better_html 1.0.14 → 2.0.0

data/lib/better_html/better_erb/validated_output_buffer.rb

@@ -1,10 +1,8 @@
+# frozen_string_literal: true
+
 module BetterHtml
   class BetterErb
     class ValidatedOutputBuffer
-      def self.wrap(output, context, code, auto_escape)
-        Context.new(output, context, code, auto_escape)
-      end
-
       class Context
         def initialize(output, context, code, auto_escape)
           @output = output
@@ -15,6 +13,7 @@ module BetterHtml
 
         def safe_quoted_value_append=(value)
           return if value.nil?
+
           value = properly_escaped(value)
 
           if value.include?(@context[:quote_character])
@@ -22,7 +21,7 @@ module BetterHtml
               "into a quoted attribute value. The value cannot contain the character #{@context[:quote_character]}."
           end
 
-          @output.safe_append= value
+          @output.safe_append = value
         end
 
         def safe_unquoted_value_append=(value)
@@ -40,6 +39,7 @@ module BetterHtml
 
         def safe_attribute_name_append=(value)
           return if value.nil?
+
           value = value.to_s
 
           unless value =~ /\A[a-z0-9\-]*\z/
@@ -47,7 +47,7 @@ module BetterHtml
               "into a attribute name around '#{@context[:attribute_name]}<%=#{@code}%>'."
           end
 
-          @output.safe_append= value
+          @output.safe_append = value
         end
 
         def safe_after_attribute_name_append=(value)
@@ -59,7 +59,7 @@ module BetterHtml
               "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>."
           end
 
-          @output.safe_append= value.to_s
+          @output.safe_append = value.to_s
         end
 
         def safe_after_equal_append=(value)
@@ -76,11 +76,12 @@ module BetterHtml
               "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>."
           end
 
-          @output.safe_append= value.to_s
+          @output.safe_append = value.to_s
         end
 
         def safe_tag_name_append=(value)
           return if value.nil?
+
           value = value.to_s
 
           unless value =~ /\A[a-z0-9\:\-]*\z/
@@ -88,7 +89,7 @@ module BetterHtml
               "into a tag name around: <#{@context[:tag_name]}<%=#{@code}%>>."
           end
 
-          @output.safe_append= value
+          @output.safe_append = value
         end
 
         def safe_rawtext_append=(value)
@@ -96,23 +97,25 @@ module BetterHtml
 
           value = properly_escaped(value)
 
-          if @context[:tag_name].downcase == 'script' &&
-              (value =~ /<script/i || value =~ /<\/script/i)
+          if @context[:tag_name].downcase == "script" &&
+              (value =~ /<script/i || value =~ %r{</script}i)
             # https://www.w3.org/TR/html5/scripting-1.html#restrictions-for-contents-of-script-elements
             raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
               "into a script tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>. "\
               "A script tag cannot contain <script or </script anywhere inside of it."
           elsif value =~ /<#{Regexp.escape(@context[:tag_name].downcase)}/i ||
-              value =~ /<\/#{Regexp.escape(@context[:tag_name].downcase)}/i
+              value =~ %r{</#{Regexp.escape(@context[:tag_name].downcase)}}i
             raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
-              "into a #{@context[:tag_name].downcase} tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>."
+              "into a #{@context[:tag_name].downcase} tag around: " \
+              "<#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>."
           end
 
-          @output.safe_append= value
+          @output.safe_append = value
         end
 
         def safe_comment_append=(value)
           return if value.nil?
+
           value = properly_escaped(value)
 
           # in a <!-- ...here --> we disallow -->
@@ -121,12 +124,13 @@ module BetterHtml
               "into a html comment around: <!--#{@context[:comment_text]}<%=#{@code}%>."
           end
 
-          @output.safe_append= value
+          @output.safe_append = value
         end
 
         def safe_none_append=(value)
           return if value.nil?
-          @output.safe_append= properly_escaped(value)
+
+          @output.safe_append = properly_escaped(value)
         end
 
         private
@@ -135,13 +139,11 @@ module BetterHtml
           if value.is_a?(ValidatedOutputBuffer)
             # in html context, never escape a ValidatedOutputBuffer
             value.to_s
-          else
+          elsif @auto_escape
             # in html context, follow auto_escape rule
-            if @auto_escape
-              auto_escape_html_safe_value(value.to_s)
-            else
-              value.to_s
-            end
+            auto_escape_html_safe_value(value.to_s)
+          else
+            value.to_s
           end
         end
 
@@ -150,6 +152,12 @@ module BetterHtml
         end
       end
 
+      class << self
+        def wrap(output, context, code, auto_escape)
+          Context.new(output, context, code, auto_escape)
+        end
+      end
+
       def html_safe?
         true
       end

data/lib/better_html/better_erb.rb

@@ -1,74 +1,78 @@
-require 'action_view'
-if ActionView.version < Gem::Version.new("5.1")
-require 'better_html/better_erb/erubis_implementation'
-else
-require 'better_html/better_erb/erubi_implementation'
-end
-require 'better_html/better_erb/validated_output_buffer'
+# frozen_string_literal: true
 
+require "action_view"
 
-class BetterHtml::BetterErb
-  cattr_accessor :content_types
-  if ActionView.version < Gem::Version.new("5.1")
-    self.content_types = {
-      'html.erb' => BetterHtml::BetterErb::ErubisImplementation
-    }
-  else
-    self.content_types = {
-      'html.erb' => BetterHtml::BetterErb::ErubiImplementation
-    }
-  end
+require "better_html_ext"
+require "better_html/better_erb/erubi_implementation"
+require "better_html/better_erb/validated_output_buffer"
+
+module BetterHtml
+  class ParserError < RuntimeError
+    attr_reader :position, :line, :column
 
-  def self.prepend!
-    ActionView::Template::Handlers::ERB.prepend(ConditionalImplementation)
+    def initialize(message, position, line, column)
+      super(message)
+      @position = position
+      @line = line
+      @column = column
+    end
   end
+end
 
-  private
+module BetterHtml
+  class BetterErb
+    cattr_accessor :content_types
 
-  module ConditionalImplementation
+    self.content_types = {
+      "html.erb" => BetterHtml::BetterErb::ErubiImplementation,
+    }
 
-    def call(template, source = nil)
-      generate(template, source)
+    class << self
+      def prepend!
+        ActionView::Template::Handlers::ERB.prepend(ConditionalImplementation)
+      end
     end
 
-    private
+    module ConditionalImplementation
+      def call(template, source = nil)
+        generate(template, source)
+      end
+
+      private
 
-    def generate(template, source)
-      # First, convert to BINARY, so in case the encoding is
-      # wrong, we can still find an encoding tag
-      # (<%# encoding %>) inside the String using a regular
-      # expression
+      def generate(template, source)
+        # First, convert to BINARY, so in case the encoding is
+        # wrong, we can still find an encoding tag
+        # (<%# encoding %>) inside the String using a regular
+        # expression
 
-      source ||= template.source
-      filename = template.identifier.split("/").last
-      exts = filename.split(".")
-      exts = exts[1..exts.length].join(".")
-      template_source = source.dup.force_encoding(Encoding::ASCII_8BIT)
+        source ||= template.source
+        filename = template.identifier.split("/").last
+        exts = filename.split(".")
+        exts = exts[1..exts.length].join(".")
+        template_source = source.dup.force_encoding(Encoding::ASCII_8BIT)
 
-      erb = template_source.gsub(ActionView::Template::Handlers::ERB::ENCODING_TAG, '')
-      encoding = $2
+        erb = template_source.gsub(ActionView::Template::Handlers::ERB::ENCODING_TAG, "")
+        encoding = Regexp.last_match(2)
 
-      erb.force_encoding valid_encoding(source.dup, encoding)
+        erb.force_encoding(valid_encoding(source.dup, encoding))
 
-      # Always make sure we return a String in the default_internal
-      erb.encode!
+        # Always make sure we return a String in the default_internal
+        erb.encode!
 
-      excluded_template = !!BetterHtml.config.template_exclusion_filter&.call(template.identifier)
-      klass = BetterHtml::BetterErb.content_types[exts] unless excluded_template
-      klass ||= self.class.erb_implementation
+        excluded_template = !!BetterHtml.config.template_exclusion_filter&.call(template.identifier)
+        klass = BetterHtml::BetterErb.content_types[exts] unless excluded_template
+        klass ||= self.class.erb_implementation
 
-      escape = if ActionView::VERSION::MAJOR <= 5
-        self.class.escape_whitelist.include?(template.type)
-      else
-        self.class.escape_ignore_list.include?(template.type)
+        escape = self.class.escape_ignore_list.include?(template.type)
+        generator = klass.new(
+          erb,
+          escape: escape,
+          trim: (self.class.erb_trim_mode == "-")
+        )
+        generator.validate! if generator.respond_to?(:validate!)
+        generator.src
       end
-      generator = klass.new(
-        erb,
-        :escape => escape,
-        :trim => (self.class.erb_trim_mode == "-")
-      )
-      generator.validate! if generator.respond_to?(:validate!)
-      generator.src
     end
   end
 end

data/lib/better_html/config.rb

@@ -1,4 +1,6 @@
-require 'smart_properties'
+# frozen_string_literal: true
+
+require "smart_properties"
 
 module BetterHtml
   class Config
@@ -8,17 +10,18 @@ module BetterHtml
     property :partial_attribute_name_pattern, default: -> { /\A[a-zA-Z0-9\-\:]+\z/ }
     property :allow_single_quoted_attributes, default: true
     property :allow_unquoted_attributes, default: false
-    property :javascript_safe_methods, default: -> { ['to_json'] }
+    property :javascript_safe_methods, default: -> { ["to_json"] }
     property :javascript_attribute_names, default: -> { [/\Aon/i] }
     property :template_exclusion_filter
     property :lodash_safe_javascript_expression, default: -> { [/\AJSON\.stringify\(/] }
+    property :disable_parser_validation, default: false
 
     def javascript_attribute_name?(name)
-      javascript_attribute_names.any?{ |other| other === name.to_s }
+      javascript_attribute_names.any? { |other| other === name.to_s } # rubocop:disable Style/CaseEquality
     end
 
     def lodash_safe_javascript_expression?(code)
-      lodash_safe_javascript_expression.any?{ |other| other === code }
+      lodash_safe_javascript_expression.any? { |other| other === code } # rubocop:disable Style/CaseEquality
     end
 
     def javascript_safe_method?(name)

data/lib/better_html/errors.rb

@@ -1,5 +1,7 @@
-require 'active_support/core_ext/string/output_safety'
-require 'action_view'
+# frozen_string_literal: true
+
+require "active_support/core_ext/string/output_safety"
+require "action_view"
 
 module BetterHtml
   class InterpolatorError < RuntimeError; end

data/lib/better_html/helpers.rb

@@ -1,5 +1,9 @@
-module BetterHtml::Helpers
-  def html_attributes(args)
-    BetterHtml::HtmlAttributes.new(args)
+# frozen_string_literal: true
+
+module BetterHtml
+  module Helpers
+    def html_attributes(args)
+      BetterHtml::HtmlAttributes.new(args)
+    end
   end
 end

data/lib/better_html/html_attributes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module BetterHtml
   class HtmlAttributes
     def initialize(data)
@@ -7,10 +9,12 @@ module BetterHtml
     def to_s
       @data.map do |key, value|
         unless key =~ BetterHtml.config.partial_attribute_name_pattern
-          raise ArgumentError, "Attribute names must match the pattern #{BetterHtml.config.partial_attribute_name_pattern.inspect}"
+          raise ArgumentError,
+            "Attribute names must match the pattern #{BetterHtml.config.partial_attribute_name_pattern.inspect}"
         end
+
         if value.nil?
-          "#{key}"
+          key.to_s
         else
           value = value.to_s
           escaped_value = value.html_safe? ? value : CGI.escapeHTML(value)

data/lib/better_html/parser.rb

@@ -1,10 +1,12 @@
-require_relative 'tokenizer/javascript_erb'
-require_relative 'tokenizer/html_erb'
-require_relative 'tokenizer/html_lodash'
-require_relative 'tokenizer/location'
-require_relative 'tokenizer/token_array'
-require_relative 'ast/node'
-require 'parser/source/buffer'
+# frozen_string_literal: true
+
+require_relative "tokenizer/javascript_erb"
+require_relative "tokenizer/html_erb"
+require_relative "tokenizer/html_lodash"
+require_relative "tokenizer/location"
+require_relative "tokenizer/token_array"
+require_relative "ast/node"
+require "parser/source/buffer"
 
 module BetterHtml
   class Parser
@@ -21,7 +23,8 @@ module BetterHtml
     end
 
     def initialize(buffer, template_language: :html)
-      raise ArgumentError, 'first argument must be Parser::Source::Buffer' unless buffer.is_a?(::Parser::Source::Buffer)
+      raise ArgumentError, "first argument must be Parser::Source::Buffer" unless buffer.is_a?(::Parser::Source::Buffer)
+
       @buffer = buffer
       @template_language = template_language
       @erb = case template_language
@@ -38,7 +41,7 @@ module BetterHtml
 
     def nodes_with_type(*type)
       types = Array.wrap(type)
-      ast.children.select{ |node| node.is_a?(::AST::Node) && types.include?(node.type) }
+      ast.children.select { |node| node.is_a?(::AST::Node) && types.include?(node.type) }
     end
 
     def ast
@@ -76,7 +79,8 @@ module BetterHtml
         when :text, *INTERPOLATION_TYPES
           children << build_text_node(tokens)
         else
-          raise RuntimeError, "Unhandled token #{tokens.current.type} line #{tokens.current.loc.line} column #{tokens.current.loc.column}, #{children.inspect}"
+          raise "Unhandled token #{tokens.current.type} line #{tokens.current.loc.line} column " \
+            "#{tokens.current.loc.column}, #{children.inspect}"
         end
       end
 
@@ -141,6 +145,7 @@ module BetterHtml
       attributes_tokens = []
       while tokens.any?
         break if tokens.size == 1 && tokens.last.type == :solidus
+
         if tokens.current.type == :attribute_name
           attributes_tokens << build_attribute_node(tokens)
         elsif tokens.current.type == :attribute_quoted_value_start
@@ -148,7 +153,7 @@ module BetterHtml
         elsif tokens.current.type == :erb_begin
           attributes_tokens << build_erb_node(tokens)
         else
-          # todo: warn about ignored things
+          # TODO: warn about ignored things
           tokens.shift
         end
       end
@@ -179,8 +184,7 @@ module BetterHtml
     def build_attribute_value_node(tokens)
       children = shift_all_with_interpolation(tokens,
         :attribute_quoted_value_start, :attribute_quoted_value,
-        :attribute_quoted_value_end, :attribute_unquoted_value
-      )
+        :attribute_quoted_value_end, :attribute_unquoted_value)
 
       build_node(:attribute_value, children)
     end
@@ -201,6 +205,7 @@ module BetterHtml
     def build_location(enumerable)
       enumerable = enumerable.compact
       raise ArgumentError, "cannot build location for #{enumerable.inspect}" unless enumerable.first && enumerable.last
+
       Tokenizer::Location.new(@buffer, enumerable.first.loc.begin_pos, enumerable.last.loc.end_pos)
     end
 
@@ -289,9 +294,11 @@ module BetterHtml
 
     def wrap_token(object)
       return unless object
+
       if object.is_a?(::AST::Node)
         object
-      elsif [:text, :tag_name, :attribute_name, :attribute_quoted_value, :attribute_unquoted_value].include?(object.type)
+      elsif [:text, :tag_name, :attribute_name, :attribute_quoted_value,
+             :attribute_unquoted_value,].include?(object.type)
         object.loc.source
       elsif [:attribute_quoted_value_start, :attribute_quoted_value_end].include?(object.type)
         BetterHtml::AST::Node.new(:quote, [object.loc.source], loc: object.loc)

data/lib/better_html/railtie.rb

@@ -1,7 +1,11 @@
-require 'better_html/better_erb'
+# frozen_string_literal: true
 
-class BetterHtml::Railtie < Rails::Railtie
-  initializer "better_html.better_erb.initialization" do
-    BetterHtml::BetterErb.prepend!
+require "better_html/better_erb"
+
+module BetterHtml
+  class Railtie < Rails::Railtie
+    initializer "better_html.better_erb.initialization" do
+      BetterHtml::BetterErb.prepend!
+    end
   end
 end

data/lib/better_html/test_helper/ruby_node.rb

@@ -1,4 +1,7 @@
-require 'parser/current'
+# frozen_string_literal: true
+
+require "better_html/parser"
+require "parser/current"
 
 module BetterHtml
   module TestHelper
@@ -13,15 +16,17 @@ module BetterHtml
         end
       end
 
-      def self.parse(code)
-        parser = ::Parser::CurrentRuby.new(Builder.new)
-        parser.diagnostics.ignore_warnings = true
-        parser.diagnostics.all_errors_are_fatal = false
-        parser.diagnostics.consumer = nil
+      class << self
+        def parse(code)
+          parser = ::Parser::CurrentRuby.new(Builder.new)
+          parser.diagnostics.ignore_warnings = true
+          parser.diagnostics.all_errors_are_fatal = false
+          parser.diagnostics.consumer = nil
 
-        buf = ::Parser::Source::Buffer.new('(string)')
-        buf.source = code.sub(BLOCK_EXPR, '')
-        parser.parse(buf)
+          buf = ::Parser::Source::Buffer.new("(string)")
+          buf.source = code.sub(BLOCK_EXPR, "")
+          parser.parse(buf)
+        end
       end
 
       def child_nodes
@@ -64,6 +69,7 @@ module BetterHtml
 
       def static_return_value?
         return false if (possible_values = return_values.to_a).empty?
+
         possible_values.all?(&:static_value?)
       end
 

data/lib/better_html/test_helper/safe_erb/allowed_script_type.rb

@@ -1,10 +1,12 @@
-require_relative 'base'
+# frozen_string_literal: true
+
+require_relative "base"
 
 module BetterHtml
   module TestHelper
     module SafeErb
       class AllowedScriptType < Base
-        VALID_JAVASCRIPT_TAG_TYPES = ['text/javascript', 'text/template', 'text/html']
+        VALID_JAVASCRIPT_TAG_TYPES = ["application/ld+json", "text/javascript", "text/template", "text/html"]
 
         def validate
           script_tags.each do |tag, _|
@@ -15,11 +17,13 @@ module BetterHtml
         private
 
         def validate_type(tag)
-          return unless type_attribute = tag.attributes['type']
+          type_attribute = tag.attributes["type"]
+
+          return unless type_attribute
           return if VALID_JAVASCRIPT_TAG_TYPES.include?(type_attribute.value)
 
           add_error(
-            "#{type_attribute.value} is not a valid type, valid types are #{VALID_JAVASCRIPT_TAG_TYPES.join(', ')}",
+            "#{type_attribute.value} is not a valid type, valid types are #{VALID_JAVASCRIPT_TAG_TYPES.join(", ")}",
             location: type_attribute.loc
           )
         end

data/lib/better_html/test_helper/safe_erb/base.rb

@@ -1,7 +1,9 @@
-require 'better_html/errors'
-require 'better_html/tree/tag'
-require 'better_html/test_helper/safety_error'
-require 'ast'
+# frozen_string_literal: true
+
+require "better_html/errors"
+require "better_html/tree/tag"
+require "better_html/test_helper/safety_error"
+require "ast"
 
 module BetterHtml
   module TestHelper
@@ -24,6 +26,7 @@ module BetterHtml
         def erb_nodes(root_node)
           Enumerator.new do |yielder|
             next if root_node.nil?
+
             root_node.descendants(:erb).each do |erb_node|
               indicator_node, _, code_node, _ = *erb_node
               yielder.yield(erb_node, indicator_node, code_node)
@@ -37,12 +40,12 @@ module BetterHtml
               tag = Tree::Tag.from_node(tag_node)
               next if tag.closing?
 
-              if tag.name == 'script'
-                index = ast.to_a.find_index(tag_node)
-                next_node = ast.to_a[index + 1]
+              next unless tag.name == "script"
+
+              index = ast.to_a.find_index(tag_node)
+              next_node = ast.to_a[index + 1]
 
-                yielder.yield(tag, next_node&.type == :text ? next_node : nil)
-              end
+              yielder.yield(tag, next_node&.type == :text ? next_node : nil)
             end
           end
         end

data/lib/better_html/test_helper/safe_erb/no_javascript_tag_helper.rb

@@ -1,5 +1,7 @@
-require_relative 'base'
-require 'better_html/test_helper/ruby_node'
+# frozen_string_literal: true
+
+require_relative "base"
+require "better_html/test_helper/ruby_node"
 
 module BetterHtml
   module TestHelper
@@ -14,7 +16,8 @@ module BetterHtml
         def no_javascript_tag_helper(node)
           erb_nodes(node).each do |erb_node, indicator_node, code_node|
             indicator = indicator_node&.loc&.source
-            next if indicator == '#' || indicator == '%'
+            next if indicator == "#" || indicator == "%"
+
             source = code_node.loc.source
 
             ruby_node = begin
@@ -23,6 +26,7 @@ module BetterHtml
               nil
             end
             next unless ruby_node
+
             ruby_node.descendants(:send, :csend).each do |send_node|
               next unless send_node.method_name?(:javascript_tag)
 

data/lib/better_html/test_helper/safe_erb/no_statements.rb

@@ -1,4 +1,6 @@
-require_relative 'base'
+# frozen_string_literal: true
+
+require_relative "base"
 
 module BetterHtml
   module TestHelper
@@ -6,7 +8,7 @@ module BetterHtml
       class NoStatements < Base
         def validate
           script_tags.each do |tag, content_node|
-            no_statements(content_node) unless content_node.present? && tag.attributes['type']&.value == "text/html"
+            no_statements(content_node) unless content_node.present? && tag.attributes["type"]&.value == "text/html"
           end
 
           if @parser.template_language == :javascript
@@ -25,8 +27,10 @@ module BetterHtml
         def no_statements(node)
           erb_nodes(node).each do |erb_node, indicator_node, code_node|
             next unless indicator_node.nil?
+
             source = code_node.loc.source
-            next if /\A\s*end/m === source
+
+            next if /\A\s*end/m.match?(source)
 
             add_error(
               "erb statement not allowed here; did you mean '<%=' ?",