brakeman 6.1.2 → 7.1.0

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/compiler/script_compiler.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+require 'temple/static_analyzer'
+require 'haml/ruby_expression'
+require 'haml/string_splitter'
+
+module Haml
+  class Compiler
+    class ScriptCompiler
+      def self.find_and_preserve(input, tags)
+        tags = tags.map { |tag| Regexp.escape(tag) }.join('|')
+        re = /<(#{tags})([^>]*)>(.*?)(<\/\1>)/im
+        input.to_s.gsub(re) do |s|
+          s =~ re # Can't rely on $1, etc. existing since Rails' SafeBuffer#gsub is incompatible
+          "<#{$1}#{$2}>#{Haml::Helpers.preserve($3)}</#{$1}>"
+        end
+      end
+
+      def initialize(identity, options)
+        @identity = identity
+        @disable_capture = options[:disable_capture]
+      end
+
+      def compile(node, &block)
+        unless Ripper.respond_to?(:lex) # No Ripper.lex in truffleruby
+          return dynamic_compile(node, &block)
+        end
+
+        no_children = node.children.empty?
+        case
+        when no_children && node.value[:escape_interpolation]
+          compile_interpolated_plain(node)
+        when no_children && RubyExpression.string_literal?(node.value[:text])
+          delegate_optimization(node)
+        when no_children && Temple::StaticAnalyzer.static?(node.value[:text])
+          static_compile(node)
+        else
+          dynamic_compile(node, &block)
+        end
+      end
+
+      private
+
+      # String-interpolated plain text must be compiled with this method
+      # because we have to escape only interpolated values.
+      def compile_interpolated_plain(node)
+        temple = [:multi]
+        StringSplitter.compile(node.value[:text]).each do |type, value|
+          case type
+          when :static
+            temple << [:static, value]
+          when :dynamic
+            temple << [:escape, node.value[:escape_interpolation], [:dynamic, value]]
+          end
+        end
+        temple << [:newline]
+      end
+
+      # :dynamic is optimized in other filter: StringSplitter
+      def delegate_optimization(node)
+        [:multi,
+         [:escape, node.value[:escape_html], [:dynamic, node.value[:text]]],
+         [:newline],
+        ]
+      end
+
+      def static_compile(node)
+        str = eval(node.value[:text]).to_s
+        if node.value[:escape_html]
+          str = Haml::Util.escape_html(str)
+        elsif node.value[:preserve]
+          str = ScriptCompiler.find_and_preserve(str, %w(textarea pre code))
+        end
+        [:multi, [:static, str], [:newline]]
+      end
+
+      def dynamic_compile(node, &block)
+        var = @identity.generate
+        temple = compile_script_assign(var, node, &block)
+        temple << compile_script_result(var, node)
+      end
+
+      def compile_script_assign(var, node, &block)
+        if node.children.empty?
+          [:multi,
+           [:code, "#{var} = (#{node.value[:text]}"],
+           [:newline],
+           [:code, ')'],
+          ]
+        else
+          [:multi,
+           [:block, "#{var} = #{node.value[:text]}",
+            [:multi, [:newline], @disable_capture ? yield(node) : [:capture, Temple::Utils.unique_name, yield(node)]]
+           ],
+          ]
+        end
+      end
+
+      def compile_script_result(result, node)
+        if !node.value[:escape_html] && node.value[:preserve]
+          result = find_and_preserve(result)
+        end
+        [:escapeany, node.value[:escape_html], [:dynamic, result]]
+      end
+
+      def find_and_preserve(code)
+        %Q[::Haml::Compiler::ScriptCompiler.find_and_preserve(#{code}, %w(textarea pre code))]
+      end
+
+      def escape_html(temple)
+        [:escape, true, temple]
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/compiler/silent_script_compiler.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+module Haml
+  class Compiler
+    class SilentScriptCompiler
+      def compile(node, &block)
+        if node.children.empty?
+          [:multi, [:code, node.value[:text]], [:newline]]
+        else
+          compile_with_children(node, &block)
+        end
+      end
+
+      private
+
+      def compile_with_children(node, &block)
+        [:multi,
+         [:block, node.value[:text],
+          [:multi, [:newline], yield(node)],
+         ],
+        ]
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/compiler/tag_compiler.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+require 'haml/util'
+require 'haml/attribute_compiler'
+require 'haml/string_splitter'
+
+module Haml
+  class Compiler
+    class TagCompiler
+      def initialize(identity, options)
+        @autoclose = options[:autoclose]
+        @identity  = identity
+        @attribute_compiler = AttributeCompiler.new(identity, options)
+      end
+
+      def compile(node, &block)
+        attrs    = @attribute_compiler.compile(node)
+        contents = compile_contents(node, &block)
+        [:html, :tag, node.value[:name], attrs, contents]
+      end
+
+      private
+
+      def compile_contents(node, &block)
+        case
+        when !node.children.empty?
+          yield(node)
+        when node.value[:value].nil? && self_closing?(node)
+          nil
+        when node.value[:parse]
+          return compile_interpolated_plain(node) if node.value[:escape_interpolation]
+          if Ripper.respond_to?(:lex) # No Ripper.lex in truffleruby
+            return delegate_optimization(node) if RubyExpression.string_literal?(node.value[:value])
+            return delegate_optimization(node) if Temple::StaticAnalyzer.static?(node.value[:value])
+          end
+
+          var = @identity.generate
+          [:multi,
+           [:code, "#{var} = (#{node.value[:value]}"],
+           [:newline],
+           [:code, ')'],
+           [:escape, node.value[:escape_html], [:dynamic, var]]
+          ]
+        else
+          [:static, node.value[:value]]
+        end
+      end
+
+      # :dynamic is optimized in other filters: StringSplitter or StaticAnalyzer
+      def delegate_optimization(node)
+        [:multi,
+         [:escape, node.value[:escape_html], [:dynamic, node.value[:value]]],
+         [:newline],
+        ]
+      end
+
+      # We should handle interpolation here to escape only interpolated values.
+      def compile_interpolated_plain(node)
+        temple = [:multi]
+        StringSplitter.compile(node.value[:value]).each do |type, value|
+          case type
+          when :static
+            temple << [:static, value]
+          when :dynamic
+            temple << [:escape, node.value[:escape_interpolation], [:dynamic, value]]
+          end
+        end
+        temple << [:newline]
+      end
+
+      def self_closing?(node)
+        return true if @autoclose && @autoclose.include?(node.value[:name])
+        node.value[:self_closing]
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/compiler.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+require 'haml/compiler/children_compiler'
+require 'haml/compiler/comment_compiler'
+require 'haml/compiler/doctype_compiler'
+require 'haml/compiler/script_compiler'
+require 'haml/compiler/silent_script_compiler'
+require 'haml/compiler/tag_compiler'
+require 'haml/filters'
+require 'haml/identity'
+
+module Haml
+  class Compiler
+    def initialize(options = {})
+      identity                = Identity.new
+      @children_compiler      = ChildrenCompiler.new
+      @comment_compiler       = CommentCompiler.new
+      @doctype_compiler       = DoctypeCompiler.new(options)
+      @filter_compiler        = Filters.new(options)
+      @script_compiler        = ScriptCompiler.new(identity, options)
+      @silent_script_compiler = SilentScriptCompiler.new
+      @tag_compiler           = TagCompiler.new(identity, options)
+    end
+
+    def call(ast)
+      return runtime_error(ast) if ast.is_a?(Error)
+      compile(ast)
+    rescue Error => e
+      runtime_error(e)
+    end
+
+    private
+
+    def compile(node)
+      case node.type
+      when :root
+        compile_children(node)
+      when :comment
+        compile_comment(node)
+      when :doctype
+        compile_doctype(node)
+      when :filter
+        compile_filter(node)
+      when :plain
+        compile_plain(node)
+      when :script
+        compile_script(node)
+      when :silent_script
+        compile_silent_script(node)
+      when :tag
+        compile_tag(node)
+      when :haml_comment
+        [:multi]
+      else
+        raise InternalError.new("Unexpected node type: #{node.type}")
+      end
+    end
+
+    def compile_children(node)
+      @children_compiler.compile(node) { |n| compile(n) }
+    end
+
+    def compile_comment(node)
+      @comment_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def compile_doctype(node)
+      @doctype_compiler.compile(node)
+    end
+
+    def compile_filter(node)
+      @filter_compiler.compile(node)
+    end
+
+    def compile_plain(node)
+      [:static, node.value[:text]]
+    end
+
+    def compile_script(node)
+      @script_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def compile_silent_script(node)
+      @silent_script_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def compile_tag(node)
+      @tag_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def runtime_error(error)
+      [:multi].tap do |temple|
+        error.line.times { temple << [:newline] } if error.line
+        temple << [:code, %Q[raise #{error.class}.new(%q[#{error.message}], #{error.line.inspect})]]
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/dynamic_merger.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+module Haml
+  # Compile [:multi, [:static, 'foo'], [:dynamic, 'bar']] to [:dynamic, '"foo#{bar}"']
+  class DynamicMerger < Temple::Filter
+    def on_multi(*exps)
+      exps = exps.dup
+      result = [:multi]
+      buffer = []
+
+      until exps.empty?
+        type, arg = exps.first
+        if type == :dynamic && arg.count("\n") == 0
+          buffer << exps.shift
+        elsif type == :static && exps.size > (count = arg.count("\n")) &&
+              exps[1, count].all? { |e| e == [:newline] }
+          (1 + count).times { buffer << exps.shift }
+        elsif type == :newline && exps.size > (count = count_newline(exps)) &&
+              exps[count].first == :static && count == exps[count].last.count("\n")
+          (count + 1).times { buffer << exps.shift }
+        else
+          result.concat(merge_dynamic(buffer))
+          buffer = []
+          result << compile(exps.shift)
+        end
+      end
+      result.concat(merge_dynamic(buffer))
+
+      result.size == 2 ? result[1] : result
+    end
+
+    private
+
+    def merge_dynamic(exps)
+      # Merge exps only when they have both :static and :dynamic
+      unless exps.any? { |type,| type == :static } && exps.any? { |type,| type == :dynamic }
+        return exps
+      end
+
+      strlit_body = String.new
+      exps.each do |type, arg|
+        case type
+        when :static
+          strlit_body << arg.dump.sub!(/\A"/, '').sub!(/"\z/, '').gsub('\n', "\n")
+        when :dynamic
+          strlit_body << "\#{#{arg}}"
+        when :newline
+          # newline is added by `gsub('\n', "\n")`
+        else
+          raise "unexpected type #{type.inspect} is given to #merge_dynamic"
+        end
+      end
+      [[:dynamic, "%Q\0#{strlit_body}\0"]]
+    end
+
+    def count_newline(exps)
+      count = 0
+      exps.each do |exp|
+        if exp == [:newline]
+          count += 1
+        else
+          return count
+        end
+      end
+      return count
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/engine.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+require 'temple'
+require 'haml/parser'
+require 'haml/compiler'
+require 'haml/html'
+require 'haml/string_splitter'
+require 'haml/escape'
+require 'haml/escape_any'
+require 'haml/force_escape'
+require 'haml/dynamic_merger'
+require 'haml/ambles'
+require 'haml/whitespace'
+
+module Haml
+  class Engine < Temple::Engine
+    define_options(
+      :buffer_class,
+      generator:    Temple::Generators::StringBuffer,
+      format:       :html,
+      attr_quote:   "'",
+      escape_html:  true,
+      escape_attrs: true,
+      autoclose:    %w(area base basefont br col command embed frame
+                       hr img input isindex keygen link menuitem meta
+                       param source track wbr),
+      filename:     "",
+      disable_capture: false,
+      remove_whitespace: false,
+    )
+
+    use Parser
+    use Compiler
+    use HTML
+    use StringSplitter
+    filter :StaticAnalyzer
+    use Escape
+    use EscapeAny
+    use ForceEscape
+    filter :ControlFlow
+    use Ambles
+    filter :MultiFlattener
+    use Whitespace
+    filter :StaticMerger
+    use DynamicMerger
+    use :Generator, -> { options[:generator] }
+  end
+
+  # For backward compatibility of Tilt integration. TODO: We should deprecate this
+  # and let Tilt have a native support of Haml 6. At least it generates warnings now.
+  class TempleEngine < Engine
+    def compile(template)
+      @precompiled = call(template)
+    end
+
+    def precompiled_with_ambles(_local_names, after_preamble:)
+      "#{after_preamble.tr("\n", ';')}#{@precompiled}".dup
+    end
+  end
+end

data/bundle/ruby/{3.3.0/gems/haml-5.2.2 → 3.2.0/gems/haml-6.3.0}/lib/haml/error.rb

@@ -1,9 +1,6 @@
 # frozen_string_literal: true
-
 module Haml
-  # An exception raised by Haml code.
   class Error < StandardError
-
     MESSAGES = {
       bad_script_indent:            '"%s" is indented at wrong level: expected %d, but was at %d.',
       cant_run_filter:              'Can\'t run "%s" filter; you must require its dependencies first',
@@ -61,5 +58,9 @@ END
   # except in that it's a subclass of {Haml::Error}.
   class SyntaxError < Error; end
 
-  class InvalidAttributeNameError < SyntaxError; end
+  # An invalid filter name was used.
+  class FilterNotFound < Error; end
+
+  # InternalError means that you hit a bug of Haml itself.
+  class InternalError < Error; end
 end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/escape.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+require 'haml/util'
+
+module Haml
+  class Escape < Temple::Filters::Escapable
+    def initialize(opts = {})
+      super
+      @escape_code = options[:escape_code] ||
+        "::Haml::Util.escape_html#{options[:use_html_safe] ? '_safe' : ''}((%s))"
+      @escaper = eval("proc {|v| #{@escape_code % 'v'} }")
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/escape_any.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+require 'haml/escape'
+
+module Haml
+  # This module allows Temple::Filter to dispatch :fescape on `#compile`.
+  module EscapeanyDispathcer
+    def on_escapeany(flag, exp)
+      [:escapeany, flag, compile(exp)]
+    end
+  end
+  ::Temple::Filter.include EscapeanyDispathcer
+
+  # Unlike Haml::Escape, this calls to_s when not escaped.
+  class EscapeAny < Escape
+    alias_method :on_escapeany, :on_escape
+
+    def on_dynamic(value)
+      [:dynamic, @escape ? @escape_code % value : "(#{value}).to_s"]
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/base.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+require 'haml/util'
+
+module Haml
+  class Filters
+    class Base
+      def initialize(options = {})
+        @format = options[:format]
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/cdata.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+module Haml
+  class Filters
+    class Cdata < TextBase
+      def compile(node)
+        compile_cdata(node)
+      end
+
+      private
+
+      def compile_cdata(node)
+        temple = [:multi]
+        temple << [:static, "<![CDATA[\n"]
+        compile_text!(temple, node, '    ')
+        temple << [:static, "\n]]>"]
+        temple
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/coffee.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+module Haml
+  class Filters
+    class Coffee < TiltBase
+      def compile(node)
+        require 'tilt/coffee' if explicit_require?('coffee')
+        temple = [:multi]
+        temple << [:static, "<script>\n"]
+        temple << compile_with_tilt(node, 'coffee', indent_width: 2)
+        temple << [:static, "</script>"]
+        temple
+      end
+    end
+
+    CoffeeScript = Coffee
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/css.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+module Haml
+  class Filters
+    class Css < TextBase
+      def compile(node)
+        case @format
+        when :xhtml
+          compile_xhtml(node)
+        else
+          compile_html(node)
+        end
+      end
+
+      private
+
+      def compile_html(node)
+        temple = [:multi]
+        temple << [:static, "<style>\n"]
+        compile_text!(temple, node, '  ')
+        temple << [:static, "\n</style>"]
+        temple
+      end
+
+      def compile_xhtml(node)
+        temple = [:multi]
+        temple << [:static, "<style type='text/css'>\n  /*<![CDATA[*/\n"]
+        compile_text!(temple, node, '    ')
+        temple << [:static, "\n  /*]]>*/\n</style>"]
+        temple
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/erb.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+module Haml
+  class Filters
+    class Erb < TiltBase
+      def compile(node)
+        precompiled_with_tilt(node, 'erb')
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/escaped.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+module Haml
+  class Filters
+    class Escaped < Base
+      def compile(node)
+        text = node.value[:text].rstrip
+        temple = compile_text(text)
+        [:escape, true, temple]
+      end
+
+      private
+
+      def compile_text(text)
+        if ::Haml::Util.contains_interpolation?(text)
+          [:dynamic, ::Haml::Util.unescape_interpolation(text)]
+        else
+          [:static, text]
+        end
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/javascript.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+module Haml
+  class Filters
+    class Javascript < TextBase
+      def compile(node)
+        case @format
+        when :xhtml
+          compile_xhtml(node)
+        else
+          compile_html(node)
+        end
+      end
+
+      private
+
+      def compile_html(node)
+        temple = [:multi]
+        temple << [:static, "<script>\n"]
+        compile_text!(temple, node, '  ')
+        temple << [:static, "\n</script>"]
+        temple
+      end
+
+      def compile_xhtml(node)
+        temple = [:multi]
+        temple << [:static, "<script type='text/javascript'>\n  //<![CDATA[\n"]
+        compile_text!(temple, node, '    ')
+        temple << [:static, "\n  //]]>\n</script>"]
+        temple
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/less.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+# LESS support is deprecated since it requires therubyracer.gem,
+# which is hard to maintain.
+#
+# It's not supported in Sprockets 3.0+ too.
+# https://github.com/sstephenson/sprockets/pull/547
+module Haml
+  class Filters
+    class Less < TiltBase
+      def compile(node)
+        require 'tilt/less' if explicit_require?('less')
+        temple = [:multi]
+        temple << [:static, "<style>\n"]
+        temple << compile_with_tilt(node, 'less', indent_width: 2)
+        temple << [:static, '</style>']
+        temple
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/filters/markdown.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+module Haml
+  class Filters
+    class Markdown < TiltBase
+      def compile(node)
+        require 'tilt/redcarpet' if explicit_require?('markdown')
+        compile_with_tilt(node, 'markdown')
+      end
+    end
+  end
+end