haml_lint 0.73.0 → 0.75.0

data/lib/haml_lint/linter/multiline_script.rb

@@ -5,6 +5,9 @@ module HamlLint
   class Linter::MultilineScript < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+    autocorrect_safe(false)
+
     # List of operators that can split a script into two lines that we want to
     # alert on.
     SPLIT_OPERATORS = %w[
@@ -31,8 +34,40 @@ module HamlLint
       check(node)
     end
 
+    def after_visit_root(node)
+      super
+      return if merges.empty?
+
+      apply_autocorrect(merged_source)
+    end
+
     private
 
+    def reset_autocorrect_state
+      super
+      @merges = []
+    end
+
+    def merged_source
+      lines = document.source_lines.dup
+      to_delete = apply_merges(lines)
+      lines.reject.with_index { |_, index| to_delete.include?(index) }.join("\n")
+    end
+
+    # Mutates +lines+ in place, folding each continuation script onto its chain
+    # root, and returns the line indices that should be deleted.
+    #
+    # @return [Array<Integer>]
+    def apply_merges(lines)
+      redirect = {}
+      merges.sort_by { |merge| merge[:from] }.map do |merge|
+        root = redirect.fetch(merge[:from], merge[:from])
+        redirect[merge[:succ_line]] = root
+        lines[root] = "#{lines[root].rstrip} #{merge[:succ_script]}"
+        merge[:succ_line]
+      end
+    end
+
     def check(node)
       # Condition occurs when scripts do not contain nested content, e.g.
       #
@@ -48,11 +83,36 @@ module HamlLint
       return unless node.children.empty?
 
       operator = node.script[/\s+(\S+)\z/, 1]
-      if SPLIT_OPERATORS.include?(operator)
-        record_lint(node,
-                    "Script with trailing operator `#{operator}` should be " \
-                    'merged with the script on the following line')
-      end
+      return unless SPLIT_OPERATORS.include?(operator)
+
+      corrected = collect_merge(node)
+      record_lint(node,
+                  "Script with trailing operator `#{operator}` should be " \
+                  'merged with the script on the following line',
+                  corrected: corrected)
+    end
+
+    def collect_merge(node)
+      return false unless autocorrect?
+
+      # Only merge with the immediately following sibling on the next line.
+      # `node.successor` would climb to an ancestor's sibling when this script is
+      # the last child of its block, which would pull a line from outside the
+      # block into it and change the semantics.
+      succ = node.subsequents.first
+      return false unless succ && %i[script silent_script].include?(succ.type)
+      return false unless succ.line == node.line + 1
+
+      merges << {
+        from: node.line - 1,
+        succ_line: succ.line - 1,
+        succ_script: succ.script.strip,
+      }
+      true
+    end
+
+    def merges
+      @merges ||= []
     end
   end
 end

data/lib/haml_lint/linter/rubocop.rb

@@ -4,14 +4,14 @@ require 'rubocop'
 require 'tempfile'
 
 module HamlLint
-  # Runs RuboCop on the Ruby code contained within HAML templates.
+  # Runs RuboCop on the Ruby code contained within Haml templates.
   #
   # The processing is done by extracting a Ruby file that matches the content, including
-  # the indentation, of the HAML file. This way, we can run RuboCop with autocorrect
-  # and get new Ruby code which should be HAML compatible.
+  # the indentation, of the Haml file. This way, we can run RuboCop with autocorrect
+  # and get new Ruby code which should be Haml compatible.
   #
-  # The ruby extraction makes "Chunks" which wrap each HAML constructs. The Chunks can then
-  # use the corrected Ruby code to apply the corrections back in the HAML using logic specific
+  # The ruby extraction makes "Chunks" which wrap each Haml constructs. The Chunks can then
+  # use the corrected Ruby code to apply the corrections back in the Haml using logic specific
   # to each type of Chunk.
   #
   # The work is spread across the classes in the HamlLint::RubyExtraction module.
@@ -20,10 +20,12 @@ module HamlLint
     class Runner < ::RuboCop::Runner
       attr_reader :offenses
 
-      def run(haml_path, ruby_code, config:, allow_cache: false)
-        @allow_cache = allow_cache
+      def run(haml_path, ruby_code, config:)
         @offenses = []
         @config_store.instance_variable_set(:@options_config, config)
+        # Using stdin also disables RuboCop's result cache, which is intentional:
+        # it reconstructs offense positions from the on-disk Haml, not the Ruby we
+        # inspected, so reusing it misreports lines (sds/haml-lint#593).
         @options[:stdin] = ruby_code
         super([haml_path])
       end
@@ -40,20 +42,6 @@ module HamlLint
       def file_finished(_file, offenses)
         @offenses = offenses
       end
-
-      # RuboCop caches results by taking a hash of the file contents & path, among other things.
-      # It disables its cache when working on file-content from stdin.
-      # Unfortunately we always use RuboCop's stdin, even when we're linting a file on-disk.
-      # So, override RuboCop::Runner#cached_run? so that it'll allow caching results, so long
-      # as haml-lint itself isn't being invoked with files on stdin.
-      def cached_run?
-        return false unless @allow_cache
-
-        @cached_run ||=
-          (@options[:cache] == 'true' ||
-          (@options[:cache] != 'false' && @config_store.for_pwd.for_all_cops['UseCache'])) &&
-          !@options[:auto_gen_config]
-      end
     end
 
     include LinterRegistry
@@ -242,7 +230,7 @@ module HamlLint
     # @param path [String] the path to tell RuboCop we are running
     # @return [Array<RuboCop::Cop::Offense>, String]
     def run_rubocop(rubocop_runner, ruby_code, path) # rubocop:disable Metrics
-      rubocop_runner.run(path, ruby_code, config: rubocop_config_for(path), allow_cache: @document&.file_on_disk)
+      rubocop_runner.run(path, ruby_code, config: rubocop_config_for(path))
 
       if ENV['HAML_LINT_INTERNAL_DEBUG'] == 'true'
         if rubocop_runner.offenses.empty?

data/lib/haml_lint/linter/ruby_comments.rb

@@ -1,14 +1,17 @@
 # frozen_string_literal: true
 
 module HamlLint
-  # Checks for Ruby comments that can be written as HAML comments.
+  # Checks for Ruby comments that can be written as Haml comments.
   class Linter::RubyComments < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     def visit_silent_script(node)
-      if code_comment?(node)
-        record_lint(node, 'Use `-#` for comments instead of `- #`')
-      end
+      return unless code_comment?(node)
+
+      corrected = correct_comment(node)
+      record_lint(node, 'Use `-#` for comments instead of `- #`', corrected: corrected)
     end
 
     private
@@ -16,5 +19,12 @@ module HamlLint
     def code_comment?(node)
       node.script =~ /\A\s+#/
     end
+
+    # @return [Boolean]
+    def correct_comment(node)
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      correct_line(index, line.sub(/\A(\s*)-\s+#/, '\1-#'))
+    end
   end
 end

data/lib/haml_lint/linter/space_before_script.rb

@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 
 module HamlLint
-  # Checks for Ruby script in HAML templates with no space after the `=`/`-`.
+  # Checks for Ruby script in Haml templates with no space after the `=`/`-`.
   class Linter::SpaceBeforeScript < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     MESSAGE_FORMAT = 'The %s symbol should have one space separating it from code'
 
     ALLOWED_SEPARATORS = [' ', '#'].freeze
@@ -33,18 +35,23 @@ module HamlLint
       # (need to do it this way as the parser strips whitespace from node)
       return unless tag_with_text[index - 1] != ' '
 
-      record_lint(node, MESSAGE_FORMAT % '=')
+      corrected = correct_inline_script(node, text)
+      record_lint(node, MESSAGE_FORMAT % '=', corrected: corrected)
     end
 
     def visit_script(node)
       # Plain text nodes with interpolation are converted to script nodes, so we
       # need to ignore them here.
       return unless document.source_lines[node.line - 1].lstrip.start_with?('=')
-      record_lint(node, MESSAGE_FORMAT % '=') if missing_space?(node)
+      return unless missing_space?(node)
+
+      record_lint(node, MESSAGE_FORMAT % '=', corrected: correct_leading_marker(node, '='))
     end
 
     def visit_silent_script(node)
-      record_lint(node, MESSAGE_FORMAT % '-') if missing_space?(node)
+      return unless missing_space?(node)
+
+      record_lint(node, MESSAGE_FORMAT % '-', corrected: correct_leading_marker(node, '-'))
     end
 
     private
@@ -53,5 +60,31 @@ module HamlLint
       text = node.script
       !ALLOWED_SEPARATORS.include?(text[0]) if text
     end
+
+    # Inserts one space after a leading `=`/`-` marker.
+    #
+    # @return [Boolean]
+    def correct_leading_marker(node, marker)
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      escaped = Regexp.escape(marker)
+      correct_line(index, line.sub(/\A(\s*#{escaped})(?=[^\s#{escaped}])/, '\1 '))
+    end
+
+    # Inserts a space after the `=` marker introducing a tag's inline script.
+    #
+    # @return [Boolean]
+    def correct_inline_script(node, text)
+      index = node.line - 1
+      line = autocorrected_lines[index]
+
+      pos = line.rindex("=#{text}")
+      if pos.nil? && (unquoted = strip_surrounding_quotes(text))
+        pos = line.rindex("=#{unquoted}")
+      end
+      return false unless pos
+
+      correct_line(index, "#{line[0..pos]} #{line[(pos + 1)..]}")
+    end
   end
 end

data/lib/haml_lint/linter/space_inside_hash_attributes.rb

@@ -6,6 +6,8 @@ module HamlLint
   class Linter::SpaceInsideHashAttributes < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     STYLE = {
       'no_space' => {
         start_regex: /\A\{[^ ]/,
@@ -24,11 +26,47 @@ module HamlLint
     def visit_tag(node)
       return unless node.hash_attributes?
 
-      style = STYLE[config['style'] == 'no_space' ? 'no_space' : 'space']
+      style_name = config['style'] == 'no_space' ? 'no_space' : 'space'
+      style = STYLE[style_name]
       source = node.hash_attributes_source
 
-      record_lint(node, style[:start_message]) unless source&.match?(style[:start_regex])
-      record_lint(node, style[:end_message]) unless source&.match?(style[:end_regex])
+      start_ok = source.match?(style[:start_regex])
+      end_ok = source.match?(style[:end_regex])
+      return if start_ok && end_ok
+
+      corrected = correct_hash_spacing(node, source, style_name)
+      record_lint(node, style[:start_message], corrected: corrected) unless start_ok
+      record_lint(node, style[:end_message], corrected: corrected) unless end_ok
+    end
+
+    private
+
+    # @return [Boolean]
+    def correct_hash_spacing(node, source, style_name)
+      return false unless source
+      return false if source.include?("\n") # multi-line hash: detection-only
+
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      return false unless line.include?(source)
+
+      fixed = corrected_hash_source(source, style_name)
+      return false if fixed == source
+
+      correct_line(index, line.sub(source) { fixed })
+    end
+
+    # @return [String]
+    def corrected_hash_source(source, style_name)
+      inner = source[1...-1].strip
+
+      if style_name == 'no_space'
+        "{#{inner}}"
+      elsif inner.empty?
+        '{ }'
+      else
+        "{ #{inner} }"
+      end
     end
   end
 end

data/lib/haml_lint/linter/tag_name.rb

@@ -5,11 +5,24 @@ module HamlLint
   class Linter::TagName < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     def visit_tag(node)
       tag = node.tag_name
       return unless /[A-Z]/.match?(tag)
 
-      record_lint(node, "`#{tag}` should be written in lowercase as `#{tag.downcase}`")
+      corrected = correct_tag_name(node, tag)
+      record_lint(node, "`#{tag}` should be written in lowercase as `#{tag.downcase}`",
+                  corrected: corrected)
+    end
+
+    private
+
+    # @return [Boolean]
+    def correct_tag_name(node, tag)
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      correct_line(index, line.sub(/(%)#{Regexp.escape(tag)}/, "\\1#{tag.downcase}"))
     end
   end
 end

data/lib/haml_lint/linter/trailing_empty_lines.rb

@@ -5,6 +5,8 @@ module HamlLint
   class Linter::TrailingEmptyLines < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     DummyNode = Struct.new(:line)
 
     def visit_root(root)
@@ -16,7 +18,17 @@ module HamlLint
 
       return unless document.source.end_with?("\n\n")
 
-      record_lint(line_number, 'Files should not end with trailing empty lines')
+      record_lint(line_number, 'Files should not end with trailing empty lines',
+                  corrected: autocorrect?)
+
+      apply_autocorrect(corrected_source)
+    end
+
+    private
+
+    def corrected_source
+      last_non_empty_index = document.source_lines.rindex { |line| !line.empty? } || 0
+      "#{document.source_lines[0..last_non_empty_index].join("\n")}\n"
     end
   end
 end

data/lib/haml_lint/linter/trailing_whitespace.rb

@@ -5,17 +5,30 @@ module HamlLint
   class Linter::TrailingWhitespace < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     DummyNode = Struct.new(:line)
 
     def visit_root(root)
+      new_lines = document.source_lines.dup
+      changed = false
+
       document.source_lines.each_with_index do |line, index|
         next unless /\s+$/.match?(line)
 
         node = root.node_for_line(index + 1)
-        unless node.disabled?(self)
-          record_lint DummyNode.new(index + 1), 'Line contains trailing whitespace'
+        next if node.disabled?(self)
+
+        if autocorrect?
+          new_lines[index] = line.sub(/\s+$/, '')
+          changed = true
         end
+
+        record_lint(DummyNode.new(index + 1), 'Line contains trailing whitespace',
+                    corrected: autocorrect?)
       end
+
+      apply_autocorrect(new_lines.join("\n")) if changed
     end
   end
 end

data/lib/haml_lint/linter/unescaped_html.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module HamlLint
+  # Flags Haml's unescaped-output markers (`!=`, `!~`, and the unescaped
+  # plain-text `!`), which bypass HTML escaping.
+  #
+  # Like `raw`, `html_safe`, and `h()` in Rails, these make it easy to
+  # accidentally introduce XSS vulnerabilities when the output includes
+  # user-controlled data, e.g.:
+  #
+  #   != "Username: <strong>#{user.name}</strong>"
+  class Linter::UnescapedHtml < Linter
+    include LinterRegistry
+
+    MESSAGE =
+      'Avoid outputting unescaped HTML with `!`; it bypasses HTML escaping and ' \
+      'can introduce XSS vulnerabilities. Sanitize the value instead.'
+
+    def visit_script(node)
+      record_lint(node, MESSAGE) if /\A\s*!/.match?(node.source_code)
+    end
+
+    def visit_tag(node)
+      record_lint(node, MESSAGE) if node.unescape_html?
+    end
+  end
+end

data/lib/haml_lint/linter/unnecessary_interpolation.rb

@@ -11,21 +11,48 @@ module HamlLint
   class Linter::UnnecessaryInterpolation < Linter
     include LinterRegistry
 
+    supports_autocorrect(true)
+
     def visit_tag(node)
       return if node.script.length <= 2
 
       count = 0
       chars = 2 # Include surrounding quote chars
-      HamlLint::Utils.extract_interpolated_values(node.script) do |interpolated_code, _line|
+      interpolated_code = nil
+      HamlLint::Utils.extract_interpolated_values(node.script) do |code, _line|
         count += 1
         return if count > 1 # rubocop:disable Lint/NonLocalExitFromIterator
-        chars += interpolated_code.length + 3
+        chars += code.length + 3
+        interpolated_code = code
       end
 
       if chars == node.script.length
+        corrected = correct_interpolation(node, interpolated_code)
         record_lint(node, '`%... \#{expression}` can be written without ' \
-                          'interpolation as `%...= expression`')
+                          'interpolation as `%...= expression`', corrected: corrected)
       end
     end
+
+    private
+
+    # @return [Boolean]
+    def correct_interpolation(node, interpolated_code)
+      return false unless interpolated_code
+
+      index = node.line - 1
+      line = autocorrected_lines[index]
+      escaped = Regexp.escape(interpolated_code)
+
+      new_line =
+        if inline_content_is_string?(node)
+          line.sub(/=\s*"\#\{#{escaped}\}"\s*\z/, "= #{interpolated_code}")
+        else
+          line.sub(/\s+\#\{#{escaped}\}\s*\z/, "= #{interpolated_code}")
+        end
+
+      return false if new_line == line
+
+      correct_line(index, new_line)
+    end
   end
 end

data/lib/haml_lint/linter/unnecessary_string_output.rb

@@ -20,7 +20,7 @@ module HamlLint
     end
 
     def visit_script(node)
-      # Some script nodes created by the HAML parser aren't actually script
+      # Some script nodes created by the Haml parser aren't actually script
       # nodes declared via the `=` marker. Check for it.
       return unless /\A\s*=/.match?(node.source_code)
 
@@ -33,8 +33,11 @@ module HamlLint
 
     def outputs_string_literal?(script_node)
       return unless tree = parse_ruby(script_node.script)
-      %i[str dstr].include?(tree.type) &&
-        !starts_with_reserved_character?(tree.children.first)
+      return unless %i[str dstr].include?(tree.type)
+
+      !starts_with_reserved_character?(tree.children.first) &&
+        !contains_escape_sequence?(tree) &&
+        !contains_significant_whitespace?(tree)
     rescue ::Parser::SyntaxError
       # Gracefully ignore syntax errors, as that's managed by a different linter
     end
@@ -45,5 +48,34 @@ module HamlLint
       string = stringish.respond_to?(:children) ? stringish.children.first : stringish
       string =~ %r{\A\s*[/#-=%~]} if string.is_a?(String)
     end
+
+    # The ordered segments of a string literal, including any interpolation.
+    # A plain `str` node has no interpolation, so it is its own only segment.
+    def string_segments(tree)
+      tree.type == :dstr ? tree.children : [tree]
+    end
+
+    # Returns whether any literal portion of the string contains a backslash
+    # escape (e.g. `\n`, `\t`, `\u202F`). Such escapes are interpreted inside
+    # a Ruby string but would be emitted verbatim as Haml plain text, so the
+    # `= "..."` form is not equivalent to the unwrapped plain text.
+    def contains_escape_sequence?(tree)
+      string_segments(tree).any? do |segment|
+        segment.type == :str && segment.location.expression.source.include?('\\')
+      end
+    end
+
+    # Returns whether the string begins or ends with whitespace. Haml strips
+    # trailing whitespace from plain text (and leading whitespace denotes
+    # indentation), so unwrapping such a string would change the output.
+    def contains_significant_whitespace?(tree)
+      segments = string_segments(tree)
+      bounded_by_whitespace?(segments.first, /\A\s/) ||
+        bounded_by_whitespace?(segments.last, /\s\z/)
+    end
+
+    def bounded_by_whitespace?(segment, pattern)
+      segment.type == :str && segment.children.first.to_s.match?(pattern)
+    end
   end
 end