haml 2.2.19 → 2.2.20

data/VERSION

@@ -1 +1 @@
-2.2.19
+2.2.20

data/extra/haml-mode.el

@@ -4,7 +4,7 @@
 
 ;; Author: Nathan Weizenbaum
 ;; URL: http://github.com/nex3/haml/tree/master
-;; Version: 2.2.18
+;; Version: 2.2.20
 ;; Created: 2007-03-08
 ;; By: Nathan Weizenbaum
 ;; Keywords: markup, language, html
@@ -26,10 +26,10 @@
 (require 'ruby-mode)
 
 ;; Additional (optional) libraries for fontification
-(require 'css-mode nil nil)
-(require 'textile-mode nil nil)
-(require 'markdown-mode nil nil)
-(require 'javascript-mode "javascript" nil)
+(require 'css-mode nil t)
+(require 'textile-mode nil t)
+(require 'markdown-mode nil t)
+(require 'javascript-mode "javascript" t)
 
 
 ;; User definable variables

data/extra/sass-mode.el

@@ -4,11 +4,11 @@
 
 ;; Author: Nathan Weizenbaum
 ;; URL: http://github.com/nex3/haml/tree/master
-;; Version: 2.2.18
+;; Version: 2.2.20
 ;; Created: 2007-03-15
 ;; By: Nathan Weizenbaum
 ;; Keywords: markup, language, css
-;; Package-Requires: ((haml-mode "2.2.18"))
+;; Package-Requires: ((haml-mode "2.2.20"))
 
 ;;; Commentary:
 

data/lib/haml/helpers.rb

@@ -519,12 +519,12 @@ END
     # @yield A block in which the given buffer should be used
     def with_haml_buffer(buffer)
       @haml_buffer, old_buffer = buffer, @haml_buffer
-      old_buffer.active, was_active = false, old_buffer.active? if old_buffer
-      @haml_buffer.active = true
+      old_buffer.active, old_was_active = false, old_buffer.active? if old_buffer
+      @haml_buffer.active, was_active = true, @haml_buffer.active?
       yield
     ensure
-      @haml_buffer.active = false
-      old_buffer.active = was_active if old_buffer
+      @haml_buffer.active = was_active
+      old_buffer.active = old_was_active if old_buffer
       @haml_buffer = old_buffer
     end
 

data/lib/haml/helpers/action_view_extensions.rb

@@ -45,10 +45,10 @@ module Haml
       # @yield A block in which all input to `#haml_concat` is treated as raw.
       # @see Haml::Util#rails_xss_safe?
       def with_raw_haml_concat
-        @_haml_concat_raw = true
+        @_haml_concat_raw, old = true, @_haml_concat_raw
         yield
       ensure
-        @_haml_concat_raw = false
+        @_haml_concat_raw = old
       end
     end
   end

data/lib/haml/helpers/action_view_mods.rb

@@ -125,7 +125,7 @@ module ActionView
         @template_object.send :is_haml?
       end
 
-      unless defined?(ActionView::Helpers::ActiveRecordInstanceTag)
+      unless defined?(ActionView::Helpers) && defined?(ActionView::Helpers::ActiveRecordInstanceTag)
         alias_method :content_tag_without_haml, :content_tag
         alias_method :content_tag, :content_tag_with_haml
       end

data/lib/haml/helpers/xss_mods.rb

@@ -97,28 +97,36 @@ end
 
 module ActionView
   module Helpers
+    module FormTagHelper
+      def form_tag_with_haml_xss(*args, &block)
+        Haml::Util.html_safe(form_tag_without_haml_xss(*args, &block))
+      end
+      alias_method :form_tag_without_haml_xss, :form_tag
+      alias_method :form_tag, :form_tag_with_haml_xss
+    end
+
     module TextHelper
-      def concat_with_haml(string)
+      def concat_with_haml_xss(string)
         if is_haml?
           haml_buffer.buffer.concat(haml_xss_html_escape(string))
         else
-          concat_without_haml(string)
+          concat_without_haml_xss(string)
         end
       end
-      alias_method :concat_without_haml, :concat
-      alias_method :concat, :concat_with_haml
+      alias_method :concat_without_haml_xss, :concat
+      alias_method :concat, :concat_with_haml_xss
 
       # safe_concat was introduced in Rails 3.0
       if Haml::Util.has?(:instance_method, self, :safe_concat)
-        def safe_concat_with_haml(string)
+        def safe_concat_with_haml_xss(string)
           if is_haml?
             haml_buffer.buffer.concat(string)
           else
-            safe_concat_without_haml(string)
+            safe_concat_without_haml_xss(string)
           end
         end
-        alias_method :safe_concat_without_haml, :safe_concat
-        alias_method :safe_concat, :safe_concat_with_haml
+        alias_method :safe_concat_without_haml_xss, :safe_concat
+        alias_method :safe_concat, :safe_concat_with_haml_xss
       end
     end
   end

data/lib/haml/template.rb

@@ -46,7 +46,8 @@ end
 # Decide how we want to load Haml into Rails.
 # Patching was necessary for versions <= 2.0.1,
 # but we can make it a normal handler for higher versions.
-if defined?(ActionView::TemplateHandler) || defined?(ActionView::Template::Handler)
+if defined?(ActionView::TemplateHandler) ||
+    (defined?(ActionView::Template) && defined?(ActionView::Template::Handler))
   require 'haml/template/plugin'
 else
   require 'haml/template/patch'

data/lib/haml/template/plugin.rb

@@ -3,8 +3,11 @@
 
 module Haml
   class Plugin < Haml::Util.av_template_class(:Handler)
-    if defined?(ActionView::TemplateHandlers::Compilable) ||
-        defined?(ActionView::Template::Handlers::Compilable)
+    if (defined?(ActionView::TemplateHandlers) &&
+        defined?(ActionView::TemplateHandlers::Compilable)) ||
+       (defined?(ActionView::Template) &&
+        defined?(ActionView::Template::Handlers) &&
+        defined?(ActionView::Template::Handlers::Compilable))
       include Haml::Util.av_template_class(:Handlers)::Compilable
     end
 

data/lib/sass/files.rb

@@ -104,7 +104,7 @@ END
         return unless f.readline("\n").strip == sha
         return Marshal.load(f.read)
       end
-    rescue TypeError, ArgumentError => e
+    rescue EOFError, TypeError, ArgumentError => e
       warn "Warning. Error encountered while reading cache #{compiled_filename}: #{e}"
     end
 

data/lib/sass/plugin/rack.rb

@@ -48,12 +48,12 @@ module Sass
       # This is automatically done once the Rack plugin is activated.
       # This is done so that the stylesheets aren't checked twice for each request.
       def self.disable_native_plugin!
-        if defined?(Merb::Rack::Application) &&
+        if defined?(Merb::Rack) && defined?(Merb::Rack::Application) &&
             Haml::Util.has?(:instance_method, Merb::Rack::Application, :call_without_sass)
           Merb::Rack::Application.instance_eval {alias_method :call, :call_without_sass}
         end
 
-        if defined?(ActionDispatch::Callbacks.to_prepare)
+        if defined?(ActionDispatch::Callbacks) && defined?(ActionDispatch::Callbacks.to_prepare)
           ActionDispatch::Callbacks.skip_callback(:prepare, :__sass_process)
         elsif defined?(ActionController::Base) &&
             Haml::Util.has?(:instance_method, ActionController::Base, :sass_old_process)

data/lib/sass/plugin/rails.rb

@@ -7,7 +7,8 @@ unless defined?(Sass::RAILS_LOADED)
                               :always_check      => Haml::Util.rails_env != "production",
                               :full_exception    => Haml::Util.rails_env != "production")
 
-  if defined?(ActionDispatch::Callbacks.to_prepare)
+  if defined?(ActionDispatch::Callbacks) &&
+      defined?(ActionDispatch::Callbacks.to_prepare)
     # Rails >= 3.0.0
     ActionDispatch::Callbacks.to_prepare(:sass_process) {Sass::Plugin.check_for_updates}
   else

data/test/haml/template_test.rb

@@ -306,5 +306,38 @@ END
         assert_equal("Foo & Bar", render('- safe_concat "Foo & Bar"', :action_view))
       end
     end
+
+    ## Regression
+
+    def test_xss_protection_with_nested_haml_tag
+      assert_equal(<<HTML, render(<<HAML, :action_view))
+<div>
+  <ul>
+    <li>Content!</li>
+  </ul>
+</div>
+HTML
+- haml_tag :div do
+  - haml_tag :ul do
+    - haml_tag :li, "Content!"
+HAML
+    end
+
+    def test_xss_protection_with_form_for
+      assert_equal(<<HTML, render(<<HAML, :action_view))
+<form action="" method="post">
+  Title:
+  <input id="article_title" name="article[title]" size="30" type="text" value="Hello" />
+  Body:
+  <input id="article_body" name="article[body]" size="30" type="text" value="World" />
+</form>
+HTML
+- form_for :article, @article, :url => '' do |f|
+  Title:
+  = f.text_field :title
+  Body:
+  = f.text_field :body
+HAML
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: haml
 version: !ruby/object:Gem::Version 
-  version: 2.2.19
+  version: 2.2.20
 platform: ruby
 authors: 
 - Nathan Weizenbaum
@@ -10,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-02-07 00:00:00 -08:00
+date: 2010-02-15 00:00:00 -08:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency