hamlit 0.4.3 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1688e256cfeb017819cd1ea62ba2a083a9347224
-  data.tar.gz: 77978ed4df48aa09950e3462ea3e00914d1da7e8
+  metadata.gz: f3c1078cb3f9e7ede4ba7c795b4e3efc2362741f
+  data.tar.gz: 698a072f9a818ce45c49840474b3a195ce1eddaf
 SHA512:
-  metadata.gz: cb9bdcb4facccdb71d92e5e80014797326ac2c1e118b61a137b203ec4f145ad4d2529a58a0450beb340f623909f035cdf824e91fed50e2708bac1ec582a22840
-  data.tar.gz: 3e1a31ea12ab7ab547e7b38516cf80b95f48a29ef3c7cf20d4a8c128eeb0dd1f5499cbd59cf4ff86e8df6bf453487b0f8fcd7a1d4d6efd54e1df3070d391a17a
+  metadata.gz: 87200444daaae8c0d02f191bd001bfee731e357087220926f8fb4c8659c2e9028af2996d1d819b7002cf1ad7582b80bcd83962ea24bd4ece1c04e3fcaa8f2d6a
+  data.tar.gz: dce886340c509921c981afdcc7f83d1d9a5f8bd175c796dc285064a6f2f8e35e68e9929a8ce6158087919bde932f695e4db989d941f34b0384e4221d041d8b30

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v0.5.0
+
+- Escape special characters in attribute values
+ - https://github.com/k0kubun/hamlit/issues/10
+ - Thanks to @mono0x, @eagletmt
+
 ## v0.4.3
 
 - Allow empty else statement

data/lib/hamlit/compilers/attributes.rb

@@ -1,5 +1,6 @@
 require 'hamlit/compilers/new_attribute'
 require 'hamlit/compilers/old_attribute'
+require 'hamlit/concerns/escapable'
 require 'hamlit/concerns/included'
 
 module Hamlit
@@ -10,6 +11,8 @@ module Hamlit
       include Compilers::OldAttribute
 
       included do
+        include Concerns::Escapable
+
         define_options :format, :attr_quote
       end
 
@@ -18,11 +21,21 @@ module Hamlit
         attrs = join_ids(attrs)
         attrs = combine_classes(attrs)
         attrs = pull_class_first(attrs)
-        [:html, :attrs, *attrs]
+        [:html, :attrs, *escape_attribute_values(attrs)]
       end
 
       private
 
+      def escape_attribute_values(attrs)
+        attrs.map do |attr|
+          _, _, name, value = attr
+          type, arg = value
+          next attr unless name && type && type && arg
+
+          [:html, :attr, name, escape_html(value, true)]
+        end
+      end
+
       def compile_attributes(exps)
         attrs = []
         exps.each do |exp|

data/lib/hamlit/version.rb

@@ -1,3 +1,3 @@
 module Hamlit
-  VERSION = "0.4.3"
+  VERSION = "0.5.0"
 end

data/spec/hamlit/engine/new_attribute_spec.rb

@@ -15,5 +15,31 @@ describe Hamlit::Engine do
         <p a='1' b='2'>bar</p>
       HTML
     end
+
+    describe 'html escape' do
+      it 'escapes attribute values on static attributes' do
+        assert_render(<<-'HAML', <<-HTML)
+          %a(title="'")
+          %a(title = "'\"")
+          %a(href='/search?foo=bar&hoge=<fuga>')
+        HAML
+          <a title='&#39;'></a>
+          <a title='&#39;&quot;'></a>
+          <a href='/search?foo=bar&amp;hoge=&lt;fuga&gt;'></a>
+        HTML
+      end
+
+      it 'escapes attribute values on dynamic attributes' do
+        assert_render(<<-'HAML', <<-HTML)
+          - title = "'\""
+          - href  = '/search?foo=bar&hoge=<fuga>'
+          %a(title=title)
+          %a(href=href)
+        HAML
+          <a title='&#39;&quot;'></a>
+          <a href='/search?foo=bar&amp;hoge=&lt;fuga&gt;'></a>
+        HTML
+      end
+    end
   end
 end

data/spec/hamlit/engine/old_attributes_spec.rb

@@ -78,15 +78,6 @@ describe Hamlit::Engine do
       HTML
     end
 
-    it 'renders runtime hash attribute escaping only value' do
-      assert_render(<<-'HAML', <<-HTML)
-        - hash = { "'<foo>'" => '<bar>' }
-        %span{ hash }
-      HAML
-        <span '<foo>'='&lt;bar&gt;'></span>
-      HTML
-    end
-
     it 'renders multi-byte chars as static attribute value' do
       assert_render(<<-'HAML', <<-HTML)
         %img{ alt: 'こんにちは' }
@@ -95,6 +86,44 @@ describe Hamlit::Engine do
       HTML
     end
 
+    describe 'html escape' do
+      it 'escapes attribute values on static attributes' do
+        assert_render(<<-'HAML', <<-HTML)
+          %a{title: "'"}
+          %a{title: "'\""}
+          %a{href: '/search?foo=bar&hoge=<fuga>'}
+        HAML
+          <a title='&#39;'></a>
+          <a title='&#39;&quot;'></a>
+          <a href='/search?foo=bar&amp;hoge=&lt;fuga&gt;'></a>
+        HTML
+      end
+
+      it 'escapes attribute values on dynamic attributes' do
+        assert_render(<<-'HAML', <<-HTML)
+          - title = "'\""
+          - href  = '/search?foo=bar&hoge=<fuga>'
+          %a{title: title}
+          %a{href: href}
+        HAML
+          <a title='&#39;&quot;'></a>
+          <a href='/search?foo=bar&amp;hoge=&lt;fuga&gt;'></a>
+        HTML
+      end
+
+      it 'escapes attribute values on hash attributes' do
+        assert_render(<<-'HAML', <<-HTML)
+          - title = { title: "'\"" }
+          - href  = { href:  '/search?foo=bar&hoge=<fuga>' }
+          %a{ title }
+          %a{ href }
+        HAML
+          <a title='&#39;&quot;'></a>
+          <a href='/search?foo=bar&amp;hoge=&lt;fuga&gt;'></a>
+        HTML
+      end
+    end
+
     describe 'nested attributes' do
       it 'renders true attributes' do
         assert_render(<<-'HAML', <<-HTML)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hamlit
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.5.0
 platform: ruby
 authors:
 - Takashi Kokubun