brakeman 4.10.0 → 4.10.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (111) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +8 -0
  3. data/bundle/load.rb +2 -1
  4. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/CHANGELOG.md +16 -0
  5. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/FAQ.md +0 -0
  6. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/Gemfile +1 -4
  7. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/MIT-LICENSE +0 -0
  8. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/README.md +2 -3
  9. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/REFERENCE.md +29 -7
  10. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/TODO +0 -0
  11. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/haml.gemspec +2 -1
  12. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml.rb +0 -0
  13. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_builder.rb +3 -3
  14. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_compiler.rb +42 -31
  15. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_parser.rb +0 -0
  16. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/buffer.rb +0 -0
  17. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/compiler.rb +0 -0
  18. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/engine.rb +0 -0
  19. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/error.rb +0 -0
  20. data/bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/escapable.rb +77 -0
  21. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/exec.rb +0 -0
  22. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/filters.rb +0 -0
  23. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/generator.rb +0 -0
  24. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers.rb +7 -1
  25. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_extensions.rb +0 -0
  26. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_mods.rb +0 -0
  27. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
  28. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubi_template.rb +0 -0
  29. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubis_template.rb +0 -0
  30. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/xss_mods.rb +6 -3
  31. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/options.rb +0 -0
  32. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/parser.rb +32 -4
  33. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/plugin.rb +0 -0
  34. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/railtie.rb +0 -0
  35. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/sass_rails_filter.rb +0 -0
  36. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template.rb +0 -0
  37. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template/options.rb +0 -0
  38. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_engine.rb +0 -0
  39. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_line_counter.rb +0 -0
  40. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/util.rb +1 -1
  41. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/version.rb +1 -1
  42. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/fulldoc/html/css/common.sass +0 -0
  43. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/layout/html/footer.erb +0 -0
  44. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/Gemfile +6 -0
  45. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/LICENSE.txt +22 -0
  46. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/NEWS.md +141 -0
  47. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/README.md +60 -0
  48. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attlistdecl.rb +63 -0
  49. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attribute.rb +205 -0
  50. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/cdata.rb +68 -0
  51. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/child.rb +97 -0
  52. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/comment.rb +80 -0
  53. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/doctype.rb +287 -0
  54. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/document.rb +291 -0
  55. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/attlistdecl.rb +11 -0
  56. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/dtd.rb +47 -0
  57. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/elementdecl.rb +18 -0
  58. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/entitydecl.rb +57 -0
  59. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/notationdecl.rb +40 -0
  60. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/element.rb +1269 -0
  61. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/encoding.rb +51 -0
  62. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/entity.rb +171 -0
  63. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/default.rb +116 -0
  64. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/pretty.rb +142 -0
  65. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/transitive.rb +58 -0
  66. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/functions.rb +447 -0
  67. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/instruction.rb +79 -0
  68. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/light/node.rb +196 -0
  69. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/namespace.rb +59 -0
  70. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/node.rb +76 -0
  71. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/output.rb +30 -0
  72. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parent.rb +166 -0
  73. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parseexception.rb +52 -0
  74. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/baseparser.rb +594 -0
  75. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/lightparser.rb +59 -0
  76. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/pullparser.rb +197 -0
  77. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/sax2parser.rb +273 -0
  78. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/streamparser.rb +61 -0
  79. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/treeparser.rb +101 -0
  80. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/ultralightparser.rb +57 -0
  81. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/xpathparser.rb +675 -0
  82. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/quickpath.rb +266 -0
  83. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/rexml.rb +32 -0
  84. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/sax2listener.rb +98 -0
  85. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/security.rb +28 -0
  86. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/source.rb +298 -0
  87. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/streamlistener.rb +93 -0
  88. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/text.rb +424 -0
  89. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/undefinednamespaceexception.rb +9 -0
  90. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/relaxng.rb +539 -0
  91. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validation.rb +144 -0
  92. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validationexception.rb +10 -0
  93. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmldecl.rb +130 -0
  94. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmltokens.rb +85 -0
  95. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath.rb +81 -0
  96. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath_parser.rb +968 -0
  97. data/bundle/ruby/2.7.0/gems/rexml-3.2.4/rexml.gemspec +84 -0
  98. data/lib/brakeman/checks/check_execute.rb +1 -1
  99. data/lib/brakeman/checks/check_regex_dos.rb +1 -1
  100. data/lib/brakeman/file_parser.rb +5 -0
  101. data/lib/brakeman/processors/alias_processor.rb +2 -2
  102. data/lib/brakeman/processors/controller_processor.rb +1 -1
  103. data/lib/brakeman/processors/haml_template_processor.rb +8 -1
  104. data/lib/brakeman/processors/output_processor.rb +1 -1
  105. data/lib/brakeman/processors/template_alias_processor.rb +5 -0
  106. data/lib/brakeman/tracker/controller.rb +1 -1
  107. data/lib/brakeman/util.rb +2 -2
  108. data/lib/brakeman/version.rb +1 -1
  109. data/lib/ruby_parser/bm_sexp.rb +9 -9
  110. metadata +96 -42
  111. data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb +0 -50
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 5b1be4496aae700f3a9f60ba8ce4502b8ad278669336e9b76e35b626a2c0ec67
4
- data.tar.gz: 1f550b46ffcf86e0bdb8ecd6c98d531db2a33e76697c2a7877703bcb7c6f8a15
3
+ metadata.gz: 1266c840ed2a8f9b6e44686cba353eb6f75eb8d4ec87c7bbdcc56d81785b9227
4
+ data.tar.gz: a0ed358121968434f3289b25685970d338d72f1d1f97b0c27103a81a9792cb16
5
5
  SHA512:
6
- metadata.gz: 54daba5852a749294bc3f4d62f511a9e04d8befb1cf44e984390cb37e3ecbde493948bc0fc475140c38da450434a5bf4b644028ac9706d7aaf02b4edecdcd86b
7
- data.tar.gz: adcdaa789d59514e1909beb72f79c32debcc2bf4f351ea95ad2292226d3061dccb0bf57ca7822e7fdc641b04ba0d643f838b6073f0fe077e149608dbbee1196d
6
+ metadata.gz: 22f064e0f38f304c3d9a18e0c7d36999b7161f9e33ff5c5cd4bca669d19b331e0f92651eb238faf1fd58de66c14da166d7de89353913d806d970f77eb87fa992
7
+ data.tar.gz: 4345e389eb3f592139f32cf70b8d618fcb8695cee9f4a8398fdaa636ac5e9be7b2b0ebe6667810f5cd0667f33898effcd9fbf8beac36f48883da73b68fa7c76f
data/CHANGES.md CHANGED
@@ -1,3 +1,11 @@
1
+ # 4.10.1 - 2020-12-24
2
+
3
+ * Declare REXML as a dependency (Ruby 3.0 compatibility)
4
+ * Use `Sexp#sexp_body` instead of `Sexp#[..]` (Ruby 3.0 compatibility)
5
+ * Prevent render loops when template names are absolute paths
6
+ * Ensure RubyParser is passed file path as a String
7
+ * Support new Haml 5.2.0 escaping method
8
+
1
9
  # 4.10.0 - 2020-09-28
2
10
 
3
11
  * Add SARIF report format (Steve Winton)
@@ -8,7 +8,8 @@ $:.unshift "#{path}/bundle/ruby/2.7.0/gems/slim-4.1.0/lib"
8
8
  $:.unshift "#{path}/bundle/ruby/2.7.0/gems/highline-2.0.3/lib"
9
9
  $:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib"
10
10
  $:.unshift "#{path}/bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib"
11
- $:.unshift "#{path}/bundle/ruby/2.7.0/gems/haml-5.1.2/lib"
11
+ $:.unshift "#{path}/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib"
12
12
  $:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/lib"
13
13
  $:.unshift "#{path}/bundle/ruby/2.7.0/gems/erubis-2.7.0/lib"
14
+ $:.unshift "#{path}/bundle/ruby/2.7.0/gems/haml-5.2.1/lib"
14
15
  $:.unshift "#{path}/bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib"
@@ -1,5 +1,21 @@
1
1
  # Haml Changelog
2
2
 
3
+ ## 5.2.1
4
+
5
+ Released on November 30, 2020
6
+ ([diff](https://github.com/haml/haml/compare/v5.2.0...v5.2.1)).
7
+
8
+ * Add in improved "multiline" support for attributes [#1043](https://github.com/haml/haml/issues/1043)
9
+
10
+ ## 5.2
11
+
12
+ Released on September 28, 2020
13
+ ([diff](https://github.com/haml/haml/compare/v5.1.2...v5.2.0)).
14
+
15
+ * Fix crash in the attribute optimizer when `#inspect` is overridden in TrueClass / FalseClass [#972](https://github.com/haml/haml/issues/972)
16
+ * Do not HTML-escape templates that are declared to be plaintext [#1014](https://github.com/haml/haml/issues/1014) (Thanks [@cesarizu](https://github.com/cesarizu))
17
+ * Class names are no longer ordered alphabetically, and now follow a new specification as laid out in REFERENCE [#306](https://github.com/haml/haml/issues/306)
18
+
3
19
  ## 5.1.2
4
20
 
5
21
  Released on August 6, 2019
@@ -3,6 +3,7 @@ gemspec
3
3
 
4
4
  gem "m"
5
5
  gem "pry"
6
+ gem "simplecov"
6
7
 
7
8
  group :docs do
8
9
  gem "yard"
@@ -13,7 +14,3 @@ end
13
14
  platform :mri do
14
15
  gem "ruby-prof"
15
16
  end
16
-
17
- platform :mri_21 do
18
- gem "simplecov"
19
- end
@@ -1,9 +1,8 @@
1
1
  # Haml
2
2
 
3
3
  [![Gem Version](https://badge.fury.io/rb/haml.svg)](http://rubygems.org/gems/haml)
4
- [![Build Status](https://travis-ci.org/haml/haml.svg?branch=master)](http://travis-ci.org/haml/haml)
4
+ [![Build Status](https://travis-ci.org/haml/haml.svg?branch=main)](http://travis-ci.org/haml/haml)
5
5
  [![Code Climate](https://codeclimate.com/github/haml/haml/badges/gpa.svg)](https://codeclimate.com/github/haml/haml)
6
- [![Coverage Status](http://img.shields.io/coveralls/haml/haml.svg)](https://coveralls.io/r/haml/haml)
7
6
  [![Inline docs](http://inch-ci.org/github/haml/haml.png)](http://inch-ci.org/github/haml/haml)
8
7
 
9
8
  Haml is a templating engine for HTML. It's designed to make it both easier and
@@ -32,7 +31,7 @@ to compile it to HTML. For more information on these commands, check out
32
31
  haml --help
33
32
  ~~~
34
33
 
35
- To use Haml programatically, check out the [YARD documentation](http://haml.info/docs/yardoc/).
34
+ To use Haml programmatically, check out the [YARD documentation](http://haml.info/docs/yardoc/).
36
35
 
37
36
  ## Using Haml with Rails
38
37
 
@@ -228,15 +228,19 @@ is compiled to:
228
228
  <html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'></html>
229
229
 
230
230
  Attribute hashes can also be stretched out over multiple lines to accommodate
231
- many attributes. However, newlines may only be placed immediately after commas.
232
- For example:
231
+ many attributes.
233
232
 
234
- %script{:type => "text/javascript",
235
- :src => "javascripts/script_#{2 + 7}"}
233
+ %script{
234
+ "type": text/javascript",
235
+ "src": javascripts/script_#{2 + 7}",
236
+ "data": {
237
+ "controller": "reporter",
238
+ },
239
+ }
236
240
 
237
241
  is compiled to:
238
242
 
239
- <script src='javascripts/script_9' type='text/javascript'></script>
243
+ <script src='javascripts/script_9' type='text/javascript' data-controller='reporter'></script>
240
244
 
241
245
  #### `:class` and `:id` Attributes {#class-and-id-attributes}
242
246
 
@@ -517,6 +521,24 @@ and is compiled to:
517
521
  </div>
518
522
  </div>
519
523
 
524
+ #### Class Name Merging and Ordering
525
+
526
+ Class names are ordered in the following way:
527
+
528
+ 1) Tag identifiers in order (aka, ".alert.me" => "alert me")
529
+ 2) Classes appearing in HTML-style attributes
530
+ 3) Classes appearing in Hash-style attributes
531
+
532
+ For instance, this is a complicated and unintuitive test case illustrating the ordering
533
+
534
+ .foo.moo{:class => ['bar', 'alpha']}(class='baz')
535
+
536
+ The resulting HTML would be as follows:
537
+
538
+ <div class='foo moo baz bar alpha'></div>
539
+
540
+ *Versions of Haml prior to 5.0 would alphabetically sort class names.*
541
+
520
542
  ### Empty (void) Tags: `/`
521
543
 
522
544
  The forward slash character, when placed at the end of a tag definition, causes
@@ -853,7 +875,7 @@ is compiled to:
853
875
 
854
876
  ## Ruby Evaluation
855
877
 
856
- ### Inserting Ruby: `=`
878
+ ### Inserting Ruby: `=` {#inserting_ruby}
857
879
 
858
880
  The equals character is followed by Ruby code. This code is evaluated and the
859
881
  output is inserted into the document. For example:
@@ -1323,7 +1345,7 @@ that just need a lot of template information.
1323
1345
  So data structures and functions that require lots of arguments
1324
1346
  can be wrapped over multiple lines,
1325
1347
  as long as each line but the last ends in a comma
1326
- (see [Inserting Ruby](#inserting_ruby_)).
1348
+ (see [Inserting Ruby](#inserting_ruby)).
1327
1349
 
1328
1350
  ## Whitespace Preservation
1329
1351
 
@@ -16,7 +16,7 @@ Gem::Specification.new do |spec|
16
16
  spec.license = "MIT"
17
17
  spec.metadata = {
18
18
  "bug_tracker_uri" => "https://github.com/haml/haml/issues",
19
- "changelog_uri" => "https://github.com/haml/haml/blob/master/CHANGELOG.md",
19
+ "changelog_uri" => "https://github.com/haml/haml/blob/main/CHANGELOG.md",
20
20
  "documentation_uri" => "http://haml.info/docs.html",
21
21
  "homepage_uri" => "http://haml.info",
22
22
  "mailing_list_uri" => "https://groups.google.com/forum/?fromgroups#!forum/haml",
@@ -32,6 +32,7 @@ Gem::Specification.new do |spec|
32
32
  spec.add_development_dependency 'rbench'
33
33
  spec.add_development_dependency 'minitest', '>= 4.0'
34
34
  spec.add_development_dependency 'nokogiri'
35
+ spec.add_development_dependency 'simplecov'
35
36
 
36
37
  spec.description = <<-END
37
38
  Haml (HTML Abstraction Markup Language) is a layer on top of HTML or XML that's
@@ -36,9 +36,9 @@ module Haml
36
36
 
37
37
  value =
38
38
  if escape_attrs == :once
39
- Haml::Helpers.escape_once(value.to_s)
39
+ Haml::Helpers.escape_once_without_haml_xss(value.to_s)
40
40
  elsif escape_attrs
41
- Haml::Helpers.html_escape(value.to_s)
41
+ Haml::Helpers.html_escape_without_haml_xss(value.to_s)
42
42
  else
43
43
  value.to_s
44
44
  end
@@ -126,7 +126,7 @@ module Haml
126
126
  elsif key == 'class'
127
127
  merged_class = filter_and_join(from, ' ')
128
128
  if to && merged_class
129
- merged_class = (merged_class.split(' ') | to.split(' ')).sort.join(' ')
129
+ merged_class = (to.split(' ') | merged_class.split(' ')).join(' ')
130
130
  elsif to || merged_class
131
131
  merged_class ||= to
132
132
  end
@@ -7,27 +7,7 @@ module Haml
7
7
  # @param type [Symbol] :static or :dynamic
8
8
  # @param key [String]
9
9
  # @param value [String] Actual string value for :static type, value's Ruby literal for :dynamic type.
10
- AttributeValue = Struct.new(:type, :key, :value) do
11
- # @return [String] A Ruby literal of value.
12
- def to_literal
13
- case type
14
- when :static
15
- Haml::Util.inspect_obj(value)
16
- when :dynamic
17
- value
18
- end
19
- end
20
- end
21
-
22
- # Returns a script to render attributes on runtime.
23
- #
24
- # @param attributes [Hash]
25
- # @param object_ref [String,:nil]
26
- # @param dynamic_attributes [DynamicAttributes]
27
- # @return [String] Attributes rendering code
28
- def self.runtime_build(attributes, object_ref, dynamic_attributes)
29
- "_hamlout.attributes(#{Haml::Util.inspect_obj(attributes)}, #{object_ref},#{dynamic_attributes.to_literal})"
30
- end
10
+ AttributeValue = Struct.new(:type, :key, :value)
31
11
 
32
12
  # @param options [Haml::Options]
33
13
  def initialize(options)
@@ -41,16 +21,16 @@ module Haml
41
21
  #
42
22
  # @param attributes [Hash]
43
23
  # @param object_ref [String,:nil]
44
- # @param dynamic_attributes [DynamicAttributes]
24
+ # @param dynamic_attributes [Haml::Parser::DynamicAttributes]
45
25
  # @return [Array] Temple expression
46
26
  def compile(attributes, object_ref, dynamic_attributes)
47
27
  if object_ref != :nil || !AttributeParser.available?
48
- return [:dynamic, AttributeCompiler.runtime_build(attributes, object_ref, dynamic_attributes)]
28
+ return [:dynamic, compile_runtime_build(attributes, object_ref, dynamic_attributes)]
49
29
  end
50
30
 
51
31
  parsed_hashes = [dynamic_attributes.new, dynamic_attributes.old].compact.map do |attribute_hash|
52
32
  unless (hash = AttributeParser.parse(attribute_hash))
53
- return [:dynamic, AttributeCompiler.runtime_build(attributes, object_ref, dynamic_attributes)]
33
+ return [:dynamic, compile_runtime_build(attributes, object_ref, dynamic_attributes)]
54
34
  end
55
35
  hash
56
36
  end
@@ -64,6 +44,16 @@ module Haml
64
44
 
65
45
  private
66
46
 
47
+ # Returns a script to render attributes on runtime.
48
+ #
49
+ # @param attributes [Hash]
50
+ # @param object_ref [String,:nil]
51
+ # @param dynamic_attributes [Haml::Parser::DynamicAttributes]
52
+ # @return [String] Attributes rendering code
53
+ def compile_runtime_build(attributes, object_ref, dynamic_attributes)
54
+ "_hamlout.attributes(#{to_literal(attributes)}, #{object_ref}, #{dynamic_attributes.to_literal})"
55
+ end
56
+
67
57
  # Build array of grouped values whose sort order may go back and forth, which is also sorted with key name.
68
58
  # This method needs to group values with the same start because it can be changed in `Haml::AttributeBuidler#build_data_keys`.
69
59
  # @param values [Array<Haml::AttributeCompiler::AttributeValue>]
@@ -130,7 +120,7 @@ module Haml
130
120
 
131
121
  arguments = [@is_html, @attr_wrapper, @escape_attrs, @hyphenate_data_attrs]
132
122
  code = "::Haml::AttributeBuilder.build_attributes"\
133
- "(#{arguments.map { |a| Haml::Util.inspect_obj(a) }.join(', ')}, { #{hash_content} })"
123
+ "(#{arguments.map(&method(:to_literal)).join(', ')}, { #{hash_content} })"
134
124
  [:static, eval(code).to_s]
135
125
  end
136
126
 
@@ -139,16 +129,16 @@ module Haml
139
129
  # @return [String]
140
130
  def merged_value(key, values)
141
131
  if values.size == 1
142
- values.first.to_literal
132
+ attr_literal(values.first)
143
133
  else
144
- "::Haml::AttributeBuilder.merge_values(#{frozen_string(key)}, #{values.map(&:to_literal).join(', ')})"
134
+ "::Haml::AttributeBuilder.merge_values(#{frozen_string(key)}, #{values.map(&method(:attr_literal)).join(', ')})"
145
135
  end
146
136
  end
147
137
 
148
138
  # @param str [String]
149
139
  # @return [String]
150
140
  def frozen_string(str)
151
- "#{Haml::Util.inspect_obj(str)}.freeze"
141
+ "#{to_literal(str)}.freeze"
152
142
  end
153
143
 
154
144
  # Compiles attribute values for one key to Temple expression that generates ` key='value'`.
@@ -157,7 +147,7 @@ module Haml
157
147
  # @param values [Array<AttributeValue>]
158
148
  # @return [Array] Temple expression
159
149
  def compile_attribute(key, values)
160
- if values.all? { |v| Temple::StaticAnalyzer.static?(v.to_literal) }
150
+ if values.all? { |v| Temple::StaticAnalyzer.static?(attr_literal(v)) }
161
151
  return static_build(values)
162
152
  end
163
153
 
@@ -181,7 +171,7 @@ module Haml
181
171
  ['false, nil', [:multi]],
182
172
  [:else, [:multi,
183
173
  [:static, " #{id_or_class}=#{@attr_wrapper}"],
184
- [:escape, @escape_attrs, [:dynamic, var]],
174
+ [:escape, Escapable::EscapeSafeBuffer.new(@escape_attrs), [:dynamic, var]],
185
175
  [:static, @attr_wrapper]],
186
176
  ]
187
177
  ],
@@ -201,7 +191,7 @@ module Haml
201
191
  ['false, nil', [:multi]],
202
192
  [:else, [:multi,
203
193
  [:static, " #{key}=#{@attr_wrapper}"],
204
- [:escape, @escape_attrs, [:dynamic, var]],
194
+ [:escape, Escapable::EscapeSafeBuffer.new(@escape_attrs), [:dynamic, var]],
205
195
  [:static, @attr_wrapper]],
206
196
  ]
207
197
  ],
@@ -220,5 +210,26 @@ module Haml
220
210
  @unique_name ||= 0
221
211
  "_haml_attribute_compiler#{@unique_name += 1}"
222
212
  end
213
+
214
+ # @param [Haml::AttributeCompiler::AttributeValue] attr
215
+ def attr_literal(attr)
216
+ case attr.type
217
+ when :static
218
+ to_literal(attr.value)
219
+ when :dynamic
220
+ attr.value
221
+ end
222
+ end
223
+
224
+ # For haml/haml#972
225
+ # @param [Object] value
226
+ def to_literal(value)
227
+ case value
228
+ when true, false
229
+ value.to_s
230
+ else
231
+ Haml::Util.inspect_obj(value)
232
+ end
233
+ end
223
234
  end
224
235
  end
@@ -0,0 +1,77 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Haml
4
+ # Like Temple::Filters::Escapable, but with support for escaping by
5
+ # Haml::Herlpers.html_escape and Haml::Herlpers.escape_once.
6
+ class Escapable < Temple::Filter
7
+ # Special value of `flag` to ignore html_safe?
8
+ EscapeSafeBuffer = Struct.new(:value)
9
+
10
+ def initialize(*)
11
+ super
12
+ @escape = false
13
+ @escape_safe_buffer = false
14
+ end
15
+
16
+ def on_escape(flag, exp)
17
+ old_escape, old_escape_safe_buffer = @escape, @escape_safe_buffer
18
+ @escape_safe_buffer = flag.is_a?(EscapeSafeBuffer)
19
+ @escape = @escape_safe_buffer ? flag.value : flag
20
+ compile(exp)
21
+ ensure
22
+ @escape, @escape_safe_buffer = old_escape, old_escape_safe_buffer
23
+ end
24
+
25
+ # The same as Haml::AttributeBuilder.build_attributes
26
+ def on_static(value)
27
+ [:static,
28
+ if @escape == :once
29
+ escape_once(value)
30
+ elsif @escape
31
+ escape(value)
32
+ else
33
+ value
34
+ end
35
+ ]
36
+ end
37
+
38
+ # The same as Haml::AttributeBuilder.build_attributes
39
+ def on_dynamic(value)
40
+ [:dynamic,
41
+ if @escape == :once
42
+ escape_once_code(value)
43
+ elsif @escape
44
+ escape_code(value)
45
+ else
46
+ "(#{value}).to_s"
47
+ end
48
+ ]
49
+ end
50
+
51
+ private
52
+
53
+ def escape_once(value)
54
+ if @escape_safe_buffer
55
+ ::Haml::Helpers.escape_once_without_haml_xss(value)
56
+ else
57
+ ::Haml::Helpers.escape_once(value)
58
+ end
59
+ end
60
+
61
+ def escape(value)
62
+ if @escape_safe_buffer
63
+ ::Haml::Helpers.html_escape_without_haml_xss(value)
64
+ else
65
+ ::Haml::Helpers.html_escape(value)
66
+ end
67
+ end
68
+
69
+ def escape_once_code(value)
70
+ "::Haml::Helpers.escape_once#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
71
+ end
72
+
73
+ def escape_code(value)
74
+ "::Haml::Helpers.html_escape#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
75
+ end
76
+ end
77
+ end