haml 5.1.2 → 5.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ab71634acdfecb8525662d862961b21f26d77f32adf34457443b96aa5118b8d
-  data.tar.gz: 3eae0d107f253137df0583ead35dfee0d7840d3de616db50e0dbbd5734acbe27
+  metadata.gz: ec6cbb2e4023f397f1d7b6d84f06d78ab492a61e88c3f16496f39d0baeb47a83
+  data.tar.gz: 004c2dd34697cb61a8c12854bf4b99abb3cab5195f28922b813ee299225e7663
 SHA512:
-  metadata.gz: fb8005b129e6874259a4ff900579a13cbc42c3f64b13640856a219c9f69fbd2cfc77d8126231148c2ebc6b58883e8687a4f447603fd6cdfc41195bf08e1127c3
-  data.tar.gz: 813db45e219554933892a41e023419e9a1a0e10602ebdf525f7efc1f14fe6f2afa4ff96ac691a0d8552989016453e7ce553864fc778447e1f55725de43b53406
+  metadata.gz: a7430b4e42cf809f847448a9e04623b4b58878e44facedef5e43714820e8068f0bb853772564d5545936cdad8346f0c33abfc11642a3737d91c9a1f6242b3e41
+  data.tar.gz: 8a91df0cb185014512ee473a21755ba41edb06e835b29740e8e46c76287a81405b2706d8a10ea148893a9429de306c67584ac1c286637c0812a5562cf149431b

data/.github/workflows/test.yml

@@ -0,0 +1,36 @@
+name: test
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+jobs:
+  test:
+    name: 'Ruby: ${{ matrix.ruby }}, Rails: ${{ matrix.rails }}'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: [2.6, 2.7, 3.0, jruby-9.2]
+        rails: [5.2.x, 6.0.x, 6.1.x, rails-edge]
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+      - uses: actions/cache@v2
+        with:
+          path: vendor/bundle
+          key: ${{ runner.os }}-${{ matrix.ruby }}-gems-${{ hashFiles('**/Gemfile.lock') }}
+          restore-keys: ${{ runner.os }}-gems-
+      - name: bundle install --gemfile=test/gemfiles/Gemfile.rails-${{matrix.rails}}.x
+        run: bundle config path vendor/bundle && bundle install -j$(nproc) --retry 3
+      - name: rake test
+        run: bundle exec rake test submodules
+        env:
+          RUBYOPT: "--enable-frozen-string-literal"

data/.gitignore

@@ -1,3 +1,4 @@
+/.idea
 /.yardoc
 /coverage
 /doc

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Haml Changelog
 
+## 5.2.2
+Released on July 27, 2021
+([diff](https://github.com/haml/haml/compare/v5.2.1...v5.2.2)).
+
+* Support for adding Annotations to Haml output (a Rails feature 6.1+)
+* Expanded test matrix to include Ruby 3.0 and Rails 6.1
+* Only testing Ruby 2.7+ and Rails 5.2+
+
+## 5.2.1
+
+Released on November 30, 2020
+([diff](https://github.com/haml/haml/compare/v5.2.0...v5.2.1)).
+
+* Add in improved "multiline" support for attributes [#1043](https://github.com/haml/haml/issues/1043)
+
+## 5.2
+
+Released on September 28, 2020
+([diff](https://github.com/haml/haml/compare/v5.1.2...v5.2.0)).
+
+* Fix crash in the attribute optimizer when `#inspect` is overridden in TrueClass / FalseClass [#972](https://github.com/haml/haml/issues/972)
+* Do not HTML-escape templates that are declared to be plaintext [#1014](https://github.com/haml/haml/issues/1014) (Thanks [@cesarizu](https://github.com/cesarizu))
+* Class names are no longer ordered alphabetically, and now follow a new specification as laid out in REFERENCE [#306](https://github.com/haml/haml/issues/306)
+
 ## 5.1.2
 
 Released on August 6, 2019

data/Gemfile

@@ -3,6 +3,7 @@ gemspec
 
 gem "m"
 gem "pry"
+gem "simplecov"
 
 group :docs do
   gem "yard"
@@ -13,7 +14,3 @@ end
 platform :mri do
   gem "ruby-prof"
 end
-
-platform :mri_21 do
-  gem "simplecov"
-end

data/README.md

@@ -1,9 +1,8 @@
 # Haml
 
 [![Gem Version](https://badge.fury.io/rb/haml.svg)](http://rubygems.org/gems/haml)
-[![Build Status](https://travis-ci.org/haml/haml.svg?branch=master)](http://travis-ci.org/haml/haml)
+[![Build Status](https://travis-ci.org/haml/haml.svg?branch=main)](http://travis-ci.org/haml/haml)
 [![Code Climate](https://codeclimate.com/github/haml/haml/badges/gpa.svg)](https://codeclimate.com/github/haml/haml)
-[![Coverage Status](http://img.shields.io/coveralls/haml/haml.svg)](https://coveralls.io/r/haml/haml)
 [![Inline docs](http://inch-ci.org/github/haml/haml.png)](http://inch-ci.org/github/haml/haml)
 
 Haml is a templating engine for HTML. It's designed to make it both easier and
@@ -11,6 +10,13 @@ more pleasant to write HTML documents, by eliminating redundancy, reflecting the
 underlying structure that the document represents, and providing an elegant syntax
 that's both powerful and easy to understand.
 
+### Supported Versions
+
+* Ruby 2.6+
+* Rails 5.1+
+
+Other versions may likely work, but we don't test against them.
+
 ## Basic Usage
 
 Haml can be used from the command line or as part of a Ruby web framework. The
@@ -32,7 +38,7 @@ to compile it to HTML. For more information on these commands, check out
 haml --help
 ~~~
 
-To use Haml programatically, check out the [YARD documentation](http://haml.info/docs/yardoc/).
+To use Haml programmatically, check out the [YARD documentation](http://haml.info/docs/yardoc/).
 
 ## Using Haml with Rails
 
@@ -163,35 +169,34 @@ on a specific area:
 ruby -Itest test/helper_test.rb -n test_buffer_access
 ~~~
 
-Haml currently supports Ruby 2.0.0 and higher, so please make sure your changes run on 2.0+.
+Haml currently supports Ruby 2.7.0 and higher, so please make sure your changes run on 2.7+.
 
 ## Team
 
 ### Current Maintainers
 
-* [Akira Matsuda](https://github.com/amatsuda)
-* [Matt Wildig](https://github.com/mattwildig)
-* [Tee Parham](https://github.com/teeparham)
+* [Hampton Catlin](https://github.com/hcatlin)
 * [Takashi Kokubun](https://github.com/k0kubun)
+* [Akira Matsuda](https://github.com/amatsuda)
 
 ### Alumni
 
 Haml was created by [Hampton Catlin](http://hamptoncatlin.com), the author of
-the original implementation. Hampton is no longer involved in day-to-day coding,
-but still consults on language issues.
+the original implementation.
 
-[Natalie Weizenbaum](http://nex-3.com) was for many years the primary developer
+[Natalie Weizenbaum](https://github.com/nex3) was for many years the primary developer
 and architect of the "modern" Ruby implementation of Haml.
 
-[Norman Clarke](http://github.com/norman) was the primary maintainer of Haml from 2012 to 2016.
-
-## License
+This project's been around for many years, and we have many amazing people who kept the project 
+alive! as former maintainers like:
 
-Some of Natalie's work on Haml was supported by Unspace Interactive.
+[Norman Clarke](http://github.com/norman)
+[Matt Wildig](https://github.com/mattwildig)
+[Tee Parham](https://github.com/teeparham)
 
-Beyond that, the implementation is licensed under the MIT License.
+## License
 
-Copyright (c) 2006-2019 Hampton Catlin, Natalie Weizenbaum and the Haml team
+Copyright (c) 2006-2021 Hampton Catlin, Natalie Weizenbaum and the Haml team
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

data/REFERENCE.md

@@ -107,13 +107,20 @@ output.
 In Rails, options can be set by setting the {Haml::Template#options Haml::Template.options}
 hash in an initializer:
 
-    # config/initializers/haml.rb
-    Haml::Template.options[:format] = :html5
+```ruby
+# config/initializers/haml.rb
+Haml::Template.options[:format] = :html5
+
+# Avoid escaping attributes which are already escaped
+Haml::Template.options[:escape_attrs] = :once
+```
 
 Outside Rails, you can set them by configuring them globally in
 Haml::Options.defaults:
 
-    Haml::Options.defaults[:format] = :html5
+```ruby
+Haml::Options.defaults[:format] = :html5
+```
 
 In sinatra specifically, you can set them in global config with:
 ```ruby
@@ -228,15 +235,19 @@ is compiled to:
     <html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'></html>
 
 Attribute hashes can also be stretched out over multiple lines to accommodate
-many attributes. However, newlines may only be placed immediately after commas.
-For example:
+many attributes.
 
-    %script{:type => "text/javascript",
-            :src  => "javascripts/script_#{2 + 7}"}
+    %script{
+      "type": text/javascript",
+      "src": javascripts/script_#{2 + 7}",
+      "data": {
+        "controller": "reporter",
+      },
+    }
 
 is compiled to:
 
-    <script src='javascripts/script_9' type='text/javascript'></script>
+    <script src='javascripts/script_9' type='text/javascript' data-controller='reporter'></script>
 
 #### `:class` and `:id` Attributes {#class-and-id-attributes}
 
@@ -517,6 +528,24 @@ and is compiled to:
       </div>
     </div>
 
+#### Class Name Merging and Ordering
+
+Class names are ordered in the following way:
+
+1) Tag identifiers in order (aka, ".alert.me" => "alert me")
+2) Classes appearing in HTML-style attributes
+3) Classes appearing in Hash-style attributes
+
+For instance, this is a complicated and unintuitive test case illustrating the ordering
+
+    .foo.moo{:class => ['bar', 'alpha']}(class='baz')
+
+The resulting HTML would be as follows:
+
+    <div class='foo moo baz bar alpha'></div>
+
+*Versions of Haml prior to 5.0 would alphabetically sort class names.*
+
 ### Empty (void) Tags: `/`
 
 The forward slash character, when placed at the end of a tag definition, causes
@@ -853,7 +882,7 @@ is compiled to:
 
 ## Ruby Evaluation
 
-### Inserting Ruby: `=`
+### Inserting Ruby: `=` {#inserting_ruby}
 
 The equals character is followed by Ruby code. This code is evaluated and the
 output is inserted into the document. For example:
@@ -1323,7 +1352,7 @@ that just need a lot of template information.
 So data structures and  functions that require lots of arguments
 can be wrapped over multiple lines,
 as long as each line but the last ends in a comma
-(see [Inserting Ruby](#inserting_ruby_)).
+(see [Inserting Ruby](#inserting_ruby)).
 
 ## Whitespace Preservation
 

data/Rakefile

@@ -14,7 +14,7 @@ isolated_test = Rake::TestTask.new do |t|
 end
 Rake::TestTask.new do |t|
   t.libs << 'test'
-  t.test_files = Dir['test/*_test.rb'] + Dir['test/haml-spec/*_test.rb'] - isolated_test.file_list
+  t.test_files = Dir['test/*_test.rb'] + Dir['test/haml-spec/*_test.rb'] + Dir['test/cases/*_test.rb'] - isolated_test.file_list
   t.warning = true
   t.verbose = true
 end
@@ -26,13 +26,6 @@ task :benchmark do
   sh "ruby benchmark.rb #{ENV['TIMES']}"
 end
 
-task :set_coverage_env do
-  ENV["COVERAGE"] = "true"
-end
-
-desc "Run Simplecov"
-task :coverage => [:set_coverage_env, :test]
-
 task :submodules do
   if File.exist?(File.dirname(__FILE__) + "/.git")
     sh %{git submodule sync}

data/haml.gemspec

@@ -16,7 +16,7 @@ Gem::Specification.new do |spec|
   spec.license     = "MIT"
   spec.metadata    = {
     "bug_tracker_uri"   => "https://github.com/haml/haml/issues",
-    "changelog_uri"     => "https://github.com/haml/haml/blob/master/CHANGELOG.md",
+    "changelog_uri"     => "https://github.com/haml/haml/blob/main/CHANGELOG.md",
     "documentation_uri" => "http://haml.info/docs.html",
     "homepage_uri"      => "http://haml.info",
     "mailing_list_uri"  => "https://groups.google.com/forum/?fromgroups#!forum/haml",
@@ -32,6 +32,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rbench'
   spec.add_development_dependency 'minitest', '>= 4.0'
   spec.add_development_dependency 'nokogiri'
+  spec.add_development_dependency 'simplecov'
 
   spec.description = <<-END
 Haml (HTML Abstraction Markup Language) is a layer on top of HTML or XML that's

data/lib/haml/attribute_builder.rb

@@ -6,6 +6,17 @@ module Haml
     INVALID_ATTRIBUTE_NAME_REGEX = /[ \0"'>\/=]/
 
     class << self
+      def build(class_id, obj_ref, is_html, attr_wrapper, escape_attrs, hyphenate_data_attrs, *attributes_hashes)
+        attributes = class_id
+        attributes_hashes.each do |old|
+          result = {}
+          old.each { |k, v| result[k.to_s] = v }
+          merge_attributes!(attributes, result)
+        end
+        merge_attributes!(attributes, parse_object_ref(obj_ref)) if obj_ref
+        build_attributes(is_html, attr_wrapper, escape_attrs, hyphenate_data_attrs, attributes)
+      end
+
       def build_attributes(is_html, attr_wrapper, escape_attrs, hyphenate_data_attrs, attributes = {})
         # @TODO this is an absolutely ridiculous amount of arguments. At least
         # some of this needs to be moved into an instance method.
@@ -36,9 +47,9 @@ module Haml
 
           value =
             if escape_attrs == :once
-              Haml::Helpers.escape_once(value.to_s)
+              Haml::Helpers.escape_once_without_haml_xss(value.to_s)
             elsif escape_attrs
-              Haml::Helpers.html_escape(value.to_s)
+              Haml::Helpers.html_escape_without_haml_xss(value.to_s)
             else
               value.to_s
             end
@@ -126,7 +137,7 @@ module Haml
         elsif key == 'class'
           merged_class = filter_and_join(from, ' ')
           if to && merged_class
-            merged_class = (merged_class.split(' ') | to.split(' ')).sort.join(' ')
+            merged_class = (to.split(' ') | merged_class.split(' ')).join(' ')
           elsif to || merged_class
             merged_class ||= to
           end
@@ -159,6 +170,50 @@ module Haml
           hash.merge! flatten_data_attributes(v, joined, join_char, seen)
         end
       end
+
+      # Takes an array of objects and uses the class and id of the first
+      # one to create an attributes hash.
+      # The second object, if present, is used as a prefix,
+      # just like you can do with `dom_id()` and `dom_class()` in Rails
+      def parse_object_ref(ref)
+        prefix = ref[1]
+        ref = ref[0]
+        # Let's make sure the value isn't nil. If it is, return the default Hash.
+        return {} if ref.nil?
+        class_name =
+          if ref.respond_to?(:haml_object_ref)
+            ref.haml_object_ref
+          else
+            underscore(ref.class)
+          end
+        ref_id =
+          if ref.respond_to?(:to_key)
+            key = ref.to_key
+            key.join('_') unless key.nil?
+          else
+            ref.id
+          end
+        id = "#{class_name}_#{ref_id || 'new'}"
+        if prefix
+          class_name = "#{ prefix }_#{ class_name}"
+          id = "#{ prefix }_#{ id }"
+        end
+
+        { 'id'.freeze => id, 'class'.freeze => class_name }
+      end
+
+      # Changes a word from camel case to underscores.
+      # Based on the method of the same name in Rails' Inflector,
+      # but copied here so it'll run properly without Rails.
+      def underscore(camel_cased_word)
+        word = camel_cased_word.to_s.dup
+        word.gsub!(/::/, '_')
+        word.gsub!(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+        word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+        word.tr!('-', '_')
+        word.downcase!
+        word
+      end
     end
   end
 end

data/lib/haml/attribute_compiler.rb

@@ -7,27 +7,7 @@ module Haml
     # @param type [Symbol] :static or :dynamic
     # @param key [String]
     # @param value [String] Actual string value for :static type, value's Ruby literal for :dynamic type.
-    AttributeValue = Struct.new(:type, :key, :value) do
-      # @return [String] A Ruby literal of value.
-      def to_literal
-        case type
-        when :static
-          Haml::Util.inspect_obj(value)
-        when :dynamic
-          value
-        end
-      end
-    end
-
-    # Returns a script to render attributes on runtime.
-    #
-    # @param attributes [Hash]
-    # @param object_ref [String,:nil]
-    # @param dynamic_attributes [DynamicAttributes]
-    # @return [String] Attributes rendering code
-    def self.runtime_build(attributes, object_ref, dynamic_attributes)
-      "_hamlout.attributes(#{Haml::Util.inspect_obj(attributes)}, #{object_ref},#{dynamic_attributes.to_literal})"
-    end
+    AttributeValue = Struct.new(:type, :key, :value)
 
     # @param options [Haml::Options]
     def initialize(options)
@@ -41,16 +21,16 @@ module Haml
     #
     # @param attributes [Hash]
     # @param object_ref [String,:nil]
-    # @param dynamic_attributes [DynamicAttributes]
+    # @param dynamic_attributes [Haml::Parser::DynamicAttributes]
     # @return [Array] Temple expression
     def compile(attributes, object_ref, dynamic_attributes)
       if object_ref != :nil || !AttributeParser.available?
-        return [:dynamic, AttributeCompiler.runtime_build(attributes, object_ref, dynamic_attributes)]
+        return [:dynamic, compile_runtime_build(attributes, object_ref, dynamic_attributes)]
       end
 
       parsed_hashes = [dynamic_attributes.new, dynamic_attributes.old].compact.map do |attribute_hash|
         unless (hash = AttributeParser.parse(attribute_hash))
-          return [:dynamic, AttributeCompiler.runtime_build(attributes, object_ref, dynamic_attributes)]
+          return [:dynamic, compile_runtime_build(attributes, object_ref, dynamic_attributes)]
         end
         hash
       end
@@ -64,6 +44,17 @@ module Haml
 
     private
 
+    # Returns a script to render attributes on runtime.
+    #
+    # @param attributes [Hash]
+    # @param object_ref [String,:nil]
+    # @param dynamic_attributes [Haml::Parser::DynamicAttributes]
+    # @return [String] Attributes rendering code
+    def compile_runtime_build(attributes, object_ref, dynamic_attributes)
+      arguments = [@is_html, @attr_wrapper, @escape_attrs, @hyphenate_data_attrs].map(&method(:to_literal)).join(', ')
+      "::Haml::AttributeBuilder.build(#{to_literal(attributes)}, #{object_ref}, #{arguments}, #{dynamic_attributes.to_literal})"
+    end
+
     # Build array of grouped values whose sort order may go back and forth, which is also sorted with key name.
     # This method needs to group values with the same start because it can be changed in `Haml::AttributeBuidler#build_data_keys`.
     # @param values [Array<Haml::AttributeCompiler::AttributeValue>]
@@ -116,7 +107,8 @@ module Haml
       hash_content = values.group_by(&:key).map do |key, values_for_key|
         "#{frozen_string(key)} => #{merged_value(key, values_for_key)}"
       end.join(', ')
-      [:dynamic, "_hamlout.attributes({ #{hash_content} }, nil)"]
+      arguments = [@is_html, @attr_wrapper, @escape_attrs, @hyphenate_data_attrs].map(&method(:to_literal)).join(', ')
+      [:dynamic, "::Haml::AttributeBuilder.build({ #{hash_content} }, nil, #{arguments})"]
     end
 
     # Renders attribute values statically.
@@ -130,7 +122,7 @@ module Haml
 
       arguments = [@is_html, @attr_wrapper, @escape_attrs, @hyphenate_data_attrs]
       code = "::Haml::AttributeBuilder.build_attributes"\
-        "(#{arguments.map { |a| Haml::Util.inspect_obj(a) }.join(', ')}, { #{hash_content} })"
+        "(#{arguments.map(&method(:to_literal)).join(', ')}, { #{hash_content} })"
       [:static, eval(code).to_s]
     end
 
@@ -139,16 +131,16 @@ module Haml
     # @return [String]
     def merged_value(key, values)
       if values.size == 1
-        values.first.to_literal
+        attr_literal(values.first)
       else
-        "::Haml::AttributeBuilder.merge_values(#{frozen_string(key)}, #{values.map(&:to_literal).join(', ')})"
+        "::Haml::AttributeBuilder.merge_values(#{frozen_string(key)}, #{values.map(&method(:attr_literal)).join(', ')})"
       end
     end
 
     # @param str [String]
     # @return [String]
     def frozen_string(str)
-      "#{Haml::Util.inspect_obj(str)}.freeze"
+      "#{to_literal(str)}.freeze"
     end
 
     # Compiles attribute values for one key to Temple expression that generates ` key='value'`.
@@ -157,7 +149,7 @@ module Haml
     # @param values [Array<AttributeValue>]
     # @return [Array] Temple expression
     def compile_attribute(key, values)
-      if values.all? { |v| Temple::StaticAnalyzer.static?(v.to_literal) }
+      if values.all? { |v| Temple::StaticAnalyzer.static?(attr_literal(v)) }
         return static_build(values)
       end
 
@@ -181,7 +173,7 @@ module Haml
         ['false, nil', [:multi]],
         [:else, [:multi,
                  [:static, " #{id_or_class}=#{@attr_wrapper}"],
-                 [:escape, @escape_attrs, [:dynamic, var]],
+                 [:escape, Escapable::EscapeSafeBuffer.new(@escape_attrs), [:dynamic, var]],
                  [:static, @attr_wrapper]],
         ]
        ],
@@ -201,7 +193,7 @@ module Haml
         ['false, nil', [:multi]],
         [:else, [:multi,
                  [:static, " #{key}=#{@attr_wrapper}"],
-                 [:escape, @escape_attrs, [:dynamic, var]],
+                 [:escape, Escapable::EscapeSafeBuffer.new(@escape_attrs), [:dynamic, var]],
                  [:static, @attr_wrapper]],
         ]
        ],
@@ -220,5 +212,26 @@ module Haml
       @unique_name ||= 0
       "_haml_attribute_compiler#{@unique_name += 1}"
     end
+
+    # @param [Haml::AttributeCompiler::AttributeValue] attr
+    def attr_literal(attr)
+      case attr.type
+      when :static
+        to_literal(attr.value)
+      when :dynamic
+        attr.value
+      end
+    end
+
+    # For haml/haml#972
+    # @param [Object] value
+    def to_literal(value)
+      case value
+      when true, false
+        value.to_s
+      else
+        Haml::Util.inspect_obj(value)
+      end
+    end
   end
 end

data/lib/haml/buffer.rb

@@ -130,18 +130,6 @@ module Haml
       @real_tabs += tab_change
     end
 
-    def attributes(class_id, obj_ref, *attributes_hashes)
-      attributes = class_id
-      attributes_hashes.each do |old|
-        result = {}
-        old.each { |k, v| result[k.to_s] = v }
-        AttributeBuilder.merge_attributes!(attributes, result)
-      end
-      AttributeBuilder.merge_attributes!(attributes, parse_object_ref(obj_ref)) if obj_ref
-      AttributeBuilder.build_attributes(
-        html?, @options[:attr_wrapper], @options[:escape_attrs], @options[:hyphenate_data_attrs], attributes)
-    end
-
     # Remove the whitespace from the right side of the buffer string.
     # Doesn't do anything if we're at the beginning of a capture_haml block.
     def rstrip!
@@ -190,49 +178,5 @@ module Haml
       tabs = [count + @tabulation, 0].max
       @@tab_cache[tabs] ||= '  ' * tabs
     end
-
-    # Takes an array of objects and uses the class and id of the first
-    # one to create an attributes hash.
-    # The second object, if present, is used as a prefix,
-    # just like you can do with `dom_id()` and `dom_class()` in Rails
-    def parse_object_ref(ref)
-      prefix = ref[1]
-      ref = ref[0]
-      # Let's make sure the value isn't nil. If it is, return the default Hash.
-      return {} if ref.nil?
-      class_name =
-        if ref.respond_to?(:haml_object_ref)
-          ref.haml_object_ref
-        else
-          underscore(ref.class)
-        end
-      ref_id =
-        if ref.respond_to?(:to_key)
-          key = ref.to_key
-          key.join('_') unless key.nil?
-        else
-          ref.id
-        end
-      id = "#{class_name}_#{ref_id || 'new'}"
-      if prefix
-        class_name = "#{ prefix }_#{ class_name}"
-        id = "#{ prefix }_#{ id }"
-      end
-
-      { 'id'.freeze => id, 'class'.freeze => class_name }
-    end
-
-    # Changes a word from camel case to underscores.
-    # Based on the method of the same name in Rails' Inflector,
-    # but copied here so it'll run properly without Rails.
-    def underscore(camel_cased_word)
-      word = camel_cased_word.to_s.dup
-      word.gsub!(/::/, '_')
-      word.gsub!(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
-      word.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
-      word.tr!('-', '_')
-      word.downcase!
-      word
-    end
   end
 end

data/lib/haml/escapable.rb

@@ -4,30 +4,31 @@ module Haml
   # Like Temple::Filters::Escapable, but with support for escaping by
   # Haml::Herlpers.html_escape and Haml::Herlpers.escape_once.
   class Escapable < Temple::Filter
+    # Special value of `flag` to ignore html_safe?
+    EscapeSafeBuffer = Struct.new(:value)
+
     def initialize(*)
       super
-      @escape_code = "::Haml::Helpers.html_escape((%s))"
-      @escaper = eval("proc {|v| #{@escape_code % 'v'} }")
-      @once_escape_code = "::Haml::Helpers.escape_once((%s))"
-      @once_escaper = eval("proc {|v| #{@once_escape_code % 'v'} }")
       @escape = false
+      @escape_safe_buffer = false
     end
 
     def on_escape(flag, exp)
-      old = @escape
-      @escape = flag
+      old_escape, old_escape_safe_buffer = @escape, @escape_safe_buffer
+      @escape_safe_buffer = flag.is_a?(EscapeSafeBuffer)
+      @escape = @escape_safe_buffer ? flag.value : flag
       compile(exp)
     ensure
-      @escape = old
+      @escape, @escape_safe_buffer = old_escape, old_escape_safe_buffer
     end
 
     # The same as Haml::AttributeBuilder.build_attributes
     def on_static(value)
       [:static,
        if @escape == :once
-         @once_escaper[value]
+         escape_once(value)
        elsif @escape
-         @escaper[value]
+         escape(value)
        else
          value
        end
@@ -38,13 +39,39 @@ module Haml
     def on_dynamic(value)
       [:dynamic,
        if @escape == :once
-         @once_escape_code % value
+         escape_once_code(value)
        elsif @escape
-         @escape_code % value
+         escape_code(value)
        else
          "(#{value}).to_s"
        end
       ]
     end
+
+    private
+
+    def escape_once(value)
+      if @escape_safe_buffer
+        ::Haml::Helpers.escape_once_without_haml_xss(value)
+      else
+        ::Haml::Helpers.escape_once(value)
+      end
+    end
+
+    def escape(value)
+      if @escape_safe_buffer
+        ::Haml::Helpers.html_escape_without_haml_xss(value)
+      else
+        ::Haml::Helpers.html_escape(value)
+      end
+    end
+
+    def escape_once_code(value)
+      "::Haml::Helpers.escape_once#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
+    end
+
+    def escape_code(value)
+      "::Haml::Helpers.html_escape#{('_without_haml_xss' if @escape_safe_buffer)}((#{value}))"
+    end
   end
 end

data/lib/haml/helpers/xss_mods.rb

@@ -8,12 +8,15 @@ module Haml
     # to work with Rails' XSS protection methods.
     module XssMods
       def self.included(base)
-        %w[html_escape find_and_preserve preserve list_of surround
-           precede succeed capture_haml haml_concat haml_internal_concat haml_indent
-           escape_once].each do |name|
+        %w[find_and_preserve preserve list_of surround
+           precede succeed capture_haml haml_concat haml_internal_concat haml_indent].each do |name|
           base.send(:alias_method, "#{name}_without_haml_xss", name)
           base.send(:alias_method, name, "#{name}_with_haml_xss")
         end
+        # Those two always have _without_haml_xss
+        %w[html_escape escape_once].each do |name|
+          base.send(:alias_method, name, "#{name}_with_haml_xss")
+        end
       end
 
       # Don't escape text that's already safe,

data/lib/haml/helpers.rb

@@ -607,9 +607,12 @@ MESSAGE
     # @param text [String] The string to sanitize
     # @return [String] The sanitized string
     def html_escape(text)
-      ERB::Util.html_escape(text)
+      CGI.escapeHTML(text.to_s)
     end
 
+    # Always escape text regardless of html_safe?
+    alias_method :html_escape_without_haml_xss, :html_escape
+
     HTML_ESCAPE_ONCE_REGEX = /['"><]|&(?!(?:[a-zA-Z]+|#(?:\d+|[xX][0-9a-fA-F]+));)/
 
     # Escapes HTML entities in `text`, but without escaping an ampersand
@@ -622,6 +625,9 @@ MESSAGE
       text.gsub(HTML_ESCAPE_ONCE_REGEX, HTML_ESCAPE)
     end
 
+    # Always escape text once regardless of html_safe?
+    alias_method :escape_once_without_haml_xss, :escape_once
+
     # Returns whether or not the current template is a Haml template.
     #
     # This function, unlike other {Haml::Helpers} functions,

data/lib/haml/parser.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'ripper'
 require 'strscan'
 
 module Haml
@@ -90,6 +91,9 @@ module Haml
     ID_KEY    = 'id'.freeze
     CLASS_KEY = 'class'.freeze
 
+    # Used for scanning old attributes, substituting the first '{'
+    METHOD_CALL_PREFIX = 'a('
+
     def initialize(options)
       @options = Options.wrap(options)
       # Record the indent levels of "if" statements to validate the subsequent
@@ -307,7 +311,7 @@ module Haml
         return ParseNode.new(:plain, line.index + 1, :text => line.text)
       end
 
-      escape_html = @options.escape_html if escape_html.nil?
+      escape_html = @options.escape_html && @options.mime_type != 'text/plain' if escape_html.nil?
       line.text = unescape_interpolation(line.text, escape_html)
       script(line, false)
     end
@@ -651,13 +655,18 @@ module Haml
     # @return [String] rest
     # @return [Integer] last_line
     def parse_old_attributes(text)
-      text = text.dup
       last_line = @line.index + 1
 
       begin
-        attributes_hash, rest = balance(text, ?{, ?})
+        # Old attributes often look like a valid Hash literal, but it sometimes allow code like
+        # `{ hash, foo: bar }`, which is compiled to `_hamlout.attributes({}, nil, hash, foo: bar)`.
+        #
+        # To scan such code correctly, this scans `a( hash, foo: bar }` instead, stops when there is
+        # 1 more :on_embexpr_end (the last '}') than :on_embexpr_beg, and resurrects '{' afterwards.
+        balanced, rest = balance_tokens(text.sub(?{, METHOD_CALL_PREFIX), :on_embexpr_beg, :on_embexpr_end, count: 1)
+        attributes_hash = balanced.sub(METHOD_CALL_PREFIX, ?{)
       rescue SyntaxError => e
-        if text.strip[-1] == ?, && e.message == Error.message(:unbalanced_brackets)
+        if e.message == Error.message(:unbalanced_brackets) && !@template.empty?
           text << "\n#{@next_line.text}"
           last_line += 1
           next_line
@@ -811,6 +820,25 @@ module Haml
       Haml::Util.balance(*args) or raise(SyntaxError.new(Error.message(:unbalanced_brackets)))
     end
 
+    # Unlike #balance, this balances Ripper tokens to balance something like `{ a: "}" }` correctly.
+    def balance_tokens(buf, start, finish, count: 0)
+      text = ''.dup
+      Ripper.lex(buf).each do |_, token, str|
+        text << str
+        case token
+        when start
+          count += 1
+        when finish
+          count -= 1
+        end
+
+        if count == 0
+          return text, buf.sub(text, '')
+        end
+      end
+      raise SyntaxError.new(Error.message(:unbalanced_brackets))
+    end
+
     def block_opened?
       @next_line.tabs > @line.tabs
     end

data/lib/haml/plugin.rb

@@ -4,6 +4,11 @@ module Haml
 
   # This module makes Haml work with Rails using the template handler API.
   class Plugin
+    class << self
+      attr_accessor :annotate_rendered_view_with_filenames
+    end
+    self.annotate_rendered_view_with_filenames = false
+
     def handles_encoding?; true; end
 
     def compile(template, source)
@@ -14,9 +19,21 @@ module Haml
         options[:mime_type] = template.mime_type
       end
       options[:filename] = template.identifier
+
+      preamble = '@output_buffer = output_buffer ||= ActionView::OutputBuffer.new if defined?(ActionView::OutputBuffer);'
+      postamble = ''
+
+      if self.class.annotate_rendered_view_with_filenames
+        # short_identifier is only available in Rails 6+. On older versions, 'inspect' gives similar results.
+        ident = template.respond_to?(:short_identifier) ? template.short_identifier : template.inspect
+        preamble += "haml_concat '<!-- BEGIN #{ident} -->'.html_safe;"
+        postamble += "haml_concat '<!-- END #{ident} -->'.html_safe;"
+      end
+
       Haml::Engine.new(source, options).compiler.precompiled_with_ambles(
         [],
-        after_preamble: '@output_buffer = output_buffer ||= ActionView::OutputBuffer.new if defined?(ActionView::OutputBuffer)',
+        after_preamble: preamble,
+        before_postamble: postamble
       )
     end
 

data/lib/haml/railtie.rb

@@ -42,6 +42,11 @@ module Haml
           Haml::Filters::RailsErb.template_class = Haml::SafeErubisTemplate
         end
         Haml::Template.options[:filters] = { 'erb' => Haml::Filters::RailsErb }
+
+        if app.config.respond_to?(:action_view) &&
+           app.config.action_view.annotate_rendered_view_with_filenames
+          Haml::Plugin.annotate_rendered_view_with_filenames = true
+        end
       end
     end
   end

data/lib/haml/temple_engine.rb

@@ -65,7 +65,7 @@ module Haml
     # (see {file:REFERENCE.md#encodings the `:encoding` option}).
     #
     # @return [String]
-    def precompiled_with_ambles(local_names, after_preamble: '')
+    def precompiled_with_ambles(local_names, after_preamble: '', before_postamble: '')
       preamble = <<END.tr("\n", ';')
 begin
 extend Haml::Helpers
@@ -74,6 +74,7 @@ _erbout = _hamlout.buffer
 #{after_preamble}
 END
       postamble = <<END.tr("\n", ';')
+#{before_postamble}
 #{precompiled_method_return_value}
 ensure
 @haml_buffer = @haml_buffer.upper if @haml_buffer

data/lib/haml/util.rb

@@ -213,7 +213,7 @@ MSG
             scan.scan(/\w+/)
           end
           content = eval("\"#{interpolated}\"")
-          content.prepend(char) if char == '@' || char == '$'
+          content = "#{char}#{content}" if char == '@' || char == '$'
           content = "Haml::Helpers.html_escape((#{content}))" if escape_html
 
           res << "\#{#{content}}"

data/lib/haml/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Haml
-  VERSION = "5.1.2"
+  VERSION = "5.2.2"
 end

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: haml
 version: !ruby/object:Gem::Version
-  version: 5.1.2
+  version: 5.2.2
 platform: ruby
 authors:
 - Natalie Weizenbaum
 - Hampton Catlin
 - Norman Clarke
 - Akira Matsuda
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-08-06 00:00:00.000000000 Z
+date: 2021-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: temple
@@ -97,6 +97,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: |
   Haml (HTML Abstraction Markup Language) is a layer on top of HTML or XML that's
   designed to express the structure of documents in a non-repetitive, elegant, and
@@ -111,9 +125,9 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/test.yml"
 - ".gitignore"
 - ".gitmodules"
-- ".travis.yml"
 - ".yardopts"
 - CHANGELOG.md
 - FAQ.md
@@ -165,12 +179,12 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/haml/haml/issues
-  changelog_uri: https://github.com/haml/haml/blob/master/CHANGELOG.md
+  changelog_uri: https://github.com/haml/haml/blob/main/CHANGELOG.md
   documentation_uri: http://haml.info/docs.html
   homepage_uri: http://haml.info
   mailing_list_uri: https://groups.google.com/forum/?fromgroups#!forum/haml
   source_code_uri: https://github.com/haml/haml
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -185,8 +199,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: An elegant, structured (X)HTML/XML templating engine.
 test_files: []

data/.travis.yml

@@ -1,97 +0,0 @@
-sudo: false
-dist: trusty
-language: ruby
-cache: bundler
-rvm:
-  - ruby-head
-  - 2.6.3
-  - 2.5.5
-  - 2.4.6
-  - 2.3.8
-  - 2.2.10
-  - 2.1.10
-  - 2.0.0
-  - jruby-9.2.7.0
-  - rbx-3
-gemfile:
-  - test/gemfiles/Gemfile.rails-6.0.x
-  - test/gemfiles/Gemfile.rails-5.2.x
-  - test/gemfiles/Gemfile.rails-5.1.x
-  - test/gemfiles/Gemfile.rails-5.0.x
-  - test/gemfiles/Gemfile.rails-5.0.x.erubi
-  - test/gemfiles/Gemfile.rails-4.2.x
-  - test/gemfiles/Gemfile.rails-4.1.x
-  - test/gemfiles/Gemfile.rails-4.0.x
-matrix:
-  exclude:
-    - rvm: 2.0.0
-      gemfile: test/gemfiles/Gemfile.rails-6.0.x
-    - rvm: 2.1.10
-      gemfile: test/gemfiles/Gemfile.rails-6.0.x
-    - rvm: 2.2.10
-      gemfile: test/gemfiles/Gemfile.rails-6.0.x
-    - rvm: 2.3.8
-      gemfile: test/gemfiles/Gemfile.rails-6.0.x
-    - rvm: 2.4.6
-      gemfile: test/gemfiles/Gemfile.rails-6.0.x
-    - rvm: 2.0.0
-      gemfile: test/gemfiles/Gemfile.rails-5.2.x
-    - rvm: 2.1.10
-      gemfile: test/gemfiles/Gemfile.rails-5.2.x
-    - rvm: 2.0.0
-      gemfile: test/gemfiles/Gemfile.rails-5.1.x
-    - rvm: 2.1.10
-      gemfile: test/gemfiles/Gemfile.rails-5.1.x
-    - rvm: 2.0.0
-      gemfile: test/gemfiles/Gemfile.rails-5.0.x
-    - rvm: 2.0.0
-      gemfile: test/gemfiles/Gemfile.rails-5.0.x.erubi
-    - rvm: 2.1.10
-      gemfile: test/gemfiles/Gemfile.rails-5.0.x
-    - rvm: 2.1.10
-      gemfile: test/gemfiles/Gemfile.rails-5.0.x.erubi
-    - rvm: 2.4.6
-      gemfile: test/gemfiles/Gemfile.rails-4.0.x
-    - rvm: 2.4.6
-      gemfile: test/gemfiles/Gemfile.rails-4.1.x
-    - rvm: 2.4.6
-      gemfile: test/gemfiles/Gemfile.rails-4.2.x
-    - rvm: 2.5.5
-      gemfile: test/gemfiles/Gemfile.rails-4.0.x
-    - rvm: 2.5.5
-      gemfile: test/gemfiles/Gemfile.rails-4.1.x
-    - rvm: 2.5.5
-      gemfile: test/gemfiles/Gemfile.rails-4.2.x
-    - rvm: 2.6.3
-      gemfile: test/gemfiles/Gemfile.rails-4.0.x
-    - rvm: 2.6.3
-      gemfile: test/gemfiles/Gemfile.rails-4.1.x
-    - rvm: 2.6.3
-      gemfile: test/gemfiles/Gemfile.rails-4.2.x
-    - rvm: ruby-head
-      gemfile: test/gemfiles/Gemfile.rails-4.0.x
-    - rvm: ruby-head
-      gemfile: test/gemfiles/Gemfile.rails-4.1.x
-    - rvm: ruby-head
-      gemfile: test/gemfiles/Gemfile.rails-4.2.x
-  include:
-    - rvm: 2.6.3
-      gemfile: test/gemfiles/Gemfile.rails-edge
-  allow_failures:
-    - rvm: ruby-head
-    - rvm: rbx-3
-    - gemfile: test/gemfiles/Gemfile.rails-edge
-    - rvm: jruby-9.2.7.0
-      gemfile: test/gemfiles/Gemfile.rails-4.2.x
-    - rvm: jruby-9.2.7.0
-      gemfile: test/gemfiles/Gemfile.rails-4.1.x
-    - rvm: jruby-9.2.7.0
-      gemfile: test/gemfiles/Gemfile.rails-4.0.x
-    - rvm: jruby-9.2.7.0
-      gemfile: test/gemfiles/Gemfile.rails-5.0.x.erubi
-  fast_finish: true
-before_install:
-  - gem i rubygems-update -v '<3' && update_rubygems # https://github.com/travis-ci/travis-ci/issues/8974
-  - gem uninstall -v '>= 2' -i $(rvm gemdir)@global -ax bundler || true
-  - gem i bundler -v '<2'
-script: "bundle exec rake submodules test"