haml 5.1.2 → 5.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +1 -0
- data/.travis.yml +29 -54
- data/CHANGELOG.md +9 -0
- data/Gemfile +1 -4
- data/README.md +2 -3
- data/REFERENCE.md +20 -2
- data/Rakefile +1 -8
- data/haml.gemspec +2 -1
- data/lib/haml/attribute_builder.rb +3 -3
- data/lib/haml/attribute_compiler.rb +42 -31
- data/lib/haml/escapable.rb +38 -11
- data/lib/haml/helpers.rb +7 -1
- data/lib/haml/helpers/xss_mods.rb +6 -3
- data/lib/haml/parser.rb +1 -1
- data/lib/haml/version.rb +1 -1
- metadata +21 -7
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: ccbf9b5c93745c83284467b77b73dd156f049dacf55861dd486bd14404d84e84
|
4
|
+
data.tar.gz: 4e2439c5e370db4bd765ca76ab4d76c027d9a9f9f6b68e5d38761e6858f3312f
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: f0c7b716e9866070fc50281e4486eb519832c3f098cbd58bb62ca18f2659ca85bc44cd6a275121fe71f37f8d9e442ac9b75f254b28747b5fbff47a98b1e633c5
|
7
|
+
data.tar.gz: 3e870080f42d925cddc479a52318d2cb8e6a9dbfd5613e8027c0c4dfd80e4f7636fa9f50cd41d3eca6f72f12bcc1cc7e5a5b2b9120223e1e6218ad8d6dcf9ca8
|
data/.gitignore
CHANGED
data/.travis.yml
CHANGED
@@ -1,18 +1,14 @@
|
|
1
1
|
sudo: false
|
2
2
|
dist: trusty
|
3
3
|
language: ruby
|
4
|
-
cache:
|
4
|
+
cache:
|
5
|
+
bundler: true
|
5
6
|
rvm:
|
6
7
|
- ruby-head
|
7
|
-
- 2.
|
8
|
-
- 2.
|
9
|
-
- 2.
|
10
|
-
- 2
|
11
|
-
- 2.2.10
|
12
|
-
- 2.1.10
|
13
|
-
- 2.0.0
|
14
|
-
- jruby-9.2.7.0
|
15
|
-
- rbx-3
|
8
|
+
- 2.7
|
9
|
+
- 2.6
|
10
|
+
- 2.5
|
11
|
+
- jruby-9.2
|
16
12
|
gemfile:
|
17
13
|
- test/gemfiles/Gemfile.rails-6.0.x
|
18
14
|
- test/gemfiles/Gemfile.rails-5.2.x
|
@@ -24,49 +20,23 @@ gemfile:
|
|
24
20
|
- test/gemfiles/Gemfile.rails-4.0.x
|
25
21
|
matrix:
|
26
22
|
exclude:
|
27
|
-
- rvm: 2.
|
28
|
-
gemfile: test/gemfiles/Gemfile.rails-6.0.x
|
29
|
-
- rvm: 2.1.10
|
30
|
-
gemfile: test/gemfiles/Gemfile.rails-6.0.x
|
31
|
-
- rvm: 2.2.10
|
32
|
-
gemfile: test/gemfiles/Gemfile.rails-6.0.x
|
33
|
-
- rvm: 2.3.8
|
34
|
-
gemfile: test/gemfiles/Gemfile.rails-6.0.x
|
35
|
-
- rvm: 2.4.6
|
36
|
-
gemfile: test/gemfiles/Gemfile.rails-6.0.x
|
37
|
-
- rvm: 2.0.0
|
38
|
-
gemfile: test/gemfiles/Gemfile.rails-5.2.x
|
39
|
-
- rvm: 2.1.10
|
40
|
-
gemfile: test/gemfiles/Gemfile.rails-5.2.x
|
41
|
-
- rvm: 2.0.0
|
42
|
-
gemfile: test/gemfiles/Gemfile.rails-5.1.x
|
43
|
-
- rvm: 2.1.10
|
44
|
-
gemfile: test/gemfiles/Gemfile.rails-5.1.x
|
45
|
-
- rvm: 2.0.0
|
46
|
-
gemfile: test/gemfiles/Gemfile.rails-5.0.x
|
47
|
-
- rvm: 2.0.0
|
48
|
-
gemfile: test/gemfiles/Gemfile.rails-5.0.x.erubi
|
49
|
-
- rvm: 2.1.10
|
50
|
-
gemfile: test/gemfiles/Gemfile.rails-5.0.x
|
51
|
-
- rvm: 2.1.10
|
52
|
-
gemfile: test/gemfiles/Gemfile.rails-5.0.x.erubi
|
53
|
-
- rvm: 2.4.6
|
23
|
+
- rvm: 2.5
|
54
24
|
gemfile: test/gemfiles/Gemfile.rails-4.0.x
|
55
|
-
- rvm: 2.
|
25
|
+
- rvm: 2.5
|
56
26
|
gemfile: test/gemfiles/Gemfile.rails-4.1.x
|
57
|
-
- rvm: 2.
|
27
|
+
- rvm: 2.5
|
58
28
|
gemfile: test/gemfiles/Gemfile.rails-4.2.x
|
59
|
-
- rvm: 2.
|
29
|
+
- rvm: 2.6
|
60
30
|
gemfile: test/gemfiles/Gemfile.rails-4.0.x
|
61
|
-
- rvm: 2.
|
31
|
+
- rvm: 2.6
|
62
32
|
gemfile: test/gemfiles/Gemfile.rails-4.1.x
|
63
|
-
- rvm: 2.
|
33
|
+
- rvm: 2.6
|
64
34
|
gemfile: test/gemfiles/Gemfile.rails-4.2.x
|
65
|
-
- rvm: 2.
|
35
|
+
- rvm: 2.7
|
66
36
|
gemfile: test/gemfiles/Gemfile.rails-4.0.x
|
67
|
-
- rvm: 2.
|
37
|
+
- rvm: 2.7
|
68
38
|
gemfile: test/gemfiles/Gemfile.rails-4.1.x
|
69
|
-
- rvm: 2.
|
39
|
+
- rvm: 2.7
|
70
40
|
gemfile: test/gemfiles/Gemfile.rails-4.2.x
|
71
41
|
- rvm: ruby-head
|
72
42
|
gemfile: test/gemfiles/Gemfile.rails-4.0.x
|
@@ -75,23 +45,28 @@ matrix:
|
|
75
45
|
- rvm: ruby-head
|
76
46
|
gemfile: test/gemfiles/Gemfile.rails-4.2.x
|
77
47
|
include:
|
78
|
-
- rvm: 2.
|
48
|
+
- rvm: 2.7
|
79
49
|
gemfile: test/gemfiles/Gemfile.rails-edge
|
80
50
|
allow_failures:
|
81
51
|
- rvm: ruby-head
|
82
|
-
- rvm: rbx-3
|
83
52
|
- gemfile: test/gemfiles/Gemfile.rails-edge
|
84
|
-
- rvm: jruby-9.2
|
53
|
+
- rvm: jruby-9.2
|
85
54
|
gemfile: test/gemfiles/Gemfile.rails-4.2.x
|
86
|
-
- rvm: jruby-9.2
|
55
|
+
- rvm: jruby-9.2
|
87
56
|
gemfile: test/gemfiles/Gemfile.rails-4.1.x
|
88
|
-
- rvm: jruby-9.2
|
57
|
+
- rvm: jruby-9.2
|
89
58
|
gemfile: test/gemfiles/Gemfile.rails-4.0.x
|
90
|
-
- rvm: jruby-9.2
|
59
|
+
- rvm: jruby-9.2
|
91
60
|
gemfile: test/gemfiles/Gemfile.rails-5.0.x.erubi
|
92
61
|
fast_finish: true
|
93
62
|
before_install:
|
94
|
-
|
95
|
-
- gem
|
96
|
-
- gem
|
63
|
+
# install older versions of rubygems and bundler only on Ruby < 2.7
|
64
|
+
- if [ `echo "${TRAVIS_RUBY_VERSION:0:3} < 2.7" | bc` == 1 ]; then gem i rubygems-update -v '<3' && update_rubygems; fi; # https://github.com/travis-ci/travis-ci/issues/8974
|
65
|
+
- if [ `echo "${TRAVIS_RUBY_VERSION:0:3} < 2.7" | bc` == 1 ]; then gem uninstall -v '>= 2' -i $(rvm gemdir)@global -ax bundler || true; fi;
|
66
|
+
- if [ `echo "${TRAVIS_RUBY_VERSION:0:3} < 2.7" | bc` == 1 ]; then gem i bundler -v '<2'; fi;
|
67
|
+
- curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ./cc-test-reporter
|
68
|
+
- chmod +x ./cc-test-reporter
|
69
|
+
- ./cc-test-reporter before-build
|
97
70
|
script: "bundle exec rake submodules test"
|
71
|
+
after_script:
|
72
|
+
- ./cc-test-reporter after-build --exit-code $TRAVIS_TEST_RESULT
|
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,14 @@
|
|
1
1
|
# Haml Changelog
|
2
2
|
|
3
|
+
## 5.2
|
4
|
+
|
5
|
+
Released on September 28, 2020
|
6
|
+
([diff](https://github.com/haml/haml/compare/v5.1.2...v5.2)).
|
7
|
+
|
8
|
+
* Fix crash in the attribute optimizer when `#inspect` is overridden in TrueClass / FalseClass [#972](https://github.com/haml/haml/issues/972)
|
9
|
+
* Do not HTML-escape templates that are declared to be plaintext [#1014](https://github.com/haml/haml/issues/1014) (Thanks [@cesarizu](https://github.com/cesarizu))
|
10
|
+
* Class names are no longer ordered alphabetically, and now follow a new specification as laid out in REFERENCE [#306](https://github.com/haml/haml/issues/306)
|
11
|
+
|
3
12
|
## 5.1.2
|
4
13
|
|
5
14
|
Released on August 6, 2019
|
data/Gemfile
CHANGED
data/README.md
CHANGED
@@ -1,9 +1,8 @@
|
|
1
1
|
# Haml
|
2
2
|
|
3
3
|
[](http://rubygems.org/gems/haml)
|
4
|
-
[](http://travis-ci.org/haml/haml)
|
5
5
|
[](https://codeclimate.com/github/haml/haml)
|
6
|
-
[](https://coveralls.io/r/haml/haml)
|
7
6
|
[](http://inch-ci.org/github/haml/haml)
|
8
7
|
|
9
8
|
Haml is a templating engine for HTML. It's designed to make it both easier and
|
@@ -32,7 +31,7 @@ to compile it to HTML. For more information on these commands, check out
|
|
32
31
|
haml --help
|
33
32
|
~~~
|
34
33
|
|
35
|
-
To use Haml
|
34
|
+
To use Haml programmatically, check out the [YARD documentation](http://haml.info/docs/yardoc/).
|
36
35
|
|
37
36
|
## Using Haml with Rails
|
38
37
|
|
data/REFERENCE.md
CHANGED
@@ -517,6 +517,24 @@ and is compiled to:
|
|
517
517
|
</div>
|
518
518
|
</div>
|
519
519
|
|
520
|
+
#### Class Name Merging and Ordering
|
521
|
+
|
522
|
+
Class names are ordered in the following way:
|
523
|
+
|
524
|
+
1) Tag identifiers in order (aka, ".alert.me" => "alert me")
|
525
|
+
2) Classes appearing in HTML-style attributes
|
526
|
+
3) Classes appearing in Hash-style attributes
|
527
|
+
|
528
|
+
For instance, this is a complicated and unintuitive test case illustrating the ordering
|
529
|
+
|
530
|
+
.foo.moo{:class => ['bar', 'alpha']}(class='baz')
|
531
|
+
|
532
|
+
The resulting HTML would be as follows:
|
533
|
+
|
534
|
+
<div class='foo moo baz bar alpha'></div>
|
535
|
+
|
536
|
+
*Versions of Haml prior to 5.0 would alphabetically sort class names.*
|
537
|
+
|
520
538
|
### Empty (void) Tags: `/`
|
521
539
|
|
522
540
|
The forward slash character, when placed at the end of a tag definition, causes
|
@@ -853,7 +871,7 @@ is compiled to:
|
|
853
871
|
|
854
872
|
## Ruby Evaluation
|
855
873
|
|
856
|
-
### Inserting Ruby: `=`
|
874
|
+
### Inserting Ruby: `=` {#inserting_ruby}
|
857
875
|
|
858
876
|
The equals character is followed by Ruby code. This code is evaluated and the
|
859
877
|
output is inserted into the document. For example:
|
@@ -1323,7 +1341,7 @@ that just need a lot of template information.
|
|
1323
1341
|
So data structures and functions that require lots of arguments
|
1324
1342
|
can be wrapped over multiple lines,
|
1325
1343
|
as long as each line but the last ends in a comma
|
1326
|
-
(see [Inserting Ruby](#
|
1344
|
+
(see [Inserting Ruby](#inserting_ruby)).
|
1327
1345
|
|
1328
1346
|
## Whitespace Preservation
|
1329
1347
|
|
data/Rakefile
CHANGED
@@ -14,7 +14,7 @@ isolated_test = Rake::TestTask.new do |t|
|
|
14
14
|
end
|
15
15
|
Rake::TestTask.new do |t|
|
16
16
|
t.libs << 'test'
|
17
|
-
t.test_files = Dir['test/*_test.rb'] + Dir['test/haml-spec/*_test.rb'] - isolated_test.file_list
|
17
|
+
t.test_files = Dir['test/*_test.rb'] + Dir['test/haml-spec/*_test.rb'] + Dir['test/cases/*_test.rb'] - isolated_test.file_list
|
18
18
|
t.warning = true
|
19
19
|
t.verbose = true
|
20
20
|
end
|
@@ -26,13 +26,6 @@ task :benchmark do
|
|
26
26
|
sh "ruby benchmark.rb #{ENV['TIMES']}"
|
27
27
|
end
|
28
28
|
|
29
|
-
task :set_coverage_env do
|
30
|
-
ENV["COVERAGE"] = "true"
|
31
|
-
end
|
32
|
-
|
33
|
-
desc "Run Simplecov"
|
34
|
-
task :coverage => [:set_coverage_env, :test]
|
35
|
-
|
36
29
|
task :submodules do
|
37
30
|
if File.exist?(File.dirname(__FILE__) + "/.git")
|
38
31
|
sh %{git submodule sync}
|
data/haml.gemspec
CHANGED
@@ -16,7 +16,7 @@ Gem::Specification.new do |spec|
|
|
16
16
|
spec.license = "MIT"
|
17
17
|
spec.metadata = {
|
18
18
|
"bug_tracker_uri" => "https://github.com/haml/haml/issues",
|
19
|
-
"changelog_uri" => "https://github.com/haml/haml/blob/
|
19
|
+
"changelog_uri" => "https://github.com/haml/haml/blob/main/CHANGELOG.md",
|
20
20
|
"documentation_uri" => "http://haml.info/docs.html",
|
21
21
|
"homepage_uri" => "http://haml.info",
|
22
22
|
"mailing_list_uri" => "https://groups.google.com/forum/?fromgroups#!forum/haml",
|
@@ -32,6 +32,7 @@ Gem::Specification.new do |spec|
|
|
32
32
|
spec.add_development_dependency 'rbench'
|
33
33
|
spec.add_development_dependency 'minitest', '>= 4.0'
|
34
34
|
spec.add_development_dependency 'nokogiri'
|
35
|
+
spec.add_development_dependency 'simplecov', '0.17.1' # Locked to this version due to https://github.com/codeclimate/test-reporter/issues/418
|
35
36
|
|
36
37
|
spec.description = <<-END
|
37
38
|
Haml (HTML Abstraction Markup Language) is a layer on top of HTML or XML that's
|
@@ -36,9 +36,9 @@ module Haml
|
|
36
36
|
|
37
37
|
value =
|
38
38
|
if escape_attrs == :once
|
39
|
-
Haml::Helpers.
|
39
|
+
Haml::Helpers.escape_once_without_haml_xss(value.to_s)
|
40
40
|
elsif escape_attrs
|
41
|
-
Haml::Helpers.
|
41
|
+
Haml::Helpers.html_escape_without_haml_xss(value.to_s)
|
42
42
|
else
|
43
43
|
value.to_s
|
44
44
|
end
|
@@ -126,7 +126,7 @@ module Haml
|
|
126
126
|
elsif key == 'class'
|
127
127
|
merged_class = filter_and_join(from, ' ')
|
128
128
|
if to && merged_class
|
129
|
-
merged_class = (
|
129
|
+
merged_class = (to.split(' ') | merged_class.split(' ')).join(' ')
|
130
130
|
elsif to || merged_class
|
131
131
|
merged_class ||= to
|
132
132
|
end
|
@@ -7,27 +7,7 @@ module Haml
|
|
7
7
|
# @param type [Symbol] :static or :dynamic
|
8
8
|
# @param key [String]
|
9
9
|
# @param value [String] Actual string value for :static type, value's Ruby literal for :dynamic type.
|
10
|
-
AttributeValue = Struct.new(:type, :key, :value)
|
11
|
-
# @return [String] A Ruby literal of value.
|
12
|
-
def to_literal
|
13
|
-
case type
|
14
|
-
when :static
|
15
|
-
Haml::Util.inspect_obj(value)
|
16
|
-
when :dynamic
|
17
|
-
value
|
18
|
-
end
|
19
|
-
end
|
20
|
-
end
|
21
|
-
|
22
|
-
# Returns a script to render attributes on runtime.
|
23
|
-
#
|
24
|
-
# @param attributes [Hash]
|
25
|
-
# @param object_ref [String,:nil]
|
26
|
-
# @param dynamic_attributes [DynamicAttributes]
|
27
|
-
# @return [String] Attributes rendering code
|
28
|
-
def self.runtime_build(attributes, object_ref, dynamic_attributes)
|
29
|
-
"_hamlout.attributes(#{Haml::Util.inspect_obj(attributes)}, #{object_ref},#{dynamic_attributes.to_literal})"
|
30
|
-
end
|
10
|
+
AttributeValue = Struct.new(:type, :key, :value)
|
31
11
|
|
32
12
|
# @param options [Haml::Options]
|
33
13
|
def initialize(options)
|
@@ -41,16 +21,16 @@ module Haml
|
|
41
21
|
#
|
42
22
|
# @param attributes [Hash]
|
43
23
|
# @param object_ref [String,:nil]
|
44
|
-
# @param dynamic_attributes [DynamicAttributes]
|
24
|
+
# @param dynamic_attributes [Haml::Parser::DynamicAttributes]
|
45
25
|
# @return [Array] Temple expression
|
46
26
|
def compile(attributes, object_ref, dynamic_attributes)
|
47
27
|
if object_ref != :nil || !AttributeParser.available?
|
48
|
-
return [:dynamic,
|
28
|
+
return [:dynamic, compile_runtime_build(attributes, object_ref, dynamic_attributes)]
|
49
29
|
end
|
50
30
|
|
51
31
|
parsed_hashes = [dynamic_attributes.new, dynamic_attributes.old].compact.map do |attribute_hash|
|
52
32
|
unless (hash = AttributeParser.parse(attribute_hash))
|
53
|
-
return [:dynamic,
|
33
|
+
return [:dynamic, compile_runtime_build(attributes, object_ref, dynamic_attributes)]
|
54
34
|
end
|
55
35
|
hash
|
56
36
|
end
|
@@ -64,6 +44,16 @@ module Haml
|
|
64
44
|
|
65
45
|
private
|
66
46
|
|
47
|
+
# Returns a script to render attributes on runtime.
|
48
|
+
#
|
49
|
+
# @param attributes [Hash]
|
50
|
+
# @param object_ref [String,:nil]
|
51
|
+
# @param dynamic_attributes [Haml::Parser::DynamicAttributes]
|
52
|
+
# @return [String] Attributes rendering code
|
53
|
+
def compile_runtime_build(attributes, object_ref, dynamic_attributes)
|
54
|
+
"_hamlout.attributes(#{to_literal(attributes)}, #{object_ref}, #{dynamic_attributes.to_literal})"
|
55
|
+
end
|
56
|
+
|
67
57
|
# Build array of grouped values whose sort order may go back and forth, which is also sorted with key name.
|
68
58
|
# This method needs to group values with the same start because it can be changed in `Haml::AttributeBuidler#build_data_keys`.
|
69
59
|
# @param values [Array<Haml::AttributeCompiler::AttributeValue>]
|
@@ -130,7 +120,7 @@ module Haml
|
|
130
120
|
|
131
121
|
arguments = [@is_html, @attr_wrapper, @escape_attrs, @hyphenate_data_attrs]
|
132
122
|
code = "::Haml::AttributeBuilder.build_attributes"\
|
133
|
-
"(#{arguments.map
|
123
|
+
"(#{arguments.map(&method(:to_literal)).join(', ')}, { #{hash_content} })"
|
134
124
|
[:static, eval(code).to_s]
|
135
125
|
end
|
136
126
|
|
@@ -139,16 +129,16 @@ module Haml
|
|
139
129
|
# @return [String]
|
140
130
|
def merged_value(key, values)
|
141
131
|
if values.size == 1
|
142
|
-
values.first
|
132
|
+
attr_literal(values.first)
|
143
133
|
else
|
144
|
-
"::Haml::AttributeBuilder.merge_values(#{frozen_string(key)}, #{values.map(
|
134
|
+
"::Haml::AttributeBuilder.merge_values(#{frozen_string(key)}, #{values.map(&method(:attr_literal)).join(', ')})"
|
145
135
|
end
|
146
136
|
end
|
147
137
|
|
148
138
|
# @param str [String]
|
149
139
|
# @return [String]
|
150
140
|
def frozen_string(str)
|
151
|
-
"#{
|
141
|
+
"#{to_literal(str)}.freeze"
|
152
142
|
end
|
153
143
|
|
154
144
|
# Compiles attribute values for one key to Temple expression that generates ` key='value'`.
|
@@ -157,7 +147,7 @@ module Haml
|
|
157
147
|
# @param values [Array<AttributeValue>]
|
158
148
|
# @return [Array] Temple expression
|
159
149
|
def compile_attribute(key, values)
|
160
|
-
if values.all? { |v| Temple::StaticAnalyzer.static?(v
|
150
|
+
if values.all? { |v| Temple::StaticAnalyzer.static?(attr_literal(v)) }
|
161
151
|
return static_build(values)
|
162
152
|
end
|
163
153
|
|
@@ -181,7 +171,7 @@ module Haml
|
|
181
171
|
['false, nil', [:multi]],
|
182
172
|
[:else, [:multi,
|
183
173
|
[:static, " #{id_or_class}=#{@attr_wrapper}"],
|
184
|
-
[:escape, @escape_attrs, [:dynamic, var]],
|
174
|
+
[:escape, Escapable::EscapeSafeBuffer.new(@escape_attrs), [:dynamic, var]],
|
185
175
|
[:static, @attr_wrapper]],
|
186
176
|
]
|
187
177
|
],
|
@@ -201,7 +191,7 @@ module Haml
|
|
201
191
|
['false, nil', [:multi]],
|
202
192
|
[:else, [:multi,
|
203
193
|
[:static, " #{key}=#{@attr_wrapper}"],
|
204
|
-
[:escape, @escape_attrs, [:dynamic, var]],
|
194
|
+
[:escape, Escapable::EscapeSafeBuffer.new(@escape_attrs), [:dynamic, var]],
|
205
195
|
[:static, @attr_wrapper]],
|
206
196
|
]
|
207
197
|
],
|
@@ -220,5 +210,26 @@ module Haml
|
|
220
210
|
@unique_name ||= 0
|
221
211
|
"_haml_attribute_compiler#{@unique_name += 1}"
|
222
212
|
end
|
213
|
+
|
214
|
+
# @param [Haml::AttributeCompiler::AttributeValue] attr
|
215
|
+
def attr_literal(attr)
|
216
|
+
case attr.type
|
217
|
+
when :static
|
218
|
+
to_literal(attr.value)
|
219
|
+
when :dynamic
|
220
|
+
attr.value
|
221
|
+
end
|
222
|
+
end
|
223
|
+
|
224
|
+
# For haml/haml#972
|
225
|
+
# @param [Object] value
|
226
|
+
def to_literal(value)
|
227
|
+
case value
|
228
|
+
when true, false
|
229
|
+
value.to_s
|
230
|
+
else
|
231
|
+
Haml::Util.inspect_obj(value)
|
232
|
+
end
|
233
|
+
end
|
223
234
|
end
|
224
235
|
end
|
data/lib/haml/escapable.rb
CHANGED
@@ -4,30 +4,31 @@ module Haml
|
|
4
4
|
# Like Temple::Filters::Escapable, but with support for escaping by
|
5
5
|
# Haml::Herlpers.html_escape and Haml::Herlpers.escape_once.
|
6
6
|
class Escapable < Temple::Filter
|
7
|
+
# Special value of `flag` to ignore html_safe?
|
8
|
+
EscapeSafeBuffer = Struct.new(:value)
|
9
|
+
|
7
10
|
def initialize(*)
|
8
11
|
super
|
9
|
-
@escape_code = "::Haml::Helpers.html_escape((%s))"
|
10
|
-
@escaper = eval("proc {|v| #{@escape_code % 'v'} }")
|
11
|
-
@once_escape_code = "::Haml::Helpers.escape_once((%s))"
|
12
|
-
@once_escaper = eval("proc {|v| #{@once_escape_code % 'v'} }")
|
13
12
|
@escape = false
|
13
|
+
@escape_safe_buffer = false
|
14
14
|
end
|
15
15
|
|
16
16
|
def on_escape(flag, exp)
|
17
|
-
|
18
|
-
@
|
17
|
+
old_escape, old_escape_safe_buffer = @escape, @escape_safe_buffer
|
18
|
+
@escape_safe_buffer = flag.is_a?(EscapeSafeBuffer)
|
19
|
+
@escape = @escape_safe_buffer ? flag.value : flag
|
19
20
|
compile(exp)
|
20
21
|
ensure
|
21
|
-
@escape =
|
22
|
+
@escape, @escape_safe_buffer = old_escape, old_escape_safe_buffer
|
22
23
|
end
|
23
24
|
|
24
25
|
# The same as Haml::AttributeBuilder.build_attributes
|
25
26
|
def on_static(value)
|
26
27
|
[:static,
|
27
28
|
if @escape == :once
|
28
|
-
|
29
|
+
escape_once(value)
|
29
30
|
elsif @escape
|
30
|
-
|
31
|
+
escape(value)
|
31
32
|
else
|
32
33
|
value
|
33
34
|
end
|
@@ -38,13 +39,39 @@ module Haml
|
|
38
39
|
def on_dynamic(value)
|
39
40
|
[:dynamic,
|
40
41
|
if @escape == :once
|
41
|
-
|
42
|
+
escape_once_code(value)
|
42
43
|
elsif @escape
|
43
|
-
|
44
|
+
escape_code(value)
|
44
45
|
else
|
45
46
|
"(#{value}).to_s"
|
46
47
|
end
|
47
48
|
]
|
48
49
|
end
|
50
|
+
|
51
|
+
private
|
52
|
+
|
53
|
+
def escape_once(value)
|
54
|
+
if @escape_safe_buffer
|
55
|
+
::Haml::Helpers.escape_once_without_haml_xss(value)
|
56
|
+
else
|
57
|
+
::Haml::Helpers.escape_once(value)
|
58
|
+
end
|
59
|
+
end
|
60
|
+
|
61
|
+
def escape(value)
|
62
|
+
if @escape_safe_buffer
|
63
|
+
::Haml::Helpers.html_escape_without_haml_xss(value)
|
64
|
+
else
|
65
|
+
::Haml::Helpers.html_escape(value)
|
66
|
+
end
|
67
|
+
end
|
68
|
+
|
69
|
+
def escape_once_code(value)
|
70
|
+
"::Haml::Helpers.escape_once#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
|
71
|
+
end
|
72
|
+
|
73
|
+
def escape_code(value)
|
74
|
+
"::Haml::Helpers.html_escape#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
|
75
|
+
end
|
49
76
|
end
|
50
77
|
end
|
data/lib/haml/helpers.rb
CHANGED
@@ -607,9 +607,12 @@ MESSAGE
|
|
607
607
|
# @param text [String] The string to sanitize
|
608
608
|
# @return [String] The sanitized string
|
609
609
|
def html_escape(text)
|
610
|
-
|
610
|
+
CGI.escapeHTML(text.to_s)
|
611
611
|
end
|
612
612
|
|
613
|
+
# Always escape text regardless of html_safe?
|
614
|
+
alias_method :html_escape_without_haml_xss, :html_escape
|
615
|
+
|
613
616
|
HTML_ESCAPE_ONCE_REGEX = /['"><]|&(?!(?:[a-zA-Z]+|#(?:\d+|[xX][0-9a-fA-F]+));)/
|
614
617
|
|
615
618
|
# Escapes HTML entities in `text`, but without escaping an ampersand
|
@@ -622,6 +625,9 @@ MESSAGE
|
|
622
625
|
text.gsub(HTML_ESCAPE_ONCE_REGEX, HTML_ESCAPE)
|
623
626
|
end
|
624
627
|
|
628
|
+
# Always escape text once regardless of html_safe?
|
629
|
+
alias_method :escape_once_without_haml_xss, :escape_once
|
630
|
+
|
625
631
|
# Returns whether or not the current template is a Haml template.
|
626
632
|
#
|
627
633
|
# This function, unlike other {Haml::Helpers} functions,
|
@@ -8,12 +8,15 @@ module Haml
|
|
8
8
|
# to work with Rails' XSS protection methods.
|
9
9
|
module XssMods
|
10
10
|
def self.included(base)
|
11
|
-
%w[
|
12
|
-
precede succeed capture_haml haml_concat haml_internal_concat haml_indent
|
13
|
-
escape_once].each do |name|
|
11
|
+
%w[find_and_preserve preserve list_of surround
|
12
|
+
precede succeed capture_haml haml_concat haml_internal_concat haml_indent].each do |name|
|
14
13
|
base.send(:alias_method, "#{name}_without_haml_xss", name)
|
15
14
|
base.send(:alias_method, name, "#{name}_with_haml_xss")
|
16
15
|
end
|
16
|
+
# Those two always have _without_haml_xss
|
17
|
+
%w[html_escape escape_once].each do |name|
|
18
|
+
base.send(:alias_method, name, "#{name}_with_haml_xss")
|
19
|
+
end
|
17
20
|
end
|
18
21
|
|
19
22
|
# Don't escape text that's already safe,
|
data/lib/haml/parser.rb
CHANGED
@@ -307,7 +307,7 @@ module Haml
|
|
307
307
|
return ParseNode.new(:plain, line.index + 1, :text => line.text)
|
308
308
|
end
|
309
309
|
|
310
|
-
escape_html = @options.escape_html if escape_html.nil?
|
310
|
+
escape_html = @options.escape_html && @options.mime_type != 'text/plain' if escape_html.nil?
|
311
311
|
line.text = unescape_interpolation(line.text, escape_html)
|
312
312
|
script(line, false)
|
313
313
|
end
|
data/lib/haml/version.rb
CHANGED
metadata
CHANGED
@@ -1,17 +1,17 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: haml
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 5.
|
4
|
+
version: 5.2.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Natalie Weizenbaum
|
8
8
|
- Hampton Catlin
|
9
9
|
- Norman Clarke
|
10
10
|
- Akira Matsuda
|
11
|
-
autorequire:
|
11
|
+
autorequire:
|
12
12
|
bindir: bin
|
13
13
|
cert_chain: []
|
14
|
-
date:
|
14
|
+
date: 2020-09-28 00:00:00.000000000 Z
|
15
15
|
dependencies:
|
16
16
|
- !ruby/object:Gem::Dependency
|
17
17
|
name: temple
|
@@ -97,6 +97,20 @@ dependencies:
|
|
97
97
|
- - ">="
|
98
98
|
- !ruby/object:Gem::Version
|
99
99
|
version: '0'
|
100
|
+
- !ruby/object:Gem::Dependency
|
101
|
+
name: simplecov
|
102
|
+
requirement: !ruby/object:Gem::Requirement
|
103
|
+
requirements:
|
104
|
+
- - '='
|
105
|
+
- !ruby/object:Gem::Version
|
106
|
+
version: 0.17.1
|
107
|
+
type: :development
|
108
|
+
prerelease: false
|
109
|
+
version_requirements: !ruby/object:Gem::Requirement
|
110
|
+
requirements:
|
111
|
+
- - '='
|
112
|
+
- !ruby/object:Gem::Version
|
113
|
+
version: 0.17.1
|
100
114
|
description: |
|
101
115
|
Haml (HTML Abstraction Markup Language) is a layer on top of HTML or XML that's
|
102
116
|
designed to express the structure of documents in a non-repetitive, elegant, and
|
@@ -165,12 +179,12 @@ licenses:
|
|
165
179
|
- MIT
|
166
180
|
metadata:
|
167
181
|
bug_tracker_uri: https://github.com/haml/haml/issues
|
168
|
-
changelog_uri: https://github.com/haml/haml/blob/
|
182
|
+
changelog_uri: https://github.com/haml/haml/blob/main/CHANGELOG.md
|
169
183
|
documentation_uri: http://haml.info/docs.html
|
170
184
|
homepage_uri: http://haml.info
|
171
185
|
mailing_list_uri: https://groups.google.com/forum/?fromgroups#!forum/haml
|
172
186
|
source_code_uri: https://github.com/haml/haml
|
173
|
-
post_install_message:
|
187
|
+
post_install_message:
|
174
188
|
rdoc_options: []
|
175
189
|
require_paths:
|
176
190
|
- lib
|
@@ -185,8 +199,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
185
199
|
- !ruby/object:Gem::Version
|
186
200
|
version: '0'
|
187
201
|
requirements: []
|
188
|
-
rubygems_version: 3.
|
189
|
-
signing_key:
|
202
|
+
rubygems_version: 3.1.4
|
203
|
+
signing_key:
|
190
204
|
specification_version: 4
|
191
205
|
summary: An elegant, structured (X)HTML/XML templating engine.
|
192
206
|
test_files: []
|