erb_lint 0.0.37 → 0.1.2

data/lib/erb_lint/linters/no_javascript_tag_helper.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require 'better_html'
-require 'better_html/ast/node'
-require 'better_html/test_helper/ruby_node'
-require 'erb_lint/utils/block_map'
-require 'erb_lint/utils/ruby_to_erb'
+require "better_html"
+require "better_html/ast/node"
+require "better_html/test_helper/ruby_node"
+require "erb_lint/utils/block_map"
+require "erb_lint/utils/ruby_to_erb"
 
 module ERBLint
   module Linters
@@ -21,7 +21,8 @@ module ERBLint
         parser.ast.descendants(:erb).each do |erb_node|
           indicator_node, _, code_node, _ = *erb_node
           indicator = indicator_node&.loc&.source
-          next if indicator == '#'
+          next if indicator == "#"
+
           source = code_node.loc.source
 
           ruby_node =
@@ -31,13 +32,14 @@ module ERBLint
               nil
             end
           next unless ruby_node
+
           send_node = ruby_node.descendants(:send).first
           next unless send_node&.method_name?(:javascript_tag)
 
           add_offense(
             erb_node.loc,
             "Avoid using 'javascript_tag do' as it confuses tests "\
-            "that validate html, use inline <script> instead",
+              "that validate html, use inline <script> instead",
             [erb_node, send_node]
           )
         end
@@ -63,10 +65,10 @@ module ERBLint
         return unless (0..2).cover?(argument_nodes.size)
 
         script_content = unless argument_nodes.first&.type?(:hash)
-          Utils::RubyToERB.ruby_to_erb(argument_nodes.first, '==')
+          Utils::RubyToERB.ruby_to_erb(argument_nodes.first, "==")
         end
         arguments = if argument_nodes.last&.type?(:hash)
-          ' ' + Utils::RubyToERB.html_options_to_tag_attributes(argument_nodes.last)
+          " " + Utils::RubyToERB.html_options_to_tag_attributes(argument_nodes.last)
         end
 
         return if end_node && script_content

data/lib/erb_lint/linters/partial_instance_variable.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module ERBLint
+  module Linters
+    # Checks for instance variables in partials.
+    class PartialInstanceVariable < Linter
+      include LinterRegistry
+
+      def run(processed_source)
+        instance_variable_regex = /\s@\w+/
+        return unless processed_source.filename.match?(%r{(\A|.*/)_[^/\s]*\.html\.erb\z}) &&
+          processed_source.file_content.match?(instance_variable_regex)
+
+        add_offense(
+          processed_source.to_source_range(
+            processed_source.file_content =~ instance_variable_regex..processed_source.file_content.size
+          ),
+          "Instance variable detected in partial."
+        )
+      end
+    end
+  end
+end

data/lib/erb_lint/linters/require_input_autocomplete.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require "better_html"
+require "better_html/tree/tag"
+
+module ERBLint
+  module Linters
+    class RequireInputAutocomplete < Linter
+      include LinterRegistry
+
+      HTML_INPUT_TYPES_REQUIRING_AUTOCOMPLETE = [
+        "color",
+        "date",
+        "datetime-local",
+        "email",
+        "month",
+        "number",
+        "password",
+        "range",
+        "search",
+        "tel",
+        "text",
+        "time",
+        "url",
+        "week",
+      ].freeze
+
+      FORM_HELPERS_REQUIRING_AUTOCOMPLETE = [
+        :date_field_tag,
+        :color_field_tag,
+        :email_field_tag,
+        :text_field_tag,
+        :utf8_enforcer_tag,
+        :month_field_tag,
+        :number_field_tag,
+        :password_field_tag,
+        :search_field_tag,
+        :telephone_field_tag,
+        :time_field_tag,
+        :url_field_tag,
+        :week_field_tag,
+      ].freeze
+
+      def run(processed_source)
+        parser = processed_source.parser
+
+        find_html_input_tags(parser)
+        find_rails_helper_input_tags(parser)
+      end
+
+      private
+
+      def find_html_input_tags(parser)
+        parser.nodes_with_type(:tag).each do |tag_node|
+          tag = BetterHtml::Tree::Tag.from_node(tag_node)
+
+          autocomplete_attribute = tag.attributes["autocomplete"]
+          type_attribute = tag.attributes["type"]
+
+          next if !html_input_tag?(tag) || autocomplete_present?(autocomplete_attribute)
+          next unless html_type_requires_autocomplete_attribute?(type_attribute)
+
+          add_offense(
+            tag_node.to_a[1].loc,
+            "Input tag is missing an autocomplete attribute. If no "\
+              "autocomplete behaviour is desired, use the value `off` or `nope`.",
+            [autocomplete_attribute]
+          )
+        end
+      end
+
+      def autocomplete_present?(autocomplete_attribute)
+        autocomplete_attribute.present? && autocomplete_attribute.value_node.present?
+      end
+
+      def html_input_tag?(tag)
+        !tag.closing? && tag.name == "input"
+      end
+
+      def html_type_requires_autocomplete_attribute?(type_attribute)
+        type_present = type_attribute.present? && type_attribute.value_node.present?
+        type_present && HTML_INPUT_TYPES_REQUIRING_AUTOCOMPLETE.include?(type_attribute.value)
+      end
+
+      def find_rails_helper_input_tags(parser)
+        parser.ast.descendants(:erb).each do |erb_node|
+          indicator_node, _, code_node, _ = *erb_node
+          source = code_node.loc.source
+          ruby_node = extract_ruby_node(source)
+          send_node = ruby_node&.descendants(:send)&.first
+
+          next if code_comment?(indicator_node) ||
+            !ruby_node ||
+            !input_helper?(send_node) ||
+            source.include?("autocomplete")
+
+          add_offense(
+            erb_node.loc,
+            "Input field helper is missing an autocomplete attribute. If no "\
+              "autocomplete behaviour is desired, use the value `off` or `nope`.",
+            [erb_node, send_node]
+          )
+        end
+      end
+
+      def input_helper?(send_node)
+        FORM_HELPERS_REQUIRING_AUTOCOMPLETE.include?(send_node&.method_name)
+      end
+
+      def code_comment?(indicator_node)
+        indicator_node&.loc&.source == "#"
+      end
+
+      def extract_ruby_node(source)
+        BetterHtml::TestHelper::RubyNode.parse(source)
+      rescue ::Parser::SyntaxError
+        nil
+      end
+    end
+  end
+end

data/lib/erb_lint/linters/require_script_nonce.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "better_html"
+require "better_html/tree/tag"
+
+module ERBLint
+  module Linters
+    # Allow inline script tags in ERB that have a nonce attribute.
+    # This only validates inline <script> tags, as well as rails helpers like javascript_tag.
+    class RequireScriptNonce < Linter
+      include LinterRegistry
+
+      def run(processed_source)
+        parser = processed_source.parser
+
+        find_html_script_tags(parser)
+        find_rails_helper_script_tags(parser)
+      end
+
+      private
+
+      def find_html_script_tags(parser)
+        parser.nodes_with_type(:tag).each do |tag_node|
+          tag = BetterHtml::Tree::Tag.from_node(tag_node)
+          nonce_attribute = tag.attributes["nonce"]
+
+          next if !html_javascript_tag?(tag) || nonce_present?(nonce_attribute)
+
+          add_offense(
+            tag_node.to_a[1].loc,
+            "Missing a nonce attribute. Use request.content_security_policy_nonce",
+            [nonce_attribute]
+          )
+        end
+      end
+
+      def nonce_present?(nonce_attribute)
+        nonce_attribute.present? && nonce_attribute.value_node.present?
+      end
+
+      def html_javascript_tag?(tag)
+        !tag.closing? &&
+          (tag.name == "script" && !html_javascript_type_attribute?(tag))
+      end
+
+      def html_javascript_type_attribute?(tag)
+        type_attribute = tag.attributes["type"]
+
+        type_attribute &&
+          type_attribute.value_node.present? &&
+          type_attribute.value_node.to_a[1] != "text/javascript" &&
+          type_attribute.value_node.to_a[1] != "application/javascript"
+      end
+
+      def find_rails_helper_script_tags(parser)
+        parser.ast.descendants(:erb).each do |erb_node|
+          indicator_node, _, code_node, _ = *erb_node
+          source = code_node.loc.source
+          ruby_node = extract_ruby_node(source)
+          send_node = ruby_node&.descendants(:send)&.first
+
+          next if code_comment?(indicator_node) ||
+            !ruby_node ||
+            !tag_helper?(send_node) ||
+            source.include?("nonce")
+
+          add_offense(
+            erb_node.loc,
+            "Missing a nonce attribute. Use nonce: true",
+            [erb_node, send_node]
+          )
+        end
+      end
+
+      def tag_helper?(send_node)
+        send_node&.method_name?(:javascript_tag) ||
+          send_node&.method_name?(:javascript_include_tag) ||
+          send_node&.method_name?(:javascript_pack_tag)
+      end
+
+      def code_comment?(indicator_node)
+        indicator_node&.loc&.source == "#"
+      end
+
+      def extract_ruby_node(source)
+        BetterHtml::TestHelper::RubyNode.parse(source)
+      rescue ::Parser::SyntaxError
+        nil
+      end
+    end
+  end
+end

data/lib/erb_lint/linters/right_trim.rb

@@ -8,7 +8,7 @@ module ERBLint
       include LinterRegistry
 
       class ConfigSchema < LinterConfig
-        property :enforced_style, accepts: ['-', '='], default: '-'
+        property :enforced_style, accepts: ["-", "="], default: "-"
       end
       self.config_schema = ConfigSchema
 

data/lib/erb_lint/linters/rubocop.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require 'better_html'
-require 'tempfile'
-require 'erb_lint/utils/offset_corrector'
+require "better_html"
+require "tempfile"
+require "erb_lint/utils/offset_corrector"
 
 module ERBLint
   module Linters
@@ -25,7 +25,7 @@ module ERBLint
         super
         @only_cops = @config.only
         custom_config = config_from_hash(@config.rubocop_config)
-        @rubocop_config = ::RuboCop::ConfigLoader.merge_with_default(custom_config, '')
+        @rubocop_config = ::RuboCop::ConfigLoader.merge_with_default(custom_config, "")
       end
 
       def run(processed_source)
@@ -37,6 +37,7 @@ module ERBLint
       if ::RuboCop::Version::STRING.to_f >= 0.87
         def autocorrect(_processed_source, offense)
           return unless offense.context
+
           rubocop_correction = offense.context[:rubocop_correction]
           return unless rubocop_correction
 
@@ -68,13 +69,13 @@ module ERBLint
 
       def inspect_content(processed_source, erb_node)
         indicator, _, code_node, = *erb_node
-        return if indicator&.children&.first == '#'
+        return if indicator&.children&.first == "#"
 
         original_source = code_node.loc.source
-        trimmed_source = original_source.sub(BLOCK_EXPR, '').sub(SUFFIX_EXPR, '')
+        trimmed_source = original_source.sub(BLOCK_EXPR, "").sub(SUFFIX_EXPR, "")
         alignment_column = code_node.loc.column
         offset = code_node.loc.begin_pos - alignment_column
-        aligned_source = "#{' ' * alignment_column}#{trimmed_source}"
+        aligned_source = "#{" " * alignment_column}#{trimmed_source}"
 
         source = rubocop_processed_source(aligned_source, processed_source.filename)
         return unless source.valid_syntax?
@@ -150,16 +151,17 @@ module ERBLint
           @rubocop_config,
           extra_details: true,
           display_cop_names: true,
+          autocorrect: true,
           auto_correct: true,
           stdin: "",
         )
       end
 
       def config_from_hash(hash)
-        inherit_from = hash&.delete('inherit_from')
+        inherit_from = hash&.delete("inherit_from")
         resolve_inheritance(hash, inherit_from)
 
-        tempfile_from('.erblint-rubocop', hash.to_yaml) do |tempfile|
+        tempfile_from(".erblint-rubocop", hash.to_yaml) do |tempfile|
           ::RuboCop::ConfigLoader.load_file(tempfile.path)
         end
       end
@@ -174,7 +176,7 @@ module ERBLint
       end
 
       def base_configs(inherit_from)
-        regex = URI::DEFAULT_PARSER.make_regexp(%w(http https))
+        regex = URI::DEFAULT_PARSER.make_regexp(["http", "https"])
         configs = Array(inherit_from).compact.map do |base_name|
           if base_name =~ /\A#{regex}\z/
             ::RuboCop::ConfigLoader.load_file(::RuboCop::RemoteConfig.new(base_name, Dir.pwd))
@@ -191,7 +193,7 @@ module ERBLint
           { rubocop_correction: correction, offset: offset, bound_range: bound_range }
         end
 
-        super(offense_range, rubocop_offense.message.strip, context)
+        super(offense_range, rubocop_offense.message.strip, context, rubocop_offense.severity.name)
       end
     end
   end

data/lib/erb_lint/linters/rubocop_text.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'rubocop'
+require_relative "rubocop"
 
 module ERBLint
   module Linters

data/lib/erb_lint/linters/self_closing_tag.rb

@@ -11,10 +11,8 @@ module ERBLint
       end
       self.config_schema = ConfigSchema
 
-      SELF_CLOSING_TAGS = %w(
-        area base br col command embed hr input keygen
-        link menuitem meta param source track wbr img
-      )
+      SELF_CLOSING_TAGS = ["area", "base", "br", "col", "command", "embed", "hr", "input", "keygen", "link",
+                           "menuitem", "meta", "param", "source", "track", "wbr", "img",]
 
       def run(processed_source)
         processed_source.ast.descendants(:tag).each do |tag_node|
@@ -26,7 +24,7 @@ module ERBLint
             add_offense(
               start_solidus.loc,
               "Tag `#{tag.name}` is a void element, it must not start with `</`.",
-              ''
+              ""
             )
           end
 
@@ -34,16 +32,17 @@ module ERBLint
             add_offense(
               tag_node.loc.end.offset(-1),
               "Tag `#{tag.name}` is self-closing, it must end with `/>`.",
-              '/'
+              "/"
             )
           end
 
           next unless @config.enforced_style == :never && tag.self_closing?
+
           end_solidus = tag_node.children.last
           add_offense(
             end_solidus.loc,
             "Tag `#{tag.name}` is a void element, it must end with `>` and not `/>`.",
-            ''
+            ""
           )
         end
       end

data/lib/erb_lint/linters/space_around_erb_tag.rb

@@ -15,7 +15,8 @@ module ERBLint
         processed_source.ast.descendants(:erb).each do |erb_node|
           indicator_node, ltrim, code_node, rtrim = *erb_node
           indicator = indicator_node&.loc&.source
-          next if indicator == '#' || indicator == '%'
+          next if indicator == "#" || indicator == "%"
+
           code = code_node.children.first
 
           start_spaces = code.match(START_SPACES)&.captures&.first || ""
@@ -23,15 +24,15 @@ module ERBLint
             add_offense(
               code_node.loc.resize(start_spaces.size),
               "Use 1 space after `<%#{indicator}#{ltrim&.loc&.source}` "\
-              "instead of #{start_spaces.size} space#{'s' if start_spaces.size > 1}.",
-              ' '
+                "instead of #{start_spaces.size} space#{"s" if start_spaces.size > 1}.",
+              " "
             )
           elsif start_spaces.count("\n") > 1
             lines = start_spaces.split("\n", -1)
             add_offense(
               code_node.loc.resize(start_spaces.size),
               "Use 1 newline after `<%#{indicator&.loc&.source}#{ltrim&.loc&.source}` "\
-              "instead of #{start_spaces.count("\n")}.",
+                "instead of #{start_spaces.count("\n")}.",
               "#{lines.first}\n#{lines.last}"
             )
           end
@@ -41,15 +42,15 @@ module ERBLint
             add_offense(
               code_node.loc.end.adjust(begin_pos: -end_spaces.size),
               "Use 1 space before `#{rtrim&.loc&.source}%>` "\
-              "instead of #{end_spaces.size} space#{'s' if start_spaces.size > 1}.",
-              ' '
+                "instead of #{end_spaces.size} space#{"s" if start_spaces.size > 1}.",
+              " "
             )
           elsif end_spaces.count("\n") > 1
             lines = end_spaces.split("\n", -1)
             add_offense(
               code_node.loc.end.adjust(begin_pos: -end_spaces.size),
               "Use 1 newline before `#{rtrim&.loc&.source}%>` "\
-              "instead of #{end_spaces.count("\n")}.",
+                "instead of #{end_spaces.count("\n")}.",
               "#{lines.first}\n#{lines.last}"
             )
           end

data/lib/erb_lint/linters/space_in_html_tag.rb

@@ -50,7 +50,7 @@ module ERBLint
         add_offense(
           processed_source.to_source_range(range),
           "Extra space detected where there should be no space.",
-          ''
+          ""
         )
       end
 
@@ -60,24 +60,24 @@ module ERBLint
 
       def single_space(processed_source, range, accept_newline: false)
         chars = processed_source.file_content[range]
-        return if chars == ' '
+        return if chars == " "
 
         newlines = chars.include?("\n")
-        expected = newlines && accept_newline ? "\n#{chars.split("\n", -1).last}" : ' '
+        expected = newlines && accept_newline ? "\n#{chars.split("\n", -1).last}" : " "
         non_space = chars.match(/([^[[:space:]]])/m)
 
         if non_space && !non_space.captures.empty?
           add_offense(
             processed_source.to_source_range(range),
             "Non-whitespace character(s) detected: "\
-              "#{non_space.captures.map(&:inspect).join(', ')}.",
+              "#{non_space.captures.map(&:inspect).join(", ")}.",
             expected
           )
         elsif newlines && accept_newline
           if expected != chars
             add_offense(
               processed_source.to_source_range(range),
-              "#{chars.empty? ? 'No' : 'Extra'} space detected where there should be "\
+              "#{chars.empty? ? "No" : "Extra"} space detected where there should be "\
                 "a single space or a single line break.",
               expected
             )
@@ -85,7 +85,7 @@ module ERBLint
         else
           add_offense(
             processed_source.to_source_range(range),
-            "#{chars.empty? ? 'No' : 'Extra'} space detected where there should be a single space.",
+            "#{chars.empty? ? "No" : "Extra"} space detected where there should be a single space.",
             expected
           )
         end
@@ -98,6 +98,7 @@ module ERBLint
           no_space(processed_source, equal.loc.end_pos...value.loc.begin_pos) if equal && value
 
           next if index >= attributes.children.size - 1
+
           next_attribute = attributes.children[index + 1]
 
           single_space_or_newline(

data/lib/erb_lint/linters/space_indentation.rb

@@ -23,7 +23,7 @@ module ERBLint
             add_offense(
               processed_source.to_source_range(document_pos...(document_pos + spaces.length)),
               "Indent with spaces instead of tabs.",
-              spaces.gsub("\t", ' ' * @config.tab_width)
+              spaces.gsub("\t", " " * @config.tab_width)
             )
           end
 

data/lib/erb_lint/linters/trailing_whitespace.rb

@@ -25,7 +25,7 @@ module ERBLint
 
       def autocorrect(_processed_source, offense)
         lambda do |corrector|
-          corrector.replace(offense.source_range, '')
+          corrector.replace(offense.source_range, "")
         end
       end
     end

data/lib/erb_lint/offense.rb

@@ -3,29 +3,33 @@
 module ERBLint
   # Defines common functionality available to all linters.
   class Offense
-    attr_reader :linter, :source_range, :message, :context
+    attr_reader :linter, :source_range, :message, :context, :severity
 
-    def initialize(linter, source_range, message, context = nil)
+    def initialize(linter, source_range, message, context = nil, severity = nil)
       unless source_range.is_a?(Parser::Source::Range)
         raise ArgumentError, "expected Parser::Source::Range for arg 2"
       end
+
       @linter = linter
       @source_range = source_range
       @message = message
       @context = context
+      @severity = severity
     end
 
     def inspect
       "#<#{self.class.name} linter=#{linter.class.name} "\
         "source_range=#{source_range.begin_pos}...#{source_range.end_pos} "\
-        "message=#{message}>"
+        "message=#{message}> "\
+        "severity=#{severity}"
     end
 
     def ==(other)
       other.class <= ERBLint::Offense &&
         other.linter == linter &&
         other.source_range == source_range &&
-        other.message == message
+        other.message == message &&
+        other.severity == severity
     end
 
     def line_range

data/lib/erb_lint/reporter.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
-require 'active_support/core_ext/class'
-require 'active_support/core_ext/module/delegation'
+
+require "active_support/core_ext/class"
+require "active_support/core_ext/module/delegation"
 
 module ERBLint
   class Reporter
@@ -34,6 +35,7 @@ module ERBLint
     private
 
     attr_reader :stats, :autocorrect
+
     delegate :processed_files, to: :stats
   end
 end

data/lib/erb_lint/reporters/compact_reporter.rb

@@ -4,8 +4,7 @@ module ERBLint
   module Reporters
     class CompactReporter < Reporter
       def preview
-        puts "Linting #{stats.files} files with "\
-          "#{stats.linters} #{'autocorrectable ' if autocorrect}linters..."
+        puts "#{linting} #{stats.files} files with #{linters}..."
       end
 
       def show
@@ -21,6 +20,14 @@ module ERBLint
 
       private
 
+      def linting
+        "Linting" + (autocorrect ? " and autocorrecting" : "")
+      end
+
+      def linters
+        "#{stats.linters} linters" + (autocorrect ? " (#{stats.autocorrectable_linters} autocorrectable)" : "")
+      end
+
       def format_offense(filename, offense)
         [
           "#{filename}:",
@@ -35,8 +42,14 @@ module ERBLint
       def summary
         if stats.corrected > 0
           report_corrected_offenses
-        elsif stats.found > 0
-          warn(Rainbow("#{stats.found} error(s) were found in ERB files").red)
+        elsif stats.ignored > 0 || stats.found > 0
+          if stats.ignored > 0
+            warn(Rainbow("#{stats.ignored} error(s) were ignored in ERB files").yellow)
+          end
+
+          if stats.found > 0
+            warn(Rainbow("#{stats.found} error(s) were found in ERB files").red)
+          end
         else
           puts Rainbow("No errors were found in ERB files").green
         end