haml_lint 0.69.0 → 0.74.0

data/lib/haml_lint/linter/space_before_script.rb

@@ -5,6 +5,8 @@ module HamlLint
   class Linter::SpaceBeforeScript < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     MESSAGE_FORMAT = 'The %s symbol should have one space separating it from code'
 
     ALLOWED_SEPARATORS = [' ', '#'].freeze
@@ -33,18 +35,23 @@ module HamlLint
       # (need to do it this way as the parser strips whitespace from node)
       return unless tag_with_text[index - 1] != ' '
 
-      record_lint(node, MESSAGE_FORMAT % '=')
+      corrected = correct_inline_script(node, text)
+      record_lint(node, MESSAGE_FORMAT % '=', corrected: corrected)
     end
 
     def visit_script(node)
       # Plain text nodes with interpolation are converted to script nodes, so we
       # need to ignore them here.
       return unless document.source_lines[node.line - 1].lstrip.start_with?('=')
-      record_lint(node, MESSAGE_FORMAT % '=') if missing_space?(node)
+      return unless missing_space?(node)
+
+      record_lint(node, MESSAGE_FORMAT % '=', corrected: correct_leading_marker(node, '='))
     end
 
     def visit_silent_script(node)
-      record_lint(node, MESSAGE_FORMAT % '-') if missing_space?(node)
+      return unless missing_space?(node)
+
+      record_lint(node, MESSAGE_FORMAT % '-', corrected: correct_leading_marker(node, '-'))
     end
 
     private
@@ -53,5 +60,31 @@ module HamlLint
       text = node.script
       !ALLOWED_SEPARATORS.include?(text[0]) if text
     end
+
+    # Inserts one space after a leading `=`/`-` marker.
+    #
+    # @return [Boolean]
+    def correct_leading_marker(node, marker)
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      escaped = Regexp.escape(marker)
+      correct_line(index, line.sub(/\A(\s*#{escaped})(?=[^\s#{escaped}])/, '\1 '))
+    end
+
+    # Inserts a space after the `=` marker introducing a tag's inline script.
+    #
+    # @return [Boolean]
+    def correct_inline_script(node, text)
+      index = node.line - 1
+      line = autocorrected_lines[index]
+
+      pos = line.rindex("=#{text}")
+      if pos.nil? && (unquoted = strip_surrounding_quotes(text))
+        pos = line.rindex("=#{unquoted}")
+      end
+      return false unless pos
+
+      correct_line(index, "#{line[0..pos]} #{line[(pos + 1)..]}")
+    end
   end
 end

data/lib/haml_lint/linter/space_inside_hash_attributes.rb

@@ -6,6 +6,8 @@ module HamlLint
   class Linter::SpaceInsideHashAttributes < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     STYLE = {
       'no_space' => {
         start_regex: /\A\{[^ ]/,
@@ -24,11 +26,47 @@ module HamlLint
     def visit_tag(node)
       return unless node.hash_attributes?
 
-      style = STYLE[config['style'] == 'no_space' ? 'no_space' : 'space']
+      style_name = config['style'] == 'no_space' ? 'no_space' : 'space'
+      style = STYLE[style_name]
       source = node.hash_attributes_source
 
-      record_lint(node, style[:start_message]) unless source&.match?(style[:start_regex])
-      record_lint(node, style[:end_message]) unless source&.match?(style[:end_regex])
+      start_ok = source.match?(style[:start_regex])
+      end_ok = source.match?(style[:end_regex])
+      return if start_ok && end_ok
+
+      corrected = correct_hash_spacing(node, source, style_name)
+      record_lint(node, style[:start_message], corrected: corrected) unless start_ok
+      record_lint(node, style[:end_message], corrected: corrected) unless end_ok
+    end
+
+    private
+
+    # @return [Boolean]
+    def correct_hash_spacing(node, source, style_name)
+      return false unless source
+      return false if source.include?("\n") # multi-line hash: detection-only
+
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      return false unless line.include?(source)
+
+      fixed = corrected_hash_source(source, style_name)
+      return false if fixed == source
+
+      correct_line(index, line.sub(source) { fixed })
+    end
+
+    # @return [String]
+    def corrected_hash_source(source, style_name)
+      inner = source[1...-1].strip
+
+      if style_name == 'no_space'
+        "{#{inner}}"
+      elsif inner.empty?
+        '{ }'
+      else
+        "{ #{inner} }"
+      end
     end
   end
 end

data/lib/haml_lint/linter/tag_name.rb

@@ -5,11 +5,24 @@ module HamlLint
   class Linter::TagName < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     def visit_tag(node)
       tag = node.tag_name
       return unless /[A-Z]/.match?(tag)
 
-      record_lint(node, "`#{tag}` should be written in lowercase as `#{tag.downcase}`")
+      corrected = correct_tag_name(node, tag)
+      record_lint(node, "`#{tag}` should be written in lowercase as `#{tag.downcase}`",
+                  corrected: corrected)
+    end
+
+    private
+
+    # @return [Boolean]
+    def correct_tag_name(node, tag)
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      correct_line(index, line.sub(/(%)#{Regexp.escape(tag)}/, "\\1#{tag.downcase}"))
     end
   end
 end

data/lib/haml_lint/linter/trailing_empty_lines.rb

@@ -5,6 +5,8 @@ module HamlLint
   class Linter::TrailingEmptyLines < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     DummyNode = Struct.new(:line)
 
     def visit_root(root)
@@ -16,7 +18,17 @@ module HamlLint
 
       return unless document.source.end_with?("\n\n")
 
-      record_lint(line_number, 'Files should not end with trailing empty lines')
+      record_lint(line_number, 'Files should not end with trailing empty lines',
+                  corrected: autocorrect?)
+
+      apply_autocorrect(corrected_source)
+    end
+
+    private
+
+    def corrected_source
+      last_non_empty_index = document.source_lines.rindex { |line| !line.empty? } || 0
+      "#{document.source_lines[0..last_non_empty_index].join("\n")}\n"
     end
   end
 end

data/lib/haml_lint/linter/trailing_whitespace.rb

@@ -5,17 +5,30 @@ module HamlLint
   class Linter::TrailingWhitespace < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     DummyNode = Struct.new(:line)
 
     def visit_root(root)
+      new_lines = document.source_lines.dup
+      changed = false
+
       document.source_lines.each_with_index do |line, index|
         next unless /\s+$/.match?(line)
 
         node = root.node_for_line(index + 1)
-        unless node.disabled?(self)
-          record_lint DummyNode.new(index + 1), 'Line contains trailing whitespace'
+        next if node.disabled?(self)
+
+        if autocorrect?
+          new_lines[index] = line.sub(/\s+$/, '')
+          changed = true
         end
+
+        record_lint(DummyNode.new(index + 1), 'Line contains trailing whitespace',
+                    corrected: autocorrect?)
       end
+
+      apply_autocorrect(new_lines.join("\n")) if changed
     end
   end
 end

data/lib/haml_lint/linter/unescaped_html.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module HamlLint
+  # Flags HAML's unescaped-output markers (`!=`, `!~`, and the unescaped
+  # plain-text `!`), which bypass HTML escaping.
+  #
+  # Like `raw`, `html_safe`, and `h()` in Rails, these make it easy to
+  # accidentally introduce XSS vulnerabilities when the output includes
+  # user-controlled data, e.g.:
+  #
+  #   != "Username: <strong>#{user.name}</strong>"
+  class Linter::UnescapedHtml < Linter
+    include LinterRegistry
+
+    MESSAGE =
+      'Avoid outputting unescaped HTML with `!`; it bypasses HTML escaping and ' \
+      'can introduce XSS vulnerabilities. Sanitize the value instead.'
+
+    def visit_script(node)
+      record_lint(node, MESSAGE) if /\A\s*!/.match?(node.source_code)
+    end
+
+    def visit_tag(node)
+      record_lint(node, MESSAGE) if node.unescape_html?
+    end
+  end
+end

data/lib/haml_lint/linter/unnecessary_interpolation.rb

@@ -11,21 +11,48 @@ module HamlLint
   class Linter::UnnecessaryInterpolation < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     def visit_tag(node)
       return if node.script.length <= 2
 
       count = 0
       chars = 2 # Include surrounding quote chars
-      HamlLint::Utils.extract_interpolated_values(node.script) do |interpolated_code, _line|
+      interpolated_code = nil
+      HamlLint::Utils.extract_interpolated_values(node.script) do |code, _line|
         count += 1
         return if count > 1 # rubocop:disable Lint/NonLocalExitFromIterator
-        chars += interpolated_code.length + 3
+        chars += code.length + 3
+        interpolated_code = code
       end
 
       if chars == node.script.length
+        corrected = correct_interpolation(node, interpolated_code)
         record_lint(node, '`%... \#{expression}` can be written without ' \
-                          'interpolation as `%...= expression`')
+                          'interpolation as `%...= expression`', corrected: corrected)
       end
     end
+
+    private
+
+    # @return [Boolean]
+    def correct_interpolation(node, interpolated_code)
+      return false unless interpolated_code
+
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      escaped = Regexp.escape(interpolated_code)
+
+      new_line =
+        if inline_content_is_string?(node)
+          line.sub(/=\s*"\#\{#{escaped}\}"\s*\z/, "= #{interpolated_code}")
+        else
+          line.sub(/\s+\#\{#{escaped}\}\s*\z/, "= #{interpolated_code}")
+        end
+
+      return false if new_line == line
+
+      correct_line(index, new_line)
+    end
   end
 end

data/lib/haml_lint/linter/unnecessary_string_output.rb

@@ -33,8 +33,11 @@ module HamlLint
 
     def outputs_string_literal?(script_node)
       return unless tree = parse_ruby(script_node.script)
-      %i[str dstr].include?(tree.type) &&
-        !starts_with_reserved_character?(tree.children.first)
+      return unless %i[str dstr].include?(tree.type)
+
+      !starts_with_reserved_character?(tree.children.first) &&
+        !contains_escape_sequence?(tree) &&
+        !contains_significant_whitespace?(tree)
     rescue ::Parser::SyntaxError
       # Gracefully ignore syntax errors, as that's managed by a different linter
     end
@@ -45,5 +48,34 @@ module HamlLint
       string = stringish.respond_to?(:children) ? stringish.children.first : stringish
       string =~ %r{\A\s*[/#-=%~]} if string.is_a?(String)
     end
+
+    # The ordered segments of a string literal, including any interpolation.
+    # A plain `str` node has no interpolation, so it is its own only segment.
+    def string_segments(tree)
+      tree.type == :dstr ? tree.children : [tree]
+    end
+
+    # Returns whether any literal portion of the string contains a backslash
+    # escape (e.g. `\n`, `\t`, `\u202F`). Such escapes are interpreted inside
+    # a Ruby string but would be emitted verbatim as HAML plain text, so the
+    # `= "..."` form is not equivalent to the unwrapped plain text.
+    def contains_escape_sequence?(tree)
+      string_segments(tree).any? do |segment|
+        segment.type == :str && segment.location.expression.source.include?('\\')
+      end
+    end
+
+    # Returns whether the string begins or ends with whitespace. HAML strips
+    # trailing whitespace from plain text (and leading whitespace denotes
+    # indentation), so unwrapping such a string would change the output.
+    def contains_significant_whitespace?(tree)
+      segments = string_segments(tree)
+      bounded_by_whitespace?(segments.first, /\A\s/) ||
+        bounded_by_whitespace?(segments.last, /\s\z/)
+    end
+
+    def bounded_by_whitespace?(segment, pattern)
+      segment.type == :str && segment.children.first.to_s.match?(pattern)
+    end
   end
 end

data/lib/haml_lint/linter.rb

@@ -63,6 +63,7 @@ module HamlLint
       @document = document
       @lints = []
       @autocorrect = autocorrect
+      reset_autocorrect_state
       visit(document.tree)
       @lints
     end
@@ -85,6 +86,30 @@ module HamlLint
       self.class.supports_autocorrect?
     end
 
+    # Returns whether this linter's autocorrect is safe. Defaults to true (safe)
+    # unless the linter declares otherwise via `autocorrect_safe(false)`.
+    #
+    # @return [Boolean]
+    def self.autocorrect_safe?
+      @autocorrect_safe != false
+    end
+
+    # The autocorrect ordering priority for this linter. During autocorrect,
+    # linters with a lower priority run first and higher priority run later,
+    # against the same (already mutated) document. Linters with the same priority
+    # keep their default (alphabetical) order.
+    #
+    # Called with an argument (e.g. `autocorrect_priority(1)`) in a linter's
+    # top-level scope, it sets the priority; called with no argument it reads it.
+    # The default, when never set, is 0.
+    #
+    # @param value [Integer, nil] the new priority, or nil to read the current one
+    # @return [Integer]
+    def self.autocorrect_priority(value = nil)
+      @autocorrect_priority = value unless value.nil?
+      @autocorrect_priority || 0
+    end
+
     private
 
     attr_reader :config, :document
@@ -97,6 +122,92 @@ module HamlLint
       @supports_autocorrect = value
     end
 
+    # Linters can call autocorrect_safe(false) in their top-level scope to declare that their
+    # autocorrect is unsafe, meaning it only runs under `--auto-correct-all` (`:all`).
+    # The default, when not called, is safe.
+    #
+    # @params value [Boolean] The new value for autocorrect_safe
+    private_class_method def self.autocorrect_safe(value)
+      @autocorrect_safe = value
+    end
+
+    # Resets the per-run autocorrect bookkeeping. Linter instances are reused
+    # across files, so subclasses that accumulate extra autocorrect state during
+    # a traversal (e.g. a list of lines to merge or delete) must override this,
+    # calling `super`, to clear that state between files. Otherwise corrections
+    # from one file leak into the next.
+    def reset_autocorrect_state
+      @autocorrected_lines = nil
+      @autocorrect_changed = false
+    end
+
+    # Whether the linter is currently allowed to apply autocorrections, given the active
+    # autocorrect mode and this linter's declared safety:
+    #
+    #   * safe linters correct under both `:safe` and `:all`;
+    #   * unsafe linters correct only under `:all`;
+    #   * with no mode (`nil`) nothing is corrected (detection only).
+    #
+    # @return [Boolean]
+    def autocorrect?
+      case @autocorrect
+      when :all
+        true
+      when :safe
+        self.class.autocorrect_safe?
+      else
+        false
+      end
+    end
+
+    # Applies a corrected, full-document source to the document through the single
+    # mutation path (`Document#change_source`), but only when the safety gate permits.
+    # No-ops otherwise; `change_source` itself also no-ops when the source is unchanged.
+    #
+    # @param new_source [String] the corrected HAML source
+    def apply_autocorrect(new_source)
+      return unless autocorrect?
+      document.change_source(new_source)
+    end
+
+    # Lazily-initialized working copy of the document's source lines, used to
+    # accumulate line-level corrections during a single tree traversal. Editing
+    # this copy (rather than calling `apply_autocorrect` per node) avoids
+    # reparsing the document mid-walk, which would invalidate the tree being
+    # visited.
+    #
+    # @return [Array<String>]
+    def autocorrected_lines
+      @autocorrected_lines ||= document.source_lines.dup
+    end
+
+    # Replaces a single source line (0-indexed) in the working copy, but only
+    # when autocorrect is permitted and the new text actually differs.
+    #
+    # @param index [Integer] the 0-indexed line to replace
+    # @param new_text [String] the corrected line
+    # @return [Boolean] true if a change was recorded, false otherwise
+    def correct_line(index, new_text)
+      return false unless autocorrect?
+      return false if autocorrected_lines[index] == new_text
+
+      autocorrected_lines[index] = new_text
+      @autocorrect_changed = true
+    end
+
+    # Flushes any corrections accumulated via `correct_line` through the single
+    # mutation path, once, after the whole tree has been visited. Defined on the
+    # base so per-node linters need no boilerplate; no-ops for linters that never
+    # accumulated a change (including those that apply within `visit_root`).
+    #
+    # NOTE: a linter that overrides `after_visit_root` must call `super`, or
+    # accumulated corrections will not be applied.
+    def after_visit_root(_node)
+      return unless @autocorrect_changed
+
+      apply_autocorrect(autocorrected_lines.join("\n"))
+    end
+
     # Record a lint for reporting back to the user.
     #
     # @param node_or_line [#line] line number or node to extract the line number from

data/lib/haml_lint/reporter/disabled_config_reporter.rb

@@ -5,10 +5,12 @@ require_relative 'progress_reporter'
 module HamlLint
   # Outputs a YAML configuration file based on existing violations.
   class Reporter::DisabledConfigReporter < Reporter::ProgressReporter
-    HEADING =
+    DEFAULT_EXCLUDE_LIMIT = 15
+
+    HEADING_TEMPLATE =
       ['# This configuration was generated by',
-       '# `haml-lint --auto-gen-config`',
-       "# on #{Time.now} using Haml-Lint version #{HamlLint::VERSION}.",
+       '# `%<command>s`',
+       '# on %<timestamp>s using Haml-Lint version %<version>s.',
        '# The point is for the user to remove these configuration records',
        '# one by one as the lints are removed from the code base.',
        '# Note that changes in the inspected code, or installation of new',
@@ -25,11 +27,12 @@ module HamlLint
     # Create the reporter that will display the report and write the config.
     #
     # @param _log [HamlLint::Logger]
-    def initialize(log, limit: 15)
+    def initialize(log, limit: DEFAULT_EXCLUDE_LIMIT, options: {})
       super(log)
       @linters_with_lints = Hash.new { |hash, key| hash[key] = [] }
       @linters_lint_count = Hash.new(0)
       @exclude_limit = limit
+      @options = options
     end
 
     # A hash of linters with the files that have that type of lint.
@@ -81,12 +84,30 @@ module HamlLint
 
     private
 
+    # Reconstructs the CLI command used to generate this config.
+    #
+    # @return [String] the command string
+    def command
+      cmd = "#{HamlLint::APP_NAME} --auto-gen-config"
+      if @options[:auto_gen_exclude_limit]
+        cmd += " --auto-gen-exclude-limit #{@options[:auto_gen_exclude_limit]}"
+      end
+      cmd
+    end
+
+    # The heading comment for the generated config file.
+    #
+    # @return [String]
+    def heading
+      format(HEADING_TEMPLATE, command: command, timestamp: Time.now, version: HamlLint::VERSION)
+    end
+
     # The contents of the generated configuration file based on captured lint.
     #
     # @return [String] a Yaml-formatted configuration file's contents
     def config_file_contents
       output = []
-      output << HEADING
+      output << heading
       output << 'linters:' if linters_with_lints.any?
       linters_with_lints.sort.each do |linter, files|
         output << generate_config_for_linter(linter, files)

data/lib/haml_lint/reporter/github_reporter.rb

@@ -3,16 +3,16 @@
 module HamlLint
   # Outputs GitHub workflow commands for GitHub check annotations when run within GitHub actions.
   class Reporter::GithubReporter < Reporter
+    # Characters to escape within a command message.
     ESCAPE_MAP = { '%' => '%25', "\n" => '%0A', "\r" => '%0D' }.freeze
+    # Property values also escape the `:` and `,` that delimit the command.
+    PROPERTY_ESCAPE_MAP = ESCAPE_MAP.merge(':' => '%3A', ',' => '%2C').freeze
 
     include Reporter::Utils
 
     def added_lint(lint, report)
-      if lint.severity >= report.fail_level
-        print_workflow_command(lint: lint)
-      else
-        print_workflow_command(severity: 'warning', lint: lint)
-      end
+      severity = lint.severity >= report.fail_level ? 'error' : 'warning'
+      print_workflow_command(lint, severity)
     end
 
     def display_report(report)
@@ -21,12 +21,30 @@ module HamlLint
 
     private
 
-    def print_workflow_command(lint:, severity: 'error')
-      log.log "::#{severity} file=#{lint.filename},line=#{lint.line}::#{github_escape(lint.message)}"
+    def print_workflow_command(lint, severity)
+      log.log "::#{severity} file=#{github_escape_property(lint.filename)}," \
+              "line=#{lint.line},title=#{github_escape_property(annotation_title(lint))}" \
+              "::#{github_escape(annotation_message(lint))}"
+    end
+
+    # Annotation title, naming the linter that produced the lint when known.
+    def annotation_title(lint)
+      lint.linter ? "haml-lint #{lint.linter.name}" : 'haml-lint'
+    end
+
+    # Message body, prefixed with the location and linter so it stays useful in the plain log.
+    def annotation_message(lint)
+      location = "#{lint.filename}:#{lint.line}"
+      location += " #{lint.linter.name}:" if lint.linter
+      "#{location} #{lint.message}"
     end
 
     def github_escape(string)
-      string.gsub(Regexp.union(ESCAPE_MAP.keys), ESCAPE_MAP)
+      string.to_s.gsub(Regexp.union(ESCAPE_MAP.keys), ESCAPE_MAP)
+    end
+
+    def github_escape_property(string)
+      string.to_s.gsub(Regexp.union(PROPERTY_ESCAPE_MAP.keys), PROPERTY_ESCAPE_MAP)
     end
   end
 end

data/lib/haml_lint/ruby_extraction/chunk_extractor.rb

@@ -9,7 +9,7 @@ module HamlLint::RubyExtraction
   class ChunkExtractor
     include HamlLint::HamlVisitor
 
-    attr_reader :script_output_prefix
+    attr_reader :script_output_prefix, :autocorrect
 
     HAML_PARSER_INSTANCE = if Haml::VERSION >= '5.0.0'
                              ::Haml::Parser.new({})
@@ -21,9 +21,10 @@ module HamlLint::RubyExtraction
     # We don't. So the regex must be fixed to correctly detect the start of the string.
     BLOCK_KEYWORD_REGEX = Regexp.new(Haml::Parser::BLOCK_KEYWORD_REGEX.source.sub('^', '\A'))
 
-    def initialize(document, script_output_prefix:)
+    def initialize(document, script_output_prefix:, autocorrect: nil)
       @document = document
       @script_output_prefix = script_output_prefix
+      @autocorrect = autocorrect
     end
 
     def extract
@@ -299,7 +300,13 @@ module HamlLint::RubyExtraction
       end
 
       if attributes_code&.start_with?('{')
-        # Looks like the .foo(bar = 123) case. Ignoring.
+        # HTML-style (parens) attributes, e.g. %div(foo=foo), arrive as a synthesized hash string
+        # like '{"foo" => foo,}'. That text isn't present verbatim in the HAML, so we can't map
+        # RuboCop corrections back and intentionally don't autocorrect it. We still extract the
+        # attribute *values* as a non-correctable chunk so RuboCop sees variables used here;
+        # otherwise they look unused (false Lint/UselessAssignment, plus unsafe autocorrect that
+        # removes the assignment). See issue #648.
+        add_html_attributes_value_usage(node, attributes_code, indent: indent)
         attributes_code = nil
       end
 
@@ -344,6 +351,22 @@ module HamlLint::RubyExtraction
       final_line_index
     end
 
+    # For HTML-style (parens) attributes, adds the attribute value expressions as a
+    # non-autocorrectable chunk purely so RuboCop counts the variables/methods used there.
+    def add_html_attributes_value_usage(node, attributes_code, indent:)
+      ast = parse_ruby(attributes_code)
+      return unless ast&.type == :hash
+
+      value_sources = ast.children.filter_map do |pair|
+        next unless pair.type == :pair
+        pair.children[1]&.source
+      end
+      return if value_sources.empty?
+
+      lines = value_sources.map { |value| "#{' ' * indent}#{script_output_prefix}#{value}" }
+      @ruby_chunks << AdHocChunk.new(node, lines)
+    end
+
     # Visiting the script besides tag. The part to the right of the equal sign of
     # lines looking like `  %div= foo(bar)`
     def visit_tag_script(node, line_index:, indent:)
@@ -391,8 +414,10 @@ module HamlLint::RubyExtraction
       filter_name_indent = @original_haml_lines[node.line - 1].index(/\S/)
       if node.filter_type == 'ruby'
         # The indentation in node.text is normalized, so that at least one line
-        # is indented by 0.
-        lines = node.text.split("\n")
+        # is indented by 0. Split("\n", -1) + pop keeps trailing blank lines (plain split drops them),
+        # which the end marker needs so it doesn't land right after the last code line.
+        lines = node.text.split("\n", -1)
+        lines.pop
         lines.map! do |line|
           if !/\S/.match?(line)
             # whitespace or empty
@@ -637,8 +662,19 @@ module HamlLint::RubyExtraction
     def wrap_lines(lines, wrap_depth)
       lines = lines.dup
       wrapping_prefix = 'W' * (wrap_depth - 1) + '('
+
+      # Strip leading/trailing space only when linting (not autocorrecting) to avoid SpaceInsideParens violations.
+      # Preserve spaces for fully nested attribute hashes that need no adjustment.
+      # Preserve spaces during autocorrect, so RuboCop can fix them and map corrections back correctly.
+      unless lines[0] =~ /^\s*$/ || autocorrect
+        leading_spaces = lines[0][/^\s*/].length
+        lines = lines.map { |line| line.gsub(/^\s{,#{leading_spaces}}/, '') }
+        lines[-1] = lines[-1].gsub(/\s+\z/, '')
+      end
+
       lines[0] = wrapping_prefix + lines[0]
       lines[-1] = lines[-1] + ')'
+
       lines
     end