage.name.match?(/\A[A-Z]/)
+
+          unless usage.name.match?(Andromeda::Generators::ComponentGenerator::VALID_NAME_RE)
+            @report[:notes] << "<#{one_line(usage.name)}>: no partial stub generated -- the name is not a valid " \
+                               "component name; add the partial by hand"
+            next
+          end
           next if partial_exists?(usage.name)
 
-          # Reuses the real `andromeda:component` generator (rather than
-          # duplicating its stub-content logic here) via Thor's own
-          # `invoke`, which shares this generator's `destination_root`
-          # automatically. `pretend:` is passed through explicitly --
-          # `invoke` only inherits a fresh invocation's *original* options
-          # (captured at construction time), not this instance's later
-          # `self.options = options.merge(pretend: true)` translation of
-          # `--dry-run` above.
-          invoke Andromeda::Generators::ComponentGenerator, [usage.name, *usage.props], pretend: options[:dry_run]
+          # Reuses the real `andromeda:component` generator rather than
+          # duplicating its stub-content logic here. It is instantiated
+          # directly for every component: Thor's `invoke` runs a given
+          # generator class only once per run, so every stub after the
+          # first was silently skipped. `pretend:` is passed explicitly so
+          # `--dry-run` reaches it too.
+          Andromeda::Generators::ComponentGenerator.new(
+            [usage.name, *usage.props], { pretend: options[:dry_run] },
+            destination_root: destination_root, shell: shell
+          ).invoke_all
           @report[:stubs] << component_partial_path(usage.name)
         end
       end
@@ -235,10 +315,10 @@ module Andromeda
         namespace_modules.each_with_index { |mod, i| lines << "#{"  " * i}module #{mod}" }
         lines << "#{indent}class #{collection.name.to_s.singularize.camelize} < Andromeda::Entry"
         collection.notes.each do |note|
-          lines << "#{indent}  # TODO: #{note} (content.config.ts) -- fix `pattern` by hand."
+          lines << "#{indent}  # TODO: #{one_line(note)} (content.config.ts) -- fix `pattern` by hand."
         end
         lines << "#{indent}  collection :#{collection.name}, base: \"app/content/#{collection.name}\", " \
-                 "pattern: \"#{collection.pattern}\""
+                 "pattern: #{collection.pattern.inspect}"
 
         unless collection.attributes.empty?
           lines << ""
@@ -258,17 +338,25 @@ module Andromeda
         return unsupported_attribute_lines(attr) if attr.unsupported?
 
         lines = []
-        lines << "# NOTE: #{attr.note}" if attr.note
-        lines << "attribute :#{snake_name(attr)}, :#{attr.ruby_type}#{attribute_modifiers(attr)}"
+        lines << "# NOTE: #{one_line(attr.note)}" if attr.note
+        lines << "attribute #{snake_name(attr).to_sym.inspect}, :#{attr.ruby_type}#{attribute_modifiers(attr)}"
         lines
       end
 
       def unsupported_attribute_lines(attr)
-        [
-          "# TODO: unsupported schema for `#{attr.name}` in content.config.ts (#{attr.source}) -- " \
-          "add the equivalent `attribute` by hand.",
-          "# attribute :#{snake_name(attr)}, :string"
-        ]
+        lines = []
+        lines << "# NOTE: #{one_line(attr.note)}" if attr.note
+        lines << "# TODO: unsupported schema for `#{one_line(attr.name)}` in content.config.ts " \
+                 "(#{one_line(attr.source)}) -- add the equivalent `attribute` by hand."
+        lines << "# attribute :#{one_line(snake_name(attr))}, :string"
+        lines
+      end
+
+      # Everything taken from the imported project that ends up in a
+      # generated `#` comment goes through here: a newline would end the
+      # comment and turn the rest of the text into Ruby code.
+      def one_line(text)
+        text.to_s.gsub(/\s+/, " ")
       end
 
       # The generated class's `attribute` calls must use the same
@@ -280,13 +368,16 @@ module Andromeda
         Andromeda::Fix.snake_case(attr.name)
       end
 
+      # Every value taken from the imported project is written with
+      # `inspect`, never interpolated as source text, so nothing in
+      # content.config.ts can turn into Ruby code in the generated class.
       def attribute_modifiers(attr)
         parts = []
         parts << "of: :#{attr.of}" if attr.ruby_type == :array && attr.of
         parts << "values: #{attr.values.inspect}" if attr.ruby_type == :enum
-        parts << "collection: :#{attr.collection}" if attr.ruby_type == :reference
-        parts << "required: true" if attr.required && attr.default.nil?
-        parts << "default: #{attr.default}" if attr.default
+        parts << "collection: #{attr.collection.inspect}" if attr.ruby_type == :reference
+        parts << "required: true" if attr.required && !attr.default?
+        parts << "default: #{attr.default.inspect}" if attr.default?
         parts.empty? ? "" : ", #{parts.join(", ")}"
       end
 
@@ -307,11 +398,18 @@ module Andromeda
         report_section "  Notes", @report[:notes], indent: "    "
       end
 
+      def printable(text)
+        text.to_s.gsub(/[[:cntrl:]]/) { |char| char.dump[1...-1] }
+      end
+
       def report_section(title, items, indent: "  ")
         return if items.empty?
 
         say "#{title}:"
-        items.each { |item| say "#{indent}#{item}" }
+        # Items carry file names and text from the imported project; a
+        # control character (an ANSI escape, say) is shown escaped rather
+        # than sent to the terminal.
+        items.each { |item| say "#{indent}#{printable(item)}" }
         say ""
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: andromeda_cms
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.8.0
 platform: ruby
 authors:
 - LIMHAUS Inc.