RubyGems - haml - Versions diffs - 5.1.1 → 5.2.2 - Mend

haml 5.1.1 → 5.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (28) hide show

checksums.yaml +4 -4
data/.github/workflows/test.yml +36 -0
data/.gitignore +1 -0
data/CHANGELOG.md +32 -1
data/Gemfile +1 -4
data/README.md +21 -16
data/REFERENCE.md +39 -10
data/Rakefile +2 -13
data/haml.gemspec +2 -1
data/lib/haml/attribute_builder.rb +58 -3
data/lib/haml/attribute_compiler.rb +45 -32
data/lib/haml/attribute_parser.rb +1 -1
data/lib/haml/buffer.rb +0 -56
data/lib/haml/compiler.rb +19 -21
data/lib/haml/error.rb +24 -24
data/lib/haml/escapable.rb +38 -11
data/lib/haml/exec.rb +1 -1
data/lib/haml/helpers.rb +8 -2
data/lib/haml/helpers/xss_mods.rb +6 -3
data/lib/haml/options.rb +27 -35
data/lib/haml/parser.rb +36 -8
data/lib/haml/plugin.rb +18 -1
data/lib/haml/railtie.rb +5 -0
data/lib/haml/temple_engine.rb +2 -1
data/lib/haml/util.rb +1 -1
data/lib/haml/version.rb +1 -1
metadata +22 -8
data/.travis.yml +0 -99

data/lib/haml/attribute_parser.rb CHANGED Viewed

@@ -16,7 +16,7 @@ module Haml
     TYPE = 1
     TEXT = 2
-    IGNORED_TYPES = %i[on_sp on_ignored_nl]
+    IGNORED_TYPES = %i[on_sp on_ignored_nl].freeze
     class << self
       # @return [Boolean] - return true if AttributeParser.parse can be used.

data/lib/haml/buffer.rb CHANGED Viewed

@@ -130,18 +130,6 @@ module Haml
       @real_tabs += tab_change
     end
-    def attributes(class_id, obj_ref, *attributes_hashes)
-      attributes = class_id
-      attributes_hashes.each do |old|
-        result = {}
-        old.each { |k, v| result[k.to_s] = v }
-        AttributeBuilder.merge_attributes!(attributes, result)
-      end
-      AttributeBuilder.merge_attributes!(attributes, parse_object_ref(obj_ref)) if obj_ref
-      AttributeBuilder.build_attributes(
-        html?, @options[:attr_wrapper], @options[:escape_attrs], @options[:hyphenate_data_attrs], attributes)
-    end
     # Remove the whitespace from the right side of the buffer string.
     # Doesn't do anything if we're at the beginning of a capture_haml block.
     def rstrip!
@@ -190,49 +178,5 @@ module Haml
       tabs = [count + @tabulation, 0].max
       @@tab_cache[tabs] ||= '  ' * tabs
     end
-    # Takes an array of objects and uses the class and id of the first
-    # one to create an attributes hash.
-    # The second object, if present, is used as a prefix,
-    # just like you can do with `dom_id()` and `dom_class()` in Rails
-    def parse_object_ref(ref)
-      prefix = ref[1]
-      ref = ref[0]
-      # Let's make sure the value isn't nil. If it is, return the default Hash.
-      return {} if ref.nil?
-      class_name =
-        if ref.respond_to?(:haml_object_ref)
-          ref.haml_object_ref
-        else
-          underscore(ref.class)
-        end
-      ref_id =
-        if ref.respond_to?(:to_key)
-          key = ref.to_key
-          key.join('_') unless key.nil?
-        else
-          ref.id
-        end
-      id = "#{class_name}_#{ref_id || 'new'}"
-      if prefix
-        class_name = "#{ prefix }_#{ class_name}"
-        id = "#{ prefix }_#{ id }"
-      end
-      { 'id'.freeze => id, 'class'.freeze => class_name }
-    end
-    # Changes a word from camel case to underscores.
-    # Based on the method of the same name in Rails' Inflector,
-    # but copied here so it'll run properly without Rails.
-    def underscore(camel_cased_word)
-      word = camel_cased_word.to_s.dup
-      word.gsub!(/::/, '_')
-      word.gsub!(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
-      word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
-      word.tr!('-', '_')
-      word.downcase!
-      word
-    end
   end
 end

data/lib/haml/compiler.rb CHANGED Viewed

@@ -188,30 +188,28 @@ module Haml
       if @options.html5?
         '<!DOCTYPE html>'
-      else
-        if @options.xhtml?
-          if @node.value[:version] == "1.1"
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">'
-          elsif @node.value[:version] == "5"
-            '<!DOCTYPE html>'
-          else
-            case @node.value[:type]
-            when "strict";   '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">'
-            when "frameset"; '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">'
-            when "mobile";   '<!DOCTYPE html PUBLIC "-//WAPFORUM//DTD XHTML Mobile 1.2//EN" "http://www.openmobilealliance.org/tech/DTD/xhtml-mobile12.dtd">'
-            when "rdfa";     '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">'
-            when "basic";    '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML Basic 1.1//EN" "http://www.w3.org/TR/xhtml-basic/xhtml-basic11.dtd">'
-            else             '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">'
-            end
-          end
-        elsif @options.html4?
+      elsif @options.xhtml?
+        if @node.value[:version] == "1.1"
+          '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">'
+        elsif @node.value[:version] == "5"
+          '<!DOCTYPE html>'
+        else
           case @node.value[:type]
-          when "strict";   '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">'
-          when "frameset"; '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">'
-          else             '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">'
+          when "strict";   '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">'
+          when "frameset"; '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">'
+          when "mobile";   '<!DOCTYPE html PUBLIC "-//WAPFORUM//DTD XHTML Mobile 1.2//EN" "http://www.openmobilealliance.org/tech/DTD/xhtml-mobile12.dtd">'
+          when "rdfa";     '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">'
+          when "basic";    '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML Basic 1.1//EN" "http://www.w3.org/TR/xhtml-basic/xhtml-basic11.dtd">'
+          else             '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">'
           end
         end
+      elsif @options.html4?
+        case @node.value[:type]
+        when "strict";   '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">'
+        when "frameset"; '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">'
+        else             '<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">'
+        end
       end
     end

data/lib/haml/error.rb CHANGED Viewed

@@ -5,29 +5,29 @@ module Haml
   class Error < StandardError
     MESSAGES = {
-      :bad_script_indent            => '"%s" is indented at wrong level: expected %d, but was at %d.',
-      :cant_run_filter              => 'Can\'t run "%s" filter; you must require its dependencies first',
-      :cant_use_tabs_and_spaces     => "Indentation can't use both tabs and spaces.",
-      :deeper_indenting             => "The line was indented %d levels deeper than the previous line.",
-      :filter_not_defined           => 'Filter "%s" is not defined.',
-      :gem_install_filter_deps      => '"%s" filter\'s %s dependency missing: try installing it or adding it to your Gemfile',
-      :illegal_element              => "Illegal element: classes and ids must have values.",
-      :illegal_nesting_content      => "Illegal nesting: nesting within a tag that already has content is illegal.",
-      :illegal_nesting_header       => "Illegal nesting: nesting within a header command is illegal.",
-      :illegal_nesting_line         => "Illegal nesting: content can't be both given on the same line as %%%s and nested within it.",
-      :illegal_nesting_plain        => "Illegal nesting: nesting within plain text is illegal.",
-      :illegal_nesting_self_closing => "Illegal nesting: nesting within a self-closing tag is illegal.",
-      :inconsistent_indentation     => "Inconsistent indentation: %s used for indentation, but the rest of the document was indented using %s.",
-      :indenting_at_start           => "Indenting at the beginning of the document is illegal.",
-      :install_haml_contrib         => 'To use the "%s" filter, please install the haml-contrib gem.',
-      :invalid_attribute_list       => 'Invalid attribute list: %s.',
-      :invalid_filter_name          => 'Invalid filter name ":%s".',
-      :invalid_tag                  => 'Invalid tag: "%s".',
-      :missing_if                   => 'Got "%s" with no preceding "if"',
-      :no_ruby_code                 => "There's no Ruby code for %s to evaluate.",
-      :self_closing_content         => "Self-closing tags can't have content.",
-      :unbalanced_brackets          => 'Unbalanced brackets.',
-      :no_end                       => <<-END
+      bad_script_indent:            '"%s" is indented at wrong level: expected %d, but was at %d.',
+      cant_run_filter:              'Can\'t run "%s" filter; you must require its dependencies first',
+      cant_use_tabs_and_spaces:     "Indentation can't use both tabs and spaces.",
+      deeper_indenting:             "The line was indented %d levels deeper than the previous line.",
+      filter_not_defined:           'Filter "%s" is not defined.',
+      gem_install_filter_deps:      '"%s" filter\'s %s dependency missing: try installing it or adding it to your Gemfile',
+      illegal_element:              "Illegal element: classes and ids must have values.",
+      illegal_nesting_content:      "Illegal nesting: nesting within a tag that already has content is illegal.",
+      illegal_nesting_header:       "Illegal nesting: nesting within a header command is illegal.",
+      illegal_nesting_line:         "Illegal nesting: content can't be both given on the same line as %%%s and nested within it.",
+      illegal_nesting_plain:        "Illegal nesting: nesting within plain text is illegal.",
+      illegal_nesting_self_closing: "Illegal nesting: nesting within a self-closing tag is illegal.",
+      inconsistent_indentation:     "Inconsistent indentation: %s used for indentation, but the rest of the document was indented using %s.",
+      indenting_at_start:           "Indenting at the beginning of the document is illegal.",
+      install_haml_contrib:         'To use the "%s" filter, please install the haml-contrib gem.',
+      invalid_attribute_list:       'Invalid attribute list: %s.',
+      invalid_filter_name:          'Invalid filter name ":%s".',
+      invalid_tag:                  'Invalid tag: "%s".',
+      missing_if:                   'Got "%s" with no preceding "if"',
+      no_ruby_code:                 "There's no Ruby code for %s to evaluate.",
+      self_closing_content:         "Self-closing tags can't have content.",
+      unbalanced_brackets:          'Unbalanced brackets.',
+      no_end:                       <<-END
 You don't need to use "- end" in Haml. Un-indent to close a block:
 - if foo?
   %strong Foo!
@@ -35,7 +35,7 @@ You don't need to use "- end" in Haml. Un-indent to close a block:
   Not foo.
 %p This line is un-indented, so it isn't part of the "if" block
 END
-    }
+    }.freeze
     def self.message(key, *args)
       string = MESSAGES[key] or raise "[HAML BUG] No error messages for #{key}"

data/lib/haml/escapable.rb CHANGED Viewed

@@ -4,30 +4,31 @@ module Haml
   # Like Temple::Filters::Escapable, but with support for escaping by
   # Haml::Herlpers.html_escape and Haml::Herlpers.escape_once.
   class Escapable < Temple::Filter
+    # Special value of `flag` to ignore html_safe?
+    EscapeSafeBuffer = Struct.new(:value)
     def initialize(*)
       super
-      @escape_code = "::Haml::Helpers.html_escape((%s))"
-      @escaper = eval("proc {|v| #{@escape_code % 'v'} }")
-      @once_escape_code = "::Haml::Helpers.escape_once((%s))"
-      @once_escaper = eval("proc {|v| #{@once_escape_code % 'v'} }")
       @escape = false
+      @escape_safe_buffer = false
     end
     def on_escape(flag, exp)
-      old = @escape
-      @escape = flag
+      old_escape, old_escape_safe_buffer = @escape, @escape_safe_buffer
+      @escape_safe_buffer = flag.is_a?(EscapeSafeBuffer)
+      @escape = @escape_safe_buffer ? flag.value : flag
       compile(exp)
     ensure
-      @escape = old
+      @escape, @escape_safe_buffer = old_escape, old_escape_safe_buffer
     end
     # The same as Haml::AttributeBuilder.build_attributes
     def on_static(value)
       [:static,
        if @escape == :once
-         @once_escaper[value]
+         escape_once(value)
        elsif @escape
-         @escaper[value]
+         escape(value)
        else
          value
        end
@@ -38,13 +39,39 @@ module Haml
     def on_dynamic(value)
       [:dynamic,
        if @escape == :once
-         @once_escape_code % value
+         escape_once_code(value)
        elsif @escape
-         @escape_code % value
+         escape_code(value)
        else
          "(#{value}).to_s"
        end
       ]
     end
+    private
+    def escape_once(value)
+      if @escape_safe_buffer
+        ::Haml::Helpers.escape_once_without_haml_xss(value)
+      else
+        ::Haml::Helpers.escape_once(value)
+      end
+    end
+    def escape(value)
+      if @escape_safe_buffer
+        ::Haml::Helpers.html_escape_without_haml_xss(value)
+      else
+        ::Haml::Helpers.html_escape(value)
+      end
+    end
+    def escape_once_code(value)
+      "::Haml::Helpers.escape_once#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
+    end
+    def escape_code(value)
+      "::Haml::Helpers.html_escape#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
+    end
   end
 end

data/lib/haml/exec.rb CHANGED Viewed

@@ -121,7 +121,7 @@ module Haml
         @options[:input], @options[:output] = input, output
       end
-      COLORS = { :red => 31, :green => 32, :yellow => 33 }
+      COLORS = {red: 31, green: 32, yellow: 33}.freeze
       # Prints a status message about performing the given action,
       # colored using the given color (via terminal escapes) if possible.

data/lib/haml/helpers.rb CHANGED Viewed

@@ -593,7 +593,7 @@ MESSAGE
     end
     # Characters that need to be escaped to HTML entities from user input
-    HTML_ESCAPE = { '&' => '&amp;', '<' => '&lt;', '>' => '&gt;', '"' => '&quot;', "'" => '&#39;' }
+    HTML_ESCAPE = {'&' => '&amp;', '<' => '&lt;', '>' => '&gt;', '"' => '&quot;', "'" => '&#39;'}.freeze
     HTML_ESCAPE_REGEX = /['"><&]/
@@ -607,9 +607,12 @@ MESSAGE
     # @param text [String] The string to sanitize
     # @return [String] The sanitized string
     def html_escape(text)
-      ERB::Util.html_escape(text)
+      CGI.escapeHTML(text.to_s)
     end
+    # Always escape text regardless of html_safe?
+    alias_method :html_escape_without_haml_xss, :html_escape
     HTML_ESCAPE_ONCE_REGEX = /['"><]|&(?!(?:[a-zA-Z]+|#(?:\d+|[xX][0-9a-fA-F]+));)/
     # Escapes HTML entities in `text`, but without escaping an ampersand
@@ -622,6 +625,9 @@ MESSAGE
       text.gsub(HTML_ESCAPE_ONCE_REGEX, HTML_ESCAPE)
     end
+    # Always escape text once regardless of html_safe?
+    alias_method :escape_once_without_haml_xss, :escape_once
     # Returns whether or not the current template is a Haml template.
     #
     # This function, unlike other {Haml::Helpers} functions,

data/lib/haml/helpers/xss_mods.rb CHANGED Viewed

@@ -8,12 +8,15 @@ module Haml
     # to work with Rails' XSS protection methods.
     module XssMods
       def self.included(base)
-        %w[html_escape find_and_preserve preserve list_of surround
-           precede succeed capture_haml haml_concat haml_internal_concat haml_indent
-           escape_once].each do |name|
+        %w[find_and_preserve preserve list_of surround
+           precede succeed capture_haml haml_concat haml_internal_concat haml_indent].each do |name|
           base.send(:alias_method, "#{name}_without_haml_xss", name)
           base.send(:alias_method, name, "#{name}_with_haml_xss")
         end
+        # Those two always have _without_haml_xss
+        %w[html_escape escape_once].each do |name|
+          base.send(:alias_method, name, "#{name}_with_haml_xss")
+        end
       end
       # Don't escape text that's already safe,

data/lib/haml/options.rb CHANGED Viewed

@@ -5,44 +5,40 @@ module Haml
   # understands. Please see the {file:REFERENCE.md#options Haml Reference} to
   # learn how to set the options.
   class Options
     @valid_formats = [:html4, :html5, :xhtml]
     @buffer_option_keys = [:autoclose, :preserve, :attr_wrapper, :format,
       :encoding, :escape_html, :escape_filter_interpolations, :escape_attrs, :hyphenate_data_attrs, :cdata]
-    # The default option values.
-    # @return Hash
-    def self.defaults
-      @defaults ||= Haml::TempleEngine.options.to_hash.merge(encoding: 'UTF-8')
-    end
+    class << self
+      # The default option values.
+      # @return Hash
+      def defaults
+        @defaults ||= Haml::TempleEngine.options.to_hash.merge(encoding: 'UTF-8')
+      end
-    # An array of valid values for the `:format` option.
-    # @return Array
-    def self.valid_formats
-      @valid_formats
-    end
+      # An array of valid values for the `:format` option.
+      # @return Array
+      attr_reader :valid_formats
-    # An array of keys that will be used to provide a hash of options to
-    # {Haml::Buffer}.
-    # @return Hash
-    def self.buffer_option_keys
-      @buffer_option_keys
-    end
+      # An array of keys that will be used to provide a hash of options to
+      # {Haml::Buffer}.
+      # @return Hash
+      attr_reader :buffer_option_keys
-    # Returns a subset of defaults: those that {Haml::Buffer} cares about.
-    # @return [{Symbol => Object}] The options hash
-    def self.buffer_defaults
-      @buffer_defaults ||= buffer_option_keys.inject({}) do |hash, key|
-        hash.merge(key => defaults[key])
+      # Returns a subset of defaults: those that {Haml::Buffer} cares about.
+      # @return [{Symbol => Object}] The options hash
+      def buffer_defaults
+        @buffer_defaults ||= buffer_option_keys.inject({}) do |hash, key|
+          hash.merge(key => defaults[key])
+        end
       end
-    end
-    def self.wrap(options)
-      if options.is_a?(Options)
-        options
-      else
-        Options.new(options)
+      def wrap(options)
+        if options.is_a?(Options)
+          options
+        else
+          Options.new(options)
+        end
       end
     end
@@ -139,7 +135,7 @@ module Haml
     # formatting errors.
     #
     # Defaults to `false`.
-    attr_reader :remove_whitespace
+    attr_accessor :remove_whitespace
     # Whether or not attribute hashes and Ruby scripts designated by `=` or `~`
     # should be evaluated. If this is `true`, said scripts are rendered as empty
@@ -175,7 +171,7 @@ module Haml
     # Key is filter name in String and value is Class to use. Defaults to {}.
     attr_accessor :filters
-    def initialize(values = {}, &block)
+    def initialize(values = {})
       defaults.each {|k, v| instance_variable_set :"@#{k}", v}
       values.each {|k, v| send("#{k}=", v) if defaults.has_key?(k) && !v.nil?}
       yield if block_given?
@@ -245,10 +241,6 @@ module Haml
       xhtml? || @cdata
     end
-    def remove_whitespace=(value)
-      @remove_whitespace = value
-    end
     def encoding=(value)
       return unless value
       @encoding = value.is_a?(Encoding) ? value.name : value.to_s

data/lib/haml/parser.rb CHANGED Viewed

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
+require 'ripper'
 require 'strscan'
 module Haml
@@ -61,7 +62,7 @@ module Haml
       SILENT_SCRIPT,
       ESCAPE,
       FILTER
-    ]
+    ].freeze
     # The value of the character that designates that a line is part
     # of a multiline string.
@@ -75,8 +76,8 @@ module Haml
     #
     BLOCK_WITH_SPACES = /do\s*\|\s*[^\|]*\s+\|\z/
-    MID_BLOCK_KEYWORDS = %w[else elsif rescue ensure end when]
-    START_BLOCK_KEYWORDS = %w[if begin case unless]
+    MID_BLOCK_KEYWORDS = %w[else elsif rescue ensure end when].freeze
+    START_BLOCK_KEYWORDS = %w[if begin case unless].freeze
     # Try to parse assignments to block starters as best as possible
     START_BLOCK_KEYWORD_REGEX = /(?:\w+(?:,\s*\w+)*\s*=\s*)?(#{START_BLOCK_KEYWORDS.join('|')})/
     BLOCK_KEYWORD_REGEX = /^-?\s*(?:(#{MID_BLOCK_KEYWORDS.join('|')})|#{START_BLOCK_KEYWORD_REGEX.source})\b/
@@ -90,6 +91,9 @@ module Haml
     ID_KEY    = 'id'.freeze
     CLASS_KEY = 'class'.freeze
+    # Used for scanning old attributes, substituting the first '{'
+    METHOD_CALL_PREFIX = 'a('
     def initialize(options)
       @options = Options.wrap(options)
       # Record the indent levels of "if" statements to validate the subsequent
@@ -202,7 +206,7 @@ module Haml
       end
       def inspect
-        %Q[(#{type} #{value.inspect}#{children.each_with_object('') {|c, s| s << "\n#{c.inspect.gsub!(/^/, '  ')}"}})]
+        %Q[(#{type} #{value.inspect}#{children.each_with_object(''.dup) {|c, s| s << "\n#{c.inspect.gsub!(/^/, '  ')}"}})].dup
       end
     end
@@ -307,7 +311,7 @@ module Haml
         return ParseNode.new(:plain, line.index + 1, :text => line.text)
       end
-      escape_html = @options.escape_html if escape_html.nil?
+      escape_html = @options.escape_html && @options.mime_type != 'text/plain' if escape_html.nil?
       line.text = unescape_interpolation(line.text, escape_html)
       script(line, false)
     end
@@ -651,13 +655,18 @@ module Haml
     # @return [String] rest
     # @return [Integer] last_line
     def parse_old_attributes(text)
-      text = text.dup
       last_line = @line.index + 1
       begin
-        attributes_hash, rest = balance(text, ?{, ?})
+        # Old attributes often look like a valid Hash literal, but it sometimes allow code like
+        # `{ hash, foo: bar }`, which is compiled to `_hamlout.attributes({}, nil, hash, foo: bar)`.
+        #
+        # To scan such code correctly, this scans `a( hash, foo: bar }` instead, stops when there is
+        # 1 more :on_embexpr_end (the last '}') than :on_embexpr_beg, and resurrects '{' afterwards.
+        balanced, rest = balance_tokens(text.sub(?{, METHOD_CALL_PREFIX), :on_embexpr_beg, :on_embexpr_end, count: 1)
+        attributes_hash = balanced.sub(METHOD_CALL_PREFIX, ?{)
       rescue SyntaxError => e
-        if text.strip[-1] == ?, && e.message == Error.message(:unbalanced_brackets)
+        if e.message == Error.message(:unbalanced_brackets) && !@template.empty?
           text << "\n#{@next_line.text}"
           last_line += 1
           next_line
@@ -811,6 +820,25 @@ module Haml
       Haml::Util.balance(*args) or raise(SyntaxError.new(Error.message(:unbalanced_brackets)))
     end
+    # Unlike #balance, this balances Ripper tokens to balance something like `{ a: "}" }` correctly.
+    def balance_tokens(buf, start, finish, count: 0)
+      text = ''.dup
+      Ripper.lex(buf).each do |_, token, str|
+        text << str
+        case token
+        when start
+          count += 1
+        when finish
+          count -= 1
+        end
+        if count == 0
+          return text, buf.sub(text, '')
+        end
+      end
+      raise SyntaxError.new(Error.message(:unbalanced_brackets))
+    end
     def block_opened?
       @next_line.tabs > @line.tabs
     end