brakeman 7.0.1 → 7.1.0

data/bundle/ruby/{3.1.0/gems/haml-5.2.2 → 3.2.0/gems/haml-6.3.0}/lib/haml/parser.rb

@@ -2,6 +2,8 @@
 
 require 'ripper'
 require 'strscan'
+require 'haml/error'
+require 'haml/util'
 
 module Haml
   class Parser
@@ -76,7 +78,7 @@ module Haml
     #
     BLOCK_WITH_SPACES = /do\s*\|\s*[^\|]*\s+\|\z/
 
-    MID_BLOCK_KEYWORDS = %w[else elsif rescue ensure end when].freeze
+    MID_BLOCK_KEYWORDS = %w[else elsif rescue ensure end when in].freeze
     START_BLOCK_KEYWORDS = %w[if begin case unless].freeze
     # Try to parse assignments to block starters as best as possible
     START_BLOCK_KEYWORD_REGEX = /(?:\w+(?:,\s*\w+)*\s*=\s*)?(#{START_BLOCK_KEYWORDS.join('|')})/
@@ -95,15 +97,23 @@ module Haml
     METHOD_CALL_PREFIX = 'a('
 
     def initialize(options)
-      @options = Options.wrap(options)
+      @options = ParserOptions.new(options)
       # Record the indent levels of "if" statements to validate the subsequent
       # elsif and else statements are indented at the appropriate level.
       @script_level_stack = []
       @template_index     = 0
       @template_tabs      = 0
+      # When used in Haml::Engine, which gives options[:generator] to every filter
+      # in the engine, including Haml::Parser, we don't want to throw exceptions.
+      # However, when Haml::Parser is used as a library, we want to throw exceptions.
+      @raise_error = !options.key?(:generator)
     end
 
     def call(template)
+      template = Haml::Util.check_haml_encoding(template) do |msg, line|
+        raise Haml::Error.new(msg, line)
+      end
+
       match = template.rstrip.scan(/(([ \t]+)?(.*?))(?:\Z|\r\n|\r|\n)/m)
       # discard the last match which is always blank
       match.pop
@@ -152,7 +162,8 @@ module Haml
       @root
     rescue Haml::Error => e
       e.backtrace.unshift "#{@options.filename}:#{(e.line ? e.line + 1 : @line.index + 1) + @options.line - 1}"
-      raise
+      raise if @raise_error
+      error_with_lineno(e)
     end
 
     def compute_tabs(line)
@@ -182,6 +193,16 @@ module Haml
 
     private
 
+    def error_with_lineno(error)
+      return error if error.line
+
+      trace = error.backtrace.first
+      return error unless trace
+
+      line = trace.match(/\d+\z/).to_s.to_i
+      SyntaxError.new(error.message, line)
+    end
+
     # @private
     Line = Struct.new(:whitespace, :text, :full, :index, :parser, :eod) do
       alias_method :eod?, :eod
@@ -221,7 +242,7 @@ module Haml
         self[:old] = value
       end
 
-      # This will be a literal for Haml::Buffer#attributes's last argument, `attributes_hashes`.
+      # This will be a literal for Haml::HamlBuffer#attributes's last argument, `attributes_hashes`.
       def to_literal
         [new, stripped_old].compact.join(', ')
       end
@@ -307,13 +328,13 @@ module Haml
         raise SyntaxError.new(Error.message(:illegal_nesting_plain), @next_line.index)
       end
 
-      unless contains_interpolation?(line.text)
+      unless Util.contains_interpolation?(line.text)
         return ParseNode.new(:plain, line.index + 1, :text => line.text)
       end
 
       escape_html = @options.escape_html && @options.mime_type != 'text/plain' if escape_html.nil?
-      line.text = unescape_interpolation(line.text, escape_html)
-      script(line, false)
+      line.text = Util.unescape_interpolation(line.text)
+      script(line, false).tap { |n| n.value[:escape_interpolation] = true if escape_html }
     end
 
     def script(line, escape_html = nil, preserve = false)
@@ -400,7 +421,8 @@ module Haml
       when '='
         parse = true
         if value[0] == ?=
-          value = unescape_interpolation(value[1..-1].strip, escape_html)
+          value = Util.unescape_interpolation(value[1..-1].strip)
+          escape_interpolation = true if escape_html
           escape_html = false
         end
       when '&', '!'
@@ -408,19 +430,21 @@ module Haml
           parse = true
           preserve_script = (value[0] == ?~)
           if value[1] == ?=
-            value = unescape_interpolation(value[2..-1].strip, escape_html)
+            value = Util.unescape_interpolation(value[2..-1].strip)
+            escape_interpolation = true if escape_html
             escape_html = false
           else
             value = value[1..-1].strip
           end
-        elsif contains_interpolation?(value)
-          value = unescape_interpolation(value, escape_html)
+        elsif Util.contains_interpolation?(value)
+          value = Util.unescape_interpolation(value)
+          escape_interpolation = true if escape_html
           parse = true
           escape_html = false
         end
       else
-        if contains_interpolation?(value)
-          value = unescape_interpolation(value, escape_html)
+        if Util.contains_interpolation?(value)
+          value = Util.unescape_interpolation(value, escape_html)
           parse = true
           escape_html = false
         end
@@ -431,13 +455,13 @@ module Haml
 
       if attributes_hashes[:new]
         static_attributes, attributes_hash = attributes_hashes[:new]
-        AttributeBuilder.merge_attributes!(attributes, static_attributes) if static_attributes
+        AttributeMerger.merge_attributes!(attributes, static_attributes) if static_attributes
         dynamic_attributes.new = attributes_hash
       end
 
       if attributes_hashes[:old]
         static_attributes = parse_static_hash(attributes_hashes[:old])
-        AttributeBuilder.merge_attributes!(attributes, static_attributes) if static_attributes
+        AttributeMerger.merge_attributes!(attributes, static_attributes) if static_attributes
         dynamic_attributes.old = attributes_hashes[:old] unless static_attributes || @options.suppress_eval
       end
 
@@ -459,7 +483,8 @@ module Haml
         :nuke_inner_whitespace => nuke_inner_whitespace,
         :nuke_outer_whitespace => nuke_outer_whitespace, :object_ref => object_ref,
         :escape_html => escape_html, :preserve_tag => preserve_tag,
-        :preserve_script => preserve_script, :parse => parse, :value => line.text)
+        :preserve_script => preserve_script, :parse => parse, :value => line.text,
+        :escape_interpolation => escape_interpolation)
     end
 
     # Renders a line that creates an XHTML tag and has an implicit div because of
@@ -481,9 +506,9 @@ module Haml
       conditional, text = balance(text, ?[, ?]) if text[0] == ?[
       text.strip!
 
-      if contains_interpolation?(text)
+      if Util.contains_interpolation?(text)
         parse = true
-        text = unescape_interpolation(text)
+        text = Util.unescape_interpolation(text)
       else
         parse = false
       end
@@ -552,7 +577,7 @@ module Haml
 
     alias :close_script :close_silent_script
 
-    # This is a class method so it can be accessed from {Haml::Helpers}.
+    # This is a class method so it can be accessed from {Haml::HamlHelpers}.
     #
     # Iterates through the classes and ids supplied through `.`
     # and `#` syntax, and returns a hash with them as attributes,
@@ -576,8 +601,8 @@ module Haml
       attributes
     end
 
-    # This method doesn't use Haml::AttributeParser because currently it depends on Ripper and Rubinius doesn't provide it.
-    # Ideally this logic should be placed in Haml::AttributeParser instead of here and this method should use it.
+    # This method doesn't use Haml::HamlAttributeParser because currently it depends on Ripper and Rubinius doesn't provide it.
+    # Ideally this logic should be placed in Haml::HamlAttributeParser instead of here and this method should use it.
     #
     # @param  [String] text - Hash literal or text inside old attributes
     # @return [Hash,nil] - Return nil if text is not static Hash literal
@@ -714,7 +739,7 @@ module Haml
         if type == :static
           static_attributes[name] = val
         else
-          dynamic_attributes << "#{inspect_obj(name)} => #{val},"
+          dynamic_attributes << "#{Util.inspect_obj(name)} => #{val},"
         end
       end
       dynamic_attributes << "}"
@@ -749,7 +774,7 @@ module Haml
 
       return name, [:static, content.first[1]] if content.size == 1
       return name, [:dynamic,
-        %!"#{content.each_with_object(''.dup) {|(t, v), s| s << (t == :str ? inspect_obj(v)[1...-1] : "\#{#{v}}")}}"!]
+        %!"#{content.each_with_object(''.dup) {|(t, v), s| s << (t == :str ? Util.inspect_obj(v)[1...-1] : "\#{#{v}}")}}"!]
     end
 
     def next_line
@@ -852,5 +877,115 @@ module Haml
     def flat?
       @flat
     end
+
+    class << AttributeMerger = Object.new
+      # Merges two attribute hashes.
+      # This is the same as `to.merge!(from)`,
+      # except that it merges id, class, and data attributes.
+      #
+      # ids are concatenated with `"_"`,
+      # and classes are concatenated with `" "`.
+      # data hashes are simply merged.
+      #
+      # Destructively modifies `to`.
+      #
+      # @param to [{String => String,Hash}] The attribute hash to merge into
+      # @param from [{String => Object}] The attribute hash to merge from
+      # @return [{String => String,Hash}] `to`, after being merged
+      def merge_attributes!(to, from)
+        from.keys.each do |key|
+          to[key] = merge_value(key, to[key], from[key])
+        end
+        to
+      end
+
+      private
+
+      # @return [String, nil]
+      def filter_and_join(value, separator)
+        return '' if (value.respond_to?(:empty?) && value.empty?)
+
+        if value.is_a?(Array)
+          value = value.flatten
+          value.map! {|item| item ? item.to_s : nil}
+          value.compact!
+          value = value.join(separator)
+        else
+          value = value ? value.to_s : nil
+        end
+        !value.nil? && !value.empty? && value
+      end
+
+      # Merge a couple of values to one attribute value. No destructive operation.
+      #
+      # @param to [String,Hash,nil]
+      # @param from [Object]
+      # @return [String,Hash]
+      def merge_value(key, to, from)
+        if from.kind_of?(Hash) || to.kind_of?(Hash)
+          from = { nil => from } if !from.is_a?(Hash)
+          to   = { nil => to }   if !to.is_a?(Hash)
+          to.merge(from)
+        elsif key == 'id'
+          merged_id = filter_and_join(from, '_')
+          if to && merged_id
+            merged_id = "#{to}_#{merged_id}"
+          elsif to || merged_id
+            merged_id ||= to
+          end
+          merged_id
+        elsif key == 'class'
+          merged_class = filter_and_join(from, ' ')
+          if to && merged_class
+            merged_class = (to.split(' ') | merged_class.split(' ')).join(' ')
+          elsif to || merged_class
+            merged_class ||= to
+          end
+          merged_class
+        else
+          from
+        end
+      end
+    end
+    private_constant :AttributeMerger
+
+    class ParserOptions
+      # A list of options that are actually used in the parser
+      AVAILABLE_OPTIONS = %i[
+        autoclose
+        escape_html
+        filename
+        line
+        mime_type
+        preserve
+        remove_whitespace
+        suppress_eval
+      ].each do |option|
+        attr_reader option
+      end
+
+      DEFAULTS = {
+        autoclose:         %w(area base basefont br col command embed frame
+                              hr img input isindex keygen link menuitem meta
+                              param source track wbr),
+        escape_html:       false,
+        filename:          '(haml)',
+        line:              1,
+        mime_type:         'text/html',
+        preserve:          %w(textarea pre code),
+        remove_whitespace: false,
+        suppress_eval:     false,
+      }
+
+      def initialize(values = {})
+        DEFAULTS.each {|k, v| instance_variable_set :"@#{k}", v}
+        AVAILABLE_OPTIONS.each do |key|
+          if values.key?(key)
+            instance_variable_set :"@#{key}", values[key]
+          end
+        end
+      end
+    end
+    private_constant :ParserOptions
   end
 end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/rails_helpers.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: false
+require 'haml/helpers'
+
+# There are only helpers that depend on ActionView internals.
+module Haml
+  module RailsHelpers
+    include Helpers
+    extend self
+
+    DEFAULT_PRESERVE_TAGS = %w[textarea pre code].freeze
+
+    def find_and_preserve(input = nil, tags = DEFAULT_PRESERVE_TAGS, &block)
+      return find_and_preserve(capture_haml(&block), input || tags) if block
+
+      tags = tags.each_with_object('') do |t, s|
+        s << '|' unless s.empty?
+        s << Regexp.escape(t)
+      end
+
+      re = /<(#{tags})([^>]*)>(.*?)(<\/\1>)/im
+      input.to_s.gsub(re) do |s|
+        s =~ re # Can't rely on $1, etc. existing since Rails' SafeBuffer#gsub is incompatible
+        "<#{$1}#{$2}>#{preserve($3)}</#{$1}>"
+      end
+    end
+
+    def preserve(input = nil, &block)
+      return preserve(capture_haml(&block)) if block
+      super.html_safe
+    end
+
+    def surround(front, back = front, &block)
+      output = capture_haml(&block)
+      front  = escape_once(front) unless front.html_safe?
+      back   = escape_once(back)  unless back.html_safe?
+      "#{front}#{output.chomp}#{back}\n".html_safe
+    end
+
+    def precede(str, &block)
+      str = escape_once(str) unless str.html_safe?
+      "#{str}#{capture_haml(&block).chomp}\n".html_safe
+    end
+
+    def succeed(str, &block)
+      str = escape_once(str) unless str.html_safe?
+      "#{capture_haml(&block).chomp}#{str}\n".html_safe
+    end
+
+    def capture_haml(*args, &block)
+      capture(*args, &block)
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/rails_template.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+require 'temple'
+require 'haml/engine'
+require 'haml/rails_helpers'
+require 'haml/util'
+
+module Haml
+  class RailsTemplate
+    # Compatible with: https://github.com/judofyr/temple/blob/v0.7.7/lib/temple/mixins/options.rb#L15-L24
+    class << self
+      def options
+        @options ||= {
+          generator:     Temple::Generators::RailsOutputBuffer,
+          use_html_safe: true,
+          streaming:     true,
+          buffer_class:  'ActionView::OutputBuffer',
+          disable_capture: true,
+        }
+      end
+
+      def set_options(opts)
+        options.update(opts)
+      end
+    end
+
+    def call(template, source = nil)
+      source ||= template.source
+      options = RailsTemplate.options
+
+      # Make the filename available in parser etc.
+      if template.respond_to?(:identifier)
+        options = options.merge(filename: template.identifier)
+      end
+
+      # https://github.com/haml/haml/blob/4.0.7/lib/haml/template/plugin.rb#L19-L20
+      # https://github.com/haml/haml/blob/4.0.7/lib/haml/options.rb#L228
+      if template.respond_to?(:type) && template.type == 'text/xml'
+        options = options.merge(format: :xhtml)
+      end
+
+      if ActionView::Base.try(:annotate_rendered_view_with_filenames) && template.format == :html
+        options = options.merge(
+          preamble: "<!-- BEGIN #{template.short_identifier} -->\n",
+          postamble: "<!-- END #{template.short_identifier} -->\n",
+        )
+      end
+
+      Engine.new(options).call(source)
+    end
+
+    def supports_streaming?
+      RailsTemplate.options[:streaming]
+    end
+  end
+  ActionView::Template.register_template_handler(:haml, RailsTemplate.new)
+end
+
+# Haml extends Haml::Helpers in ActionView each time.
+# It costs much, so Haml includes a compatible module at first.
+ActiveSupport.on_load(:action_view) do
+  include Haml::RailsHelpers
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/railtie.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+require 'rails'
+
+module Haml
+  class Railtie < ::Rails::Railtie
+    initializer :haml, before: :load_config_initializers do |app|
+      require 'haml/rails_template'
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/ruby_expression.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+require 'ripper'
+
+module Haml
+  class RubyExpression < Ripper
+    class ParseError < StandardError; end
+
+    def self.syntax_error?(code)
+      self.new(code).parse
+      false
+    rescue ParseError
+      true
+    end
+
+    def self.string_literal?(code)
+      return false if syntax_error?(code)
+
+      type, instructions = Ripper.sexp(code)
+      return false if type != :program
+      return false if instructions.size > 1
+
+      type, _ = instructions.first
+      type == :string_literal
+    end
+
+    private
+
+    def on_parse_error(*)
+      raise ParseError
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/string_splitter.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+begin
+  require 'ripper'
+rescue LoadError
+end
+
+module Haml
+  # Compile [:dynamic, "foo#{bar}"] to [:multi, [:static, 'foo'], [:dynamic, 'bar']]
+  class StringSplitter < Temple::Filter
+    if defined?(Ripper) && RUBY_VERSION >= "2.0.0" && Ripper.respond_to?(:lex)
+      class << self
+        # `code` param must be valid string literal
+        def compile(code)
+          [].tap do |exps|
+            tokens = Ripper.lex(code.strip)
+            tokens.pop while tokens.last && [:on_comment, :on_sp].include?(tokens.last[1])
+
+            if tokens.size < 2
+              raise(Haml::InternalError, "Expected token size >= 2 but got: #{tokens.size}")
+            end
+            compile_tokens!(exps, tokens)
+          end
+        end
+
+        private
+
+        def strip_quotes!(tokens)
+          _, type, beg_str = tokens.shift
+          if type != :on_tstring_beg
+            raise(Haml::InternalError, "Expected :on_tstring_beg but got: #{type}")
+          end
+
+          _, type, end_str = tokens.pop
+          if type != :on_tstring_end
+            raise(Haml::InternalError, "Expected :on_tstring_end but got: #{type}")
+          end
+
+          [beg_str, end_str]
+        end
+
+        def compile_tokens!(exps, tokens)
+          beg_str, end_str = strip_quotes!(tokens)
+
+          until tokens.empty?
+            _, type, str = tokens.shift
+
+            case type
+            when :on_tstring_content
+              beg_str, end_str = escape_quotes(beg_str, end_str)
+              exps << [:static, eval("#{beg_str}#{str}#{end_str}").to_s]
+            when :on_embexpr_beg
+              embedded = shift_balanced_embexpr(tokens)
+              exps << [:dynamic, embedded] unless embedded.empty?
+            end
+          end
+        end
+
+        # Some quotes are split-unsafe. Replace such quotes with null characters.
+        def escape_quotes(beg_str, end_str)
+          case [beg_str[-1], end_str]
+          when ['(', ')'], ['[', ']'], ['{', '}']
+            [beg_str.sub(/.\z/) { "\0" }, "\0"]
+          else
+            [beg_str, end_str]
+          end
+        end
+
+        def shift_balanced_embexpr(tokens)
+          String.new.tap do |embedded|
+            embexpr_open = 1
+
+            until tokens.empty?
+              _, type, str = tokens.shift
+              case type
+              when :on_embexpr_beg
+                embexpr_open += 1
+              when :on_embexpr_end
+                embexpr_open -= 1
+                break if embexpr_open == 0
+              end
+
+              embedded << str
+            end
+          end
+        end
+      end
+
+      def on_dynamic(code)
+        return [:dynamic, code] unless string_literal?(code)
+        return [:dynamic, code] if code.include?("\n")
+
+        temple = [:multi]
+        StringSplitter.compile(code).each do |type, content|
+          case type
+          when :static
+            temple << [:static, content]
+          when :dynamic
+            temple << on_dynamic(content)
+          end
+        end
+        temple
+      end
+
+      private
+
+      def string_literal?(code)
+        return false if SyntaxChecker.syntax_error?(code)
+
+        type, instructions = Ripper.sexp(code)
+        return false if type != :program
+        return false if instructions.size > 1
+
+        type, _ = instructions.first
+        type == :string_literal
+      end
+
+      class SyntaxChecker < Ripper
+        class ParseError < StandardError; end
+
+        def self.syntax_error?(code)
+          self.new(code).parse
+          false
+        rescue ParseError
+          true
+        end
+
+        private
+
+        def on_parse_error(*)
+          raise ParseError
+        end
+      end
+    else
+      # Do nothing if ripper is unavailable
+      def call(ast)
+        ast
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/haml-6.3.0/lib/haml/template.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: false
+require 'temple'
+require 'haml/engine'
+require 'haml/helpers'
+
+module Haml
+  Template = Temple::Templates::Tilt.create(
+    Haml::Engine,
+    register_as: [:haml, :haml],
+  )
+
+  module TemplateExtension
+    # Activate Haml::Helpers for tilt templates.
+    # https://github.com/judofyr/temple/blob/v0.7.6/lib/temple/mixins/template.rb#L7-L11
+    def compile(*)
+      "extend Haml::Helpers; #{super}"
+    end
+  end
+  Template.send(:extend, TemplateExtension)
+end

data/bundle/ruby/{3.1.0/gems/haml-5.2.2 → 3.2.0/gems/haml-6.3.0}/lib/haml/temple_line_counter.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-
 module Haml
   # A module to count lines of expected code. This would be faster than actual code generation
   # and counting newlines in it.
@@ -22,6 +21,8 @@ module Haml
         end.reduce(:+)
       when :escape
         count_lines(args[1])
+      when :newline
+        1
       else
         raise UnexpectedExpression.new("[HAML BUG] Unexpected Temple expression '#{type}' is given!")
       end