better_html 0.0.8 → 0.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 3a3a50dbfab3ea7cc2e0f83c166345072bb1fa1f
-  data.tar.gz: 1fb0f5196c7069c9ad05af5b13b9993c744d2fbf
+  metadata.gz: 17ea4709e995bab97c314fd892b1926582788ab4
+  data.tar.gz: 497c12a9e1e060b4564d2310695fe06d54e3af86
 SHA512:
-  metadata.gz: 7de6bd1ecece7d662029e21911a89e54cb0534f07648638ee0e97ef45c1ededddc09256662a49c7b47bc71a21afaca7ccb35b9eebf77ae9fa87fadb99e9d3a61
-  data.tar.gz: d6214164d502b2e00f0b95f3659756f30b49d12e845d825d7946aa1f38c447a3246c8ea09152963c00d13822bf290daa343db45fba806fa7a42448334233896f
+  metadata.gz: 6cb55f55293eb9875635480ada4148fd3afb4a148284e24998c5cfa0a0648598f5659a8dccc41ea2329aa630f194fa8fe7d7f08bebea732310e8aebc7f80f5ff
+  data.tar.gz: 8786bbc8fe5a6df5da740715413f6ef05e9b05302f4b9cf1fe5672f4eb98ef931519155e3f219b6b3dc53c5fd1142d626e7b8c5c6f008ca655f7e9eab8daba2c

data/lib/better_html/node_iterator/html_erb.rb

@@ -14,6 +14,7 @@ module BetterHtml
       def initialize(document)
         @parser = HtmlTokenizer::Parser.new
         @tokens = []
+        @document = document
         super(document, regexp: REGEXP_WITHOUT_TRIM, trim: false)
       end
 
@@ -29,7 +30,8 @@ module BetterHtml
           type: :stmt,
           code: code,
           text: text,
-          location: Location.new(start, stop, @parser.line_number, @parser.column_number)
+          location: Location.new(@document, start, stop, @parser.line_number, @parser.column_number),
+          code_location: Location.new(@document, start+2, stop-2, @parser.line_number, @parser.column_number+2)
         )
         @parser.append_placeholder(text)
       end
@@ -42,7 +44,8 @@ module BetterHtml
           type: indicator == '=' ? :expr_literal : :expr_escaped,
           code: code,
           text: text,
-          location: Location.new(start, stop, @parser.line_number, @parser.column_number)
+          location: Location.new(@document, start, stop, @parser.line_number, @parser.column_number),
+          code_location: Location.new(@document, start+2+indicator.size, stop-2, @parser.line_number, @parser.column_number+2+indicator.size)
         )
         @parser.append_placeholder(text)
       end
@@ -58,7 +61,7 @@ module BetterHtml
         @tokens << Token.new(
           type: type,
           text: @parser.extract(start, stop),
-          location: Location.new(start, stop, line, column),
+          location: Location.new(@document, start, stop, line, column),
           **(extra_attributes || {})
         )
       end

data/lib/better_html/node_iterator/html_lodash.rb

@@ -92,7 +92,7 @@ module BetterHtml
           type: type,
           text: text,
           code: code,
-          location: Location.new(start, stop, line || @parser.line_number, column || @parser.column_number),
+          location: Location.new(@source, start, stop, line || @parser.line_number, column || @parser.column_number),
           **(extra_attributes || {})
         )
       end

data/lib/better_html/node_iterator/javascript_erb.rb

@@ -7,10 +7,11 @@ module BetterHtml
     class JavascriptErb < ::Erubi::Engine
       attr_reader :tokens
 
-      def initialize(document)
-        @document = ""
+      def initialize(source)
+        @source = source
+        @parsed_document = ""
         @tokens = []
-        super(document, regexp: HtmlErb::REGEXP_WITHOUT_TRIM, trim: false)
+        super(source, regexp: HtmlErb::REGEXP_WITHOUT_TRIM, trim: false)
       end
 
       def add_text(text)
@@ -33,21 +34,21 @@ module BetterHtml
       private
 
       def add_token(type, text, code = nil)
-        start = @document.size
+        start = @parsed_document.size
         stop = start + text.size
-        lines = @document.split("\n", -1)
+        lines = @parsed_document.split("\n", -1)
         line = lines.empty? ? 1 : lines.size
         column = lines.empty? ? 0 : lines.last.size
         @tokens << Token.new(
           type: type,
           text: text,
           code: code,
-          location: Location.new(start, stop, line, column)
+          location: Location.new(@source, start, stop, line, column)
         )
       end
 
       def append(text)
-        @document << text
+        @parsed_document << text
       end
     end
   end

data/lib/better_html/node_iterator/location.rb

@@ -1,14 +1,50 @@
 module BetterHtml
   class NodeIterator
     class Location
-      attr_accessor :start, :stop, :line, :column
+      attr_accessor :start, :stop
 
-      def initialize(start, stop, line, column)
+      def initialize(document, start, stop, line = nil, column = nil)
+        @document = document
         @start = start
         @stop = stop
         @line = line
         @column = column
       end
+
+      def range
+        Range.new(start, stop-1)
+      end
+
+      def source
+        @document[range]
+      end
+
+      def line
+        @line ||= calculate_line
+      end
+
+      def column
+        @column ||= calculate_column
+      end
+
+      def line_source_with_underline
+        line_content = @document.lines[line-1]
+        line_content = line_content.nil? ? "" : line_content.gsub(/\n$/, '')
+        spaces = line_content.scan(/\A\s*/).first
+        column_without_spaces = column - spaces.length
+        underscore_length = [[stop - start, line_content.length - column_without_spaces].min, 1].max
+        "#{line_content.gsub(/\A\s*/, '')}\n#{' ' * column_without_spaces}#{'^' * underscore_length}"
+      end
+
+      private
+
+      def calculate_line
+        @document[0..start-1].scan("\n").count + 1
+      end
+
+      def calculate_column
+        @document[0..start-1]&.split("\n", -1)&.last&.length || 0
+      end
     end
   end
 end

data/lib/better_html/test_helper/ruby_expr.rb

@@ -1,88 +1,113 @@
-require 'ripper'
-require 'pp'
+require 'parser/current'
 
 module BetterHtml
   module TestHelper
     class RubyExpr
-      attr_reader :calls
-
       BLOCK_EXPR = /\s*((\s+|\))do|\{)(\s*\|[^|]*\|)?\s*\Z/
 
       class ParseError < RuntimeError; end
 
       class MethodCall
         attr_accessor :instance, :method, :arguments
-      end
 
-      def initialize(code: nil, tree: nil)
-        if code
-          code = code.gsub(BLOCK_EXPR, '')
-          tree = Ripper.sexp(code)
-          raise ParseError, "cannot parse code" unless tree && tree.last.first.is_a?(Array)
-          @tree = tree.last.first
-        else
-          @tree = tree
+        def initialize(instance, method, arguments)
+          @instance = instance
+          @method = method
+          @arguments = arguments
         end
-        @calls = []
-        parse!
+
+        def self.from_ast_node(node)
+          new(node.children[0], node.children[1], node.children[2..-1])
+        end
+      end
+
+      def initialize(ast)
+        raise ArgumentError, "expect first argument to be Parser::AST::Node" unless ast.is_a?(Parser::AST::Node)
+        @ast = ast
       end
 
-      private
+      def self.parse(code)
+        parser = Parser::CurrentRuby.new
+        parser.diagnostics.consumer = lambda { |diag| }
+        buf = Parser::Source::Buffer.new('(string)')
+        buf.source = code.sub(BLOCK_EXPR, '')
+        parsed = parser.parse(buf)
+        raise ParseError, "error parsing code: #{code.inspect}" unless parsed
+        new(parsed)
+      end
+
+      def start
+        @ast.loc.expression.begin_pos
+      end
 
-      def parse!
-        parse_expr(@tree)
+      def end
+        @ast.loc.expression.end_pos
       end
 
-      def parse_expr(expr)
-        case expr.first
-        when :var_ref
-          parse_expr(expr[1])
-        when :paren
-          parse_expr(expr[1].first)
-        when :string_literal
-          parse_expr(expr[1])
-        when :string_content
-          expr[1..-1].each do |subexpr|
-            parse_expr(subexpr)
+      def traverse(current=@ast, only: nil, &block)
+        yield current if node_match?(current, only)
+        each_child_node(current) do |child|
+          traverse(child, only: only, &block)
+        end
+      end
+
+      def each_child_node(current=@ast, only: nil, range: (0..-1))
+        current.children[range].each do |child|
+          if child.is_a?(Parser::AST::Node) && node_match?(child, only)
+            yield child
           end
-        when :string_embexpr
-          expr[1].each do |subexpr|
-            parse_expr(subexpr)
+        end
+      end
+
+      def node_match?(current, type)
+        type.nil? || Array[type].flatten.include?(current.type)
+      end
+
+      STATIC_TYPES = [:str, :int, :true, :false, :nil]
+
+      def each_return_value_recursive(current=@ast, only: nil, &block)
+        case current.type
+        when :send, :csend, :ivar, *STATIC_TYPES
+          yield current if node_match?(current, only)
+        when :if, :masgn, :lvasgn
+          # first child is ignored as it does not contain return values
+          # for example, in `foo ? x : y` we only care about x and y, not foo
+          each_child_node(current, range: 1..-1) do |child|
+            each_return_value_recursive(child, only: only, &block)
           end
-        when :assign, :massign
-          parse_expr(expr[2])
-        when :call
-          @calls << obj = MethodCall.new
-          obj.instance = expr[1]
-          obj.method = parse_expr(expr[3])
-          obj
-        when :fcall, :vcall
-          @calls << obj = MethodCall.new
-          obj.method = parse_expr(expr[1])
-          obj
-        when :method_add_arg
-          # foo(bar) -> foo=expr[1], bar=expr[2]
-          obj = parse_expr(expr[1])
-          obj.arguments = parse_expr(expr[2])
-          obj
-        when :command
-          # foo bar -> foo=expr[1], bar=expr[2]
-          @calls << obj = MethodCall.new
-          obj.method = parse_expr(expr[1])
-          obj.arguments = parse_expr(expr[2])
-          obj
-        when :arg_paren
-          parse_expr(expr[1]) unless expr[1].nil?
-        when :if_mod, :unless_mod
-          # foo if bar -> bar=expr[1], foo=expr[2]
-          parse_expr(expr[2])
-        when :ifop
-          # foo ? bar : baz -> foo=expr[1], bar=expr[2], baz=expr[3]
-          parse_expr(expr[2])
-          parse_expr(expr[3])
         else
-          expr[1]
+          each_child_node(current) do |child|
+            each_return_value_recursive(child, only: only, &block)
+          end
+        end
+      end
+
+      def static_value?
+        returns = []
+        each_return_value_recursive do |node|
+          returns << node
+        end
+        return false if returns.size == 0
+        returns.each do |node|
+          if STATIC_TYPES.include?(node.type)
+            next
+          elsif node.type == :dstr
+            each_child_node(node) do |child|
+              return false if child.type != :str
+            end
+          else
+            return false
+          end
+        end
+        true
+      end
+
+      def calls
+        calls = []
+        each_return_value_recursive(only: [:send, :csend]) do |node|
+          calls << MethodCall.from_ast_node(node)
         end
+        calls
       end
     end
   end

data/lib/better_html/test_helper/safe_erb_tester.rb

@@ -1,11 +1,10 @@
 require 'better_html/test_helper/ruby_expr'
-require_relative 'safety_tester_base'
+require 'better_html/test_helper/safety_error'
+require 'parser/current'
 
 module BetterHtml
   module TestHelper
     module SafeErbTester
-      include SafetyTesterBase
-
       SAFETY_TIPS = <<-EOF
 -----------
 
@@ -34,7 +33,11 @@ EOF
 
         message = ""
         tester.errors.each do |error|
-          message << format_safety_error(data, error)
+          message << <<~EOL
+            On line #{error.location.line}
+            #{error.message}
+            #{error.location.line_source_with_underline}\n
+          EOL
         end
 
         message << SAFETY_TIPS
@@ -58,8 +61,8 @@ EOF
           validate!
         end
 
-        def add_error(token, message)
-          @errors.add(SafetyTesterBase::SafetyError.new(token, message))
+        def add_error(message, location:)
+          @errors.add(SafetyError.new(message, location: location))
         end
 
         def validate!
@@ -80,6 +83,8 @@ EOF
                 validate_javascript_tag_type(node) unless node.closing?
               end
             when BetterHtml::NodeIterator::Text
+              validate_text_content(node)
+
               if @nodes.template_language == :javascript
                 validate_script_tag_content(node)
                 validate_no_statements(node)
@@ -102,7 +107,10 @@ EOF
           typeattr = element['type']
           return if typeattr.nil?
           if !VALID_JAVASCRIPT_TAG_TYPES.include?(typeattr.unescaped_value)
-            add_error(typeattr.value_parts.first, "#{typeattr.value} is not a valid type, valid types are #{VALID_JAVASCRIPT_TAG_TYPES.join(', ')}")
+            add_error(
+              "#{typeattr.value} is not a valid type, valid types are #{VALID_JAVASCRIPT_TAG_TYPES.join(', ')}",
+              location: typeattr.value_parts.first.location
+            )
           end
         end
 
@@ -111,48 +119,132 @@ EOF
             attr_token.value_parts.each do |value_token|
               case value_token.type
               when :expr_literal
-                validate_tag_expression(element, attr_token.name, value_token)
+                begin
+                  expr = RubyExpr.parse(value_token.code)
+                  validate_tag_expression(value_token, expr, attr_token.name)
+                rescue RubyExpr::ParseError
+                  nil
+                end
               when :expr_escaped
-                add_error(value_token, "erb interpolation with '<%==' inside html attribute is never safe")
+                add_error(
+                  "erb interpolation with '<%==' inside html attribute is never safe",
+                  location: value_token.location
+                )
               end
             end
           end
         end
 
-        def validate_tag_expression(node, attr_name, value_token)
-          expr = RubyExpr.new(code: value_token.code)
+        def validate_text_content(text)
+          text.content_parts.each do |text_token|
+            case text_token.type
+            when :stmt, :expr_literal, :expr_escaped
+              begin
+                expr = RubyExpr.parse(text_token.code)
+                validate_ruby_helper(text_token, expr)
+              rescue RubyExpr::ParseError
+                nil
+              end
+            end
+          end
+        end
+
+        def validate_ruby_helper(parent_token, expr)
+          expr.traverse(only: [:send, :csend]) do |send_node|
+            expr.each_child_node(send_node, only: :hash) do |hash_node|
+              expr.each_child_node(hash_node, only: :pair) do |pair_node|
+                validate_ruby_helper_hash_entry(parent_token, expr, nil, *pair_node.children)
+              end
+            end
+          end
+        end
+
+        def validate_ruby_helper_hash_entry(parent_token, expr, key_prefix, key_node, value_node)
+          return unless [:sym, :str].include?(key_node.type)
+          key = [key_prefix, key_node.children.first.to_s].compact.join('-').dasherize
+          case value_node.type
+          when :dstr
+            validate_ruby_helper_hash_value(parent_token, expr, key, value_node)
+          when :hash
+            if key == 'data'
+              expr.each_child_node(value_node, only: :pair) do |pair_node|
+                validate_ruby_helper_hash_entry(parent_token, expr, key, *pair_node.children)
+              end
+            end
+          end
+        end
+
+        def validate_ruby_helper_hash_value(parent_token, expr, attr_name, hash_value)
+          expr.each_child_node(hash_value, only: :begin) do |child|
+            validate_tag_expression(parent_token, RubyExpr.new(child), attr_name)
+          end
+        end
+
+        def validate_tag_expression(parent_token, expr, attr_name)
+          return if expr.static_value?
 
           if javascript_attribute_name?(attr_name) && expr.calls.empty?
-            add_error(value_token, "erb interpolation in javascript attribute must call '(...).to_json'")
+            add_error(
+              "erb interpolation in javascript attribute must call '(...).to_json'",
+              location: NodeIterator::Location.new(
+                @data,
+                parent_token.code_location.start + expr.start,
+                parent_token.code_location.start + expr.end
+              )
+            )
             return
           end
 
           expr.calls.each do |call|
-            if call.method == 'raw'
-              add_error(value_token, "erb interpolation with '<%= raw(...) %>' inside html attribute is never safe")
-            elsif call.method == 'html_safe'
-              add_error(value_token, "erb interpolation with '<%= (...).html_safe %>' inside html attribute is never safe")
+            if call.method == :raw
+              add_error(
+                "erb interpolation with '<%= raw(...) %>' inside html attribute is never safe",
+                location: NodeIterator::Location.new(
+                  @data,
+                  parent_token.code_location.start + expr.start,
+                  parent_token.code_location.start + expr.end
+                )
+              )
+            elsif call.method == :html_safe
+              add_error(
+                "erb interpolation with '<%= (...).html_safe %>' inside html attribute is never safe",
+                location: NodeIterator::Location.new(
+                  @data,
+                  parent_token.code_location.start + expr.start,
+                  parent_token.code_location.start + expr.end
+                )
+              )
             elsif javascript_attribute_name?(attr_name) && !javascript_safe_method?(call.method)
-              add_error(value_token, "erb interpolation in javascript attribute must call '(...).to_json'")
+              add_error(
+                "erb interpolation in javascript attribute must call '(...).to_json'",
+                location: NodeIterator::Location.new(
+                  @data,
+                  parent_token.code_location.start + expr.start,
+                  parent_token.code_location.start + expr.end
+                )
+              )
             end
           end
         end
 
         def javascript_attribute_name?(name)
-          BetterHtml.config.javascript_attribute_names.any?{ |other| other === name }
+          BetterHtml.config.javascript_attribute_names.any?{ |other| other === name.to_s }
         end
 
         def javascript_safe_method?(name)
-          BetterHtml.config.javascript_safe_methods.include?(name)
+          BetterHtml.config.javascript_safe_methods.include?(name.to_s)
         end
 
         def validate_script_tag_content(node)
           node.content_parts.each do |token|
             case token.type
             when :expr_literal, :expr_escaped
-              expr = RubyExpr.new(code: token.code)
+              expr = RubyExpr.parse(token.code)
               if expr.calls.empty?
-                add_error(token, "erb interpolation in javascript tag must call '(...).to_json'")
+                add_error(
+                  "erb interpolation in javascript tag must call '(...).to_json'",
+                  location: token.location,
+                )
               else
                 validate_script_expression(node, token, expr)
               end
@@ -162,14 +254,19 @@ EOF
 
         def validate_script_expression(node, token, expr)
           expr.calls.each do |call|
-            if call.method == 'raw'
-              arguments_expr = RubyExpr.new(tree: call.arguments)
-              validate_script_expression(node, token, arguments_expr)
-            elsif call.method == 'html_safe'
-              instance_expr = RubyExpr.new(tree: call.instance)
+            if call.method == :raw
+              call.arguments.each do |argument_node|
+                arguments_expr = RubyExpr.new(argument_node)
+                validate_script_expression(node, token, arguments_expr)
+              end
+            elsif call.method == :html_safe
+              instance_expr = RubyExpr.new(call.instance)
               validate_script_expression(node, token, instance_expr)
             elsif !javascript_safe_method?(call.method)
-              add_error(token, "erb interpolation in javascript tag must call '(...).to_json'")
+              add_error(
+                "erb interpolation in javascript tag must call '(...).to_json'",
+                location: token.location,
+              )
             end
           end
         end
@@ -177,7 +274,10 @@ EOF
         def validate_no_statements(node)
           node.content_parts.each do |token|
             if token.type == :stmt && !(/\A\s*end/m === token.code)
-              add_error(token, "erb statement not allowed here; did you mean '<%=' ?")
+              add_error(
+                "erb statement not allowed here; did you mean '<%=' ?",
+                location: token.location,
+              )
             end
           end
         end
@@ -186,12 +286,15 @@ EOF
           node.content_parts.each do |token|
             if [:stmt, :expr_literal, :expr_escaped].include?(token.type)
               expr = begin
-                RubyExpr.new(code: token.code)
+                RubyExpr.parse(token.code)
               rescue RubyExpr::ParseError
                 next
               end
-              if expr.calls.size == 1 && expr.calls.first.method == 'javascript_tag'
-                add_error(token, "'javascript_tag do' syntax is deprecated; use inline <script> instead")
+              if expr.calls.size == 1 && expr.calls.first.method == :javascript_tag
+                add_error(
+                  "'javascript_tag do' syntax is deprecated; use inline <script> instead",
+                  location: token.location,
+                )
               end
             end
           end