gourami 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa26e60fe628418fe1bf31fc201b9d491b258650306fc2fe08b50787c5425ac2
-  data.tar.gz: fecc00649a3fa7df0f7acf12ae9baa25cdc8f306caa86819ca4acf523260322b
+  metadata.gz: 79b225001fdeb796c9a6224beb9c7c792f37ae0ae7f48be33a2a4ca27f938979
+  data.tar.gz: 9fa37364de4f3c646f51f864798029564629a012e16b85877822629d579650a4
 SHA512:
-  metadata.gz: 50a29467ecefc99fe47b77775e8ff833c883be91a26fd276eae0f490e46893744bfda7370e653f9f3052312b980a6a81220571501f98c5184b7a9386d7866b35
-  data.tar.gz: a9c247005a9b661a3d78177eac2a43d39c1438bc43ed63913c3c256308a5d51a7d9a77540ca4c2fbc072c87767fca31eb996394fc0ef182d661220e427a84f20
+  metadata.gz: 3b421bf22515e7380abf2a247e74e057ba26eed52d29dc7b2a8f2a13a0f2f72608f0ae6a2c1b0ca5ea4138a4b756b73cb8d9cf234f0bb416237c63c866b06f59
+  data.tar.gz: f7dd343730a9503d267f3c39ebb7b769eb62347283a69e5848f0a8e7766b1dcb2da5707eb0b71251eb0f39bdddce47d0fcee212493e811a06618bdbc20be2618

data/gourami.gemspec

@@ -23,6 +23,7 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency "activesupport", ">= 5.1.7"
   spec.add_development_dependency "filewatcher", "~> 1.1.0"
+  spec.add_development_dependency "loofah", ">= 2.24.0"
   spec.add_development_dependency "minitest", "~> 5.0"
   spec.add_development_dependency "pry", "~>0.10"
   spec.add_development_dependency "rake", "~> 10.0"

data/lib/gourami/coercer.rb

@@ -11,7 +11,12 @@ module Gourami
     # @return [*]
     def setter_filter(attribute_name, value, options)
       type = options[:type]
-      value = send(:"coerce_#{type}", value, options) if type
+
+      if type
+        raise ":coerce_#{type} does not exist. Did you forget to add a plugin for :coerce_#{type}?" unless respond_to?(:"coerce_#{type}")
+
+        value = send(:"coerce_#{type}", value, options)
+      end
 
       super(attribute_name, value, options)
     end

data/lib/gourami/form.rb

@@ -88,5 +88,35 @@ module Gourami
     include Gourami::Validations
     include Gourami::Coercer
 
+    # Load and apply a plugin.
+    # Inspired by the plugin system from the Sequel gem. https://janko.io/the-plugin-system-of-sequel-and-roda/
+    # 
+    # @param name [Symbol, Module] a name to look up under Gourami::Plugins
+    #   (e.g. :sanitize loads gourami/plugins/sanitize and resolves
+    #   Gourami::Plugins::Sanitize), or a Module to apply directly.
+    def self.plugin(name, *args, &block)
+      plugin_module = load_plugin(name)
+
+      plugin_module.apply(self, *args, &block) if plugin_module.respond_to?(:apply)
+
+      extend(plugin_module::ClassMethods) if plugin_module.const_defined?(:ClassMethods)
+      include(plugin_module::InstanceMethods) if plugin_module.const_defined?(:InstanceMethods)
+
+      plugin_module.configure(self, *args, &block) if plugin_module.respond_to?(:configure)
+    end
+
+    def self.load_plugin(name)
+      return name if name.is_a?(Module)
+
+      const_name = name.to_s.split("_").map { |part| part[0].upcase + part[1..-1] }.join
+
+      unless Gourami::Plugins.const_defined?(const_name)
+        require "gourami/plugins/#{name}"
+      end
+
+      Gourami::Plugins.const_get(const_name)
+    end
+    private_class_method :load_plugin
+
   end
 end

data/lib/gourami/plugins/sanitize.rb

@@ -0,0 +1,37 @@
+# Optional plugin adding a :sanitized_string attribute type that strips dangerous HTML
+# using loofah. Not loaded by default - opt in with `plugin :sanitize`, and add
+# "loofah" to your own application's Gemfile/gemspec.
+#
+# @example
+#   class MyForm < Gourami::Form
+#     plugin :sanitize
+#
+#     attribute :bio, :type => :sanitized_string
+#   end
+module Gourami
+  module Plugins
+    module Sanitize
+      # Runs on every `plugin :sanitize` call; require is idempotent so this is safe to repeat.
+      def self.apply(_model, *)
+        require "loofah"
+      end
+
+      module InstanceMethods
+        # @param value [Object]
+        # @param options [Hash] forwarded to #coerce_string
+        # @return [String, nil]
+        def coerce_sanitized_string(value, options = {})
+          value = coerce_string(value, options)
+          return value if value.nil?
+
+          # Unescape first so entity-encoded tags (e.g. "&lt;script&gt;") are
+          # recognized as real HTML by Loofah instead of passing through as text.
+          unescaped_content = CGI.unescapeHTML(value)
+          sanitized_content = Loofah.html4_fragment(unescaped_content).scrub!(:prune).to_s
+          # Unescape again since loofah would turn a & back into &amp;
+          CGI.unescapeHTML(sanitized_content).strip
+        end
+      end
+    end
+  end
+end

data/lib/gourami/plugins.rb

@@ -0,0 +1,6 @@
+module Gourami
+  # Namespace that plugins live under, e.g. Gourami::Plugins::Sanitize is
+  # loaded and applied via `plugin :sanitize`.
+  module Plugins
+  end
+end

data/lib/gourami/version.rb

@@ -1,3 +1,3 @@
 module Gourami
-  VERSION = "2.1.0".freeze
+  VERSION = "2.2.0".freeze
 end

data/lib/gourami.rb

@@ -15,5 +15,6 @@ require "gourami/extensions/changes"
 require "gourami/extensions/resources"
 require "gourami/form"
 require "gourami/formatting_constants"
+require "gourami/plugins"
 require "gourami/validations"
 require "gourami/version"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gourami
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - TSMMark
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-08-26 00:00:00.000000000 Z
+date: 2026-08-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.1.0
+- !ruby/object:Gem::Dependency
+  name: loofah
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.24.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.24.0
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -111,6 +125,8 @@ files:
 - lib/gourami/form.rb
 - lib/gourami/formatting_constants.rb
 - lib/gourami/not_watching_changes_error.rb
+- lib/gourami/plugins.rb
+- lib/gourami/plugins/sanitize.rb
 - lib/gourami/required_attribute_error.rb
 - lib/gourami/validation_error.rb
 - lib/gourami/validations.rb
@@ -135,7 +151,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.12
+rubygems_version: 3.4.21
 signing_key:
 specification_version: 4
 summary: Keep your Routes, Controllers and Models thin.