brakeman 7.1.2 → 8.0.6

data/bundle/ruby/3.2.0/gems/erubi-1.13.1/README.rdoc

@@ -0,0 +1,151 @@
+= Erubi
+
+Erubi is a ERB template engine for ruby. It is a simplified fork of Erubis, using
+the same basic algorithm, with the following differences:
+
+* Handles postfix conditionals when using escaping (e.g. <tt><%= foo if bar %></tt>)
+* Supports frozen_string_literal: true in templates via :freeze option
+* Works with ruby's <tt>--enable-frozen-string-literal</tt> option
+* Automatically freezes strings for template text when ruby optimizes it (on ruby 2.1+)
+* Escapes <tt>'</tt> (apostrophe) when escaping for better XSS protection 
+* Has 15x-6x faster escaping by using erb/escape or cgi/escape
+* Has 81% smaller memory footprint (calculated using +ObjectSpace.memsize_of_all+)
+* Does no monkey patching (Erubis adds a method to Kernel)
+* Uses an immutable design (all options passed to the constructor, which returns a frozen object)
+* Has simpler internals (1 file, <150 lines of code)
+* Is not dead (Erubis hasn't been updated since 2011)
+
+It is not designed with Erubis API compatibility in mind, though most Erubis
+ERB syntax works, with the following exceptions:
+
+* No support for <tt><%===</tt> for debug output
+
+= Installation
+
+  gem install erubi
+
+= Source Code
+
+Source code is available on GitHub at https://github.com/jeremyevans/erubi
+
+= Usage
+
+Erubi only has built in support for retrieving the generated source for a
+file:
+
+  require 'erubi'
+  eval(Erubi::Engine.new(File.read('filename.erb')).src)
+
+Most users will probably use Erubi via Rails or Tilt.  Erubi is the default
+erb template handler in Tilt 2.0.6+ and Rails 5.1+.
+
+== Capturing
+
+Erubi does not support capturing block output into the template by default.
+It currently ships with two implementations that allow it.
+
+=== Erubi::CaptureBlockEngine
+
+The recommended implementation can be required via +erubi/capture_block+,
+which allows capturing to work with normal <tt><%=</tt> and <tt><%==</tt>
+tags.
+
+  <%= form do %>
+    <input>
+  <% end %>
+
+When using the capture_block support, capture methods should just return
+the text it emit into the template, and call +capture+ on the buffer value.
+Since the buffer variable is a local variable and not an instance variable
+by default, you'll probably want to set the +:bufvar+ variable when using
+the capture_block support to an instance variable, and have any methods
+used call capture on that instance variable.  Example:
+
+  def form(&block)
+    "<form>#{@_buf.capture(&block)}</form>"
+  end
+
+  puts eval(Erubi::CaptureBlockEngine.new(<<-END, bufvar: '@_buf', trim: false).src)
+  before
+  <%= form do %>
+  inside
+  <% end %>
+  after
+  END
+
+  # Output:
+  # before
+  # <form>
+  # inside
+  # </form>
+  # after
+
+To use the capture_block support with tilt:
+
+  require 'tilt'
+  require 'erubi/capture_block'
+  Tilt.new("filename.erb", :engine_class=>Erubi::CaptureBlockEngine).render
+
+Note that the capture_block support, while very compatible with the default
+support, is not 100% compatible.  One area where behavior differs is when
+using multiple statements inside <tt><%=</tt> and <tt><%==</tt> tags:
+
+  <%= 1; 2 %>
+
+The default support will output 2, but the capture_block support will output
+1.
+
+=== Erubi::CaptureEndEngine
+
+An alternative capture implementation can be required via +erubi/capture_end+,
+which supports it via <tt><%|=</tt> and <tt><%|==</tt> tags which are
+closed with a <tt><%|</tt> tag:
+
+  <%|= form do %>
+    <input>
+  <%| end %>
+
+It is only recommended to use +erubi/capture_end+ for backwards
+compatibilty.
+
+When using the capture_end support, capture methods (such as +form+ in the example
+above) should return the (potentially modified) buffer. Similar to the
+capture_block support, using an instance variable is recommended. Example:
+
+  def form
+    @_buf << "<form>"
+    yield
+    @_buf << "</form>"
+    @_buf
+  end
+
+  puts eval(Erubi::CaptureEndEngine.new(<<-END, bufvar: '@_buf').src)
+  before
+  <%|= form do %>
+  inside
+  <%| end %>
+  after
+  END
+
+  # Output:
+  # before
+  # <form>
+  # inside
+  # </form>
+  # after
+
+Alternatively, passing the option <tt>:yield_returns_buffer => true</tt> will return the
+buffer captured by the block instead of the last expression in the block.
+
+= Reporting Bugs
+
+The bug tracker is located at https://github.com/jeremyevans/erubi/issues
+
+= License
+
+MIT
+
+= Authors
+
+Jeremy Evans <code@jeremyevans.net>
+kuwata-lab.com

data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_block.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'erubi'
+
+module Erubi
+  # An engine class that supports capturing blocks via the <tt><%=</tt> and <tt><%==</tt> tags:
+  #
+  #   <%= upcase_form do %>
+  #     <%= 'foo' %>
+  #   <% end %>
+  #
+  # Where +upcase_form+ is defined like:
+  #
+  #   def upcase_form(&block)
+  #     "<form>#{@bufvar.capture(&block).upcase}</form>"
+  #   end
+  #
+  # With output being:
+  #
+  #   <form>
+  #     FOO
+  #   </form>
+  #
+  # This requires using a string subclass as the buffer value, provided by the
+  # CaptureBlockEngine::Buffer class.
+  #
+  # This engine does not support the :escapefunc option.  To change the escaping function,
+  # use a subclass of CaptureBlockEngine::Buffer and override the #| method.
+  #
+  # This engine does not support the :chain_appends option, and ignores it if present.
+  class CaptureBlockEngine < Engine
+    class Buffer < ::String
+    
+      # Convert argument to string when concatening
+      def <<(v)
+        concat(v.to_s)
+      end
+
+      # Escape argument using Erubi.h then then concatenate it to the receiver.
+      def |(v)
+        concat(h(v))
+      end
+
+      # Temporarily clear the receiver before yielding to the block, yield the
+      # given args to the block, return any data captured by the receiver, and
+      # restore the original data the receiver contained before returning.
+      def capture(*args)
+        prev = dup
+        replace("") # 1.8 support!
+        yield(*args)
+        dup
+      ensure
+        replace(prev)
+      end
+
+      private
+
+      if RUBY_VERSION >= '2'
+        define_method(:h, ::Erubi.instance_method(:h))
+      # :nocov:
+      else
+        def h(v)
+          ::Erubi.h(v)
+        end
+      end
+      # :nocov:
+    end
+
+    def initialize(input, properties={})
+      properties = Hash[properties]
+      properties[:bufval] ||= '::Erubi::CaptureBlockEngine::Buffer.new'
+      properties[:chain_appends] = false
+      super
+    end
+
+    private
+
+    def add_expression_result(code)
+      add_expression_op(' <<= ', code)
+    end
+
+    def add_expression_result_escaped(code)
+      add_expression_op(' |= ', code)
+    end
+
+    def add_expression_op(op, code)
+      check = /\A\s*\z/.send(MATCH_METHOD, code) ? "''" : ''
+      with_buffer{@src << op  << check << code}
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_end.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'erubi'
+
+module Erubi
+  # An engine class that supports capturing blocks via the <tt><%|=</tt> and <tt><%|==</tt> tags,
+  # explicitly ending the captures using <tt><%|</tt> end <tt>%></tt> blocks.
+  class CaptureEndEngine < Engine
+    # Initializes the engine.  Accepts the same arguments as ::Erubi::Engine, and these
+    # additional options:
+    # :escape_capture :: Whether to make <tt><%|=</tt> escape by default, and <tt><%|==</tt> not escape by default,
+    #                    defaults to the same value as :escape.
+    # :yield_returns_buffer :: Whether to have <tt><%|</tt> tags insert the buffer as an expression, so that
+    #                          <tt><%| end %></tt> tags will have the buffer be the last expression inside
+    #                          the block, and therefore have the buffer be returned by the yield
+    #                          expression.  Normally the buffer will be returned anyway, but there
+    #                          are cases where the last expression will not be the buffer,
+    #                          and therefore a different object will be returned.
+    def initialize(input, properties={})
+      properties = Hash[properties]
+      escape = properties.fetch(:escape){properties.fetch(:escape_html, false)}
+      @escape_capture = properties.fetch(:escape_capture, escape)
+      @yield_returns_buffer = properties.fetch(:yield_returns_buffer, false)
+      @bufval = properties[:bufval] ||= '::String.new'
+      @bufstack = '__erubi_stack'
+      properties[:regexp] ||= /<%(\|?={1,2}|-|\#|%|\|)?(.*?)([-=])?%>([ \t]*\r?\n)?/m
+      super
+    end
+
+    private
+
+    # Handle the <%|= and <%|== tags
+    def handle(indicator, code, tailch, rspace, lspace)
+      case indicator
+      when '|=', '|=='
+        rspace = nil if tailch && !tailch.empty?
+        add_text(lspace) if lspace
+        escape_capture = !((indicator == '|=') ^ @escape_capture)
+        terminate_expression
+        @src << "begin; (#{@bufstack} ||= []) << #{@bufvar}; #{@bufvar} = #{@bufval}; #{@bufstack}.last << #{@escapefunc if escape_capture}((" << code
+        @buffer_on_stack = false
+        add_text(rspace) if rspace
+      when '|'
+        rspace = nil if tailch && !tailch.empty?
+        add_text(lspace) if lspace
+        if @yield_returns_buffer
+          terminate_expression
+          @src << " #{@bufvar}; "
+        end
+        @src << code << ")).to_s; ensure; #{@bufvar} = #{@bufstack}.pop; end;"
+        @buffer_on_stack = false
+        add_text(rspace) if rspace
+      else
+        super
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi.rb

@@ -0,0 +1,299 @@
+# frozen_string_literal: true
+
+module Erubi
+  VERSION = '1.13.1'
+
+  # :nocov:
+  if RUBY_VERSION >= '1.9'
+    RANGE_FIRST = 0
+    RANGE_LAST = -1
+  else
+    RANGE_FIRST = 0..0
+    RANGE_LAST = -1..-1
+  end
+
+  MATCH_METHOD = RUBY_VERSION >= '2.4' ? :match? : :match
+  SKIP_DEFINED_FOR_INSTANCE_VARIABLE = RUBY_VERSION > '3'
+  FREEZE_TEMPLATE_LITERALS = !eval("''").frozen? && RUBY_VERSION >= '2.1'
+  # :nocov:
+
+  begin
+    require 'erb/escape'
+    define_method(:h, ERB::Escape.instance_method(:html_escape))
+  # :nocov:
+  rescue LoadError
+    begin
+      require 'cgi/escape'
+      unless CGI.respond_to?(:escapeHTML) # work around for JRuby 9.1
+        CGI = Object.new
+        CGI.extend(defined?(::CGI::Escape) ? ::CGI::Escape : ::CGI::Util)
+      end
+      # Escape characters with their HTML/XML equivalents.
+      def h(value)
+        CGI.escapeHTML(value.to_s)
+      end
+    rescue LoadError
+      ESCAPE_TABLE = {'&' => '&amp;'.freeze, '<' => '&lt;'.freeze, '>' => '&gt;'.freeze, '"' => '&quot;'.freeze, "'" => '&#39;'.freeze}.freeze
+      if RUBY_VERSION >= '1.9'
+        def h(value)
+          value.to_s.gsub(/[&<>"']/, ESCAPE_TABLE)
+        end
+      else
+        def h(value)
+          value.to_s.gsub(/[&<>"']/){|s| ESCAPE_TABLE[s]}
+        end
+      end
+    end
+  end
+  # :nocov:
+  module_function :h
+
+  class Engine
+    # The default regular expression used for scanning.
+    DEFAULT_REGEXP = /<%(={1,2}|-|\#|%)?(.*?)([-=])?%>([ \t]*\r?\n)?/m
+    
+    # The frozen ruby source code generated from the template, which can be evaled.
+    attr_reader :src
+
+    # The filename of the template, if one was given.
+    attr_reader :filename
+
+    # The variable name used for the buffer variable.
+    attr_reader :bufvar
+
+    # Initialize a new Erubi::Engine.  Options:
+    # +:bufval+ :: The value to use for the buffer variable, as a string (default <tt>'::String.new'</tt>).
+    # +:bufvar+ :: The variable name to use for the buffer variable, as a string.
+    # +:chain_appends+ :: Whether to chain <tt><<</t> calls to the buffer variable. Offers better
+    #                     performance, but can cause issues when the buffer variable is reassigned during
+    #                     template rendering (default +false+).
+    # +:ensure+ :: Wrap the template in a begin/ensure block restoring the previous value of bufvar.
+    # +:escapefunc+ :: The function to use for escaping, as a string (default: <tt>'::Erubi.h'</tt>).
+    # +:escape+ :: Whether to make <tt><%=</tt> escape by default, and <tt><%==</tt> not escape by default.
+    # +:escape_html+ :: Same as +:escape+, with lower priority.
+    # +:filename+ :: The filename for the template.
+    # +:freeze+ :: Whether to enable add a <tt>frozen_string_literal: true</tt> magic comment at the top of
+    #              the resulting source code.  Note this may cause problems if you are wrapping the resulting
+    #              source code in other code, because the magic comment only has an effect at the beginning of
+    #              the file, and having the magic comment later in the file can trigger warnings.
+    # +:freeze_template_literals+ :: Whether to suffix all literal strings for template code with <tt>.freeze</tt>
+    #                                (default: +true+ on Ruby 2.1+, +false+ on Ruby 2.0 and older).
+    #                                Can be set to +false+ on Ruby 2.3+ when frozen string literals are enabled
+    #                                in order to improve performance.
+    # +:literal_prefix+ :: The prefix to output when using escaped tag delimiters (default <tt>'<%'</tt>).
+    # +:literal_postfix+ :: The postfix to output when using escaped tag delimiters (default <tt>'%>'</tt>).
+    # +:outvar+ :: Same as +:bufvar+, with lower priority.
+    # +:postamble+ :: The postamble for the template, by default returns the resulting source code.
+    # +:preamble+ :: The preamble for the template, by default initializes the buffer variable.
+    # +:regexp+ :: The regexp to use for scanning.
+    # +:src+ :: The initial value to use for the source code, an empty string by default.
+    # +:trim+ :: Whether to trim leading and trailing whitespace, true by default.
+    def initialize(input, properties={})
+      @escape = escape = properties.fetch(:escape){properties.fetch(:escape_html, false)}
+      trim       = properties[:trim] != false
+      @filename  = properties[:filename]
+      @bufvar = bufvar = properties[:bufvar] || properties[:outvar] || "_buf"
+      bufval = properties[:bufval] || '::String.new'
+      regexp = properties[:regexp] || DEFAULT_REGEXP
+      literal_prefix = properties[:literal_prefix] || '<%'
+      literal_postfix = properties[:literal_postfix] || '%>'
+      preamble   = properties[:preamble] || "#{bufvar} = #{bufval};"
+      postamble  = properties[:postamble] || "#{bufvar}.to_s\n"
+      @chain_appends = properties[:chain_appends]
+      @text_end = if properties.fetch(:freeze_template_literals, FREEZE_TEMPLATE_LITERALS)
+        "'.freeze"
+      else
+        "'"
+      end
+
+      @buffer_on_stack = false
+      @src = src = properties[:src] || String.new
+      src << "# frozen_string_literal: true\n" if properties[:freeze]
+      if properties[:ensure]
+        src << "begin; __original_outvar = #{bufvar}"
+        if SKIP_DEFINED_FOR_INSTANCE_VARIABLE && /\A@[^@]/ =~ bufvar
+          src << "; "
+        else
+          src << " if defined?(#{bufvar}); "
+        end
+      end
+
+      unless @escapefunc = properties[:escapefunc]
+        if escape
+          @escapefunc = '__erubi.h'
+          src << "__erubi = ::Erubi; "
+        else
+          @escapefunc = '::Erubi.h'
+        end
+      end
+
+      src << preamble
+
+      pos = 0
+      is_bol = true
+      input.scan(regexp) do |indicator, code, tailch, rspace|
+        match = Regexp.last_match
+        len  = match.begin(0) - pos
+        text = input[pos, len]
+        pos  = match.end(0)
+        ch   = indicator ? indicator[RANGE_FIRST] : nil
+
+        lspace = nil
+
+        unless ch == '='
+          if text.empty?
+            lspace = "" if is_bol
+          elsif text[RANGE_LAST] == "\n"
+            lspace = ""
+          else
+            rindex = text.rindex("\n")
+            if rindex
+              range = rindex+1..-1
+              s = text[range]
+              if /\A[ \t]*\z/.send(MATCH_METHOD, s)
+                lspace = s
+                text[range] = ''
+              end
+            else
+              if is_bol && /\A[ \t]*\z/.send(MATCH_METHOD, text)
+                lspace = text
+                text = ''
+              end
+            end
+          end
+        end
+
+        is_bol = rspace
+        add_text(text)
+        case ch
+        when '='
+          rspace = nil if tailch && !tailch.empty?
+          add_expression(indicator, code)
+          add_text(rspace) if rspace
+        when nil, '-'
+          if trim && lspace && rspace
+            add_code("#{lspace}#{code}#{rspace}")
+          else
+            add_text(lspace) if lspace
+            add_code(code)
+            add_text(rspace) if rspace
+          end
+        when '#'
+          n = code.count("\n") + (rspace ? 1 : 0)
+          if trim && lspace && rspace
+            add_code("\n" * n)
+          else
+            add_text(lspace) if lspace
+            add_code("\n" * n)
+            add_text(rspace) if rspace
+          end
+        when '%'
+          add_text("#{lspace}#{literal_prefix}#{code}#{tailch}#{literal_postfix}#{rspace}")
+        else
+          handle(indicator, code, tailch, rspace, lspace)
+        end
+      end
+      rest = pos == 0 ? input : input[pos..-1]
+      add_text(rest)
+
+      src << "\n" unless src[RANGE_LAST] == "\n"
+      add_postamble(postamble)
+      src << "; ensure\n  " << bufvar << " = __original_outvar\nend\n" if properties[:ensure]
+      src.freeze
+      freeze
+    end
+
+    private
+
+    if RUBY_VERSION >= '2.3'
+      def _dup_string_if_frozen(string)
+        +string
+      end
+    # :nocov:
+    else
+      def _dup_string_if_frozen(string)
+        string.frozen? ? string.dup : string
+      end
+    end
+    # :nocov:
+
+    # Add raw text to the template.  Modifies argument if argument is mutable as a memory optimization.
+    # Must be called with a string, cannot be called with nil (Rails's subclass depends on it).
+    def add_text(text)
+      return if text.empty?
+
+      text = _dup_string_if_frozen(text)
+      text.gsub!(/['\\]/, '\\\\\&')
+
+      with_buffer{@src << " << '" << text << @text_end}
+    end
+
+    # Add ruby code to the template
+    def add_code(code)
+      terminate_expression
+      @src << code
+      @src << ';' unless code[RANGE_LAST] == "\n"
+      @buffer_on_stack = false
+    end
+
+    # Add the given ruby expression result to the template,
+    # escaping it based on the indicator given and escape flag.
+    def add_expression(indicator, code)
+      if ((indicator == '=') ^ @escape)
+        add_expression_result(code)
+      else
+        add_expression_result_escaped(code)
+      end
+    end
+
+    # Add the result of Ruby expression to the template
+    def add_expression_result(code)
+      with_buffer{@src << ' << (' << code << ').to_s'}
+    end
+
+    # Add the escaped result of Ruby expression to the template
+    def add_expression_result_escaped(code)
+      with_buffer{@src << ' << ' << @escapefunc << '((' << code << '))'}
+    end
+
+    # Add the given postamble to the src.  Can be overridden in subclasses
+    # to make additional changes to src that depend on the current state.
+    def add_postamble(postamble)
+      terminate_expression
+      @src << postamble
+    end
+
+    # Raise an exception, as the base engine class does not support handling other indicators.
+    def handle(indicator, code, tailch, rspace, lspace)
+      raise ArgumentError, "Invalid indicator: #{indicator}"
+    end
+
+    # Make sure the buffer variable is the target of the next append
+    # before yielding to the block. Mark that the buffer is the target
+    # of the next append after the block executes.
+    #
+    # This method should only be called if the block will result in
+    # code where << will append to the bufvar.
+    def with_buffer
+      if @chain_appends
+        unless @buffer_on_stack
+          @src << '; ' << @bufvar
+        end
+        yield
+        @buffer_on_stack = true
+      else
+        @src << ' ' << @bufvar
+        yield
+        @src << ';'
+      end
+    end
+
+    # Make sure that any current expression has been terminated.
+    # The default is to terminate all expressions, but when
+    # the chain_appends option is used, expressions may not be
+    # terminated.
+    def terminate_expression
+      @src << '; ' if @chain_appends
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/parallel-1.28.0/lib/parallel/version.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+module Parallel
+  VERSION = Version = '1.28.0' # rubocop:disable Naming/ConstantName
+end

data/bundle/ruby/3.2.0/gems/{parallel-1.27.0 → parallel-1.28.0}/lib/parallel.rb

@@ -15,6 +15,17 @@ module Parallel
       super()
       @value = value
     end
+
+    # marshal_dump that is used for ruby exceptions
+    # avoid dumping the cause since nobody needs that and it can include undumpable exceptions
+    def _dump(_depth)
+      Marshal.dump(@value)
+    end
+
+    # marshal_load that is used for ruby exceptions
+    def self._load(data)
+      new(Marshal.load(data))
+    end
   end
 
   class Kill < Break

data/bundle/ruby/3.2.0/gems/{reline-0.6.3 → reline-0.7.0}/lib/reline/io/ansi.rb

@@ -114,13 +114,15 @@ class Reline::ANSI < Reline::IO
   end
 
   def inner_getc(timeout_second)
-    unless @buf.empty?
-      return @buf.shift
-    end
-    until @input.wait_readable(0.01)
+    while true
+      # @buf may change while handling signal, so we need to check it in each loop iteration.
+      return @buf.shift unless @buf.empty?
+      break if @input.wait_readable(0.01)
+
       timeout_second -= 0.01
       return nil if timeout_second <= 0
 
+      # handle_signal may call cursor_pos which modifies @buf
       Reline.core.line_editor.handle_signal
     end
     c = @input.getbyte