barefoot_js 0.18.7 → 0.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 25b9687ad06be1cbb4af5cccab3d8caa83e038ed2b030ecb83dd4a7430f75175
-  data.tar.gz: cedfce0556b406f8b7c32d3cf936adcc50680006c123244315bb90fc1b1e8f05
+  metadata.gz: bfdedbe747a977df46f615f6520db5261457009fd170541ef1785bdc492288bb
+  data.tar.gz: 733e254a8826a16aedd21678318c6307225f05c4fde4c18c76c251b7abd3f674
 SHA512:
-  metadata.gz: 8048f1a7bafccb96cde14303b903d10f24e857999208bad02c1d429af4135921eebdeee6440606da524569727258096bce6d2c253b1b6ca0e1e4cd14d650b0d1
-  data.tar.gz: 7044ba378260461827af82e1632ab5ffc017800d4791d2e8765c16e5adbb7528565a66b3470ebfeb429ec2b8659b5706da3ac3f2031cb23e1e5c9e3a68fca4ef
+  metadata.gz: b1c11f900684e23aa6609b9d7e4d81d5fed8dc9dda95cb91496ea66e9a14795dd032b4cc80da7267f05df73e3ccca36594fabfcd5979e501c088057717ac0207
+  data.tar.gz: a456a6030e1371aae170129871eebdd576aa0436fe6e10142173c674e121a50da6c572fb4b493802ac008d000324cfc3a2ad9af7448b930a0f7a48aa671a97e6

data/lib/barefoot_js.rb

@@ -396,6 +396,12 @@ module BarefootJS
       return '' if value.nil?
       return value ? 'true' : 'false' if value.is_a?(TrueClass) || value.is_a?(FalseClass)
       return Evaluator.number_to_string(value) if value.is_a?(Numeric)
+      # JS `Array.prototype.toString` is `this.join(',')`, applied
+      # recursively -- Ruby's `Array#to_s` (inspect-style, e.g. "[[1], [2]]")
+      # would otherwise leak through here instead of the JS comma-join
+      # (e.g. reached via `.flat(0)`'s shallow copy joined afterwards,
+      # #2262).
+      return value.map { |el| string(el) }.join(',') if value.is_a?(Array)
 
       value.to_s
     end
@@ -564,13 +570,89 @@ module BarefootJS
       recv.map { |el| string(el) }.join(sep)
     end
 
-    # `.length` works on both arrays (element count) and strings (character
-    # count).
+    # `.length` works on both arrays (element count) and strings. The
+    # string branch counts UTF-16 CODE UNITS, matching JS
+    # `String.prototype.length` (#2255) -- NOT Ruby's native `String#length`
+    # (Unicode codepoints). A codepoint outside the Basic Multilingual
+    # Plane (astral, U+10000-U+10FFFF -- e.g. '👍') is a surrogate PAIR in
+    # UTF-16, so it counts as 2, not 1; '日本語' is 3 either way (BMP-only).
     def length(recv)
       return recv.length if recv.is_a?(Array)
       return 0 if recv.is_a?(Hash) || recv.nil?
 
-      string(recv).length
+      string(recv).each_char.sum { |c| c.ord > 0xFFFF ? 2 : 1 }
+    end
+
+    # Mirrors Hono's own CSS-injection guard (`hono/jsx/utils.ts`'s
+    # `hasUnsafeStyleValue` -- the ORACLE a dynamic `style={{...}}` value
+    # must match, #2261): a hand-rolled structural scan for characters that
+    # could break out of a CSS declaration, NOT real CSSOM property
+    # validation. Ported byte-for-byte -- every character this scan tests
+    # is ASCII, so scanning by byte agrees with Hono's UTF-16-code-unit
+    # scan for every input; a multibyte UTF-8 sequence has no byte in the
+    # ASCII range, so it can never spuriously match one of these
+    # single-byte comparisons. Skips the reference implementation's regex
+    # fast-path (a pure optimization -- the scan below already returns
+    # `false` promptly for a clean value).
+    def has_unsafe_style_value?(value)
+      bytes = value.b
+      quote = 0
+      block_stack = []
+      i = 0
+      len = bytes.bytesize
+      while i < len
+        c = bytes.getbyte(i)
+        if c == 92 # \
+          return true if i == len - 1
+          i += 1
+        elsif quote != 0
+          return true if c == 10 || c == 12 || c == 13
+          quote = 0 if c == quote
+        elsif c == 47 && i + 1 < len && bytes.getbyte(i + 1) == 42 # "/*"
+          endi = bytes.index('*/', i + 2)
+          return true if endi.nil?
+          i = endi + 1
+        elsif c == 34 || c == 39 # " or '
+          quote = c
+        elsif c == 40 # (
+          block_stack.push(41)
+        elsif c == 91 # [
+          block_stack.push(93)
+        elsif c == 123 || c == 125 # { or }
+          return true
+        elsif c == 41 || c == 93 # ) or ]
+          return true if block_stack.empty? || block_stack.last != c
+          block_stack.pop
+        elsif c == 59 && block_stack.empty? # ;
+          return true
+        end
+        i += 1
+      end
+      quote != 0 || !block_stack.empty?
+    end
+
+    # Builds the CSS string for a `style={{...}}` JSX object-literal
+    # attribute (#2261) -- `pairs` alternates CSS key (always a
+    # compile-time-known literal), then value. A value that fails
+    # `has_unsafe_style_value?` (after JS-`String()`-style stringification)
+    # is DROPPED -- the whole `key:value` pair is omitted -- matching
+    # Hono's oracle behavior exactly. The final joined string is STILL
+    # HTML-escaped (mirroring Hono's own `escapeToBuffer` call on its
+    # accumulated style string) -- a "safe" value can still carry a
+    # literal `"`/`'`/`&` (e.g. a BALANCED-quote CSS string value like
+    # `"hello"` passes the structural scan) that would otherwise break out
+    # of the double-quoted `style="..."` attribute. Returns a `SafeString`
+    # so `bf.h` (which the emitter still wraps every dynamic value with)
+    # passes the already-escaped result through unchanged.
+    def style_object(*pairs)
+      parts = []
+      pairs.each_slice(2) do |key, value|
+        v = string(value)
+        next if has_unsafe_style_value?(v)
+
+        parts << "#{html_escape(key)}:#{html_escape(v)}"
+      end
+      SafeString.new(parts.join(';'))
     end
 
     # `Array.prototype.indexOf(x)` / `.lastIndexOf(x)` -- value-equality

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: barefoot_js
 version: !ruby/object:Gem::Version
-  version: 0.18.7
+  version: 0.19.1
 platform: ruby
 authors:
 - kobaken
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-13 00:00:00.000000000 Z
+date: 2026-07-14 00:00:00.000000000 Z
 dependencies: []
 description: Engine-agnostic BarefootJS server runtime targeting ERB, ported from
   packages/adapter-perl/lib/BarefootJS.pm.