better_html 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 24abf8276750c88363603b5b3900aa6c5ca253aa
-  data.tar.gz: bc8e69fb9ff82006af0b94f50f150200ec904ece
+  metadata.gz: b9b3e15933b5788d810377d49068228464e17fa3
+  data.tar.gz: 18c03ea104454fec79e3a9dd8cf29d5ec83f8adb
 SHA512:
-  metadata.gz: 1d990f65159106d1d1794c6dd9d810ced2ab3e5c79c518a9b8165235c1d5ea1919334f8bc7d9787d460ecaab7059af2d8a63fbb7721909610b43920efe2d1943
-  data.tar.gz: ed23dc14085fd3fa583a9309339f73af41bc85e8f3a6dd1a61c7febf2d03ca575136c87544b545d5fdb0864505a262fd1eb838920d69e4f26a1e309d3feac339
+  metadata.gz: f93049ef7e686b1c1419d05f86c6240bed8e18016b2e186b6b813d9760fd0662b6db83de4ba5cf18e9b1d4c0716ae358cf25d49b4e0f695ac9866b0506e527e4
+  data.tar.gz: f6c7e9af3e8f72269321f954982313fcf907b44a40a97fd3509239d73252b0c87d418e677cb8e7392789b7f658bb73f556a43ffdc18ab4a76d83fc38cbf8f8dd

data/lib/better_html/ast/iterator.rb

@@ -5,13 +5,13 @@ module BetterHtml
   module AST
     class Iterator
       def initialize(types, &block)
-        @types = Array.wrap(types)
+        @types = types.nil? ? nil : Array.wrap(types)
         @block = block
       end
 
       def traverse(node)
         return unless node.is_a?(::AST::Node)
-        @block.call(node) if @types.include?(node.type)
+        @block.call(node) if @types.nil? || @types.include?(node.type)
         traverse_all(node)
       end
 
@@ -21,7 +21,7 @@ module BetterHtml
         end
       end
 
-      def self.descendants(root_node, type, &block)
+      def self.descendants(root_node, type)
         Enumerator.new do |yielder|
           t = new(type) { |node| yielder << node }
           t.traverse(root_node)

data/lib/better_html/ast/node.rb

@@ -6,8 +6,12 @@ module BetterHtml
     class Node < ::AST::Node
       attr_reader :loc
 
-      def descendants(type, &block)
-        AST::Iterator.descendants(self, type, &block)
+      def descendants(*types)
+        AST::Iterator.descendants(self, types)
+      end
+
+      def location
+        loc
       end
     end
   end

data/lib/better_html/errors.rb

@@ -7,16 +7,7 @@ module BetterHtml
   class UnsafeHtmlError < InterpolatorError; end
   class HtmlError < RuntimeError; end
 
-  class Errors
-    delegate :[], :each, :size, :first,
-      :empty?, :any?, :present?, to: :@errors
-
-    def initialize
-      @errors = []
-    end
-
-    def add(error)
-      @errors << error
-    end
+  class Errors < Array
+    alias_method :add, :<<
   end
 end

data/lib/better_html/test_helper/ruby_node.rb

@@ -0,0 +1,103 @@
+require 'parser/current'
+
+module BetterHtml
+  module TestHelper
+    class RubyNode < BetterHtml::AST::Node
+      BLOCK_EXPR = /\s*((\s+|\))do|\{)(\s*\|[^|]*\|)?\s*\Z/
+
+      class ParseError < RuntimeError; end
+
+      class Builder < ::Parser::Builders::Default
+        def n(type, children, source_map)
+          BetterHtml::TestHelper::RubyNode.new(type, children, loc: source_map)
+        end
+      end
+
+      def self.parse(code)
+        parser = ::Parser::CurrentRuby.new(Builder.new)
+        parser.diagnostics.ignore_warnings = true
+        parser.diagnostics.all_errors_are_fatal = false
+        parser.diagnostics.consumer = nil
+
+        buf = ::Parser::Source::Buffer.new('(string)')
+        buf.source = code.sub(BLOCK_EXPR, '')
+        parser.parse(buf)
+      end
+
+      def child_nodes
+        children.select { |child| node?(child) }
+      end
+
+      def node?(current)
+        current.is_a?(self.class)
+      end
+
+      def type?(wanted_type)
+        Array.wrap(wanted_type).include?(type)
+      end
+
+      STATIC_TYPES = [:str, :int, :true, :false, :nil]
+
+      def static_value?
+        type?(STATIC_TYPES) ||
+          (type?(:dstr) && !children.any? { |child| !child.type?(:str) })
+      end
+
+      def return_values
+        Enumerator.new do |yielder|
+          case type
+          when :send, :csend, :ivar, *STATIC_TYPES
+            yielder.yield(self)
+          when :if, :masgn, :lvasgn
+            # first child is ignored as it does not contain return values
+            # for example, in `foo ? x : y` we only care about x and y, not foo
+            children[1..-1].each do |child|
+              child.return_values.each { |v| yielder.yield(v) } if node?(child)
+            end
+          else
+            child_nodes.each do |child|
+              child.return_values.each { |v| yielder.yield(v) }
+            end
+          end
+        end
+      end
+
+      def static_return_value?
+        return false if (possible_values = return_values.to_a).empty?
+        possible_values.all?(&:static_value?)
+      end
+
+      def method_call?
+        [:send, :csend].include?(type)
+      end
+
+      def hash?
+        type?(:hash)
+      end
+
+      def pair?
+        type?(:pair)
+      end
+
+      def begin?
+        type?(:begin)
+      end
+
+      def method_name
+        children[1] if method_call?
+      end
+
+      def arguments
+        children[2..-1] if method_call?
+      end
+
+      def receiver
+        children[0] if method_call?
+      end
+
+      def method_name?(name)
+        method_call? && method_name == name
+      end
+    end
+  end
+end

data/lib/better_html/test_helper/safe_erb/allowed_script_type.rb

@@ -0,0 +1,29 @@
+require_relative 'base'
+
+module BetterHtml
+  module TestHelper
+    module SafeErb
+      class AllowedScriptType < Base
+        VALID_JAVASCRIPT_TAG_TYPES = ['text/javascript', 'text/template', 'text/html']
+
+        def validate
+          script_tags.each do |tag, _|
+            validate_type(tag)
+          end
+        end
+
+        private
+
+        def validate_type(tag)
+          return unless type_attribute = tag.attributes['type']
+          return if VALID_JAVASCRIPT_TAG_TYPES.include?(type_attribute.value)
+
+          add_error(
+            "#{type_attribute.value} is not a valid type, valid types are #{VALID_JAVASCRIPT_TAG_TYPES.join(', ')}",
+            location: type_attribute.loc
+          )
+        end
+      end
+    end
+  end
+end

data/lib/better_html/test_helper/safe_erb/base.rb

@@ -0,0 +1,56 @@
+require 'better_html/errors'
+require 'better_html/tree/tag'
+require 'better_html/test_helper/safety_error'
+require 'ast'
+
+module BetterHtml
+  module TestHelper
+    module SafeErb
+      class Base
+        attr_reader :errors
+
+        def initialize(parser, config: BetterHtml.config)
+          @parser = parser
+          @config = config
+          @errors = BetterHtml::Errors.new
+        end
+
+        def add_error(message, location:)
+          @errors.add(SafetyError.new(message, location: location))
+        end
+
+        protected
+
+        def erb_nodes(root_node)
+          Enumerator.new do |yielder|
+            next if root_node.nil?
+            root_node.descendants(:erb).each do |erb_node|
+              indicator_node, _, code_node, _ = *erb_node
+              yielder.yield(erb_node, indicator_node, code_node)
+            end
+          end
+        end
+
+        def script_tags
+          Enumerator.new do |yielder|
+            @parser.nodes_with_type(:tag).each do |tag_node|
+              tag = Tree::Tag.from_node(tag_node)
+              next if tag.closing?
+
+              if tag.name == 'script'
+                index = ast.to_a.find_index(tag_node)
+                next_node = ast.to_a[index + 1]
+
+                yielder.yield(tag, next_node.type == :text ? next_node : nil)
+              end
+            end
+          end
+        end
+
+        def ast
+          @parser.ast
+        end
+      end
+    end
+  end
+end

data/lib/better_html/test_helper/safe_erb/no_javascript_tag_helper.rb

@@ -0,0 +1,34 @@
+require_relative 'base'
+require 'better_html/test_helper/ruby_node'
+
+module BetterHtml
+  module TestHelper
+    module SafeErb
+      class NoJavascriptTagHelper < Base
+        def validate
+          no_javascript_tag_helper(ast)
+        end
+
+        private
+
+        def no_javascript_tag_helper(node)
+          erb_nodes(node).each do |erb_node, indicator_node, code_node|
+            indicator = indicator_node&.loc&.source
+            next if indicator == '#'
+            source = code_node.loc.source
+
+            next unless (ruby_node = RubyNode.parse(source))
+            ruby_node.descendants(:send, :csend).each do |send_node|
+              next unless send_node.method_name?(:javascript_tag)
+
+              add_error(
+                "'javascript_tag do' syntax is deprecated; use inline <script> instead",
+                location: erb_node.loc,
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/better_html/test_helper/safe_erb/no_statements.rb

@@ -0,0 +1,40 @@
+require_relative 'base'
+
+module BetterHtml
+  module TestHelper
+    module SafeErb
+      class NoStatements < Base
+        def validate
+          script_tags.each do |tag, content_node|
+            no_statements(content_node) unless content_node.present? && tag.attributes['type']&.value == "text/html"
+          end
+
+          if @parser.template_language == :javascript
+            @parser.nodes_with_type(:text).each do |node|
+              no_statements(node)
+            end
+          end
+
+          @parser.nodes_with_type(:cdata, :comment).each do |node|
+            no_statements(node)
+          end
+        end
+
+        private
+
+        def no_statements(node)
+          erb_nodes(node).each do |erb_node, indicator_node, code_node|
+            next unless indicator_node.nil?
+            source = code_node.loc.source
+            next if /\A\s*end/m === source
+
+            add_error(
+              "erb statement not allowed here; did you mean '<%=' ?",
+              location: erb_node.loc,
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/better_html/test_helper/safe_erb/script_interpolation.rb

@@ -0,0 +1,65 @@
+require_relative 'base'
+require 'better_html/test_helper/ruby_node'
+
+module BetterHtml
+  module TestHelper
+    module SafeErb
+      class ScriptInterpolation < Base
+        def validate
+          script_tags.each do |tag, content_node|
+            if content_node.present? && (tag.attributes['type']&.value || "text/javascript") == "text/javascript"
+              validate_script(content_node)
+            end
+          end
+
+          if @parser.template_language == :javascript
+            @parser.nodes_with_type(:text).each do |node|
+              validate_script(node)
+            end
+          end
+        end
+
+        private
+
+        def validate_script(node)
+          erb_nodes(node).each do |erb_node, indicator_node, code_node|
+            next unless indicator_node.present?
+            indicator = indicator_node.loc.source
+            next if indicator == '#'
+            source = code_node.loc.source
+
+            next unless (ruby_node = RubyNode.parse(source))
+            validate_script_interpolation(erb_node, ruby_node)
+          end
+        end
+
+        def validate_script_interpolation(parent_node, ruby_node)
+          method_calls = ruby_node.return_values.select(&:method_call?)
+
+          if method_calls.empty?
+            add_error(
+              "erb interpolation in javascript tag must call '(...).to_json'",
+              location: parent_node.loc,
+            )
+            return
+          end
+
+          method_calls.each do |call_node|
+            if call_node.method_name?(:raw)
+              call_node.arguments.each do |argument_node|
+                validate_script_interpolation(parent_node, argument_node)
+              end
+            elsif call_node.method_name?(:html_safe)
+              validate_script_interpolation(parent_node, call_node.receiver)
+            elsif !@config.javascript_safe_method?(call_node.method_name)
+              add_error(
+                "erb interpolation in javascript tag must call '(...).to_json'",
+                location: parent_node.loc,
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/better_html/test_helper/safe_erb/tag_interpolation.rb

@@ -0,0 +1,163 @@
+require_relative 'base'
+require 'better_html/test_helper/ruby_node'
+
+module BetterHtml
+  module TestHelper
+    module SafeErb
+      class TagInterpolation < Base
+        def validate
+          @parser.nodes_with_type(:tag).each do |tag_node|
+            tag = Tree::Tag.from_node(tag_node)
+            tag.attributes.each do |attribute|
+              validate_attribute(attribute)
+            end
+          end
+
+          @parser.nodes_with_type(:text).each do |node|
+            validate_text_node(node) unless in_script_tag?(node)
+          end
+        end
+
+        private
+
+        def in_script_tag?(node)
+          ast = @parser.ast.to_a
+          index = ast.find_index(node)
+          return unless (previous_node = ast[index - 1])
+          return unless previous_node.type == :tag
+
+          tag = BetterHtml::Tree::Tag.from_node(previous_node)
+          tag.name == "script" && !tag.closing?
+        end
+
+        def validate_attribute(attribute)
+          erb_nodes(attribute.value_node).each do |erb_node, indicator_node, code_node|
+            next if indicator_node.nil?
+
+            indicator = indicator_node.loc.source
+            source = code_node.loc.source
+
+            if indicator == '='
+              if (ruby_node = RubyNode.parse(source))
+                no_unsafe_calls(code_node, ruby_node)
+                unless ruby_node.static_return_value?
+                  handle_missing_safe_wrapper(code_node, ruby_node, attribute.name)
+                end
+              end
+            elsif indicator == '=='
+              add_error(
+                "erb interpolation with '<%==' inside html attribute is never safe",
+                location: erb_node.loc
+              )
+            end
+          end
+        end
+
+        def validate_text_node(text_node)
+          erb_nodes(text_node).each do |erb_node, indicator_node, code_node|
+            indicator = indicator_node&.loc&.source
+            next if indicator == '#'
+            source = code_node.loc.source
+
+            next unless (ruby_node = RubyNode.parse(source))
+            no_unsafe_calls(code_node, ruby_node)
+            validate_ruby_helper(code_node, ruby_node)
+          end
+        end
+
+        def validate_ruby_helper(parent_node, ruby_node)
+          ruby_node.descendants(:send, :csend).each do |send_node|
+            send_node.descendants(:hash).each do |hash_node|
+              hash_node.child_nodes.select(&:pair?).each do |pair_node|
+                validate_ruby_helper_hash_entry(parent_node, ruby_node, nil, *pair_node.children)
+              end
+            end
+          end
+        end
+
+        def validate_ruby_helper_hash_entry(parent_node, ruby_node, key_prefix, key_node, value_node)
+          return unless [:sym, :str].include?(key_node.type)
+          key = [key_prefix, key_node.children.first.to_s].compact.join('-').dasherize
+          case value_node.type
+          when :dstr
+            validate_ruby_helper_hash_value(parent_node, ruby_node, key, value_node)
+          when :hash
+            if key == 'data'
+              value_node.child_nodes.select(&:pair?).each do |pair_node|
+                validate_ruby_helper_hash_entry(parent_node, ruby_node, key, *pair_node.children)
+              end
+            end
+          end
+        end
+
+        def validate_ruby_helper_hash_value(parent_node, ruby_node, attr_name, hash_value)
+          hash_value.child_nodes.select(&:begin?).each do |begin_node|
+            validate_tag_interpolation(parent_node, begin_node, attr_name)
+          end
+        end
+
+        def handle_missing_safe_wrapper(parent_node, ruby_node, attr_name)
+          return unless @config.javascript_attribute_name?(attr_name)
+          method_calls = ruby_node.return_values.select(&:method_call?)
+          unsafe_calls = method_calls.select { |node| !@config.javascript_safe_method?(node.method_name) }
+          if method_calls.empty?
+            add_error(
+              "erb interpolation in javascript attribute must be wrapped in safe helper such as '(...).to_json'",
+              location: nested_location(parent_node, ruby_node)
+            )
+            true
+          elsif unsafe_calls.any?
+            unsafe_calls.each do |call_node|
+              add_error(
+                "erb interpolation in javascript attribute must be wrapped in safe helper such as '(...).to_json'",
+                location: nested_location(parent_node, call_node)
+              )
+            end
+            true
+          end
+        end
+
+        def validate_tag_interpolation(parent_node, ruby_node, attr_name)
+          return if ruby_node.static_return_value?
+          return if handle_missing_safe_wrapper(parent_node, ruby_node, attr_name)
+
+          ruby_node.return_values.each do |call_node|
+            next if call_node.static_return_value?
+
+            if @config.javascript_attribute_name?(attr_name) &&
+                  !@config.javascript_safe_method?(call_node.method_name)
+              add_error(
+                "erb interpolation in javascript attribute must be wrapped in safe helper such as '(...).to_json'",
+                location: nested_location(parent_node, ruby_node)
+              )
+            end
+          end
+        end
+
+        def no_unsafe_calls(parent_node, ruby_node)
+          ruby_node.descendants(:send, :csend).each do |call|
+            if call.method_name?(:raw)
+              add_error(
+                "erb interpolation with '<%= raw(...) %>' in this context is never safe",
+                location: nested_location(parent_node, ruby_node)
+              )
+            elsif call.method_name?(:html_safe)
+              add_error(
+                "erb interpolation with '<%= (...).html_safe %>' in this context is never safe",
+                location: nested_location(parent_node, ruby_node)
+              )
+            end
+          end
+        end
+
+        def nested_location(parent_node, ruby_node)
+          Tokenizer::Location.new(
+            parent_node.loc.document,
+            parent_node.loc.start + ruby_node.loc.expression.begin_pos,
+            parent_node.loc.start + ruby_node.loc.expression.end_pos - 1
+          )
+        end
+      end
+    end
+  end
+end