barefoot_js 0.34.0 → 0.35.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc06e7c1b1034cd9b66feb96345728a982cf05d7e8ed1a516b4745610d970e92
-  data.tar.gz: db583b2109ce5698f3f5c05851a809f339696b3cb49794867e0724612444f3e6
+  metadata.gz: 9543a49df4b2eee8431bda7b44cabfe30268e917937dcd3be6db87127b8617d4
+  data.tar.gz: dea994d91c8010372fcb4ee3c0e2a3cfe5baf5f73aef51e20d59bed25e90807f
 SHA512:
-  metadata.gz: a30474f7c0db2c65a1e8060bcdb0ba81d38a3a35332b03ddaf7aa07c7b1ddcdc4b0dba8f964ff3f59d7a5283efcbc790798f2a17294d0d4b0216ad639840addf
-  data.tar.gz: 260c22ccc6de17226901f8ba5c17b049dedc8c2889a2043e42d0b614072c0b01240a750edeb327a1c3a269214b93efb3915b1ffe8cef725dee98833179047b1a
+  metadata.gz: 5ac1295c85cc4838934d5dbcc642941bc0253bb7eca334fbbd8cc8da23d2ab1c263625d9f50e786b9698481487b4c143f6927c89378086ff1045b3ea69d55055
+  data.tar.gz: 98b3d79949c9028dbb92fcf056c986b7ee65dcaba7cf7d623ab3772d6ce53205ae93233f8b35458abe60156e6ad3ee2c667240c140be0b9cc1fca3142c47460c

data/lib/barefoot_js.rb

@@ -184,6 +184,22 @@ module BarefootJS
       "<!--bf-#{text}-->"
     end
 
+    # Neutralize a value for splicing into `comment`'s HTML comment content
+    # (#2795 follow-up). `comment` itself does no escaping -- fine for every
+    # other caller (marker IDs like "cond-start:s0", "loop:l0", ...), which
+    # are entirely compiler-generated, but the whole-item-conditional loop's
+    # "loop-i:<key>" anchor carries a user-controlled key. Standard HTML
+    # escaping doesn't help inside a comment -- only the literal sequence
+    # "-->" terminates it early, and &/</>/"/' are not special there. The
+    # key's exact text doesn't need to round-trip (the client's
+    # mapArrayAnchored matches items positionally and by its own
+    # JS-computed key, never by re-parsing the anchor Comment.nodeValue), so
+    # replacing every "-" with the visually-similar U+2010 is sufficient and
+    # needs no decoding.
+    def escape_comment_key(value)
+      string(value).gsub('-', '‐')
+    end
+
     # Map a JS-boolean-shaped value to the JS `String(bool)` form. See
     # BarefootJS.pm's `bool_str` docstring for the boolean-only contract --
     # callers must have already classified the expression as boolean-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: barefoot_js
 version: !ruby/object:Gem::Version
-  version: 0.34.0
+  version: 0.35.0
 platform: ruby
 authors:
 - kobaken
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-05 00:00:00.000000000 Z
+date: 2026-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tzinfo