hamlit 2.6.0 → 2.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: acd45b093acf5ae8f7120e1e7e595028fa78915b
-  data.tar.gz: cf875adfcd85ff188fdc10efdb0af616cb2fd993
+  metadata.gz: 0b8b35eeaefa28bac22fe4535c4d33563974f734
+  data.tar.gz: 2c321cb4eafe5c6e0c7e913334867b46680b6510
 SHA512:
-  metadata.gz: 48cdaa2c88be9efe9a526f025c94ed30ec6a597971097a5976f502d74ab4914f08635ceccdc4aa38f226419920a775b50a5f4f42c3b54a7afdf87974ea6778ce
-  data.tar.gz: f7cf63537580965878635d161a4c619caba202f5e0f1626f5f4a7bcd6bd28fb96ce7b421a2ba57a3966ee0dcf2f1c6fcc5273eb7b32cf920108b777c0ce5193c
+  metadata.gz: 4ee32ce74ac89cf0fe7142ffdf3321ce83f4d69806976f7bed04757b943f78434c2a36ab85dc6c9b8ae85594cdfc2e3cfe5ffeb5eba0c723a9e9ec2c0006dec8
+  data.tar.gz: a15d8443095adca91607fa58e82e1c03bfa8cc2a64df0244b76e630377f2360f3c6b58281978b3ca5340d34092477f3aefc6e9594a376b45736bc10c177ac25a

data/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file. This
 project adheres to [Semantic Versioning](http://semver.org/). This change log is based upon
 [keep-a-changelog](https://github.com/olivierlacan/keep-a-changelog).
 
+## [2.6.1](https://github.com/k0kubun/hamlit/compare/v2.6.0...v2.6.1) - 2016-08-18
+
+### Fixed
+
+- For Rails, escape attributes even if it's html\_safe
+  - This is the same fix as Rails for [CVE-2016-6316](https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE)
+
 ## [2.6.0](https://github.com/k0kubun/hamlit/compare/v2.5.0...v2.6.0) - 2016-08-14
 
 ### Changed

data/lib/hamlit/attribute_compiler.rb

@@ -93,7 +93,7 @@ module Hamlit
         case value
         when true then temple << [:html, :attr, key, @format == :xhtml ? [:static, key] : [:multi]]
         when false, nil
-        else temple << [:html, :attr, key, [:escape, @escape_attrs, [:static, value.to_s]]]
+        else temple << [:html, :attr, key, [:fescape, @escape_attrs, [:static, value.to_s]]]
         end
       else
         var = @identity.generate
@@ -101,13 +101,13 @@ module Hamlit
           :case, "(#{var} = (#{exp}))",
           ['true', [:html, :attr, key, @format == :xhtml ? [:static, key] : [:multi]]],
           ['false, nil', [:multi]],
-          [:else, [:multi, [:static, " #{key}=#{@quote}"], [:escape, @escape_attrs, [:dynamic, var]], [:static, @quote]]],
+          [:else, [:multi, [:static, " #{key}=#{@quote}"], [:fescape, @escape_attrs, [:dynamic, var]], [:static, @quote]]],
         ]
       end
     end
 
     def compile_common!(temple, key, values)
-      temple << [:html, :attr, key, [:escape, @escape_attrs, values.last]]
+      temple << [:html, :attr, key, [:fescape, @escape_attrs, values.last]]
     end
 
     def attribute_builder(type, values)

data/lib/hamlit/engine.rb

@@ -2,6 +2,7 @@ require 'temple'
 require 'hamlit/parser'
 require 'hamlit/compiler'
 require 'hamlit/escapable'
+require 'hamlit/force_escapable'
 require 'hamlit/html'
 require 'hamlit/string_splitter'
 require 'hamlit/static_analyzer'
@@ -26,6 +27,7 @@ module Hamlit
     use StringSplitter
     use StaticAnalyzer
     use Escapable
+    use ForceEscapable
     filter :ControlFlow
     filter :MultiFlattener
     filter :StaticMerger

data/lib/hamlit/force_escapable.rb

@@ -0,0 +1,28 @@
+require 'hamlit/escapable'
+
+module Hamlit
+  # This module allows Temple::Filter to dispatch :fescape on `#compile`.
+  module FescapeDispathcer
+    def on_fescape(flag, exp)
+      [:fescape, flag, compile(exp)]
+    end
+  end
+  ::Temple::Filter.include FescapeDispathcer
+
+  # Unlike Hamlit::Escapable, this escapes value even if it's html_safe.
+  class ForceEscapable < Escapable
+    def initialize(opts = {})
+      super
+      @escape_code = options[:escape_code] || "::Hamlit::Utils.escape_html((%s))"
+      @escaper = eval("proc {|v| #{@escape_code % 'v'} }")
+    end
+
+    alias_method :on_fescape, :on_escape
+
+    # ForceEscapable doesn't touch :escape expression.
+    # This method is not used if it's inserted after Hamlit::Escapable.
+    def on_escape(flag, exp)
+      [:escape, flag, compile(exp)]
+    end
+  end
+end

data/lib/hamlit/version.rb

@@ -1,3 +1,3 @@
 module Hamlit
-  VERSION = '2.6.0'
+  VERSION = '2.6.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hamlit
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.6.1
 platform: ruby
 authors:
 - Takashi Kokubun
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-08-14 00:00:00.000000000 Z
+date: 2016-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: temple
@@ -323,6 +323,7 @@ files:
 - lib/hamlit/filters/scss.rb
 - lib/hamlit/filters/text_base.rb
 - lib/hamlit/filters/tilt_base.rb
+- lib/hamlit/force_escapable.rb
 - lib/hamlit/helpers.rb
 - lib/hamlit/html.rb
 - lib/hamlit/identity.rb