jekyll-documents 0.7.1 → 0.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa2578d6c2919197cbd6a80f56d4b93a55e3a41c6bc9801b6344094460a5e764
-  data.tar.gz: 2905501bf1a5d4d7050852dbb7293d179cd9abd6a11218a7649f155ded19109e
+  metadata.gz: aa6c0e2569d3772c02fe174700001a8290d7b313e7b068781d21627172d9e785
+  data.tar.gz: 407cc042bf5b2de1fe1b01cf9c9043bd961c811de7d0e6ee2dc896b1ab29e1dc
 SHA512:
-  metadata.gz: 899348532a7c8df6f816ed8795070c63881999f7f01b060332ae80f4b14ff183864f5543a1b63b20b461a1650cef16642ab4739148e9af763c590f55b416d357
-  data.tar.gz: e94844d7dd1614560fbbe0f8fe11d46a88f99e461aa778fc61cfc4765dfa26188d96986eebc46e693054ec3c6c4e3eb2a0661053c88278436cd1826000f3ed28
+  metadata.gz: d9016ce9608b013d8b0b6ac4d3756512d99a17cb55d5c2d2d67e096ccb5175e07ca40a17c68629dd09c684b5291fcad0ea1b876d74e7e58b0fedff0a7d1b97c7
+  data.tar.gz: f13021dccbed117f29e6c3f2c3d70f9ba9c499f3008ba30083f69c710ba3b30753a72009e3b84fa7fed64c3c73e8a85d20630cbe26de46623a38fb7766cd3986

data/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [0.7.3] - 2026-09-10
+
+### Added
+- Added Semgrep CE security scanning with a custom ReDoS detection rule for pre-commit and CI
+- Added CodeFactor code quality analysis badge and integration
+- Added SEMGREP_APP_TOKEN integration for Cloud dashboard sync from CI
+- Added `rake version:pre_release` task for pre-release security gate with FORCE=1 override
+
+### Changed
+- Updated CI to Node.js 26 and current Node 24-based GitHub Actions runtimes
+- Pinned all GitHub Actions to commit SHAs to prevent supply-chain attacks
+- Added cooldown period to Dependabot configuration
+- Pinned Lunr.js CDN to version 2.3.9 with SRI integrity hash
+- Bumped actions/checkout to v7.0.1 (SHA-pinned)
+- Reduced method complexity across 6 flagged CodeFactor findings:
+  - `generator.rb`: Extracted `process_file` and `merge_passthrough_fields` from `generate` and `configure_client_search`
+  - `doc_link.rb`: Extracted `match_documents` and `report_ambiguous` from `find_document`
+  - `doc_category.rb`: Extracted `match_categories` and `report_ambiguous_category` from `resolve_category`
+  - `latest_documents.rb`: Extracted `render_list` and `list_item` from `render`
+  - `options_parser.rb`: Extracted `read_value` from `parse_options`
+
+### Fixed
+- Replaced dangerous subshell in system spec with Open3.capture2
+
+## [0.7.2] - 2026-09-09
+
+### Fixed
+- Replaced polynomial-time Liquid tag option regexes with a shared linear-time parser
+
 ## [0.7.1] - 2026-09-09
 
 ### Changed

data/README.md

@@ -6,6 +6,8 @@
 [![Gem Downloads](https://img.shields.io/gem/dt/jekyll-documents)](https://rubygems.org/gems/jekyll-documents)
 [![License: AGPL-3.0-only](https://img.shields.io/badge/license-AGPL--3.0--only-blue)](LICENSE)
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/gundestrup/jekyll-documents)
+[![CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-documents/badge)](https://www.codefactor.io/repository/github/gundestrup/jekyll-documents)
+[![Semgrep CE](https://img.shields.io/badge/Semgrep_CE-security-success)](https://github.com/gundestrup/jekyll-documents/security/code-scanning)
 
 Turn files in `assets/documents/` into browsable document pages.
 

data/_includes/documents_search.html

@@ -9,6 +9,8 @@
   window.__jekyllDocumentsIndexPath = {{ index_path | relative_url | jsonify }};
   window.__jekyllDocumentsBaseurl = {{ site.baseurl | jsonify }};
 </script>
-<script src="https://unpkg.com/lunr/lunr.js"></script>
+<script src="https://unpkg.com/lunr@2.3.9/lunr.js"
+        integrity="sha384-Mrc0XsDxndfJgV5jLnEeThch4j9dNEXAE1vbWeyzmERxSvF8siQfuEczzgUelQQH"
+        crossorigin="anonymous"></script>
 <script src="{{ '/assets/js/documents-search.js' | relative_url }}"></script>
 {% endif %}

data/lib/jekyll/documents/generator.rb

@@ -43,39 +43,10 @@ module Jekyll
         Dir.glob("#{root}/**/*").each do |path|
           next unless File.file?(path)
 
-          source_extension = File.extname(path)
-          ext = source_extension.downcase
-          if @config["strict_extensions"] && !@config["include_extensions"].include?(ext)
-            ::Jekyll.logger.abort_with "jekyll-documents",
-                                       "Unsupported file type: #{path} (#{ext})"
-          end
-          next unless @config["include_extensions"].include?(ext)
+          doc, rel_path = process_file(path, root, collection)
+          next unless doc
 
-          source_path = source_path_for(path, root)
-          category_path = document_category_path(source_path)
-          category = remap_category(category_path)
-          rel_path = normalize_path(File.join(@config["root"], source_path))
           current_paths << rel_path
-          basename = File.basename(path, source_extension)
-
-          date, title, valid = parse_filename(basename)
-          if !valid && @config["strict_filename"]
-            ::Jekyll.logger.abort_with "jekyll-documents",
-                                       "Filename must be 'YYYY-MM-DD_Title.ext' → #{rel_path}"
-          end
-
-          doc = ::Jekyll::Document.new(
-            source_stub_for(source_path),
-            site: site,
-            collection: collection
-          )
-          file_info = {
-            title: title, date: date, category: category, category_path: category_path,
-            category_slug: slugify(category, "uncategorized"), source_path: source_path,
-            rel_path: rel_path, ext: ext, file_type: ext.delete_prefix("."),
-            icon_set: @config["icon_set"], slug: build_slug(basename), path: path
-          }
-          bake_document_data(doc, file_info)
           collection.docs << doc
           generated_docs << doc
         end
@@ -87,6 +58,42 @@ module Jekyll
 
       private
 
+      def process_file(path, root, collection)
+        source_extension = File.extname(path)
+        ext = source_extension.downcase
+        if @config["strict_extensions"] && !@config["include_extensions"].include?(ext)
+          ::Jekyll.logger.abort_with "jekyll-documents",
+                                     "Unsupported file type: #{path} (#{ext})"
+        end
+        return [nil, nil] unless @config["include_extensions"].include?(ext)
+
+        source_path = source_path_for(path, root)
+        rel_path = normalize_path(File.join(@config["root"], source_path))
+        basename = File.basename(path, source_extension)
+
+        date, title, valid = parse_filename(basename)
+        if !valid && @config["strict_filename"]
+          ::Jekyll.logger.abort_with "jekyll-documents",
+                                     "Filename must be 'YYYY-MM-DD_Title.ext' → #{rel_path}"
+        end
+
+        category_path = document_category_path(source_path)
+        category = remap_category(category_path)
+        doc = ::Jekyll::Document.new(
+          source_stub_for(source_path),
+          site: @site,
+          collection: collection
+        )
+        file_info = {
+          title: title, date: date, category: category, category_path: category_path,
+          category_slug: slugify(category, "uncategorized"), source_path: source_path,
+          rel_path: rel_path, ext: ext, file_type: ext.delete_prefix("."),
+          icon_set: @config["icon_set"], slug: build_slug(basename), path: path
+        }
+        bake_document_data(doc, file_info)
+        [doc, rel_path]
+      end
+
       # Auto-injects passthrough_fields into client_search config when the
       # documents collection is indexed. Only acts if client_search is already
       # configured with +documents+ in its collections list — does nothing if
@@ -96,13 +103,17 @@ module Jekyll
         return unless search_config.is_a?(Hash)
         return unless Array(search_config["collections"]).include?("documents")
 
+        merge_passthrough_fields(search_config)
+        search_config["icon_field"] = "icon_url" unless search_config.key?("icon_field")
+      end
+
+      def merge_passthrough_fields(search_config)
         fields = search_config["passthrough_fields"] || []
         existing = fields.flat_map { |f| f.is_a?(Hash) ? f.keys : [f.to_s] }
         %w[file_type icon_url icon_set].each do |field|
           fields << field unless existing.include?(field)
         end
         search_config["passthrough_fields"] = fields
-        search_config["icon_field"] = "icon_url" unless search_config.key?("icon_field")
       end
 
       # Ensures a collection exists and is configured for output

data/lib/jekyll/documents/options_parser.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "strscan"
+
+module Jekyll
+  module Documents
+    # Linear-time parser for Liquid tag markup key:value pairs.
+    # Replaces polynomial-redos-vulnerable regex scanning with
+    # anchored scans that advance through the input once.
+    module OptionsParser
+      module_function
+
+      def parse_options(markup)
+        scanner = StringScanner.new(markup.to_s)
+        options = {}
+
+        until scanner.eos?
+          scanner.skip(/\s+/)
+          break if scanner.eos?
+
+          key = scanner.scan(/\w+/)
+          unless key
+            scanner.getch
+            next
+          end
+
+          scanner.skip(/\s*/)
+          next unless scanner.scan(":")
+
+          value = read_value(scanner)
+          options[key] = value unless value.nil?
+        end
+
+        options
+      end
+
+      def read_value(scanner)
+        scanner.skip(/\s*/)
+        if scanner.scan(/'([^']*)'/) || scanner.scan(/"([^"]*)"/)
+          scanner[1]
+        else
+          scanner.scan(/\S+/)
+        end
+      end
+    end
+  end
+end

data/lib/jekyll/documents/tags/doc_category.rb

@@ -13,18 +13,24 @@ module Jekyll
         normalized = query.to_s.strip.downcase
         return nil if normalized.empty?
 
-        exact = categories.select do |category|
-          category_values(category).include?(normalized)
-        end
-        matches = exact.empty? ? partial_categories(categories, normalized) : exact
+        matches = match_categories(categories, normalized)
         aggregate = options["aggregate"] == "true" && options["list"] == "true"
         return matches if matches.one? || (aggregate && matches.any?)
         return nil if matches.empty?
 
+        report_ambiguous_category(site, query, matches)
+        nil
+      end
+
+      def match_categories(categories, normalized)
+        exact = categories.select { |cat| category_values(cat).include?(normalized) }
+        exact.empty? ? partial_categories(categories, normalized) : exact
+      end
+
+      def report_ambiguous_category(site, query, matches)
         paths = matches.map { |category| category["path"] }.sort.join(", ")
         message = "Ambiguous doc_category #{query.inspect}; matches: #{paths}. Rendering nothing."
         report_resolution_issue(site, message)
-        nil
       end
 
       def resolve_category_path(path, categories, site)
@@ -152,13 +158,7 @@ module Jekyll
       end
 
       def extract_options(text)
-        options = {}
-        text.to_s.scan(
-          /(\w+)\s*:\s*(?:'([^']*)'|"([^"]*)"|([^\s]+))/
-        ) do |key, single, double, bare|
-          options[key] = single || double || bare
-        end
-        options
+        OptionsParser.parse_options(text)
       end
 
       def escape_html(value)

data/lib/jekyll/documents/tags/doc_link.rb

@@ -13,21 +13,27 @@ module Jekyll
         normalized = query.to_s.strip.downcase
         return nil if normalized.empty?
 
-        exact = docs.select { |doc| document_values(doc).include?(normalized) }
-        matches = if exact.empty?
-                    docs.select do |doc|
-                      document_values(doc).any? { |value| value.include?(normalized) }
-                    end
-                  else
-                    exact
-                  end
+        matches = match_documents(docs, normalized)
         return matches.first if matches.one?
         return nil if matches.empty?
 
+        report_ambiguous(site, query, matches)
+        nil
+      end
+
+      def match_documents(docs, normalized)
+        exact = docs.select { |doc| document_values(doc).include?(normalized) }
+        return exact unless exact.empty?
+
+        docs.select do |doc|
+          document_values(doc).any? { |value| value.include?(normalized) }
+        end
+      end
+
+      def report_ambiguous(site, query, matches)
         paths = matches.map { |doc| doc.data["source_path"] || doc.path }.sort.join(", ")
         message = "Ambiguous doc_link #{query.inspect}; matches: #{paths}. Rendering nothing."
         report_resolution_issue(site, message)
-        nil
       end
 
       def find_document_by_path(docs, path, site)
@@ -148,13 +154,7 @@ module Jekyll
       end
 
       def extract_options(text)
-        options = {}
-        text.to_s.scan(
-          /(\w+)\s*:\s*(?:'([^']*)'|"([^"]*)"|([^\s]+))/
-        ) do |key, single, double, bare|
-          options[key] = single || double || bare
-        end
-        options
+        OptionsParser.parse_options(text)
       end
 
       def escape_html(value)

data/lib/jekyll/documents/tags/document_icon.rb

@@ -45,13 +45,7 @@ module Jekyll
 
       def parse_markup(markup)
         expression = markup.to_s.strip[/\A[^\s]+/]
-        options = {}
-        markup.to_s.scan(
-          /(\w+)\s*:\s*(?:'([^']*)'|"([^"]*)"|([^\s]+))/
-        ) do |key, single, double, bare|
-          options[key] = single || double || bare
-        end
-        [expression, options]
+        [expression, OptionsParser.parse_options(markup)]
       end
 
       def escape_html(value)

data/lib/jekyll/documents/tags/latest_documents.rb

@@ -20,19 +20,25 @@ module Jekyll
         docs = docs.select { |doc| doc.data["category"] == category } if category
         docs = docs.sort_by { |doc| doc.data["date"] || Time.at(0) }.reverse.first(count)
 
+        render_list(docs)
+      end
+
+      private
+
+      def render_list(docs)
         out = +"<ul class=\"latest-documents\">\n"
-        docs.each do |doc|
-          data = doc.data
-          title = escape_html(data["title"])
-          url   = escape_html(doc.url)
-          date  = (data["date"] || Time.at(0)).strftime("%Y-%m-%d")
-          out << %(<li><a href="#{url}">#{title}</a> <small>(#{date})</small></li>\n)
-        end
+        docs.each { |doc| out << list_item(doc) }
         out << "</ul>\n"
         out
       end
 
-      private
+      def list_item(doc)
+        data = doc.data
+        title = escape_html(data["title"])
+        url   = escape_html(doc.url)
+        date  = (data["date"] || Time.at(0)).strftime("%Y-%m-%d")
+        %(<li><a href="#{url}">#{title}</a> <small>(#{date})</small></li>\n)
+      end
 
       def escape_html(text)
         return "" unless text
@@ -46,19 +52,9 @@ module Jekyll
                        })
       end
 
+      # supports: count:5 category:'referat'
       def parse_args(markup)
-        # supports: count:5 category:'referat'
-        args = {}
-        # Safe: markup comes from Jekyll template authors (trusted), not end users
-        # Runs only during static site generation, not on user requests
-        markup.scan(/(\w+)\s*:\s*'([^']*)'|(\w+)\s*:\s*([^\s]+)/).each do |match|
-          if match[0]
-            args[match[0]] = match[1]
-          else
-            args[match[2]] = match[3]
-          end
-        end
-        args
+        OptionsParser.parse_options(markup)
       end
     end
   end

data/lib/jekyll/documents/version.rb

@@ -2,6 +2,6 @@
 
 module Jekyll
   module Documents
-    VERSION = "0.7.1"
+    VERSION = "0.7.3"
   end
 end

data/lib/jekyll-documents.rb

@@ -11,6 +11,7 @@ require_relative "jekyll/documents/text_extraction_manifest"
 require_relative "jekyll/documents/assets_generator"
 require_relative "jekyll/documents/json_index_generator"
 require_relative "jekyll/documents/layout_registrar"
+require_relative "jekyll/documents/options_parser"
 
 # Liquid tag(s)
 require_relative "jekyll/documents/tags/latest_documents"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-documents
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.7.3
 platform: ruby
 authors:
 - Svend Gundestrup
@@ -154,6 +154,7 @@ files:
 - lib/jekyll/documents/generator.rb
 - lib/jekyll/documents/json_index_generator.rb
 - lib/jekyll/documents/layout_registrar.rb
+- lib/jekyll/documents/options_parser.rb
 - lib/jekyll/documents/tags/doc_category.rb
 - lib/jekyll/documents/tags/doc_link.rb
 - lib/jekyll/documents/tags/document_icon.rb