better_html 0.0.9 → 0.0.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 17ea4709e995bab97c314fd892b1926582788ab4
-  data.tar.gz: 497c12a9e1e060b4564d2310695fe06d54e3af86
+  metadata.gz: b6246bfb4cf4ae99f87a12370d99b362b9b2737b
+  data.tar.gz: 67a8747a32552d237bacafe3cc782dc7b1815ffc
 SHA512:
-  metadata.gz: 6cb55f55293eb9875635480ada4148fd3afb4a148284e24998c5cfa0a0648598f5659a8dccc41ea2329aa630f194fa8fe7d7f08bebea732310e8aebc7f80f5ff
-  data.tar.gz: 8786bbc8fe5a6df5da740715413f6ef05e9b05302f4b9cf1fe5672f4eb98ef931519155e3f219b6b3dc53c5fd1142d626e7b8c5c6f008ca655f7e9eab8daba2c
+  metadata.gz: 07c548e1027d5f582ee796df6b536bd6f895edcd42c3c2898d0eb1da61c9adffaff6683bf83cbfee3e59d0f2acb2ed70c3371606cb772b39b3a8c4df30a75d8a
+  data.tar.gz: d5168282725b6e5ba210eae30eefcfa88b8270063422f0127be7f53cc888dfa1470c9a82db09971d2b9ec540024a28f57337cf9d4e092afb5aa86c092f9aef0a

data/lib/better_html.rb

@@ -3,49 +3,21 @@ require 'active_support/core_ext/module/delegation'
 require 'active_support/core_ext/class/attribute_accessors'
 
 module BetterHtml
-  class Config
-    # regex to validate "foo" in "<foo>"
-    cattr_accessor :partial_tag_name_pattern
-    self.partial_tag_name_pattern = /\A[a-z0-9\-\:]+\z/
-
-    # regex to validate "bar" in "<foo bar=1>"
-    cattr_accessor :partial_attribute_name_pattern
-    self.partial_attribute_name_pattern = /\A[a-zA-Z0-9\-\:]+\z/
-
-    # true if "<foo bar='1'>" is valid syntax
-    cattr_accessor :allow_single_quoted_attributes
-    self.allow_single_quoted_attributes = false
-
-    # true if "<foo bar=1>" is valid syntax
-    cattr_accessor :allow_unquoted_attributes
-    self.allow_unquoted_attributes = false
-
-    # all methods that return "javascript-safe" strings
-    cattr_accessor :javascript_safe_methods
-    self.javascript_safe_methods = ['to_json']
-
-    # name of all html attributes that may contain javascript
-    cattr_accessor :javascript_attribute_names
-    self.javascript_attribute_names = [/\Aon/i]
-
-    cattr_accessor :template_exclusion_filter_block
-
-    def self.template_exclusion_filter(&block)
-      self.template_exclusion_filter_block = block
-    end
-
-    cattr_accessor :lodash_safe_javascript_expression
-    self.lodash_safe_javascript_expression = [/\AJSON\.stringify\(/]
+  def self.configure
+    yield config if block_given?
   end
 
   def self.config
     @config ||= Config.new
-    yield @config if block_given?
-    @config
+  end
+
+  def self.config=(new_config)
+    @config = new_config
   end
 end
 
 require 'better_html/version'
+require 'better_html/config'
 require 'better_html/helpers'
 require 'better_html/errors'
 require 'better_html/html_attributes'

data/lib/better_html/better_erb.rb

@@ -52,7 +52,7 @@ class BetterHtml::BetterErb
       # Always make sure we return a String in the default_internal
       erb.encode!
 
-      excluded_template = !!BetterHtml::Config.template_exclusion_filter_block&.call(template.identifier)
+      excluded_template = !!BetterHtml.config.template_exclusion_filter_block&.call(template.identifier)
       klass = BetterHtml::BetterErb.content_types[exts] unless excluded_template
       klass ||= self.class.erb_implementation
 

data/lib/better_html/better_erb/runtime_checks.rb

@@ -3,9 +3,10 @@ require 'action_view'
 
 class BetterHtml::BetterErb
   module RuntimeChecks
-    def initialize(*)
+    def initialize(erb, config: BetterHtml.config, **options)
       @parser = HtmlTokenizer::Parser.new
-      super
+      @config = config
+      super(erb, **options)
     end
 
     def validate!
@@ -112,26 +113,26 @@ class BetterHtml::BetterErb
     def check_tag_name(type, start, stop, line, column)
       text = @parser.extract(start, stop)
       return if text.upcase == "!DOCTYPE"
-      return if BetterHtml.config.partial_tag_name_pattern === text
+      return if @config.partial_tag_name_pattern === text
 
       s = "Invalid tag name #{text.inspect} does not match "\
-        "regular expression #{BetterHtml.config.partial_tag_name_pattern.inspect}\n"
+        "regular expression #{@config.partial_tag_name_pattern.inspect}\n"
       s << build_location(line, column, text.size)
       raise BetterHtml::HtmlError, s
     end
 
     def check_attribute_name(type, start, stop, line, column)
       text = @parser.extract(start, stop)
-      return if BetterHtml.config.partial_attribute_name_pattern === text
+      return if @config.partial_attribute_name_pattern === text
 
       s = "Invalid attribute name #{text.inspect} does not match "\
-        "regular expression #{BetterHtml.config.partial_attribute_name_pattern.inspect}\n"
+        "regular expression #{@config.partial_attribute_name_pattern.inspect}\n"
       s << build_location(line, column, text.size)
       raise BetterHtml::HtmlError, s
     end
 
     def check_quoted_value(type, start, stop, line, column)
-      return if BetterHtml.config.allow_single_quoted_attributes
+      return if @config.allow_single_quoted_attributes
       text = @parser.extract(start, stop)
       return if text == '"'
 
@@ -141,7 +142,7 @@ class BetterHtml::BetterErb
     end
 
     def check_unquoted_value(type, start, stop, line, column)
-      return if BetterHtml.config.allow_unquoted_attributes
+      return if @config.allow_unquoted_attributes
       s = "Unquoted attribute values are not allowed\n"
       s << build_location(line, column, stop-start)
       raise BetterHtml::HtmlError, s

data/lib/better_html/config.rb

@@ -0,0 +1,16 @@
+require 'smart_properties'
+
+module BetterHtml
+  class Config
+    include SmartProperties
+
+    property :partial_tag_name_pattern, default: /\A[a-z0-9\-\:]+\z/
+    property :partial_attribute_name_pattern, default: /\A[a-zA-Z0-9\-\:]+\z/
+    property :allow_single_quoted_attributes, default: true
+    property :allow_unquoted_attributes, default: false
+    property :javascript_safe_methods, default: ['to_json']
+    property :javascript_attribute_names, default: [/\Aon/i]
+    property :template_exclusion_filter
+    property :lodash_safe_javascript_expression, default: [/\AJSON\.stringify\(/]
+  end
+end

data/lib/better_html/node_iterator/location.rb

@@ -28,10 +28,9 @@ module BetterHtml
       end
 
       def line_source_with_underline
-        line_content = @document.lines[line-1]
-        line_content = line_content.nil? ? "" : line_content.gsub(/\n$/, '')
+        line_content = extract_line(line: line)
         spaces = line_content.scan(/\A\s*/).first
-        column_without_spaces = column - spaces.length
+        column_without_spaces = [column - spaces.length, 0].max
         underscore_length = [[stop - start, line_content.length - column_without_spaces].min, 1].max
         "#{line_content.gsub(/\A\s*/, '')}\n#{' ' * column_without_spaces}#{'^' * underscore_length}"
       end
@@ -45,6 +44,10 @@ module BetterHtml
       def calculate_column
         @document[0..start-1]&.split("\n", -1)&.last&.length || 0
       end
+
+      def extract_line(line:)
+        @document.split("\n", -1)[line - 1]&.gsub(/\n$/, '') || ""
+      end
     end
   end
 end

data/lib/better_html/test_helper/safe_erb_tester.rb

@@ -52,8 +52,9 @@ EOF
 
         VALID_JAVASCRIPT_TAG_TYPES = ['text/javascript', 'text/template', 'text/html']
 
-        def initialize(data, **options)
+        def initialize(data, config: BetterHtml.config, **options)
           @data = data
+          @config = config
           @errors = Errors.new
           @options = options.present? ? options.dup : {}
           @options[:template_language] ||= :html
@@ -228,11 +229,11 @@ EOF
         end
 
         def javascript_attribute_name?(name)
-          BetterHtml.config.javascript_attribute_names.any?{ |other| other === name.to_s }
+          @config.javascript_attribute_names.any?{ |other| other === name.to_s }
         end
 
         def javascript_safe_method?(name)
-          BetterHtml.config.javascript_safe_methods.include?(name.to_s)
+          @config.javascript_safe_methods.include?(name.to_s)
         end
 
         def validate_script_tag_content(node)
@@ -240,19 +241,20 @@ EOF
             case token.type
             when :expr_literal, :expr_escaped
               expr = RubyExpr.parse(token.code)
-              if expr.calls.empty?
-                add_error(
-                  "erb interpolation in javascript tag must call '(...).to_json'",
-                  location: token.location,
-                )
-              else
-                validate_script_expression(node, token, expr)
-              end
+              validate_script_expression(node, token, expr)
             end
           end
         end
 
         def validate_script_expression(node, token, expr)
+          if expr.calls.empty?
+            add_error(
+              "erb interpolation in javascript tag must call '(...).to_json'",
+              location: token.location,
+            )
+            return
+          end
+
           expr.calls.each do |call|
             if call.method == :raw
               call.arguments.each do |argument_node|

data/lib/better_html/test_helper/safe_lodash_tester.rb

@@ -25,8 +25,8 @@ Never use <script> tags inside lodash template.
 -----------
 EOF
 
-      def assert_lodash_safety(data)
-        tester = Tester.new(data)
+      def assert_lodash_safety(data, **options)
+        tester = Tester.new(data, **options)
 
         message = ""
         tester.errors.each do |error|
@@ -47,8 +47,9 @@ EOF
       class Tester
         attr_reader :errors
 
-        def initialize(data)
+        def initialize(data, config: BetterHtml.config)
           @data = data
+          @config = config
           @errors = Errors.new
           @nodes = BetterHtml::NodeIterator.new(data, template_language: :lodash)
           validate!
@@ -109,11 +110,11 @@ EOF
         end
 
         def javascript_attribute_name?(name)
-          BetterHtml.config.javascript_attribute_names.any?{ |other| other === name }
+          @config.javascript_attribute_names.any?{ |other| other === name }
         end
 
         def lodash_safe_javascript_expression?(code)
-          BetterHtml.config.lodash_safe_javascript_expression.any?{ |other| other === code }
+          @config.lodash_safe_javascript_expression.any?{ |other| other === code }
         end
 
         def validate_no_statements(node)

data/lib/better_html/version.rb

@@ -1,3 +1,3 @@
 module BetterHtml
-  VERSION = "0.0.9"
+  VERSION = "0.0.10"
 end

data/test/better_html/better_erb/implementation_test.rb

@@ -6,36 +6,36 @@ require 'json'
 class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
   test "simple template rendering" do
     assert_equal "<foo>some value<foo>",
-      render("<foo><%= bar %><foo>", { bar: 'some value' })
+      render("<foo><%= bar %><foo>", locals: { bar: 'some value' })
   end
 
   test "html_safe interpolation" do
     assert_equal "<foo><bar /><foo>",
-      render("<foo><%= bar %><foo>", { bar: '<bar />'.html_safe })
+      render("<foo><%= bar %><foo>", locals: { bar: '<bar />'.html_safe })
   end
 
   test "non html_safe interpolation" do
     assert_equal "<foo>&lt;bar /&gt;<foo>",
-      render("<foo><%= bar %><foo>", { bar: '<bar />' })
+      render("<foo><%= bar %><foo>", locals: { bar: '<bar />' })
   end
 
   test "interpolate non-html_safe inside attribute is escaped" do
     assert_equal "<a href=\" &#39;&quot;&gt;x \">",
-      render("<a href=\"<%= value %>\">", { value: ' \'">x ' })
+      render("<a href=\"<%= value %>\">", locals: { value: ' \'">x ' })
   end
 
   test "interpolate html_safe inside attribute is magically force-escaped" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<a href=\"<%= value %>\">", { value: ' \'">x '.html_safe })
+      render("<a href=\"<%= value %>\">", locals: { value: ' \'">x '.html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a quoted attribute value. The value cannot contain the character \".", e.message
   end
 
   test "interpolate html_safe inside single quoted attribute" do
-    BetterHtml.config.stubs(:allow_single_quoted_attributes).returns(true)
+    config = build_config(allow_single_quoted_attributes: true)
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<a href=\'<%= value %>\'>", { value: ' \'">x '.html_safe })
+      render("<a href=\'<%= value %>\'>", config: config, locals: { value: ' \'">x '.html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a quoted attribute value. The value cannot contain the character '.", e.message
@@ -43,12 +43,12 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in attribute name" do
     assert_equal "<a data-safe-foo>",
-      render("<a data-<%= value %>-foo>", { value: "safe" })
+      render("<a data-<%= value %>-foo>", locals: { value: "safe" })
   end
 
   test "interpolate in attribute name with unsafe value with spaces" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<a data-<%= value %>-foo>", { value: "un safe" })
+      render("<a data-<%= value %>-foo>", locals: { value: "un safe" })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a attribute name around 'data-<%= value %>'.", e.message
@@ -56,7 +56,7 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in attribute name with unsafe value with equal sign" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<a data-<%= value %>-foo>", { value: "un=safe" })
+      render("<a data-<%= value %>-foo>", locals: { value: "un=safe" })
     end
     assert_equal "Detected invalid characters as part of the "\
       "interpolation into a attribute name around 'data-<%= value %>'.", e.message
@@ -64,7 +64,7 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in attribute name with unsafe value with quote" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<a data-<%= value %>-foo>", { value: "un\"safe" })
+      render("<a data-<%= value %>-foo>", locals: { value: "un\"safe" })
     end
     assert_equal "Detected invalid characters as part of the "\
       "interpolation into a attribute name around 'data-<%= value %>'.", e.message
@@ -76,9 +76,9 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
   end
 
   test "interpolate after an attribute name with equal sign" do
-    BetterHtml.config.stubs(:allow_unquoted_attributes).returns(true)
+    config = build_config(allow_unquoted_attributes: true)
     e = assert_raises(BetterHtml::DontInterpolateHere) do
-      render("<a data-foo= <%= html_attributes(foo: 'bar') %>>")
+      render("<a data-foo= <%= html_attributes(foo: 'bar') %>>", config: config)
     end
     assert_equal "Do not interpolate without quotes after "\
       "attribute around 'data-foo=<%= html_attributes(foo: 'bar') %>'.", e.message
@@ -94,18 +94,18 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
   end
 
   test "interpolate in attribute without quotes" do
-    BetterHtml.config.stubs(:allow_unquoted_attributes).returns(true)
+    config = build_config(allow_unquoted_attributes: true)
     e = assert_raises(BetterHtml::DontInterpolateHere) do
-      render("<a href=<%= value %>>", { value: "un safe" })
+      render("<a href=<%= value %>>", config: config, locals: { value: "un safe" })
     end
     assert_equal "Do not interpolate without quotes after "\
       "attribute around 'href=<%= value %>'.", e.message
   end
 
   test "interpolate in attribute after value" do
-    BetterHtml.config.stubs(:allow_unquoted_attributes).returns(true)
+    config = build_config(allow_unquoted_attributes: true)
     e = assert_raises(BetterHtml::DontInterpolateHere) do
-      render("<a href=something<%= value %>>", { value: "" })
+      render("<a href=something<%= value %>>", config: config, locals: { value: "" })
     end
     assert_equal "Do not interpolate without quotes around this "\
       "attribute value. Instead of <a href=something<%= value %>> "\
@@ -114,12 +114,12 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in tag name" do
     assert_equal "<tag-safe-foo>",
-      render("<tag-<%= value %>-foo>", { value: "safe" })
+      render("<tag-<%= value %>-foo>", locals: { value: "safe" })
   end
 
   test "interpolate in tag name with space" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<tag-<%= value %>-foo>", { value: "un safe" })
+      render("<tag-<%= value %>-foo>", locals: { value: "un safe" })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a tag name around: <tag-<%= value %>>.", e.message
@@ -127,7 +127,7 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in tag name with slash" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<tag-<%= value %>-foo>", { value: "un/safe" })
+      render("<tag-<%= value %>-foo>", locals: { value: "un/safe" })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a tag name around: <tag-<%= value %>>.", e.message
@@ -135,7 +135,7 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in tag name with end of tag" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<tag-<%= value %>-foo>", { value: "><script>" })
+      render("<tag-<%= value %>-foo>", locals: { value: "><script>" })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a tag name around: <tag-<%= value %>>.", e.message
@@ -143,12 +143,12 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in comment" do
     assert_equal "<!-- safe -->",
-      render("<!-- <%= value %> -->", { value: "safe" })
+      render("<!-- <%= value %> -->", locals: { value: "safe" })
   end
 
   test "interpolate in comment with end-of-comment" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<!-- <%= value %> -->", { value: "-->".html_safe })
+      render("<!-- <%= value %> -->", locals: { value: "-->".html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a html comment around: <!-- <%= value %>.", e.message
@@ -156,18 +156,18 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "non html_safe interpolation into comment tag" do
     assert_equal "<!-- --&gt; -->",
-      render("<!-- <%= value %> -->", value: '-->')
+      render("<!-- <%= value %> -->", locals: { value: '-->' })
   end
 
   test "interpolate in script tag" do
     assert_equal "<script> foo safe bar<script>",
-      render("<script> foo <%= value %> bar<script>", { value: "safe" })
+      render("<script> foo <%= value %> bar<script>", locals: { value: "safe" })
   end
 
   test "interpolate in script tag with start of comment" do
     skip "skip for now; causing problems"
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<script> foo <%= value %> bar<script>", { value: "<!--".html_safe })
+      render("<script> foo <%= value %> bar<script>", locals: { value: "<!--".html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a script tag around: <script> foo <%= value %>. "\
@@ -176,7 +176,7 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in script tag with start of script" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<script> foo <%= value %> bar<script>", { value: "<script".html_safe })
+      render("<script> foo <%= value %> bar<script>", locals: { value: "<script".html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a script tag around: <script> foo <%= value %>. "\
@@ -185,12 +185,12 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in script tag with raw interpolation" do
     assert_equal "<script> x = \"foo\" </script>",
-      render("<script> x = <%== value %> </script>", { value: JSON.dump("foo") })
+      render("<script> x = <%== value %> </script>", locals: { value: JSON.dump("foo") })
   end
 
   test "interpolate in script tag with start of script case insensitive" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<script> foo <%= value %> bar<script>", { value: "<ScRIpT".html_safe })
+      render("<script> foo <%= value %> bar<script>", locals: { value: "<ScRIpT".html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a script tag around: <script> foo <%= value %>. "\
@@ -199,7 +199,7 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "interpolate in script tag with end of script" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<script> foo <%= value %> bar<script>", { value: "</script".html_safe })
+      render("<script> foo <%= value %> bar<script>", locals: { value: "</script".html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a script tag around: <script> foo <%= value %>. "\
@@ -221,17 +221,17 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "non html_safe interpolation into rawtext tag" do
     assert_equal "<title>&lt;/title&gt;</title>",
-      render("<title><%= value %></title>", value: '</title>')
+      render("<title><%= value %></title>", locals: { value: '</title>' })
   end
 
   test "html_safe interpolation into rawtext tag" do
     assert_equal "<title><safe></title>",
-      render("<title><%= value %></title>", value: '<safe>'.html_safe)
+      render("<title><%= value %></title>", locals: { value: '<safe>'.html_safe })
   end
 
   test "html_safe interpolation terminating the current tag" do
     e = assert_raises(BetterHtml::UnsafeHtmlError) do
-      render("<title><%= value %></title>", value: '</title>'.html_safe)
+      render("<title><%= value %></title>", locals: { value: '</title>'.html_safe })
     end
     assert_equal "Detected invalid characters as part of the interpolation "\
       "into a title tag around: <title><%= value %>.", e.message
@@ -273,7 +273,7 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
 
   test "can interpolate method calls without parenthesis" do
     assert_equal "<div>foo</div>",
-      render("<div><%= send 'value' %></div>", value: 'foo')
+      render("<div><%= send 'value' %></div>", locals: { value: 'foo' })
   end
 
   test "tag names are validated against tag_name_pattern regexp" do
@@ -290,16 +290,16 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
     e = assert_raises(BetterHtml::HtmlError) do
       render("<foo bar_baz=\"1\">")
     end
-    assert_equal "Invalid attribute name \"bar_baz\" does not match regular expression #{BetterHtml.config.partial_attribute_name_pattern.inspect}\n"\
+    assert_equal "Invalid attribute name \"bar_baz\" does not match regular expression #{build_config.partial_attribute_name_pattern.inspect}\n"\
       "On line 1 column 5:\n"\
       "<foo bar_baz=\"1\">\n"\
       "     ^^^^^^^", e.message
   end
 
   test "single quotes are disallowed when allow_single_quoted_attributes=false" do
-    BetterHtml.config.stubs(:allow_single_quoted_attributes).returns(false)
+    config = build_config(allow_single_quoted_attributes: false)
     e = assert_raises(BetterHtml::HtmlError) do
-      render("<foo bar='1'>")
+      render("<foo bar='1'>", config: config)
     end
     assert_equal "Single-quoted attributes are not allowed\n"\
       "On line 1 column 9:\n"\
@@ -308,16 +308,16 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
   end
 
   test "single quotes are allowed when allow_single_quoted_attributes=true" do
-    BetterHtml.config.stubs(:allow_single_quoted_attributes).returns(true)
+    config = build_config(allow_single_quoted_attributes: true)
     assert_nothing_raised do
-      render("<foo bar='1'>")
+      render("<foo bar='1'>", config: config)
     end
   end
 
   test "unquoted values are disallowed when allow_unquoted_attributes=false" do
-    BetterHtml.config.stubs(:allow_unquoted_attributes).returns(false)
+    config = build_config(allow_unquoted_attributes: false)
     e = assert_raises(BetterHtml::HtmlError) do
-      render("<foo bar=1>")
+      render("<foo bar=1>", config: config)
     end
     assert_equal "Unquoted attribute values are not allowed\n"\
       "On line 1 column 9:\n"\
@@ -326,9 +326,9 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
   end
 
   test "unquoted values are allowed when allow_unquoted_attributes=true" do
-    BetterHtml.config.stubs(:allow_unquoted_attributes).returns(true)
+    config = build_config(allow_unquoted_attributes: true)
     assert_nothing_raised do
-      render("<foo bar=1>")
+      render("<foo bar=1>", config: config)
     end
   end
 
@@ -382,9 +382,13 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
     end
   end
 
-  def render(source, locals={})
+  def build_config(**options)
+    BetterHtml::Config.new(**options)
+  end
+
+  def render(source, config: build_config, locals: {})
     context = ViewContext.new(locals)
-    impl = compile(source)
+    impl = compile(source, config: config)
     if ActionView.version < Gem::Version.new("5.1")
       impl.result(context.get_binding)
     else
@@ -392,11 +396,11 @@ class BetterHtml::BetterErb::ImplementationTest < ActiveSupport::TestCase
     end
   end
 
-  def compile(source)
+  def compile(source, config: build_config)
     if ActionView.version < Gem::Version.new("5.1")
-      BetterHtml::BetterErb::ErubisImplementation.new(source)
+      BetterHtml::BetterErb::ErubisImplementation.new(source, config: config)
     else
-      BetterHtml::BetterErb::ErubiImplementation.new(source)
+      BetterHtml::BetterErb::ErubiImplementation.new(source, config: config)
     end
   end
 end

data/test/better_html/test_helper/safe_erb_tester_test.rb

@@ -5,12 +5,10 @@ module BetterHtml
   module TestHelper
     class SafeErbTesterTest < ActiveSupport::TestCase
       setup do
-        BetterHtml.config
-          .stubs(:javascript_safe_methods)
-          .returns(['j', 'escape_javascript', 'to_json'])
-        BetterHtml.config
-          .stubs(:javascript_attribute_names)
-          .returns([/\Aon/i, 'data-eval'])
+        @config = BetterHtml::Config.new(
+          javascript_safe_methods: ['j', 'escape_javascript', 'to_json'],
+          javascript_attribute_names: [/\Aon/i, 'data-eval'],
+        )
       end
 
       test "string without interpolation is safe" do
@@ -390,9 +388,17 @@ module BetterHtml
         assert_equal "erb interpolation in javascript attribute must call '(...).to_json'", errors.first.message
       end
 
+      test "ivar missing .to_json is unsafe" do
+        errors = parse('<script><%= @feature.html_safe %></script>').errors
+
+        assert_equal 1, errors.size
+        assert_equal "<%= @feature.html_safe %>", errors.first.location.source
+        assert_equal "erb interpolation in javascript tag must call '(...).to_json'", errors.first.message
+      end
+
       private
       def parse(data, template_language: :html)
-        SafeErbTester::Tester.new(data, template_language: template_language)
+        SafeErbTester::Tester.new(data, config: @config, template_language: template_language)
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: better_html
 version: !ruby/object:Gem::Version
-  version: 0.0.9
+  version: 0.0.10
 platform: ruby
 authors:
 - Francois Chagnon
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-11-06 00:00:00.000000000 Z
+date: 2017-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: erubi
@@ -66,6 +66,34 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.4'
+- !ruby/object:Gem::Dependency
+  name: smart_properties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: html_tokenizer
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -96,6 +124,7 @@ files:
 - lib/better_html/better_erb/erubis_implementation.rb
 - lib/better_html/better_erb/runtime_checks.rb
 - lib/better_html/better_erb/validated_output_buffer.rb
+- lib/better_html/config.rb
 - lib/better_html/errors.rb
 - lib/better_html/helpers.rb
 - lib/better_html/html_attributes.rb