brakeman 7.1.2 → 8.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGES.md +11 -0
- data/README.md +1 -1
- data/bundle/load.rb +2 -2
- data/bundle/ruby/3.2.0/gems/erubi-1.13.1/CHANGELOG +111 -0
- data/bundle/ruby/3.2.0/gems/{erubis-2.7.0 → erubi-1.13.1}/MIT-LICENSE +1 -0
- data/bundle/ruby/3.2.0/gems/erubi-1.13.1/README.rdoc +151 -0
- data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_block.rb +91 -0
- data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_end.rb +58 -0
- data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi.rb +299 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/asciidoc.rb +12 -5
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/babel.rb +5 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/builder.rb +4 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/coffee.rb +14 -4
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/commonmarker.rb +41 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/csv.rb +63 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/erb.rb +130 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/erubi.rb +41 -8
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/etanni.rb +7 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/haml.rb +67 -1
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/kramdown.rb +59 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/liquid.rb +93 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/livescript.rb +11 -4
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/mapping.rb +8 -8
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/markaby.rb +11 -2
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/nokogiri.rb +13 -2
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/pandoc.rb +81 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/pipeline.rb +6 -1
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/plain.rb +5 -1
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/prawn.rb +17 -6
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/radius.rb +96 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rdiscount.rb +82 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rdoc.rb +33 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/redcarpet.rb +73 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/redcloth.rb +40 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rst-pandoc.rb +33 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/sass.rb +16 -3
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/slim.rb +18 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/string.rb +10 -2
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/template.rb +5 -5
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/typescript.rb +5 -0
- data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/yajl.rb +91 -0
- data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt.rb +1 -2
- data/lib/brakeman/app_tree.rb +7 -2
- data/lib/brakeman/checks/check_model_attributes.rb +1 -1
- data/lib/brakeman/checks/check_render.rb +1 -27
- data/lib/brakeman/checks/check_render_rce.rb +43 -0
- data/lib/brakeman/checks/check_session_settings.rb +1 -1
- data/lib/brakeman/checks.rb +31 -25
- data/lib/brakeman/commandline.rb +6 -1
- data/lib/brakeman/file_parser.rb +3 -2
- data/lib/brakeman/logger.rb +264 -0
- data/lib/brakeman/options.rb +0 -9
- data/lib/brakeman/parsers/rails_erubi.rb +82 -0
- data/lib/brakeman/parsers/template_parser.rb +7 -15
- data/lib/brakeman/processor.rb +2 -2
- data/lib/brakeman/processors/controller_alias_processor.rb +1 -1
- data/lib/brakeman/processors/controller_processor.rb +3 -3
- data/lib/brakeman/processors/{erubis_template_processor.rb → erubi_template_procesor.rb} +3 -3
- data/lib/brakeman/processors/lib/rails2_config_processor.rb +4 -3
- data/lib/brakeman/processors/lib/rails2_route_processor.rb +1 -1
- data/lib/brakeman/processors/lib/render_helper.rb +1 -1
- data/lib/brakeman/processors/lib/render_path.rb +1 -1
- data/lib/brakeman/processors/model_processor.rb +1 -1
- data/lib/brakeman/report/ignore/config.rb +1 -1
- data/lib/brakeman/scanner.rb +25 -49
- data/lib/brakeman/tracker/collection.rb +12 -2
- data/lib/brakeman/tracker/config.rb +17 -13
- data/lib/brakeman/tracker/constants.rb +17 -2
- data/lib/brakeman/tracker/controller.rb +1 -1
- data/lib/brakeman/tracker.rb +7 -15
- data/lib/brakeman/version.rb +1 -1
- data/lib/brakeman.rb +89 -49
- metadata +51 -80
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/CHANGES.txt +0 -828
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/README.txt +0 -102
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/erubis +0 -3468
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/erubis-run.rb +0 -132
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/inline-require +0 -179
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/context.rb +0 -83
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/converter.rb +0 -357
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ec.rb +0 -117
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ecpp.rb +0 -113
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ejava.rb +0 -110
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ejavascript.rb +0 -119
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/enhanced.rb +0 -126
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/eperl.rb +0 -95
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ephp.rb +0 -99
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/eruby.rb +0 -125
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/escheme.rb +0 -114
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/optimized.rb +0 -127
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine.rb +0 -120
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/enhancer.rb +0 -723
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/error.rb +0 -23
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/evaluator.rb +0 -88
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/generator.rb +0 -85
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helper.rb +0 -47
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helpers/rails_form_helper.rb +0 -197
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helpers/rails_helper.rb +0 -353
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/local-setting.rb +0 -9
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/main.rb +0 -516
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/preprocessing.rb +0 -58
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/tiny.rb +0 -144
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/util.rb +0 -22
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis.rb +0 -73
- data/bundle/ruby/3.2.0/gems/erubis-2.7.0/setup.rb +0 -1331
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/creole.rb +0 -16
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/csv.rb +0 -53
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/erb.rb +0 -65
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/kramdown.rb +0 -13
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/liquid.rb +0 -37
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/pandoc.rb +0 -39
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/radius.rb +0 -41
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rdiscount.rb +0 -23
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rdoc.rb +0 -11
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/redcarpet.rb +0 -31
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/redcloth.rb +0 -13
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rst-pandoc.rb +0 -10
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/slim.rb +0 -5
- data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/yajl.rb +0 -81
- data/lib/brakeman/parsers/erubis_patch.rb +0 -11
- data/lib/brakeman/parsers/rails2_erubis.rb +0 -9
- data/lib/brakeman/parsers/rails2_xss_plugin_erubis.rb +0 -52
- data/lib/brakeman/parsers/rails3_erubis.rb +0 -85
- /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/COPYING +0 -0
- /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_emacs_org.rb +0 -0
- /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_handlebars.rb +0 -0
- /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_jbuilder.rb +0 -0
- /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_org.rb +0 -0
- /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/cli.rb +0 -0
|
@@ -0,0 +1,299 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
module Erubi
|
|
4
|
+
VERSION = '1.13.1'
|
|
5
|
+
|
|
6
|
+
# :nocov:
|
|
7
|
+
if RUBY_VERSION >= '1.9'
|
|
8
|
+
RANGE_FIRST = 0
|
|
9
|
+
RANGE_LAST = -1
|
|
10
|
+
else
|
|
11
|
+
RANGE_FIRST = 0..0
|
|
12
|
+
RANGE_LAST = -1..-1
|
|
13
|
+
end
|
|
14
|
+
|
|
15
|
+
MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
|
|
16
|
+
SKIP_DEFINED_FOR_INSTANCE_VARIABLE = RUBY_VERSION > '3'
|
|
17
|
+
FREEZE_TEMPLATE_LITERALS = !eval("''").frozen? && RUBY_VERSION >= '2.1'
|
|
18
|
+
# :nocov:
|
|
19
|
+
|
|
20
|
+
begin
|
|
21
|
+
require 'erb/escape'
|
|
22
|
+
define_method(:h, ERB::Escape.instance_method(:html_escape))
|
|
23
|
+
# :nocov:
|
|
24
|
+
rescue LoadError
|
|
25
|
+
begin
|
|
26
|
+
require 'cgi/escape'
|
|
27
|
+
unless CGI.respond_to?(:escapeHTML) # work around for JRuby 9.1
|
|
28
|
+
CGI = Object.new
|
|
29
|
+
CGI.extend(defined?(::CGI::Escape) ? ::CGI::Escape : ::CGI::Util)
|
|
30
|
+
end
|
|
31
|
+
# Escape characters with their HTML/XML equivalents.
|
|
32
|
+
def h(value)
|
|
33
|
+
CGI.escapeHTML(value.to_s)
|
|
34
|
+
end
|
|
35
|
+
rescue LoadError
|
|
36
|
+
ESCAPE_TABLE = {'&' => '&'.freeze, '<' => '<'.freeze, '>' => '>'.freeze, '"' => '"'.freeze, "'" => '''.freeze}.freeze
|
|
37
|
+
if RUBY_VERSION >= '1.9'
|
|
38
|
+
def h(value)
|
|
39
|
+
value.to_s.gsub(/[&<>"']/, ESCAPE_TABLE)
|
|
40
|
+
end
|
|
41
|
+
else
|
|
42
|
+
def h(value)
|
|
43
|
+
value.to_s.gsub(/[&<>"']/){|s| ESCAPE_TABLE[s]}
|
|
44
|
+
end
|
|
45
|
+
end
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
# :nocov:
|
|
49
|
+
module_function :h
|
|
50
|
+
|
|
51
|
+
class Engine
|
|
52
|
+
# The default regular expression used for scanning.
|
|
53
|
+
DEFAULT_REGEXP = /<%(={1,2}|-|\#|%)?(.*?)([-=])?%>([ \t]*\r?\n)?/m
|
|
54
|
+
|
|
55
|
+
# The frozen ruby source code generated from the template, which can be evaled.
|
|
56
|
+
attr_reader :src
|
|
57
|
+
|
|
58
|
+
# The filename of the template, if one was given.
|
|
59
|
+
attr_reader :filename
|
|
60
|
+
|
|
61
|
+
# The variable name used for the buffer variable.
|
|
62
|
+
attr_reader :bufvar
|
|
63
|
+
|
|
64
|
+
# Initialize a new Erubi::Engine. Options:
|
|
65
|
+
# +:bufval+ :: The value to use for the buffer variable, as a string (default <tt>'::String.new'</tt>).
|
|
66
|
+
# +:bufvar+ :: The variable name to use for the buffer variable, as a string.
|
|
67
|
+
# +:chain_appends+ :: Whether to chain <tt><<</t> calls to the buffer variable. Offers better
|
|
68
|
+
# performance, but can cause issues when the buffer variable is reassigned during
|
|
69
|
+
# template rendering (default +false+).
|
|
70
|
+
# +:ensure+ :: Wrap the template in a begin/ensure block restoring the previous value of bufvar.
|
|
71
|
+
# +:escapefunc+ :: The function to use for escaping, as a string (default: <tt>'::Erubi.h'</tt>).
|
|
72
|
+
# +:escape+ :: Whether to make <tt><%=</tt> escape by default, and <tt><%==</tt> not escape by default.
|
|
73
|
+
# +:escape_html+ :: Same as +:escape+, with lower priority.
|
|
74
|
+
# +:filename+ :: The filename for the template.
|
|
75
|
+
# +:freeze+ :: Whether to enable add a <tt>frozen_string_literal: true</tt> magic comment at the top of
|
|
76
|
+
# the resulting source code. Note this may cause problems if you are wrapping the resulting
|
|
77
|
+
# source code in other code, because the magic comment only has an effect at the beginning of
|
|
78
|
+
# the file, and having the magic comment later in the file can trigger warnings.
|
|
79
|
+
# +:freeze_template_literals+ :: Whether to suffix all literal strings for template code with <tt>.freeze</tt>
|
|
80
|
+
# (default: +true+ on Ruby 2.1+, +false+ on Ruby 2.0 and older).
|
|
81
|
+
# Can be set to +false+ on Ruby 2.3+ when frozen string literals are enabled
|
|
82
|
+
# in order to improve performance.
|
|
83
|
+
# +:literal_prefix+ :: The prefix to output when using escaped tag delimiters (default <tt>'<%'</tt>).
|
|
84
|
+
# +:literal_postfix+ :: The postfix to output when using escaped tag delimiters (default <tt>'%>'</tt>).
|
|
85
|
+
# +:outvar+ :: Same as +:bufvar+, with lower priority.
|
|
86
|
+
# +:postamble+ :: The postamble for the template, by default returns the resulting source code.
|
|
87
|
+
# +:preamble+ :: The preamble for the template, by default initializes the buffer variable.
|
|
88
|
+
# +:regexp+ :: The regexp to use for scanning.
|
|
89
|
+
# +:src+ :: The initial value to use for the source code, an empty string by default.
|
|
90
|
+
# +:trim+ :: Whether to trim leading and trailing whitespace, true by default.
|
|
91
|
+
def initialize(input, properties={})
|
|
92
|
+
@escape = escape = properties.fetch(:escape){properties.fetch(:escape_html, false)}
|
|
93
|
+
trim = properties[:trim] != false
|
|
94
|
+
@filename = properties[:filename]
|
|
95
|
+
@bufvar = bufvar = properties[:bufvar] || properties[:outvar] || "_buf"
|
|
96
|
+
bufval = properties[:bufval] || '::String.new'
|
|
97
|
+
regexp = properties[:regexp] || DEFAULT_REGEXP
|
|
98
|
+
literal_prefix = properties[:literal_prefix] || '<%'
|
|
99
|
+
literal_postfix = properties[:literal_postfix] || '%>'
|
|
100
|
+
preamble = properties[:preamble] || "#{bufvar} = #{bufval};"
|
|
101
|
+
postamble = properties[:postamble] || "#{bufvar}.to_s\n"
|
|
102
|
+
@chain_appends = properties[:chain_appends]
|
|
103
|
+
@text_end = if properties.fetch(:freeze_template_literals, FREEZE_TEMPLATE_LITERALS)
|
|
104
|
+
"'.freeze"
|
|
105
|
+
else
|
|
106
|
+
"'"
|
|
107
|
+
end
|
|
108
|
+
|
|
109
|
+
@buffer_on_stack = false
|
|
110
|
+
@src = src = properties[:src] || String.new
|
|
111
|
+
src << "# frozen_string_literal: true\n" if properties[:freeze]
|
|
112
|
+
if properties[:ensure]
|
|
113
|
+
src << "begin; __original_outvar = #{bufvar}"
|
|
114
|
+
if SKIP_DEFINED_FOR_INSTANCE_VARIABLE && /\A@[^@]/ =~ bufvar
|
|
115
|
+
src << "; "
|
|
116
|
+
else
|
|
117
|
+
src << " if defined?(#{bufvar}); "
|
|
118
|
+
end
|
|
119
|
+
end
|
|
120
|
+
|
|
121
|
+
unless @escapefunc = properties[:escapefunc]
|
|
122
|
+
if escape
|
|
123
|
+
@escapefunc = '__erubi.h'
|
|
124
|
+
src << "__erubi = ::Erubi; "
|
|
125
|
+
else
|
|
126
|
+
@escapefunc = '::Erubi.h'
|
|
127
|
+
end
|
|
128
|
+
end
|
|
129
|
+
|
|
130
|
+
src << preamble
|
|
131
|
+
|
|
132
|
+
pos = 0
|
|
133
|
+
is_bol = true
|
|
134
|
+
input.scan(regexp) do |indicator, code, tailch, rspace|
|
|
135
|
+
match = Regexp.last_match
|
|
136
|
+
len = match.begin(0) - pos
|
|
137
|
+
text = input[pos, len]
|
|
138
|
+
pos = match.end(0)
|
|
139
|
+
ch = indicator ? indicator[RANGE_FIRST] : nil
|
|
140
|
+
|
|
141
|
+
lspace = nil
|
|
142
|
+
|
|
143
|
+
unless ch == '='
|
|
144
|
+
if text.empty?
|
|
145
|
+
lspace = "" if is_bol
|
|
146
|
+
elsif text[RANGE_LAST] == "\n"
|
|
147
|
+
lspace = ""
|
|
148
|
+
else
|
|
149
|
+
rindex = text.rindex("\n")
|
|
150
|
+
if rindex
|
|
151
|
+
range = rindex+1..-1
|
|
152
|
+
s = text[range]
|
|
153
|
+
if /\A[ \t]*\z/.send(MATCH_METHOD, s)
|
|
154
|
+
lspace = s
|
|
155
|
+
text[range] = ''
|
|
156
|
+
end
|
|
157
|
+
else
|
|
158
|
+
if is_bol && /\A[ \t]*\z/.send(MATCH_METHOD, text)
|
|
159
|
+
lspace = text
|
|
160
|
+
text = ''
|
|
161
|
+
end
|
|
162
|
+
end
|
|
163
|
+
end
|
|
164
|
+
end
|
|
165
|
+
|
|
166
|
+
is_bol = rspace
|
|
167
|
+
add_text(text)
|
|
168
|
+
case ch
|
|
169
|
+
when '='
|
|
170
|
+
rspace = nil if tailch && !tailch.empty?
|
|
171
|
+
add_expression(indicator, code)
|
|
172
|
+
add_text(rspace) if rspace
|
|
173
|
+
when nil, '-'
|
|
174
|
+
if trim && lspace && rspace
|
|
175
|
+
add_code("#{lspace}#{code}#{rspace}")
|
|
176
|
+
else
|
|
177
|
+
add_text(lspace) if lspace
|
|
178
|
+
add_code(code)
|
|
179
|
+
add_text(rspace) if rspace
|
|
180
|
+
end
|
|
181
|
+
when '#'
|
|
182
|
+
n = code.count("\n") + (rspace ? 1 : 0)
|
|
183
|
+
if trim && lspace && rspace
|
|
184
|
+
add_code("\n" * n)
|
|
185
|
+
else
|
|
186
|
+
add_text(lspace) if lspace
|
|
187
|
+
add_code("\n" * n)
|
|
188
|
+
add_text(rspace) if rspace
|
|
189
|
+
end
|
|
190
|
+
when '%'
|
|
191
|
+
add_text("#{lspace}#{literal_prefix}#{code}#{tailch}#{literal_postfix}#{rspace}")
|
|
192
|
+
else
|
|
193
|
+
handle(indicator, code, tailch, rspace, lspace)
|
|
194
|
+
end
|
|
195
|
+
end
|
|
196
|
+
rest = pos == 0 ? input : input[pos..-1]
|
|
197
|
+
add_text(rest)
|
|
198
|
+
|
|
199
|
+
src << "\n" unless src[RANGE_LAST] == "\n"
|
|
200
|
+
add_postamble(postamble)
|
|
201
|
+
src << "; ensure\n " << bufvar << " = __original_outvar\nend\n" if properties[:ensure]
|
|
202
|
+
src.freeze
|
|
203
|
+
freeze
|
|
204
|
+
end
|
|
205
|
+
|
|
206
|
+
private
|
|
207
|
+
|
|
208
|
+
if RUBY_VERSION >= '2.3'
|
|
209
|
+
def _dup_string_if_frozen(string)
|
|
210
|
+
+string
|
|
211
|
+
end
|
|
212
|
+
# :nocov:
|
|
213
|
+
else
|
|
214
|
+
def _dup_string_if_frozen(string)
|
|
215
|
+
string.frozen? ? string.dup : string
|
|
216
|
+
end
|
|
217
|
+
end
|
|
218
|
+
# :nocov:
|
|
219
|
+
|
|
220
|
+
# Add raw text to the template. Modifies argument if argument is mutable as a memory optimization.
|
|
221
|
+
# Must be called with a string, cannot be called with nil (Rails's subclass depends on it).
|
|
222
|
+
def add_text(text)
|
|
223
|
+
return if text.empty?
|
|
224
|
+
|
|
225
|
+
text = _dup_string_if_frozen(text)
|
|
226
|
+
text.gsub!(/['\\]/, '\\\\\&')
|
|
227
|
+
|
|
228
|
+
with_buffer{@src << " << '" << text << @text_end}
|
|
229
|
+
end
|
|
230
|
+
|
|
231
|
+
# Add ruby code to the template
|
|
232
|
+
def add_code(code)
|
|
233
|
+
terminate_expression
|
|
234
|
+
@src << code
|
|
235
|
+
@src << ';' unless code[RANGE_LAST] == "\n"
|
|
236
|
+
@buffer_on_stack = false
|
|
237
|
+
end
|
|
238
|
+
|
|
239
|
+
# Add the given ruby expression result to the template,
|
|
240
|
+
# escaping it based on the indicator given and escape flag.
|
|
241
|
+
def add_expression(indicator, code)
|
|
242
|
+
if ((indicator == '=') ^ @escape)
|
|
243
|
+
add_expression_result(code)
|
|
244
|
+
else
|
|
245
|
+
add_expression_result_escaped(code)
|
|
246
|
+
end
|
|
247
|
+
end
|
|
248
|
+
|
|
249
|
+
# Add the result of Ruby expression to the template
|
|
250
|
+
def add_expression_result(code)
|
|
251
|
+
with_buffer{@src << ' << (' << code << ').to_s'}
|
|
252
|
+
end
|
|
253
|
+
|
|
254
|
+
# Add the escaped result of Ruby expression to the template
|
|
255
|
+
def add_expression_result_escaped(code)
|
|
256
|
+
with_buffer{@src << ' << ' << @escapefunc << '((' << code << '))'}
|
|
257
|
+
end
|
|
258
|
+
|
|
259
|
+
# Add the given postamble to the src. Can be overridden in subclasses
|
|
260
|
+
# to make additional changes to src that depend on the current state.
|
|
261
|
+
def add_postamble(postamble)
|
|
262
|
+
terminate_expression
|
|
263
|
+
@src << postamble
|
|
264
|
+
end
|
|
265
|
+
|
|
266
|
+
# Raise an exception, as the base engine class does not support handling other indicators.
|
|
267
|
+
def handle(indicator, code, tailch, rspace, lspace)
|
|
268
|
+
raise ArgumentError, "Invalid indicator: #{indicator}"
|
|
269
|
+
end
|
|
270
|
+
|
|
271
|
+
# Make sure the buffer variable is the target of the next append
|
|
272
|
+
# before yielding to the block. Mark that the buffer is the target
|
|
273
|
+
# of the next append after the block executes.
|
|
274
|
+
#
|
|
275
|
+
# This method should only be called if the block will result in
|
|
276
|
+
# code where << will append to the bufvar.
|
|
277
|
+
def with_buffer
|
|
278
|
+
if @chain_appends
|
|
279
|
+
unless @buffer_on_stack
|
|
280
|
+
@src << '; ' << @bufvar
|
|
281
|
+
end
|
|
282
|
+
yield
|
|
283
|
+
@buffer_on_stack = true
|
|
284
|
+
else
|
|
285
|
+
@src << ' ' << @bufvar
|
|
286
|
+
yield
|
|
287
|
+
@src << ';'
|
|
288
|
+
end
|
|
289
|
+
end
|
|
290
|
+
|
|
291
|
+
# Make sure that any current expression has been terminated.
|
|
292
|
+
# The default is to terminate all expressions, but when
|
|
293
|
+
# the chain_appends option is used, expressions may not be
|
|
294
|
+
# terminated.
|
|
295
|
+
def terminate_expression
|
|
296
|
+
@src << '; ' if @chain_appends
|
|
297
|
+
end
|
|
298
|
+
end
|
|
299
|
+
end
|
|
@@ -1,14 +1,21 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
|
-
require_relative 'template'
|
|
3
|
-
require 'asciidoctor'
|
|
4
|
-
# AsciiDoc see: http://asciidoc.org/
|
|
5
2
|
|
|
6
|
-
#
|
|
7
|
-
#
|
|
3
|
+
# = AsciiDoc
|
|
4
|
+
#
|
|
5
|
+
# Asciidoctor implementation for AsciiDoc
|
|
8
6
|
#
|
|
9
7
|
# Asciidoctor is an open source, pure-Ruby processor for
|
|
10
8
|
# converting AsciiDoc documents or strings into HTML 5,
|
|
11
9
|
# DocBook 4.5 and other formats.
|
|
10
|
+
#
|
|
11
|
+
# === See also
|
|
12
|
+
#
|
|
13
|
+
# * http://asciidoc.org
|
|
14
|
+
# * http://asciidoctor.github.com
|
|
15
|
+
|
|
16
|
+
require_relative 'template'
|
|
17
|
+
require 'asciidoctor'
|
|
18
|
+
|
|
12
19
|
Tilt::AsciidoctorTemplate = Tilt::StaticTemplate.subclass do
|
|
13
20
|
@options[:header_footer] = false if @options[:header_footer].nil?
|
|
14
21
|
Asciidoctor.render(@data, @options)
|
|
@@ -1,12 +1,22 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# CoffeeScript / Literate CoffeeScript template implementation.
|
|
4
|
+
#
|
|
5
|
+
# CoffeeScript templates do not support object scopes, locals, or yield.
|
|
6
|
+
#
|
|
7
|
+
# === See also
|
|
8
|
+
#
|
|
9
|
+
# * http://coffeescript.org
|
|
10
|
+
#
|
|
11
|
+
# === Related modules
|
|
12
|
+
#
|
|
13
|
+
# * Tilt::CoffeeScriptTemplate
|
|
14
|
+
# * Tilt::CoffeeScriptLiterateTemplate
|
|
15
|
+
|
|
2
16
|
require_relative 'template'
|
|
3
17
|
require 'coffee_script'
|
|
4
18
|
|
|
5
19
|
module Tilt
|
|
6
|
-
# CoffeeScript template implementation. See:
|
|
7
|
-
# http://coffeescript.org/
|
|
8
|
-
#
|
|
9
|
-
# CoffeeScript templates do not support object scopes, locals, or yield.
|
|
10
20
|
class CoffeeScriptTemplate < StaticTemplate
|
|
11
21
|
self.default_mime_type = 'application/javascript'
|
|
12
22
|
|
|
@@ -1,4 +1,45 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
|
+
#
|
|
3
|
+
# = Markdown (<tt>markdown</tt>, <tt>md</tt>, <tt>mkd</tt>)
|
|
4
|
+
#
|
|
5
|
+
# Markdown is a lightweight markup language, created by John Gruber
|
|
6
|
+
# and Aaron Swartz. For any markup that is not covered by Markdown’s syntax, HTML
|
|
7
|
+
# is used. Marking up plain text with Markdown markup is easy and Markdown
|
|
8
|
+
# formatted texts are readable.
|
|
9
|
+
#
|
|
10
|
+
# === Example
|
|
11
|
+
#
|
|
12
|
+
# Hello Markdown Templates
|
|
13
|
+
# ========================
|
|
14
|
+
#
|
|
15
|
+
# Hello World. This is a paragraph.
|
|
16
|
+
#
|
|
17
|
+
# === Usage
|
|
18
|
+
#
|
|
19
|
+
# To wrap a Markdown formatted document with a layout:
|
|
20
|
+
#
|
|
21
|
+
# layout = Tilt['erb'].new do
|
|
22
|
+
# "<!doctype html><title></title><%= yield %>"
|
|
23
|
+
# end
|
|
24
|
+
# data = Tilt['md'].new { "# hello tilt" }
|
|
25
|
+
# layout.render { data.render }
|
|
26
|
+
# # => "<!doctype html><title></title><h1>hello tilt</h1>\n"
|
|
27
|
+
#
|
|
28
|
+
# === Options
|
|
29
|
+
#
|
|
30
|
+
# ==== <tt>:smartypants => true|false</tt>
|
|
31
|
+
#
|
|
32
|
+
# Set <tt>true</tt> to enable [Smarty Pants][smartypants] style punctuation replacement.
|
|
33
|
+
#
|
|
34
|
+
# ==== <tt>:escape_html => true|false</tt>
|
|
35
|
+
#
|
|
36
|
+
# Set <tt>true</tt> disallow raw HTML in Markdown contents. HTML is converted to
|
|
37
|
+
# literal text by escaping <tt><</tt> characters.
|
|
38
|
+
#
|
|
39
|
+
# === See also
|
|
40
|
+
#
|
|
41
|
+
# * {Markdown Syntax Documentation}[http://daringfireball.net/projects/markdown/syntax]
|
|
42
|
+
|
|
2
43
|
require_relative 'template'
|
|
3
44
|
require 'commonmarker'
|
|
4
45
|
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# = CSV
|
|
4
|
+
#
|
|
5
|
+
# CSV Template implementation.
|
|
6
|
+
#
|
|
7
|
+
# === Example
|
|
8
|
+
#
|
|
9
|
+
# # Example of csv template
|
|
10
|
+
# tpl = <<-EOS
|
|
11
|
+
# # header
|
|
12
|
+
# csv << ['NAME', 'ID']
|
|
13
|
+
#
|
|
14
|
+
# # data rows
|
|
15
|
+
# @people.each do |person|
|
|
16
|
+
# csv << [person[:name], person[:id]]
|
|
17
|
+
# end
|
|
18
|
+
# EOS
|
|
19
|
+
#
|
|
20
|
+
# @people = [
|
|
21
|
+
# {:name => "Joshua Peek", :id => 1},
|
|
22
|
+
# {:name => "Ryan Tomayko", :id => 2},
|
|
23
|
+
# {:name => "Simone Carletti", :id => 3}
|
|
24
|
+
# ]
|
|
25
|
+
#
|
|
26
|
+
# template = Tilt::CSVTemplate.new { tpl }
|
|
27
|
+
# template.render(self)
|
|
28
|
+
#
|
|
29
|
+
# === See also
|
|
30
|
+
#
|
|
31
|
+
# * http://ruby-doc.org/stdlib/libdoc/csv/rdoc/CSV.html
|
|
32
|
+
#
|
|
33
|
+
# === Related module
|
|
34
|
+
#
|
|
35
|
+
# * Tilt::CSVTemplate
|
|
36
|
+
|
|
37
|
+
require_relative 'template'
|
|
38
|
+
require 'csv'
|
|
39
|
+
|
|
40
|
+
module Tilt
|
|
41
|
+
|
|
42
|
+
class CSVTemplate < Template
|
|
43
|
+
self.default_mime_type = 'text/csv'
|
|
44
|
+
|
|
45
|
+
def prepare
|
|
46
|
+
@outvar = @options.delete(:outvar) || '_csvout'
|
|
47
|
+
end
|
|
48
|
+
|
|
49
|
+
def precompiled_template(locals)
|
|
50
|
+
<<-RUBY
|
|
51
|
+
#{@outvar} = CSV.generate(**#{@options}) do |csv|
|
|
52
|
+
#{@data}
|
|
53
|
+
end
|
|
54
|
+
RUBY
|
|
55
|
+
end
|
|
56
|
+
|
|
57
|
+
def precompiled(locals)
|
|
58
|
+
source, offset = super
|
|
59
|
+
[source, offset + 1]
|
|
60
|
+
end
|
|
61
|
+
|
|
62
|
+
end
|
|
63
|
+
end
|
|
@@ -0,0 +1,130 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# = ERB (<tt>erb</tt>, <tt>rhtml</tt>)
|
|
4
|
+
#
|
|
5
|
+
# ERB is a simple but powerful template languge for Ruby. In Tilt it's
|
|
6
|
+
# backed by {Erubi}[rdoc-ref:lib/tilt/erubi.rb] (if installed on your system] or by
|
|
7
|
+
# {erb.rb}[rdoc-ref:lib/tilt/erb.rb] (which is included in Ruby's standard library]. This
|
|
8
|
+
# documentation applies to both implementations.
|
|
9
|
+
#
|
|
10
|
+
# === Example
|
|
11
|
+
#
|
|
12
|
+
# Hello <%= world %>!
|
|
13
|
+
#
|
|
14
|
+
# === Usage
|
|
15
|
+
#
|
|
16
|
+
# ERB templates support custom evaluation scopes and locals:
|
|
17
|
+
#
|
|
18
|
+
# >> require 'erb'
|
|
19
|
+
# >> template = Tilt.new('hello.html.erb')
|
|
20
|
+
# >> template.render(self, :world => 'World!')
|
|
21
|
+
# => "Hello World!"
|
|
22
|
+
#
|
|
23
|
+
# Or, use <tt>Tilt['erb']</tt> directly to process strings:
|
|
24
|
+
#
|
|
25
|
+
# template = Tilt['erb'].new { "Hello <%= world %>!" }
|
|
26
|
+
# template.render(self, :world => 'World!')
|
|
27
|
+
#
|
|
28
|
+
# The <tt>Tilt::ERBTemplate</tt> class is registered for all files ending in <tt>.erb</tt> or
|
|
29
|
+
# <tt>.rhtml</tt> by default, but with a *lower* priority than ErubiTemplate.
|
|
30
|
+
# If you specifically want to use ERB, it's recommended to use
|
|
31
|
+
# <tt>#prefer</tt>:
|
|
32
|
+
#
|
|
33
|
+
# Tilt.prefer Tilt::ERBTemplate
|
|
34
|
+
#
|
|
35
|
+
# __NOTE:__ It's suggested that your program <tt>require 'erb'</tt> at load time when
|
|
36
|
+
# using this template engine within a threaded environment.
|
|
37
|
+
#
|
|
38
|
+
# === Options
|
|
39
|
+
#
|
|
40
|
+
# ==== <tt>:trim => trim</tt>
|
|
41
|
+
#
|
|
42
|
+
# The ERB trim mode flags. This is a string consisting of any combination of the
|
|
43
|
+
# following characters:
|
|
44
|
+
#
|
|
45
|
+
# * <tt>'>'</tt> omits newlines for lines ending in <tt>></tt>
|
|
46
|
+
# * <tt>'<>'</tt> omits newlines for lines starting with <tt><%</tt> and ending in <tt>%></tt>
|
|
47
|
+
# * <tt>'%'</tt> enables processing of lines beginning with <tt>%</tt>
|
|
48
|
+
# * <tt>true</tt> is an alias of <tt><></tt>
|
|
49
|
+
#
|
|
50
|
+
# ==== <tt>:outvar => '_erbout'</tt>
|
|
51
|
+
#
|
|
52
|
+
# The name of the variable used to accumulate template output. This can be
|
|
53
|
+
# any valid Ruby expression but must be assignable. By default a local
|
|
54
|
+
# variable named <tt>_erbout</tt> is used.
|
|
55
|
+
#
|
|
56
|
+
# ==== <tt>:freeze => false</tt>
|
|
57
|
+
#
|
|
58
|
+
# If set to true, will set the <tt>frozen_string_literal</tt> flag in the compiled
|
|
59
|
+
# template code, so that string literals inside the templates will be frozen.
|
|
60
|
+
#
|
|
61
|
+
# === See also
|
|
62
|
+
#
|
|
63
|
+
# * http://www.ruby-doc.org/stdlib/libdoc/erb/rdoc/classes/ERB.html
|
|
64
|
+
#
|
|
65
|
+
# === Related module
|
|
66
|
+
#
|
|
67
|
+
# * Tilt::ERBTemplate
|
|
68
|
+
|
|
69
|
+
require_relative 'template'
|
|
70
|
+
require 'erb'
|
|
71
|
+
|
|
72
|
+
module Tilt
|
|
73
|
+
class ERBTemplate < Template
|
|
74
|
+
SUPPORTS_KVARGS = ::ERB.instance_method(:initialize).parameters.assoc(:key) rescue false
|
|
75
|
+
|
|
76
|
+
def prepare
|
|
77
|
+
@freeze_string_literals = !!@options[:freeze]
|
|
78
|
+
@outvar = @options[:outvar] || '_erbout'
|
|
79
|
+
trim = case @options[:trim]
|
|
80
|
+
when false
|
|
81
|
+
nil
|
|
82
|
+
when nil, true
|
|
83
|
+
'<>'
|
|
84
|
+
else
|
|
85
|
+
@options[:trim]
|
|
86
|
+
end
|
|
87
|
+
@engine = if SUPPORTS_KVARGS
|
|
88
|
+
::ERB.new(@data, trim_mode: trim, eoutvar: @outvar)
|
|
89
|
+
# :nocov:
|
|
90
|
+
else
|
|
91
|
+
::ERB.new(@data, options[:safe], trim, @outvar)
|
|
92
|
+
# :nocov:
|
|
93
|
+
end
|
|
94
|
+
end
|
|
95
|
+
|
|
96
|
+
def precompiled_template(locals)
|
|
97
|
+
source = @engine.src
|
|
98
|
+
source
|
|
99
|
+
end
|
|
100
|
+
|
|
101
|
+
def precompiled_preamble(locals)
|
|
102
|
+
<<-RUBY
|
|
103
|
+
begin
|
|
104
|
+
__original_outvar = #{@outvar} if defined?(#{@outvar})
|
|
105
|
+
#{super}
|
|
106
|
+
RUBY
|
|
107
|
+
end
|
|
108
|
+
|
|
109
|
+
def precompiled_postamble(locals)
|
|
110
|
+
<<-RUBY
|
|
111
|
+
#{super}
|
|
112
|
+
ensure
|
|
113
|
+
#{@outvar} = __original_outvar
|
|
114
|
+
end
|
|
115
|
+
RUBY
|
|
116
|
+
end
|
|
117
|
+
|
|
118
|
+
# ERB generates a line to specify the character coding of the generated
|
|
119
|
+
# source in 1.9. Account for this in the line offset.
|
|
120
|
+
def precompiled(locals)
|
|
121
|
+
source, offset = super
|
|
122
|
+
[source, offset + 1]
|
|
123
|
+
end
|
|
124
|
+
|
|
125
|
+
def freeze_string_literals?
|
|
126
|
+
@freeze_string_literals
|
|
127
|
+
end
|
|
128
|
+
end
|
|
129
|
+
end
|
|
130
|
+
|
|
@@ -1,16 +1,49 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# = Erubi (<tt>erb</tt>, <tt>rhtml</tt>, <tt>erubi</tt>)
|
|
4
|
+
#
|
|
5
|
+
# {Erubi}[https://github.com/jeremyevans/erubi] is an ERB implementation that uses the same algorithm as
|
|
6
|
+
# the erubis gem, but is maintained and offers numerous improvements.
|
|
7
|
+
#
|
|
8
|
+
# All the documentation of {ERB}[rdoc-ref:lib/tilt/erb.rb] applies in addition to the following:
|
|
9
|
+
#
|
|
10
|
+
# === Usage
|
|
11
|
+
#
|
|
12
|
+
# The <tt>Tilt::ErubiTemplate</tt> class is registered for all files ending in <tt>.erb</tt> or
|
|
13
|
+
# <tt>.rhtml</tt> by default, with the *highest* priority.
|
|
14
|
+
#
|
|
15
|
+
# __NOTE:__ It's suggested that your program <tt>require 'erubi'</tt> at load time when
|
|
16
|
+
# using this template engine within a threaded environment.
|
|
17
|
+
#
|
|
18
|
+
# === Options
|
|
19
|
+
#
|
|
20
|
+
# ==== <tt>:engine_class => Erubi::Engine</tt>
|
|
21
|
+
#
|
|
22
|
+
# Allows you to specify a custom engine class to use instead of the
|
|
23
|
+
# default which is <tt>Erubi::Engine</tt>.
|
|
24
|
+
#
|
|
25
|
+
# ==== Other
|
|
26
|
+
#
|
|
27
|
+
# Other options are passed to the constructor of the engine class.
|
|
28
|
+
#
|
|
29
|
+
# ErubiTemplate supports the following additional options, in addition
|
|
30
|
+
# to the options supported by the Erubi engine:
|
|
31
|
+
#
|
|
32
|
+
# :engine_class :: allows you to specify a custom engine class to use
|
|
33
|
+
# instead of the default (which is ::Erubi::Engine).
|
|
34
|
+
#
|
|
35
|
+
# === See also
|
|
36
|
+
#
|
|
37
|
+
# * {Erubi Home}[https://github.com/jeremyevans/erubi]
|
|
38
|
+
#
|
|
39
|
+
# === Related module
|
|
40
|
+
#
|
|
41
|
+
# * Tilt::ErubiTemplate
|
|
42
|
+
|
|
2
43
|
require_relative 'template'
|
|
3
44
|
require 'erubi'
|
|
4
45
|
|
|
5
46
|
module Tilt
|
|
6
|
-
# Erubi (a simplified version of Erubis) template implementation.
|
|
7
|
-
# See https://github.com/jeremyevans/erubi
|
|
8
|
-
#
|
|
9
|
-
# ErubiTemplate supports the following additional options, in addition
|
|
10
|
-
# to the options supported by the Erubi engine:
|
|
11
|
-
#
|
|
12
|
-
# :engine_class :: allows you to specify a custom engine class to use
|
|
13
|
-
# instead of the default (which is ::Erubi::Engine).
|
|
14
47
|
class ErubiTemplate < Template
|
|
15
48
|
def prepare
|
|
16
49
|
@options[:preamble] = false
|