brakeman 5.2.2 → 7.1.1

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/rails_helpers.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: false
+require 'haml/helpers'
+
+# There are only helpers that depend on ActionView internals.
+module Haml
+  module RailsHelpers
+    include Helpers
+    extend self
+
+    DEFAULT_PRESERVE_TAGS = %w[textarea pre code].freeze
+
+    def find_and_preserve(input = nil, tags = DEFAULT_PRESERVE_TAGS, &block)
+      return find_and_preserve(capture_haml(&block), input || tags) if block
+
+      tags = tags.each_with_object('') do |t, s|
+        s << '|' unless s.empty?
+        s << Regexp.escape(t)
+      end
+
+      re = /<(#{tags})([^>]*)>(.*?)(<\/\1>)/im
+      input.to_s.gsub(re) do |s|
+        s =~ re # Can't rely on $1, etc. existing since Rails' SafeBuffer#gsub is incompatible
+        "<#{$1}#{$2}>#{preserve($3)}</#{$1}>"
+      end
+    end
+
+    def preserve(input = nil, &block)
+      return preserve(capture_haml(&block)) if block
+      super.html_safe
+    end
+
+    def surround(front, back = front, &block)
+      output = capture_haml(&block)
+      front  = escape_once(front) unless front.html_safe?
+      back   = escape_once(back)  unless back.html_safe?
+      "#{front}#{output.chomp}#{back}\n".html_safe
+    end
+
+    def precede(str, &block)
+      str = escape_once(str) unless str.html_safe?
+      "#{str}#{capture_haml(&block).chomp}\n".html_safe
+    end
+
+    def succeed(str, &block)
+      str = escape_once(str) unless str.html_safe?
+      "#{capture_haml(&block).chomp}#{str}\n".html_safe
+    end
+
+    def capture_haml(*args, &block)
+      capture(*args, &block)
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/rails_template.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+require 'temple'
+require 'haml/engine'
+require 'haml/rails_helpers'
+require 'haml/util'
+
+module Haml
+  class RailsTemplate
+    # Compatible with: https://github.com/judofyr/temple/blob/v0.7.7/lib/temple/mixins/options.rb#L15-L24
+    class << self
+      def options
+        @options ||= {
+          generator:     Temple::Generators::RailsOutputBuffer,
+          use_html_safe: true,
+          streaming:     true,
+          buffer_class:  'ActionView::OutputBuffer',
+          disable_capture: true,
+        }
+      end
+
+      def set_options(opts)
+        options.update(opts)
+      end
+    end
+
+    def call(template, source = nil)
+      source ||= template.source
+      options = RailsTemplate.options
+
+      # Make the filename available in parser etc.
+      if template.respond_to?(:identifier)
+        options = options.merge(filename: template.identifier)
+      end
+
+      # https://github.com/haml/haml/blob/4.0.7/lib/haml/template/plugin.rb#L19-L20
+      # https://github.com/haml/haml/blob/4.0.7/lib/haml/options.rb#L228
+      if template.respond_to?(:type) && template.type == 'text/xml'
+        options = options.merge(format: :xhtml)
+      end
+
+      if ActionView::Base.try(:annotate_rendered_view_with_filenames) && template.format == :html
+        options = options.merge(
+          preamble: "<!-- BEGIN #{template.short_identifier} -->",
+          postamble: "<!-- END #{template.short_identifier} -->",
+        )
+      end
+
+      Engine.new(options).call(source)
+    end
+
+    def supports_streaming?
+      RailsTemplate.options[:streaming]
+    end
+  end
+  ActionView::Template.register_template_handler(:haml, RailsTemplate.new)
+end
+
+# Haml extends Haml::Helpers in ActionView each time.
+# It costs much, so Haml includes a compatible module at first.
+ActiveSupport.on_load(:action_view) do
+  include Haml::RailsHelpers
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/railtie.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+require 'rails'
+
+module Haml
+  class Railtie < ::Rails::Railtie
+    initializer :haml, before: :load_config_initializers do |app|
+      require 'haml/rails_template'
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/ruby_expression.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+require 'ripper'
+
+module Haml
+  class RubyExpression < Ripper
+    class ParseError < StandardError; end
+
+    def self.syntax_error?(code)
+      self.new(code).parse
+      false
+    rescue ParseError
+      true
+    end
+
+    def self.string_literal?(code)
+      return false if syntax_error?(code)
+
+      type, instructions = Ripper.sexp(code)
+      return false if type != :program
+      return false if instructions.size > 1
+
+      type, _ = instructions.first
+      type == :string_literal
+    end
+
+    private
+
+    def on_parse_error(*)
+      raise ParseError
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/string_splitter.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+begin
+  require 'ripper'
+rescue LoadError
+end
+
+module Haml
+  # Compile [:dynamic, "foo#{bar}"] to [:multi, [:static, 'foo'], [:dynamic, 'bar']]
+  class StringSplitter < Temple::Filter
+    if defined?(Ripper) && RUBY_VERSION >= "2.0.0" && Ripper.respond_to?(:lex)
+      class << self
+        # `code` param must be valid string literal
+        def compile(code)
+          [].tap do |exps|
+            tokens = Ripper.lex(code.strip)
+            tokens.pop while tokens.last && [:on_comment, :on_sp].include?(tokens.last[1])
+
+            if tokens.size < 2
+              raise(Haml::InternalError, "Expected token size >= 2 but got: #{tokens.size}")
+            end
+            compile_tokens!(exps, tokens)
+          end
+        end
+
+        private
+
+        def strip_quotes!(tokens)
+          _, type, beg_str = tokens.shift
+          if type != :on_tstring_beg
+            raise(Haml::InternalError, "Expected :on_tstring_beg but got: #{type}")
+          end
+
+          _, type, end_str = tokens.pop
+          if type != :on_tstring_end
+            raise(Haml::InternalError, "Expected :on_tstring_end but got: #{type}")
+          end
+
+          [beg_str, end_str]
+        end
+
+        def compile_tokens!(exps, tokens)
+          beg_str, end_str = strip_quotes!(tokens)
+
+          until tokens.empty?
+            _, type, str = tokens.shift
+
+            case type
+            when :on_tstring_content
+              beg_str, end_str = escape_quotes(beg_str, end_str)
+              exps << [:static, eval("#{beg_str}#{str}#{end_str}").to_s]
+            when :on_embexpr_beg
+              embedded = shift_balanced_embexpr(tokens)
+              exps << [:dynamic, embedded] unless embedded.empty?
+            end
+          end
+        end
+
+        # Some quotes are split-unsafe. Replace such quotes with null characters.
+        def escape_quotes(beg_str, end_str)
+          case [beg_str[-1], end_str]
+          when ['(', ')'], ['[', ']'], ['{', '}']
+            [beg_str.sub(/.\z/) { "\0" }, "\0"]
+          else
+            [beg_str, end_str]
+          end
+        end
+
+        def shift_balanced_embexpr(tokens)
+          String.new.tap do |embedded|
+            embexpr_open = 1
+
+            until tokens.empty?
+              _, type, str = tokens.shift
+              case type
+              when :on_embexpr_beg
+                embexpr_open += 1
+              when :on_embexpr_end
+                embexpr_open -= 1
+                break if embexpr_open == 0
+              end
+
+              embedded << str
+            end
+          end
+        end
+      end
+
+      def on_dynamic(code)
+        return [:dynamic, code] unless string_literal?(code)
+        return [:dynamic, code] if code.include?("\n")
+
+        temple = [:multi]
+        StringSplitter.compile(code).each do |type, content|
+          case type
+          when :static
+            temple << [:static, content]
+          when :dynamic
+            temple << on_dynamic(content)
+          end
+        end
+        temple
+      end
+
+      private
+
+      def string_literal?(code)
+        return false if SyntaxChecker.syntax_error?(code)
+
+        type, instructions = Ripper.sexp(code)
+        return false if type != :program
+        return false if instructions.size > 1
+
+        type, _ = instructions.first
+        type == :string_literal
+      end
+
+      class SyntaxChecker < Ripper
+        class ParseError < StandardError; end
+
+        def self.syntax_error?(code)
+          self.new(code).parse
+          false
+        rescue ParseError
+          true
+        end
+
+        private
+
+        def on_parse_error(*)
+          raise ParseError
+        end
+      end
+    else
+      # Do nothing if ripper is unavailable
+      def call(ast)
+        ast
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/template.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: false
+require 'temple'
+require 'haml/engine'
+require 'haml/helpers'
+
+module Haml
+  Template = Temple::Templates::Tilt.create(
+    Haml::Engine,
+    register_as: [:haml, :haml],
+  )
+
+  module TemplateExtension
+    # Activate Haml::Helpers for tilt templates.
+    # https://github.com/judofyr/temple/blob/v0.7.6/lib/temple/mixins/template.rb#L7-L11
+    def compile(*)
+      "extend Haml::Helpers; #{super}"
+    end
+  end
+  Template.send(:extend, TemplateExtension)
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/temple_line_counter.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+module Haml
+  # A module to count lines of expected code. This would be faster than actual code generation
+  # and counting newlines in it.
+  module TempleLineCounter
+    class UnexpectedExpression < StandardError; end
+
+    def self.count_lines(exp)
+      type, *args = exp
+      case type
+      when :multi
+        args.map { |a| count_lines(a) }.reduce(:+) || 0
+      when :dynamic, :code
+        args.first.count("\n")
+      when :static
+        0 # It has not real newline "\n" but escaped "\\n".
+      when :case
+        arg, *cases = args
+        arg.count("\n") + cases.map do |cond, e|
+          (cond == :else ? 0 : cond.count("\n")) + count_lines(e)
+        end.reduce(:+)
+      when :escape
+        count_lines(args[1])
+      when :newline
+        1
+      else
+        raise UnexpectedExpression.new("[HAML BUG] Unexpected Temple expression '#{type}' is given!")
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/util.rb

@@ -0,0 +1,262 @@
+# frozen_string_literal: true
+
+begin
+  require 'erubis/tiny'
+rescue LoadError
+  require 'erb'
+end
+require 'set'
+require 'stringio'
+require 'strscan'
+
+module Haml
+  # A module containing various useful functions.
+  module Util
+    extend self
+
+    begin # Ruby 3.2+ or ERB 4+
+      require 'erb/escape'
+
+      define_singleton_method(:escape_html, ERB::Escape.instance_method(:html_escape))
+    rescue LoadError
+      require 'cgi/escape'
+
+      def self.escape_html(html)
+        CGI.escapeHTML(html.to_s)
+      end
+    end
+
+    # TODO: Remove unescape_interpolation's workaround and get rid of `respond_to?`.
+    def self.escape_html_safe(html)
+      html = html.to_s
+      (html.respond_to?(:html_safe?) && html.html_safe?) ? html : escape_html(html)
+    end
+
+    # Silence all output to STDERR within a block.
+    #
+    # @yield A block in which no output will be printed to STDERR
+    def silence_warnings
+      the_real_stderr, $stderr = $stderr, StringIO.new
+      yield
+    ensure
+      $stderr = the_real_stderr
+    end
+
+    ## Rails XSS Safety
+
+    # Whether or not ActionView's XSS protection is available and enabled,
+    # as is the default for Rails 3.0+, and optional for version 2.3.5+.
+    # Overridden in haml/template.rb if this is the case.
+    #
+    # @return [Boolean]
+    def rails_xss_safe?
+      false
+    end
+
+    # Checks that the encoding of a string is valid
+    # and cleans up potential encoding gotchas like the UTF-8 BOM.
+    # If it's not, yields an error string describing the invalid character
+    # and the line on which it occurs.
+    #
+    # @param str [String] The string of which to check the encoding
+    # @yield [msg] A block in which an encoding error can be raised.
+    #   Only yields if there is an encoding error
+    # @yieldparam msg [String] The error message to be raised
+    # @return [String] `str`, potentially with encoding gotchas like BOMs removed
+    def check_encoding(str)
+      if str.valid_encoding?
+        # Get rid of the Unicode BOM if possible
+        # Shortcut for UTF-8 which might be the majority case
+        if str.encoding == Encoding::UTF_8
+          return str.gsub(/\A\uFEFF/, '')
+        elsif str.encoding.name =~ /^UTF-(16|32)(BE|LE)?$/
+          return str.gsub(Regexp.new("\\A\uFEFF".encode(str.encoding)), '')
+        else
+          return str
+        end
+      end
+
+      encoding = str.encoding
+      newlines = Regexp.new("\r\n|\r|\n".encode(encoding).force_encoding(Encoding::ASCII_8BIT))
+      str.force_encoding(Encoding::ASCII_8BIT).split(newlines).each_with_index do |line, i|
+        begin
+          line.encode(encoding)
+        rescue Encoding::UndefinedConversionError => e
+          yield <<MSG.rstrip, i + 1
+Invalid #{encoding.name} character #{e.error_char.dump}
+MSG
+        end
+      end
+      return str
+    end
+
+    # Like {\#check\_encoding}, but also checks for a Ruby-style `-# coding:` comment
+    # at the beginning of the template and uses that encoding if it exists.
+    #
+    # The Haml encoding rules are simple.
+    # If a `-# coding:` comment exists,
+    # we assume that that's the original encoding of the document.
+    # Otherwise, we use whatever encoding Ruby has.
+    #
+    # Haml uses the same rules for parsing coding comments as Ruby.
+    # This means that it can understand Emacs-style comments
+    # (e.g. `-*- encoding: "utf-8" -*-`),
+    # and also that it cannot understand non-ASCII-compatible encodings
+    # such as `UTF-16` and `UTF-32`.
+    #
+    # @param str [String] The Haml template of which to check the encoding
+    # @yield [msg] A block in which an encoding error can be raised.
+    #   Only yields if there is an encoding error
+    # @yieldparam msg [String] The error message to be raised
+    # @return [String] The original string encoded properly
+    # @raise [ArgumentError] if the document declares an unknown encoding
+    def check_haml_encoding(str, &block)
+      str = str.dup if str.frozen?
+
+      bom, encoding = parse_haml_magic_comment(str)
+      if encoding; str.force_encoding(encoding)
+      elsif bom; str.force_encoding(Encoding::UTF_8)
+      end
+
+      return check_encoding(str, &block)
+    end
+
+    # Like `Object#inspect`, but preserves non-ASCII characters rather than escaping them.
+    # This is necessary so that the precompiled Haml template can be `#encode`d into `@options[:encoding]`
+    # before being evaluated.
+    #
+    # @param obj {Object}
+    # @return {String}
+    def inspect_obj(obj)
+      case obj
+      when String
+        %Q!"#{obj.gsub(/[\x00-\x7F]+/) {|s| s.dump[1...-1]}}"!
+      when Symbol
+        ":#{inspect_obj(obj.to_s)}"
+      else
+        obj.inspect
+      end
+    end
+
+    # Scans through a string looking for the interoplation-opening `#{`
+    # and, when it's found, yields the scanner to the calling code
+    # so it can handle it properly.
+    #
+    # The scanner will have any backslashes immediately in front of the `#{`
+    # as the second capture group (`scan[2]`),
+    # and the text prior to that as the first (`scan[1]`).
+    #
+    # @yieldparam scan [StringScanner] The scanner scanning through the string
+    # @return [String] The text remaining in the scanner after all `#{`s have been processed
+    def handle_interpolation(str)
+      scan = StringScanner.new(str)
+      yield scan while scan.scan(/(.*?)(\\*)#([\{@$])/)
+      scan.rest
+    end
+
+    # Moves a scanner through a balanced pair of characters.
+    # For example:
+    #
+    #     Foo (Bar (Baz bang) bop) (Bang (bop bip))
+    #     ^                       ^
+    #     from                    to
+    #
+    # @param scanner [StringScanner] The string scanner to move
+    # @param start [String] The character opening the balanced pair.
+    # @param finish [String] The character closing the balanced pair.
+    # @param count [Fixnum] The number of opening characters matched
+    #   before calling this method
+    # @return [(String, String)] The string matched within the balanced pair
+    #   and the rest of the string.
+    #   `["Foo (Bar (Baz bang) bop)", " (Bang (bop bip))"]` in the example above.
+    def balance(scanner, start, finish, count = 0)
+      str = ''.dup
+      scanner = StringScanner.new(scanner) unless scanner.is_a? StringScanner
+      regexp = Regexp.new("(.*?)[\\#{start.chr}\\#{finish.chr}]", Regexp::MULTILINE)
+      while scanner.scan(regexp)
+        str << scanner.matched
+        count += 1 if scanner.matched[-1] == start
+        count -= 1 if scanner.matched[-1] == finish
+        return [str.strip, scanner.rest] if count == 0
+      end
+    end
+
+    # Formats a string for use in error messages about indentation.
+    #
+    # @param indentation [String] The string used for indentation
+    # @return [String] The name of the indentation (e.g. `"12 spaces"`, `"1 tab"`)
+    def human_indentation(indentation)
+      if !indentation.include?(?\t)
+        noun = 'space'
+      elsif !indentation.include?(?\s)
+        noun = 'tab'
+      else
+        return indentation.inspect
+      end
+
+      singular = indentation.length == 1
+      "#{indentation.length} #{noun}#{'s' unless singular}"
+    end
+
+    def contains_interpolation?(str)
+      /#[\{$@]/ === str
+    end
+
+    def unescape_interpolation(str, escape_html = nil)
+      res = ''.dup
+      rest = Haml::Util.handle_interpolation str.dump do |scan|
+        escapes = (scan[2].size - 1) / 2
+        char = scan[3] # '{', '@' or '$'
+        res << scan.matched[0...-3 - escapes]
+        if escapes % 2 == 1
+          res << "\##{char}"
+        else
+          interpolated = if char == '{'
+            balance(scan, ?{, ?}, 1)[0][0...-1]
+          else
+            scan.scan(/\w+/)
+          end
+          content = eval("\"#{interpolated}\"")
+          content = "#{char}#{content}" if char == '@' || char == '$'
+          content = "Haml::Util.escape_html_safe((#{content}).to_s)" if escape_html
+
+          res << "\#{#{content}}"
+        end
+      end
+      res + rest
+    end
+
+    private
+
+    # Parses a magic comment at the beginning of a Haml file.
+    # The parsing rules are basically the same as Ruby's.
+    #
+    # @return [(Boolean, String or nil)]
+    #   Whether the document begins with a UTF-8 BOM,
+    #   and the declared encoding of the document (or nil if none is declared)
+    def parse_haml_magic_comment(str)
+      scanner = StringScanner.new(str.dup.force_encoding(Encoding::ASCII_8BIT))
+      bom = scanner.scan(/\xEF\xBB\xBF/n)
+      return bom unless scanner.scan(/-\s*#\s*/n)
+      if (coding = try_parse_haml_emacs_magic_comment(scanner))
+        return bom, coding
+      end
+
+      return bom unless scanner.scan(/.*?coding[=:]\s*([\w-]+)/in)
+      return bom, scanner[1]
+    end
+
+    def try_parse_haml_emacs_magic_comment(scanner)
+      pos = scanner.pos
+      return unless scanner.scan(/.*?-\*-\s*/n)
+      # From Ruby's parse.y
+      return unless scanner.scan(/([^\s'":;]+)\s*:\s*("(?:\\.|[^"])*"|[^"\s;]+?)[\s;]*-\*-/n)
+      name, val = scanner[1], scanner[2]
+      return unless name =~ /(en)?coding/in
+      val = $1 if val =~ /^"(.*)"$/n
+      return val
+    ensure
+      scanner.pos = pos
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/version.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+module Haml
+  VERSION = '6.4.0'
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/whitespace.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+module Haml
+  class Whitespace < Temple::Filter
+    def on_whitespace
+      [:static, "\n"]
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+require 'haml/engine'
+require 'haml/error'
+require 'haml/version'
+require 'haml/template'
+
+if File.basename($0) != 'haml'
+  begin
+    require 'rails'
+    require 'haml/railtie'
+  rescue LoadError
+  end
+end