brakeman 4.4.0 → 5.0.0

data/bundle/ruby/{2.5.0/gems/haml-4.0.7 → 2.7.0/gems/haml-5.2.1}/lib/haml/engine.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'forwardable'
 
 require 'haml/parser'
@@ -7,6 +9,7 @@ require 'haml/helpers'
 require 'haml/buffer'
 require 'haml/filters'
 require 'haml/error'
+require 'haml/temple_engine'
 
 module Haml
   # This is the frontend for using Haml programmatically.
@@ -35,9 +38,6 @@ module Haml
     # @return [String]
     attr_accessor :indentation
 
-    attr_accessor :compiler
-    attr_accessor :parser
-
     # Tilt currently depends on these moved methods, provide a stable API
     def_delegators :compiler, :precompiled, :precompiled_method_return_value
 
@@ -52,25 +52,28 @@ module Haml
     #   see {file:REFERENCE.md#options the Haml options documentation}
     # @raise [Haml::Error] if there's a Haml syntax error in the template
     def initialize(template, options = {})
+      # Reflect changes of `Haml::Options.defaults` to `Haml::TempleEngine` options, but `#initialize_encoding`
+      # should be run against the arguemnt `options[:encoding]` for backward compatibility with old `Haml::Engine`.
+      options = Options.defaults.dup.tap { |o| o.delete(:encoding) }.merge!(options)
       @options = Options.new(options)
 
       @template = check_haml_encoding(template) do |msg, line|
         raise Haml::Error.new(msg, line)
       end
 
-      initialize_encoding options[:encoding]
-
-      @parser   = @options.parser_class.new(@template, @options)
-      @compiler = @options.compiler_class.new(@options)
+      @temple_engine = TempleEngine.new(options)
+      @temple_engine.compile(@template)
+    end
 
-      @compiler.compile(@parser.parse)
+    # Deprecated API for backword compatibility
+    def compiler
+      @temple_engine
     end
 
     # Processes the template and returns the result as a string.
     #
     # `scope` is the context in which the template is evaluated.
-    # If it's a `Binding` or `Proc` object,
-    # Haml uses it as the second argument to `Kernel#eval`;
+    # If it's a `Binding`, Haml uses it as the second argument to `Kernel#eval`;
     # otherwise, Haml just uses its `#instance_eval` context.
     #
     # Note that Haml modifies the evaluation context
@@ -95,23 +98,23 @@ module Haml
     # within the template.
     #
     # Due to some Ruby quirks,
-    # if `scope` is a `Binding` or `Proc` object and a block is given,
+    # if `scope` is a `Binding` object and a block is given,
     # the evaluation context may not be quite what the user expects.
     # In particular, it's equivalent to passing `eval("self", scope)` as `scope`.
     # This won't have an effect in most cases,
     # but if you're relying on local variables defined in the context of `scope`,
     # they won't work.
     #
-    # @param scope [Binding, Proc, Object] The context in which the template is evaluated
+    # @param scope [Binding, Object] The context in which the template is evaluated
     # @param locals [{Symbol => Object}] Local variables that will be made available
     #   to the template
     # @param block [#to_proc] A block that can be yielded to within the template
     # @return [String] The rendered template
     def render(scope = Object.new, locals = {}, &block)
-      parent = scope.instance_variable_defined?('@haml_buffer') ? scope.instance_variable_get('@haml_buffer') : nil
+      parent = scope.instance_variable_defined?(:@haml_buffer) ? scope.instance_variable_get(:@haml_buffer) : nil
       buffer = Haml::Buffer.new(parent, @options.for_buffer)
 
-      if scope.is_a?(Binding) || scope.is_a?(Proc)
+      if scope.is_a?(Binding)
         scope_object = eval("self", scope)
         scope = scope_object.instance_eval{binding} if block_given?
       else
@@ -121,20 +124,16 @@ module Haml
 
       set_locals(locals.merge(:_hamlout => buffer, :_erbout => buffer.buffer), scope, scope_object)
 
-      scope_object.instance_eval do
-        extend Haml::Helpers
-        @haml_buffer = buffer
-      end
+      scope_object.extend(Haml::Helpers)
+      scope_object.instance_variable_set(:@haml_buffer, buffer)
       begin
-        eval(@compiler.precompiled_with_return_value, scope, @options[:filename], @options[:line])
+        eval(@temple_engine.precompiled_with_return_value, scope, @options.filename, @options.line)
       rescue ::SyntaxError => e
         raise SyntaxError, e.message
       end
     ensure
       # Get rid of the current buffer
-      scope_object.instance_eval do
-        @haml_buffer = buffer.upper if buffer
-      end
+      scope_object.instance_variable_set(:@haml_buffer, buffer.upper) if buffer
     end
     alias_method :to_html, :render
 
@@ -159,11 +158,11 @@ module Haml
     #
     # The proc doesn't take a block; any yields in the template will fail.
     #
-    # @param scope [Binding, Proc, Object] The context in which the template is evaluated
+    # @param scope [Binding, Object] The context in which the template is evaluated
     # @param local_names [Array<Symbol>] The names of the locals that can be passed to the proc
     # @return [Proc] The proc that will run the template
     def render_proc(scope = Object.new, *local_names)
-      if scope.is_a?(Binding) || scope.is_a?(Proc)
+      if scope.is_a?(Binding)
         scope_object = eval("self", scope)
       else
         scope_object = scope
@@ -171,8 +170,13 @@ module Haml
       end
 
       begin
-        eval("Proc.new { |*_haml_locals| _haml_locals = _haml_locals[0] || {};" +
-             compiler.precompiled_with_ambles(local_names) + "}\n", scope, @options[:filename], @options[:line])
+        str = @temple_engine.precompiled_with_ambles(local_names)
+        eval(
+          "Proc.new { |*_haml_locals| _haml_locals = _haml_locals[0] || {}; #{str}}\n",
+          scope,
+          @options.filename,
+          @options.line
+        )
       rescue ::SyntaxError => e
         raise SyntaxError, e.message
       end
@@ -182,7 +186,7 @@ module Haml
     # that renders the template and returns the result as a string.
     #
     # If `object` is a class or module,
-    # the method will instead by defined as an instance method.
+    # the method will instead be defined as an instance method.
     # For example:
     #
     #     t = Time.now
@@ -219,25 +223,14 @@ module Haml
     def def_method(object, name, *local_names)
       method = object.is_a?(Module) ? :module_eval : :instance_eval
 
-      object.send(method, "def #{name}(_haml_locals = {}); #{compiler.precompiled_with_ambles(local_names)}; end",
-                  @options[:filename], @options[:line])
+      object.send(method, "def #{name}(_haml_locals = {}); #{@temple_engine.precompiled_with_ambles(local_names)}; end",
+                  @options.filename, @options.line)
     end
 
     private
 
-    if RUBY_VERSION < "1.9"
-      def initialize_encoding(given_value)
-      end
-    else
-      def initialize_encoding(given_value)
-        unless given_value
-          @options.encoding = Encoding.default_internal || @template.encoding
-        end
-      end
-    end
-
     def set_locals(locals, scope, scope_object)
-      scope_object.send(:instance_variable_set, '@_haml_locals', locals)
+      scope_object.instance_variable_set :@_haml_locals, locals
       set_locals = locals.keys.map { |k| "#{k} = @_haml_locals[#{k.inspect}]" }.join("\n")
       eval(set_locals, scope)
     end

data/bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/error.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Haml
+  # An exception raised by Haml code.
+  class Error < StandardError
+
+    MESSAGES = {
+      bad_script_indent:            '"%s" is indented at wrong level: expected %d, but was at %d.',
+      cant_run_filter:              'Can\'t run "%s" filter; you must require its dependencies first',
+      cant_use_tabs_and_spaces:     "Indentation can't use both tabs and spaces.",
+      deeper_indenting:             "The line was indented %d levels deeper than the previous line.",
+      filter_not_defined:           'Filter "%s" is not defined.',
+      gem_install_filter_deps:      '"%s" filter\'s %s dependency missing: try installing it or adding it to your Gemfile',
+      illegal_element:              "Illegal element: classes and ids must have values.",
+      illegal_nesting_content:      "Illegal nesting: nesting within a tag that already has content is illegal.",
+      illegal_nesting_header:       "Illegal nesting: nesting within a header command is illegal.",
+      illegal_nesting_line:         "Illegal nesting: content can't be both given on the same line as %%%s and nested within it.",
+      illegal_nesting_plain:        "Illegal nesting: nesting within plain text is illegal.",
+      illegal_nesting_self_closing: "Illegal nesting: nesting within a self-closing tag is illegal.",
+      inconsistent_indentation:     "Inconsistent indentation: %s used for indentation, but the rest of the document was indented using %s.",
+      indenting_at_start:           "Indenting at the beginning of the document is illegal.",
+      install_haml_contrib:         'To use the "%s" filter, please install the haml-contrib gem.',
+      invalid_attribute_list:       'Invalid attribute list: %s.',
+      invalid_filter_name:          'Invalid filter name ":%s".',
+      invalid_tag:                  'Invalid tag: "%s".',
+      missing_if:                   'Got "%s" with no preceding "if"',
+      no_ruby_code:                 "There's no Ruby code for %s to evaluate.",
+      self_closing_content:         "Self-closing tags can't have content.",
+      unbalanced_brackets:          'Unbalanced brackets.',
+      no_end:                       <<-END
+You don't need to use "- end" in Haml. Un-indent to close a block:
+- if foo?
+  %strong Foo!
+- else
+  Not foo.
+%p This line is un-indented, so it isn't part of the "if" block
+END
+    }.freeze
+
+    def self.message(key, *args)
+      string = MESSAGES[key] or raise "[HAML BUG] No error messages for #{key}"
+      (args.empty? ? string : string % args).rstrip
+    end
+
+    # The line of the template on which the error occurred.
+    #
+    # @return [Fixnum]
+    attr_reader :line
+
+    # @param message [String] The error message
+    # @param line [Fixnum] See \{#line}
+    def initialize(message = nil, line = nil)
+      super(message)
+      @line = line
+    end
+  end
+
+  # SyntaxError is the type of exception raised when Haml encounters an
+  # ill-formatted document.
+  # It's not particularly interesting,
+  # except in that it's a subclass of {Haml::Error}.
+  class SyntaxError < Error; end
+
+  class InvalidAttributeNameError < SyntaxError; end
+end

data/bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/escapable.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Haml
+  # Like Temple::Filters::Escapable, but with support for escaping by
+  # Haml::Herlpers.html_escape and Haml::Herlpers.escape_once.
+  class Escapable < Temple::Filter
+    # Special value of `flag` to ignore html_safe?
+    EscapeSafeBuffer = Struct.new(:value)
+
+    def initialize(*)
+      super
+      @escape = false
+      @escape_safe_buffer = false
+    end
+
+    def on_escape(flag, exp)
+      old_escape, old_escape_safe_buffer = @escape, @escape_safe_buffer
+      @escape_safe_buffer = flag.is_a?(EscapeSafeBuffer)
+      @escape = @escape_safe_buffer ? flag.value : flag
+      compile(exp)
+    ensure
+      @escape, @escape_safe_buffer = old_escape, old_escape_safe_buffer
+    end
+
+    # The same as Haml::AttributeBuilder.build_attributes
+    def on_static(value)
+      [:static,
+       if @escape == :once
+         escape_once(value)
+       elsif @escape
+         escape(value)
+       else
+         value
+       end
+      ]
+    end
+
+    # The same as Haml::AttributeBuilder.build_attributes
+    def on_dynamic(value)
+      [:dynamic,
+       if @escape == :once
+         escape_once_code(value)
+       elsif @escape
+         escape_code(value)
+       else
+         "(#{value}).to_s"
+       end
+      ]
+    end
+
+    private
+
+    def escape_once(value)
+      if @escape_safe_buffer
+        ::Haml::Helpers.escape_once_without_haml_xss(value)
+      else
+        ::Haml::Helpers.escape_once(value)
+      end
+    end
+
+    def escape(value)
+      if @escape_safe_buffer
+        ::Haml::Helpers.html_escape_without_haml_xss(value)
+      else
+        ::Haml::Helpers.html_escape(value)
+      end
+    end
+
+    def escape_once_code(value)
+      "::Haml::Helpers.escape_once#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
+    end
+
+    def escape_code(value)
+      "::Haml::Helpers.html_escape#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
+    end
+  end
+end

data/bundle/ruby/{2.5.0/gems/haml-4.0.7 → 2.7.0/gems/haml-5.2.1}/lib/haml/exec.rb

@@ -1,5 +1,6 @@
+# frozen_string_literal: true
+
 require 'optparse'
-require 'fileutils'
 require 'rbconfig'
 require 'pp'
 
@@ -120,7 +121,7 @@ module Haml
         @options[:input], @options[:output] = input, output
       end
 
-      COLORS = { :red => 31, :green => 32, :yellow => 33 }
+      COLORS = {red: 31, green: 32, yellow: 33}.freeze
 
       # Prints a status message about performing the given action,
       # colored using the given color (via terminal escapes) if possible.
@@ -212,11 +213,6 @@ END
           @options[:output] = StringIO.new
         end
 
-        opts.on('-t', '--style NAME',
-                'Output style. Can be indented (default) or ugly.') do |name|
-          @options[:for_engine][:ugly] = true if name.to_sym == :ugly
-        end
-
         opts.on('-f', '--format NAME',
                 'Output format. Can be html5 (default), xhtml, or html4.') do |name|
           @options[:for_engine][:format] = name.to_sym
@@ -237,6 +233,11 @@ END
           @options[:for_engine][:attr_wrapper] = '"'
         end
 
+        opts.on('--remove-whitespace',
+                'Remove whitespace surrounding and within tags') do
+          @options[:for_engine][:remove_whitespace] = true
+        end
+
         opts.on('--cdata',
                 'Always add CDATA sections to javascript and css blocks.') do
           @options[:for_engine][:cdata] = true
@@ -260,15 +261,13 @@ END
           @options[:load_paths] << path
         end
 
-        unless RUBY_VERSION < "1.9"
-          opts.on('-E ex[:in]', 'Specify the default external and internal character encodings.') do |encoding|
-            external, internal = encoding.split(':')
-            Encoding.default_external = external if external && !external.empty?
-            Encoding.default_internal = internal if internal && !internal.empty?
-          end
+        opts.on('-E ex[:in]', 'Specify the default external and internal character encodings.') do |encoding|
+          external, internal = encoding.split(':')
+          Encoding.default_external = external if external && !external.empty?
+          Encoding.default_internal = internal if internal && !internal.empty?
         end
 
-        opts.on('-d', '--debug', "Print out the precompiled Ruby source.") do
+        opts.on('-d', '--debug', "Print out the precompiled Ruby source, and show syntax errors in the Ruby code.") do
           @options[:debug] = true
         end
 
@@ -294,20 +293,33 @@ END
 
         begin
 
-          engine = ::Haml::Engine.new(template, @options[:for_engine])
-          if @options[:check_syntax]
-            puts "Syntax OK"
+          if @options[:parse]
+            parser = ::Haml::Parser.new(::Haml::Options.new(@options))
+            pp parser.call(template)
             return
           end
 
-          if @options[:parse]
-            pp engine.parser.root
+          engine = ::Haml::Engine.new(template, @options[:for_engine])
+
+          if @options[:check_syntax]
+            error = validate_ruby(engine.precompiled)
+            if error
+              puts error.message.split("\n").first
+              exit 1
+            end
+            puts "Syntax OK"
             return
           end
 
           if @options[:debug]
             puts engine.precompiled
-            puts '=' * 100
+            error = validate_ruby(engine.precompiled)
+            if error
+              puts '=' * 100
+              puts error.message.split("\n")[0]
+              exit 1
+            end
+            return
           end
 
           result = engine.to_html
@@ -324,6 +336,12 @@ END
         output.write(result)
         output.close() if output.is_a? File
       end
+
+      def validate_ruby(code)
+        eval("BEGIN {return nil}; #{code}", binding, @options[:filename] || "")
+      rescue ::SyntaxError # Not to be confused with Haml::SyntaxError
+        $!
+      end
     end
   end
 end

data/bundle/ruby/{2.5.0/gems/haml-4.0.7 → 2.7.0/gems/haml-5.2.1}/lib/haml/filters.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "tilt"
 
 module Haml
@@ -59,7 +61,7 @@ module Haml
     end
 
     # Removes a filter from Haml. If the filter was removed, it returns
-    # the that was remove Module upon success, or nil on failure. If you try
+    # the Module that was removed upon success, or nil on failure. If you try
     # to redefine a filter, Haml will raise an error. Use this method first to
     # explicitly remove the filter before redefining it.
     # @return Module The filter module that has been removed
@@ -118,7 +120,7 @@ module Haml
       # @param text [String] The source text for the filter to process
       # @return [String] The filtered result
       # @raise [Haml::Error] if it's not overridden
-      def render(text)
+      def render(_text)
         raise Error.new("#{self.inspect}#render not defined!")
       end
 
@@ -129,7 +131,7 @@ module Haml
       # @param text [String] The source text for the filter to process
       # @return [String] The filtered result
       # @raise [Haml::Error] if it or \{#render} isn't overridden
-      def render_with_options(text, options)
+      def render_with_options(text, _options)
         render(text)
       end
 
@@ -163,10 +165,14 @@ module Haml
           if contains_interpolation?(text)
             return if options[:suppress_eval]
 
-            text = unescape_interpolation(text).gsub(/(\\+)n/) do |s|
+            escape = options[:escape_filter_interpolations]
+            # `escape_filter_interpolations` defaults to `escape_html` if unset.
+            escape = options[:escape_html] if escape.nil?
+
+            text = unescape_interpolation(text, escape).gsub(/(\\+)n/) do |s|
               escapes = $1.size
               next s if escapes % 2 == 0
-              ("\\" * (escapes - 1)) + "\n"
+              "#{'\\' * (escapes - 1)}\n"
             end
             # We need to add a newline at the beginning to get the
             # filter lines to line up (since the Haml filter contains
@@ -174,20 +180,15 @@ module Haml
             # filter name). Then we need to escape the trailing
             # newline so that the whole filter block doesn't take up
             # too many.
-            text = "\n" + text.sub(/\n"\Z/, "\\n\"")
+            text = %[\n#{text.sub(/\n"\Z/, "\\n\"")}]
             push_script <<RUBY.rstrip, :escape_html => false
 find_and_preserve(#{filter.inspect}.render_with_options(#{text}, _hamlout.options))
 RUBY
             return
           end
 
-          rendered = Haml::Helpers::find_and_preserve(filter.render_with_options(text, compiler.options), compiler.options[:preserve])
-
-          if options[:ugly]
-            push_text(rendered.rstrip)
-          else
-            push_text(rendered.rstrip.gsub("\n", "\n#{'  ' * @output_tabs}"))
-          end
+          rendered = Haml::Helpers::find_and_preserve(filter.render_with_options(text.to_s, compiler.options), compiler.options[:preserve])
+          push_text("#{rendered.rstrip}\n")
         end
       end
     end
@@ -216,13 +217,10 @@ RUBY
           type = " type=#{options[:attr_wrapper]}text/javascript#{options[:attr_wrapper]}"
         end
 
-        str = "<script#{type}>\n"
-        str << "  //<![CDATA[\n" if options[:cdata]
-        str << "#{indent}#{text.rstrip.gsub("\n", "\n#{indent}")}\n"
-        str << "  //]]>\n" if options[:cdata]
-        str << "</script>"
+        text = text.rstrip
+        text.gsub!("\n", "\n#{indent}")
 
-        str
+        %!<script#{type}>\n#{"  //<![CDATA[\n" if options[:cdata]}#{indent}#{text}\n#{"  //]]>\n" if options[:cdata]}</script>!
       end
     end
 
@@ -240,13 +238,10 @@ RUBY
           type = " type=#{options[:attr_wrapper]}text/css#{options[:attr_wrapper]}"
         end
 
-        str = "<style#{type}>\n"
-        str << "  /*<![CDATA[*/\n" if options[:cdata]
-        str << "#{indent}#{text.rstrip.gsub("\n", "\n#{indent}")}\n"
-        str << "  /*]]>*/\n" if options[:cdata]
-        str << "</style>"
+        text = text.rstrip
+        text.gsub!("\n", "\n#{indent}")
 
-        str
+        %(<style#{type}>\n#{"  /*<![CDATA[*/\n" if options[:cdata]}#{indent}#{text}\n#{"  /*]]>*/\n" if options[:cdata]}</style>)
       end
     end
 
@@ -256,7 +251,7 @@ RUBY
 
       # @see Base#render
       def render(text)
-        "<![CDATA[#{("\n" + text).rstrip.gsub("\n", "\n    ")}\n]]>"
+        "<![CDATA[#{"\n#{text.rstrip}".gsub("\n", "\n    ")}\n]]>"
       end
     end
 
@@ -288,7 +283,7 @@ RUBY
       def compile(compiler, text)
         return if compiler.options[:suppress_eval]
         compiler.instance_eval do
-          push_silent <<-FIRST.gsub("\n", ';') + text + <<-LAST.gsub("\n", ';')
+          push_silent "#{<<-FIRST.tr("\n", ';')}#{text}#{<<-LAST.tr("\n", ';')}"
             begin
               haml_io = StringIO.new(_hamlout.buffer, 'a')
           FIRST