better_html 2.0.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1ac84c6b49b11f21c5195484e1534ca08499baf267b1a3ee0c8f867cfcb827a6
-  data.tar.gz: 07fb6f3ac263b81d2dc7f92287b051453ff69efbfa580572b6c528e329e1cba3
+  metadata.gz: 3f1644bc4ce488d46cba781f055a90e82b5660cd66600a0452070dedaeda9543
+  data.tar.gz: 053d1b7f7c078f5a3b7999480d180ccfd6eaddd0149bfe9c43086b1d77fb4e1f
 SHA512:
-  metadata.gz: 471d66dbf8b8571382cb316fad44c8792c93a14176a56e061e98254c6387a474219850c308f640047d1c9fcf359257c4a704eb7db868d2abd6bbc7e947dab30a
-  data.tar.gz: 1149ea4793a2251359e67ebbea8683298306d02cf17c8853997f0a7283247b8f269d4ee1eaf7833ebf6c139308a2c01ece8a9e157538b79a724fb095bd40509f
+  metadata.gz: d764cd009cec9d23f767a69ddde688f7949a1236809942e9fd927c10f6f5efbcad2ae8a6adec0395e959ac8284f38a606b44dd3962b980ca56c7dea256752050
+  data.tar.gz: 92b47eb924dcbb7ac773176765b8bfb486d9f851e54958485622064de757e33a1167afc4112ff58f343ab23fcee98de24228d17b8c10d515b436bca07eea8039

data/ext/better_html_ext/html_tokenizer.c

@@ -4,7 +4,7 @@
 
 static VALUE mHtmlTokenizer = Qnil;
 
-void Init_better_html_ext()
+void Init_better_html_ext(void)
 {
   mHtmlTokenizer = rb_define_module("HtmlTokenizer");
   Init_html_tokenizer_tokenizer(mHtmlTokenizer);

data/ext/better_html_ext/parser.c

@@ -1,4 +1,5 @@
 #include <ruby.h>
+#include <ruby/util.h>
 #include <ruby/encoding.h>
 #include "html_tokenizer.h"
 #include "parser.h"
@@ -81,7 +82,7 @@ static inline void parser_append_ref(struct token_reference_t *dest, struct toke
 static void parser_add_error(struct parser_t *parser, const char *message)
 {
   REALLOC_N(parser->errors, struct parser_document_error_t, parser->errors_count + 1);
-  parser->errors[parser->errors_count].message = strdup(message);
+  parser->errors[parser->errors_count].message = ruby_strdup(message);
   parser->errors[parser->errors_count].pos = parser->tk.scan.cursor;
   parser->errors[parser->errors_count].mb_pos = parser->tk.scan.mb_cursor;
   parser->errors[parser->errors_count].line_number = parser->doc.line_number;

data/lib/better_html/better_erb/runtime_checks.rb

@@ -119,7 +119,7 @@ module BetterHtml
         return if text.upcase == "!DOCTYPE"
         return if @config.partial_tag_name_pattern.match?(text)
 
-        s = +"Invalid tag name #{text.inspect} does not match "\
+        s = +"Invalid tag name #{text.inspect} does not match " \
           "regular expression #{@config.partial_tag_name_pattern.inspect}\n"
         s << build_location(line, column, text.size)
         raise BetterHtml::HtmlError, s
@@ -129,7 +129,7 @@ module BetterHtml
         text = @parser.document[start...stop]
         return if @config.partial_attribute_name_pattern.match?(text)
 
-        s = +"Invalid attribute name #{text.inspect} does not match "\
+        s = +"Invalid attribute name #{text.inspect} does not match " \
           "regular expression #{@config.partial_attribute_name_pattern.inspect}\n"
         s << build_location(line, column, text.size)
         raise BetterHtml::HtmlError, s
@@ -155,7 +155,8 @@ module BetterHtml
       end
 
       def build_location(line, column, length)
-        s = +"On line #{line} column #{column}:\n"
+        s = filename ? +"In #{filename}\n" : +""
+        s << "On line #{line} column #{column}:\n"
         s << "#{extract_line(line)}\n"
         s << "#{" " * column}#{"^" * length}"
       end

data/lib/better_html/better_erb/validated_output_buffer.rb

@@ -17,7 +17,7 @@ module BetterHtml
           value = properly_escaped(value)
 
           if value.include?(@context[:quote_character])
-            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
+            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation " \
               "into a quoted attribute value. The value cannot contain the character #{@context[:quote_character]}."
           end
 
@@ -25,15 +25,15 @@ module BetterHtml
         end
 
         def safe_unquoted_value_append=(value)
-          raise DontInterpolateHere, "Do not interpolate without quotes around this "\
-            "attribute value. Instead of "\
-            "<#{@context[:tag_name]} #{@context[:attribute_name]}=#{@context[:attribute_value]}<%=#{@code}%>> "\
+          raise DontInterpolateHere, "Do not interpolate without quotes around this " \
+            "attribute value. Instead of " \
+            "<#{@context[:tag_name]} #{@context[:attribute_name]}=#{@context[:attribute_value]}<%=#{@code}%>> " \
             "try <#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}<%=#{@code}%>\">."
         end
 
         def safe_space_after_attribute_append=(value)
-          raise DontInterpolateHere, "Add a space after this attribute value. Instead of "\
-            "<#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}\"<%=#{@code}%>> "\
+          raise DontInterpolateHere, "Add a space after this attribute value. Instead of " \
+            "<#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}\"<%=#{@code}%>> " \
             "try <#{@context[:tag_name]} #{@context[:attribute_name]}=\"#{@context[:attribute_value]}\" <%=#{@code}%>>."
         end
 
@@ -43,7 +43,7 @@ module BetterHtml
           value = value.to_s
 
           unless value =~ /\A[a-z0-9\-]*\z/
-            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
+            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation " \
               "into a attribute name around '#{@context[:attribute_name]}<%=#{@code}%>'."
           end
 
@@ -54,8 +54,8 @@ module BetterHtml
           return if value.nil?
 
           unless value.is_a?(BetterHtml::HtmlAttributes)
-            raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. "\
-              "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please "\
+            raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. " \
+              "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please " \
               "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>."
           end
 
@@ -63,7 +63,7 @@ module BetterHtml
         end
 
         def safe_after_equal_append=(value)
-          raise DontInterpolateHere, "Do not interpolate without quotes after "\
+          raise DontInterpolateHere, "Do not interpolate without quotes after " \
             "attribute around '#{@context[:attribute_name]}=<%=#{@code}%>'."
         end
 
@@ -71,8 +71,8 @@ module BetterHtml
           return if value.nil?
 
           unless value.is_a?(BetterHtml::HtmlAttributes)
-            raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. "\
-              "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please "\
+            raise DontInterpolateHere, "Do not interpolate #{value.class} in a tag. " \
+              "Instead of <#{@context[:tag_name]} <%=#{@code}%>> please " \
               "try <#{@context[:tag_name]} <%= html_attributes(attr: value) %>>."
           end
 
@@ -85,7 +85,7 @@ module BetterHtml
           value = value.to_s
 
           unless value =~ /\A[a-z0-9\:\-]*\z/
-            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
+            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation " \
               "into a tag name around: <#{@context[:tag_name]}<%=#{@code}%>>."
           end
 
@@ -100,12 +100,12 @@ module BetterHtml
           if @context[:tag_name].downcase == "script" &&
               (value =~ /<script/i || value =~ %r{</script}i)
             # https://www.w3.org/TR/html5/scripting-1.html#restrictions-for-contents-of-script-elements
-            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
-              "into a script tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>. "\
+            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation " \
+              "into a script tag around: <#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>. " \
               "A script tag cannot contain <script or </script anywhere inside of it."
           elsif value =~ /<#{Regexp.escape(@context[:tag_name].downcase)}/i ||
               value =~ %r{</#{Regexp.escape(@context[:tag_name].downcase)}}i
-            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
+            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation " \
               "into a #{@context[:tag_name].downcase} tag around: " \
               "<#{@context[:tag_name]}>#{@context[:rawtext_text]}<%=#{@code}%>."
           end
@@ -120,7 +120,7 @@ module BetterHtml
 
           # in a <!-- ...here --> we disallow -->
           if value =~ /-->/
-            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation "\
+            raise UnsafeHtmlError, "Detected invalid characters as part of the interpolation " \
               "into a html comment around: <!--#{@context[:comment_text]}<%=#{@code}%>."
           end
 

data/lib/better_html/better_erb.rb

@@ -52,10 +52,20 @@ module BetterHtml
         klass ||= self.class.erb_implementation
 
         escape = self.class.escape_ignore_list.include?(template.type)
+
+        options = {
+          escape: escape,
+          trim: (self.class.erb_trim_mode == "-"),
+        }
+        if BetterHtml.config.annotate_rendered_view_with_filenames && template.format == :html
+          options[:preamble] = "@output_buffer.safe_append='<!-- BEGIN #{template.short_identifier} -->';"
+          options[:postamble] = "@output_buffer.safe_append='<!-- END #{template.short_identifier} -->';" \
+            "@output_buffer.to_s"
+        end
+
         generator = klass.new(
           erb,
-          escape: escape,
-          trim: (self.class.erb_trim_mode == "-")
+          **options,
         )
         generator.validate! if generator.respond_to?(:validate!)
         generator.src

data/lib/better_html/config.rb

@@ -15,6 +15,7 @@ module BetterHtml
     property :template_exclusion_filter
     property :lodash_safe_javascript_expression, default: -> { [/\AJSON\.stringify\(/] }
     property :disable_parser_validation, default: false
+    property :annotate_rendered_view_with_filenames, default: false
 
     def javascript_attribute_name?(name)
       javascript_attribute_names.any? { |other| other === name.to_s } # rubocop:disable Style/CaseEquality

data/lib/better_html/html_attributes.rb

@@ -19,7 +19,7 @@ module BetterHtml
           value = value.to_s
           escaped_value = value.html_safe? ? value : CGI.escapeHTML(value)
           if escaped_value.include?('"')
-            raise ArgumentError, "The value provided for attribute '#{key}' contains a `\"` "\
+            raise ArgumentError, "The value provided for attribute '#{key}' contains a `\"` " \
               "character which is not allowed. Did you call .html_safe without properly escaping this data?"
           end
           "#{key}=\"#{escaped_value}\""

data/lib/better_html/parser.rb

@@ -53,7 +53,7 @@ module BetterHtml
       @erb.parser.errors.map do |error|
         Error.new(
           error.message,
-          location: Tokenizer::Location.new(@buffer, error.position, error.position + 1)
+          location: Tokenizer::Location.new(@buffer, error.position, error.position + 1),
         )
       end
     end
@@ -183,9 +183,13 @@ module BetterHtml
     end
 
     def build_attribute_value_node(tokens)
-      children = shift_all_with_interpolation(tokens,
-        :attribute_quoted_value_start, :attribute_quoted_value,
-        :attribute_quoted_value_end, :attribute_unquoted_value)
+      children = shift_all_with_interpolation(
+        tokens,
+        :attribute_quoted_value_start,
+        :attribute_quoted_value,
+        :attribute_quoted_value_end,
+        :attribute_unquoted_value,
+      )
 
       build_node(:attribute_value, children)
     end
@@ -199,7 +203,7 @@ module BetterHtml
       BetterHtml::AST::Node.new(
         type,
         tokens.present? ? wrap_tokens(tokens) : [],
-        loc: tokens.present? ? build_location([pre, *tokens, post]) : empty_location
+        loc: tokens.present? ? build_location([pre, *tokens, post]) : empty_location,
       )
     end
 
@@ -298,8 +302,13 @@ module BetterHtml
 
       if object.is_a?(::AST::Node)
         object
-      elsif [:text, :tag_name, :attribute_name, :attribute_quoted_value,
-             :attribute_unquoted_value,].include?(object.type)
+      elsif [
+        :text,
+        :tag_name,
+        :attribute_name,
+        :attribute_quoted_value,
+        :attribute_unquoted_value,
+      ].include?(object.type)
         object.loc.source
       elsif [:attribute_quoted_value_start, :attribute_quoted_value_end].include?(object.type)
         BetterHtml::AST::Node.new(:quote, [object.loc.source], loc: object.loc)

data/lib/better_html/railtie.rb

@@ -6,6 +6,10 @@ module BetterHtml
   class Railtie < Rails::Railtie
     initializer "better_html.better_erb.initialization" do
       BetterHtml::BetterErb.prepend!
+
+      ActiveSupport.on_load(:action_view) do
+        BetterHtml.config.annotate_rendered_view_with_filenames = ActionView::Base.annotate_rendered_view_with_filenames
+      end
     end
   end
 end

data/lib/better_html/test_helper/safe_erb/allowed_script_type.rb

@@ -24,7 +24,7 @@ module BetterHtml
 
           add_error(
             "#{type_attribute.value} is not a valid type, valid types are #{VALID_JAVASCRIPT_TAG_TYPES.join(", ")}",
-            location: type_attribute.loc
+            location: type_attribute.loc,
           )
         end
       end

data/lib/better_html/test_helper/safe_erb/tag_interpolation.rb

@@ -7,8 +7,18 @@ module BetterHtml
   module TestHelper
     module SafeErb
       class TagInterpolation < Base
-        NO_HTML_TAGS = ["title", "textarea", "script", "style", "xmp", "iframe", "noembed", "noframes", "listing",
-                        "plaintext",]
+        NO_HTML_TAGS = [
+          "title",
+          "textarea",
+          "script",
+          "style",
+          "xmp",
+          "iframe",
+          "noembed",
+          "noframes",
+          "listing",
+          "plaintext",
+        ]
 
         def validate
           @parser.nodes_with_type(:tag).each do |tag_node|
@@ -28,8 +38,8 @@ module BetterHtml
         def no_html_tag?(node)
           ast = @parser.ast.to_a
           index = ast.find_index(node)
-          return unless (previous_node = ast[index - 1])
-          return unless previous_node.type == :tag
+          return false unless (previous_node = ast[index - 1])
+          return false unless previous_node.type == :tag
 
           tag = BetterHtml::Tree::Tag.from_node(previous_node)
           NO_HTML_TAGS.include?(tag.name) && !tag.closing?
@@ -57,7 +67,7 @@ module BetterHtml
             elsif indicator == "=="
               add_error(
                 "erb interpolation with '<%==' inside html attribute is never safe",
-                location: erb_node.loc
+                location: erb_node.loc,
               )
             end
           end
@@ -122,14 +132,14 @@ module BetterHtml
           if method_calls.empty?
             add_error(
               "erb interpolation in javascript attribute must be wrapped in safe helper such as '(...).to_json'",
-              location: nested_location(parent_node, ruby_node)
+              location: nested_location(parent_node, ruby_node),
             )
             true
           elsif unsafe_calls.any?
             unsafe_calls.each do |call_node|
               add_error(
                 "erb interpolation in javascript attribute must be wrapped in safe helper such as '(...).to_json'",
-                location: nested_location(parent_node, call_node)
+                location: nested_location(parent_node, call_node),
               )
             end
             true
@@ -148,7 +158,7 @@ module BetterHtml
 
             add_error(
               "erb interpolation in javascript attribute must be wrapped in safe helper such as '(...).to_json'",
-              location: nested_location(parent_node, ruby_node)
+              location: nested_location(parent_node, ruby_node),
             )
           end
         end
@@ -158,12 +168,12 @@ module BetterHtml
             if call.method_name?(:raw)
               add_error(
                 "erb interpolation with '<%= raw(...) %>' in this context is never safe",
-                location: nested_location(parent_node, ruby_node)
+                location: nested_location(parent_node, ruby_node),
               )
             elsif call.method_name?(:html_safe)
               add_error(
                 "erb interpolation with '<%= (...).html_safe %>' in this context is never safe",
-                location: nested_location(parent_node, ruby_node)
+                location: nested_location(parent_node, ruby_node),
               )
             end
           end
@@ -173,7 +183,7 @@ module BetterHtml
           Tokenizer::Location.new(
             parent_node.loc.source_buffer,
             parent_node.loc.begin_pos + ruby_node.loc.expression.begin_pos,
-            parent_node.loc.begin_pos + ruby_node.loc.expression.end_pos
+            parent_node.loc.begin_pos + ruby_node.loc.expression.end_pos,
           )
         end
       end

data/lib/better_html/test_helper/safe_erb_tester.rb

@@ -41,7 +41,7 @@ module BetterHtml
         options[:template_language] ||= :html
         buffer = ::Parser::Source::Buffer.new(options[:filename] || "(buffer)")
         buffer.source = data
-        parser = BetterHtml::Parser.new(buffer, **options)
+        parser = BetterHtml::Parser.new(buffer, template_language: options[:template_language])
 
         tester_classes = [
           SafeErb::NoStatements,

data/lib/better_html/test_helper/safe_lodash_tester.rb

@@ -74,7 +74,7 @@ module BetterHtml
 
             add_error(
               "No script tags allowed nested in lodash templates",
-              location: tag_node.loc
+              location: tag_node.loc,
             )
           end
 
@@ -104,7 +104,7 @@ module BetterHtml
               elsif indicator_node.loc.source == "!"
                 add_error(
                   "lodash interpolation with '[%!' inside html attribute is never safe",
-                  location: lodash_node.loc
+                  location: lodash_node.loc,
                 )
               end
             end
@@ -116,9 +116,9 @@ module BetterHtml
           source = code_node.loc.source.strip
           if @config.javascript_attribute_name?(attribute.name) && !@config.lodash_safe_javascript_expression?(source)
             add_error(
-              "lodash interpolation in javascript attribute "\
+              "lodash interpolation in javascript attribute " \
                 "`#{attribute.name}` must call `JSON.stringify(#{source})`",
-              location: lodash_node.loc
+              location: lodash_node.loc,
             )
           end
         end
@@ -132,7 +132,7 @@ module BetterHtml
         def add_no_statement_error(loc)
           add_error(
             "javascript statement not allowed here; did you mean '[%=' ?",
-            location: loc
+            location: loc,
           )
         end
       end

data/lib/better_html/tokenizer/base_erb.rb

@@ -10,7 +10,7 @@ module BetterHtml
     class BaseErb < ::Erubi::Engine
       REGEXP_WITHOUT_TRIM = /<%(={1,2})?(.*?)()?%>([ \t]*\r?\n)?/m
       STMT_TRIM_MATCHER = /\A(-|#)?(.*?)([-=])?\z/m
-      EXPR_TRIM_MATCHER = /\A(.*?)(-)?\z/m
+      EXPR_TRIM_MATCHER = /\A(.*?)([-=])?\z/m
 
       attr_reader :tokens
       attr_reader :current_position
@@ -80,7 +80,7 @@ module BetterHtml
       def add_token(type, begin_pos, end_pos)
         token = Token.new(
           type: type,
-          loc: Location.new(@buffer, begin_pos, end_pos)
+          loc: Location.new(@buffer, begin_pos, end_pos),
         )
         @tokens << token
         token

data/lib/better_html/tokenizer/html_lodash.rb

@@ -96,7 +96,7 @@ module BetterHtml
       def add_token(type, begin_pos: nil, end_pos: nil)
         token = Token.new(
           type: type,
-          loc: Location.new(@buffer, begin_pos, end_pos)
+          loc: Location.new(@buffer, begin_pos, end_pos),
         )
         @tokens << token
         token

data/lib/better_html/tokenizer/location.rb

@@ -39,7 +39,7 @@ module BetterHtml
       def line_source_with_underline
         spaces = source_line.scan(/\A\s*/).first
         column_without_spaces = [column - spaces.length, 0].max
-        underscore_length = [[end_pos - begin_pos, source_line.length - column_without_spaces].min, 1].max
+        underscore_length = (end_pos - begin_pos).clamp(1, (source_line.length - column_without_spaces))
         "#{source_line.gsub(/\A\s*/, "")}\n#{" " * column_without_spaces}#{"^" * underscore_length}"
       end
 

data/lib/better_html/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BetterHtml
-  VERSION = "2.0.2"
+  VERSION = "2.1.0"
 end

data/lib/tasks/better_html_tasks.rake

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # desc "Explaining what the task does"
 # task :better_html do
 #   # Task goes here

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: better_html
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.1.0
 platform: ruby
 authors:
 - Francois Chagnon
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-06-28 00:00:00.000000000 Z
+date: 2024-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionview
@@ -168,7 +168,7 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/Shopify/better-html/issues
   changelog_uri: https://github.com/Shopify/better-html/releases
-  source_code_uri: https://github.com/Shopify/better-html/tree/v2.0.2
+  source_code_uri: https://github.com/Shopify/better-html/tree/v2.1.0
   allowed_push_host: https://rubygems.org
 post_install_message: 
 rdoc_options: []
@@ -178,14 +178,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.14
+rubygems_version: 3.5.6
 signing_key: 
 specification_version: 4
 summary: Better HTML for Rails.