haml 3.2.0.rc.3 → 3.2.0.rc.4
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of haml might be problematic. Click here for more details.
- data/lib/haml/filters.rb +1 -1
- data/lib/haml/helpers/action_view_xss_mods.rb +58 -0
- data/lib/haml/helpers/xss_mods.rb +0 -59
- data/lib/haml/template.rb +1 -0
- data/lib/haml/util.rb +11 -5
- data/lib/haml/version.rb +1 -1
- metadata +6 -4
data/lib/haml/filters.rb
CHANGED
@@ -65,7 +65,7 @@ module Haml
|
|
65
65
|
# @return Module The filter module that has been removed
|
66
66
|
# @since 3.2.0
|
67
67
|
def remove_filter(name)
|
68
|
-
defined.delete name.downcase
|
68
|
+
defined.delete name.to_s.downcase
|
69
69
|
if constants.map(&:to_s).include?(name.to_s)
|
70
70
|
remove_const name.to_sym
|
71
71
|
end
|
@@ -0,0 +1,58 @@
|
|
1
|
+
module ActionView
|
2
|
+
module Helpers
|
3
|
+
module CaptureHelper
|
4
|
+
def with_output_buffer_with_haml_xss(*args, &block)
|
5
|
+
res = with_output_buffer_without_haml_xss(*args, &block)
|
6
|
+
case res
|
7
|
+
when Array; res.map {|s| Haml::Util.html_safe(s)}
|
8
|
+
when String; Haml::Util.html_safe(res)
|
9
|
+
else; res
|
10
|
+
end
|
11
|
+
end
|
12
|
+
alias_method :with_output_buffer_without_haml_xss, :with_output_buffer
|
13
|
+
alias_method :with_output_buffer, :with_output_buffer_with_haml_xss
|
14
|
+
end
|
15
|
+
|
16
|
+
module FormTagHelper
|
17
|
+
def form_tag_with_haml_xss(*args, &block)
|
18
|
+
res = form_tag_without_haml_xss(*args, &block)
|
19
|
+
res = Haml::Util.html_safe(res) unless block_given?
|
20
|
+
res
|
21
|
+
end
|
22
|
+
alias_method :form_tag_without_haml_xss, :form_tag
|
23
|
+
alias_method :form_tag, :form_tag_with_haml_xss
|
24
|
+
end
|
25
|
+
|
26
|
+
module FormHelper
|
27
|
+
def form_for_with_haml_xss(*args, &block)
|
28
|
+
res = form_for_without_haml_xss(*args, &block)
|
29
|
+
return Haml::Util.html_safe(res) if res.is_a?(String)
|
30
|
+
return res
|
31
|
+
end
|
32
|
+
alias_method :form_for_without_haml_xss, :form_for
|
33
|
+
alias_method :form_for, :form_for_with_haml_xss
|
34
|
+
end
|
35
|
+
|
36
|
+
module TextHelper
|
37
|
+
def concat_with_haml_xss(string)
|
38
|
+
if is_haml?
|
39
|
+
haml_buffer.buffer.concat(haml_xss_html_escape(string))
|
40
|
+
else
|
41
|
+
concat_without_haml_xss(string)
|
42
|
+
end
|
43
|
+
end
|
44
|
+
alias_method :concat_without_haml_xss, :concat
|
45
|
+
alias_method :concat, :concat_with_haml_xss
|
46
|
+
|
47
|
+
def safe_concat_with_haml_xss(string)
|
48
|
+
if is_haml?
|
49
|
+
haml_buffer.buffer.concat(string)
|
50
|
+
else
|
51
|
+
safe_concat_without_haml_xss(string)
|
52
|
+
end
|
53
|
+
end
|
54
|
+
alias_method :safe_concat_without_haml_xss, :safe_concat
|
55
|
+
alias_method :safe_concat, :safe_concat_with_haml_xss
|
56
|
+
end
|
57
|
+
end
|
58
|
+
end
|
@@ -102,62 +102,3 @@ module Haml
|
|
102
102
|
end
|
103
103
|
end
|
104
104
|
end
|
105
|
-
|
106
|
-
module ActionView
|
107
|
-
module Helpers
|
108
|
-
module CaptureHelper
|
109
|
-
def with_output_buffer_with_haml_xss(*args, &block)
|
110
|
-
res = with_output_buffer_without_haml_xss(*args, &block)
|
111
|
-
case res
|
112
|
-
when Array; res.map {|s| Haml::Util.html_safe(s)}
|
113
|
-
when String; Haml::Util.html_safe(res)
|
114
|
-
else; res
|
115
|
-
end
|
116
|
-
end
|
117
|
-
alias_method :with_output_buffer_without_haml_xss, :with_output_buffer
|
118
|
-
alias_method :with_output_buffer, :with_output_buffer_with_haml_xss
|
119
|
-
end
|
120
|
-
|
121
|
-
module FormTagHelper
|
122
|
-
def form_tag_with_haml_xss(*args, &block)
|
123
|
-
res = form_tag_without_haml_xss(*args, &block)
|
124
|
-
res = Haml::Util.html_safe(res) unless block_given?
|
125
|
-
res
|
126
|
-
end
|
127
|
-
alias_method :form_tag_without_haml_xss, :form_tag
|
128
|
-
alias_method :form_tag, :form_tag_with_haml_xss
|
129
|
-
end
|
130
|
-
|
131
|
-
module FormHelper
|
132
|
-
def form_for_with_haml_xss(*args, &block)
|
133
|
-
res = form_for_without_haml_xss(*args, &block)
|
134
|
-
return Haml::Util.html_safe(res) if res.is_a?(String)
|
135
|
-
return res
|
136
|
-
end
|
137
|
-
alias_method :form_for_without_haml_xss, :form_for
|
138
|
-
alias_method :form_for, :form_for_with_haml_xss
|
139
|
-
end
|
140
|
-
|
141
|
-
module TextHelper
|
142
|
-
def concat_with_haml_xss(string)
|
143
|
-
if is_haml?
|
144
|
-
haml_buffer.buffer.concat(haml_xss_html_escape(string))
|
145
|
-
else
|
146
|
-
concat_without_haml_xss(string)
|
147
|
-
end
|
148
|
-
end
|
149
|
-
alias_method :concat_without_haml_xss, :concat
|
150
|
-
alias_method :concat, :concat_with_haml_xss
|
151
|
-
|
152
|
-
def safe_concat_with_haml_xss(string)
|
153
|
-
if is_haml?
|
154
|
-
haml_buffer.buffer.concat(string)
|
155
|
-
else
|
156
|
-
safe_concat_without_haml_xss(string)
|
157
|
-
end
|
158
|
-
end
|
159
|
-
alias_method :safe_concat_without_haml_xss, :safe_concat
|
160
|
-
alias_method :safe_concat, :safe_concat_with_haml_xss
|
161
|
-
end
|
162
|
-
end
|
163
|
-
end
|
data/lib/haml/template.rb
CHANGED
data/lib/haml/util.rb
CHANGED
@@ -1,4 +1,8 @@
|
|
1
|
-
|
1
|
+
begin
|
2
|
+
require 'erubis/tiny'
|
3
|
+
rescue LoadError
|
4
|
+
require 'erb'
|
5
|
+
end
|
2
6
|
require 'set'
|
3
7
|
require 'stringio'
|
4
8
|
require 'strscan'
|
@@ -236,10 +240,12 @@ MSG
|
|
236
240
|
info = caller_info
|
237
241
|
powerset(vars).each do |set|
|
238
242
|
context = StaticConditionalContext.new(set).instance_eval {binding}
|
243
|
+
method_content = (defined?(Erubis::TinyEruby) && Erubis::TinyEruby || ERB).new(erb).result(context)
|
244
|
+
|
239
245
|
klass.class_eval(<<METHOD, info[0], info[1])
|
240
|
-
def #{static_method_name(name, *vars.map {|v| set.include?(v)})}(#{args.join(', ')})
|
241
|
-
|
242
|
-
end
|
246
|
+
def #{static_method_name(name, *vars.map {|v| set.include?(v)})}(#{args.join(', ')})
|
247
|
+
#{method_content}
|
248
|
+
end
|
243
249
|
METHOD
|
244
250
|
end
|
245
251
|
end
|
@@ -250,7 +256,7 @@ METHOD
|
|
250
256
|
# @param vars [Array<Boolean>] The static variable assignment
|
251
257
|
# @return [String] The real name of the static method
|
252
258
|
def static_method_name(name, *vars)
|
253
|
-
"#{name}_#{vars.map {|v| !!v}.join('_')}"
|
259
|
+
:"#{name}_#{vars.map {|v| !!v}.join('_')}"
|
254
260
|
end
|
255
261
|
|
256
262
|
# Scans through a string looking for the interoplation-opening `#{`
|
data/lib/haml/version.rb
CHANGED
metadata
CHANGED
@@ -2,7 +2,7 @@
|
|
2
2
|
name: haml
|
3
3
|
version: !ruby/object:Gem::Version
|
4
4
|
prerelease: 6
|
5
|
-
version: 3.2.0.rc.
|
5
|
+
version: 3.2.0.rc.4
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
8
8
|
- Nathan Weizenbaum
|
@@ -11,7 +11,7 @@ authors:
|
|
11
11
|
autorequire:
|
12
12
|
bindir: bin
|
13
13
|
cert_chain: []
|
14
|
-
date: 2013-
|
14
|
+
date: 2013-02-07 00:00:00.000000000 Z
|
15
15
|
dependencies:
|
16
16
|
- !ruby/object:Gem::Dependency
|
17
17
|
name: tilt
|
@@ -121,6 +121,7 @@ files:
|
|
121
121
|
- lib/haml/filters.rb
|
122
122
|
- lib/haml/helpers/action_view_extensions.rb
|
123
123
|
- lib/haml/helpers/action_view_mods.rb
|
124
|
+
- lib/haml/helpers/action_view_xss_mods.rb
|
124
125
|
- lib/haml/helpers/rails_323_textarea_fix.rb
|
125
126
|
- lib/haml/helpers/safe_erubis_template.rb
|
126
127
|
- lib/haml/helpers/xss_mods.rb
|
@@ -210,7 +211,8 @@ files:
|
|
210
211
|
- README.md
|
211
212
|
- REFERENCE.md
|
212
213
|
homepage: http://haml.info/
|
213
|
-
licenses:
|
214
|
+
licenses:
|
215
|
+
- MIT
|
214
216
|
post_install_message: ! '
|
215
217
|
|
216
218
|
HEADS UP! Haml 3.2 has many improvements, but also has changes that may break
|
@@ -248,7 +250,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
248
250
|
- !ruby/object:Gem::Version
|
249
251
|
segments:
|
250
252
|
- 0
|
251
|
-
hash:
|
253
|
+
hash: 3493289151037980825
|
252
254
|
version: '0'
|
253
255
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
254
256
|
none: false
|