padrino-helpers 0.18.2 → 0.18.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 924909fe1054736b28e1ab952d79295455cb02678e634fadf70632672baaee66
-  data.tar.gz: 53e1a1f8c8e69f4723355f0857e69196543cd72cd1d6e90b526481f446b24350
+  metadata.gz: 35050a53fc94cf2c43d7594e7de3cc42b18a84aef606a6f200105dd96ec0aaa3
+  data.tar.gz: 1d7736573b50b4eab2443e94708cb4885afbee1b551bc822c94964907838b548
 SHA512:
-  metadata.gz: 022652651c54083698e889064b555ae5262d041e770f80880a22998f0c95c4ce30302952b51aa6e338a4b58a61de76a9a4be377e6ab1108aec53e860ff700730
-  data.tar.gz: 14c646b16ad8a04f93f828b888de6bf2ec6dc20d6ff36d28aa2e93da3dcfdafc1fac514964be0bbe03fd451eaf8b7bab58e83fe4e41f27506ad43ec440176111
+  metadata.gz: d7c76cd3c24cd86eb0f74a4c13dbcb2df2146e35115c50092a45b353e5b6055ff1b249452994718a225f542b37bb0f560d5672f5d7bbb55b96e512b4954c8b64
+  data.tar.gz: dbb2af3ccc585f139ccbe8397e2e866a8e374674ce30363d92736cf78cf27a39d29279f011ed7baec531f72fff231093ac47d691c431d742dd3c1959dde3b0ce

data/lib/padrino-helpers/form_helpers/security.rb

@@ -52,7 +52,7 @@ module Padrino
         # it will create one and assign it to the session's `csrf` key.
         #
         def csrf_token
-          session[:csrf] ||= SecureRandom.hex(32) if defined?(session)
+          session[:csrf] ||= SecureRandom.urlsafe_base64(32) if defined?(session)
         end
 
         ##

data/lib/padrino-helpers/format_helpers.rb

@@ -203,6 +203,7 @@ module Padrino
       #     The html pattern for wrapping the highlighted words.
       #
       # @return [String] The text with the words specified wrapped with highlighted spans.
+      #   Words inside HTML tags (tag names and attributes) are left as they are.
       #
       # @example
       #   highlight('Lorem ipsum dolor sit amet', 'dolor')
@@ -217,8 +218,10 @@ module Padrino
         if text.empty? || words.empty?
           text
         else
-          match = Array(words).map { |p| Regexp.escape(p) }.join('|')
-          text.gsub(/(#{match})(?!(?:[^<]*?)(?:["'])[^<>]*>)/i, options[:highlighter])
+          pattern = /(#{Array(words).map { |p| Regexp.escape(p) }.join('|')})/i
+          text.to_str.gsub(%r{(<[A-Za-z/!?](?:=\s*+"[^"]*+"|=\s*+'[^']*+'|[^<>])*+>?)|(?:[^<]|<(?![A-Za-z/!?]))++}) do |part|
+            Regexp.last_match(1) || part.gsub(pattern, options[:highlighter])
+          end
         end
       end
 

data/lib/padrino-helpers/number_helpers.rb

@@ -135,14 +135,19 @@ module Padrino
       def number_with_delimiter(number, *args)
         options = args.last.is_a?(Hash) ? Utils.symbolize_keys(args.pop) : {}
 
-        defaults = I18n.translate(:'number.format', locale: options[:locale], raise: true) rescue {}
+        delimiter = options[:delimiter]
+        separator = options[:separator]
+        unless delimiter && separator
+          defaults = I18n.translate(:'number.format', locale: options[:locale], raise: true) rescue {}
 
-        delimiter ||= options[:delimiter] || defaults[:delimiter]
-        separator ||= options[:separator] || defaults[:separator]
+          delimiter ||= defaults[:delimiter]
+          separator ||= defaults[:separator]
+        end
 
         begin
           parts = number.to_s.split('.')
-          parts[0].gsub!(/(\d)(?=(\d\d\d)+(?!\d))/, "\\1#{delimiter}")
+          reversed_delimiter = delimiter.to_s.reverse
+          parts[0].gsub!(/\d+/) { |digits| digits.reverse.scan(/\d{1,3}/).join(reversed_delimiter).reverse }
           parts.join(separator)
         rescue StandardError
           number
@@ -178,14 +183,19 @@ module Padrino
       def number_with_precision(number, *args)
         options = args.last.is_a?(Hash) ? Utils.symbolize_keys(args.pop) : {}
 
-        defaults           = I18n.translate(:'number.format', locale: options[:locale], raise: true) rescue {}
-        precision_defaults = I18n.translate(:'number.precision.format', locale: options[:locale],
-                                                                        raise: true) rescue {}
-        defaults           = defaults.merge(precision_defaults)
+        precision = options[:precision]
+        separator = options[:separator]
+        delimiter = options[:delimiter]
+        unless precision && separator && delimiter
+          defaults           = I18n.translate(:'number.format', locale: options[:locale], raise: true) rescue {}
+          precision_defaults = I18n.translate(:'number.precision.format', locale: options[:locale],
+                                                                          raise: true) rescue {}
+          defaults           = defaults.merge(precision_defaults)
 
-        precision ||= options[:precision] || defaults[:precision]
-        separator ||= options[:separator] || defaults[:separator]
-        delimiter ||= options[:delimiter] || defaults[:delimiter]
+          precision ||= defaults[:precision]
+          separator ||= defaults[:separator]
+          delimiter ||= defaults[:delimiter]
+        end
 
         begin
           rounded_number = (Float(number) * (10**precision)).round.to_f / 10**precision

data/lib/padrino-helpers/output_helpers/erb_handler.rb

@@ -9,7 +9,7 @@ module Padrino
         # Outputs the given text to the templates buffer directly.
         #
         def concat_to_template(text = '', context = nil)
-          return text if context&.eval('@__in_ruby_literal')
+          return text if context&.receiver&.instance_variable_get(:@__in_ruby_literal)
           output_buffer << text
           nil
         end
@@ -18,7 +18,7 @@ module Padrino
         # Returns true if the block is Erb.
         #
         def engine_matches?(block)
-          block.binding.eval('defined? __in_erb_template')
+          block.binding.local_variable_defined?(:__in_erb_template)
         end
       end
       OutputHelpers.register(:erb, ErbHandler)

data/lib/padrino-helpers/output_helpers/haml_handler.rb

@@ -10,7 +10,7 @@ module Padrino
           # Returns true if the block is for Hamlit.
           #
           def engine_matches?(block)
-            block.binding.eval('defined? __in_hamlit_template')
+            block.binding.local_variable_defined?(:__in_hamlit_template)
           end
         end
         OutputHelpers.register(:haml, HamlitHandler)
@@ -43,7 +43,7 @@ module Padrino
           # Returns true if the block is for Hamlit.
           #
           def engine_matches?(block)
-            block.binding.eval('defined? __in_hamlit_template')
+            block.binding.local_variable_defined?(:__in_hamlit_template)
           end
         end
         OutputHelpers.register(:haml, HamlitHandler)

data/lib/padrino-helpers/output_helpers/slim_handler.rb

@@ -9,7 +9,7 @@ module Padrino
         # Returns true if the block is for Slim.
         #
         def engine_matches?(block)
-          block.binding.eval('defined? __in_slim_template')
+          block.binding.local_variable_defined?(:__in_slim_template)
         end
       end
       OutputHelpers.register(:slim, SlimHandler)

data/lib/padrino-helpers/tag_helpers.rb

@@ -41,6 +41,9 @@ module Padrino
         novalidate
       ].freeze
 
+      BOOLEAN_ATTRIBUTE_LOOKUP = BOOLEAN_ATTRIBUTES.to_h { |attribute| [attribute, true] }.freeze
+      private_constant :BOOLEAN_ATTRIBUTE_LOOKUP
+
       ##
       # Custom data attributes,
       # feel free to update with yours:
@@ -278,19 +281,21 @@ module Padrino
       def tag_attributes(options)
         return '' unless options
 
-        options.inject(+'') do |all, (key, value)|
-          next all unless value
+        all = +''
+        options.each do |key, value|
+          next unless value
 
           all << ' ' if all.empty?
           all <<
             if value.is_a?(Hash)
               nested_values(key, value)
-            elsif BOOLEAN_ATTRIBUTES.include?(key)
+            elsif BOOLEAN_ATTRIBUTE_LOOKUP.key?(key)
               %(#{key}="#{key}" )
             else
               %(#{key}="#{escape_value(value)}" )
             end
-        end.chomp!(' ')
+        end
+        all.chomp!(' ')
       end
 
       ##
@@ -298,7 +303,8 @@ module Padrino
       #
       def escape_value(string)
         string = string.collect(&:to_s).join(' ') if string.is_a?(Array)
-        string.to_s.gsub(ESCAPE_REGEXP, ESCAPE_VALUES)
+        string = string.to_s
+        string.match?(ESCAPE_REGEXP) ? string.gsub(ESCAPE_REGEXP, ESCAPE_VALUES) : string
       end
 
       ##
@@ -321,6 +327,8 @@ module Padrino
       #
       def parse_data_options(tag, options)
         return unless options
+        return options unless DATA_ATTRIBUTES.any? { |key| options.key?(key) }
+
         parsed_options = options.dup
         options.each_key do |key|
           next if !DATA_ATTRIBUTES.include?(key) || (tag.to_s == 'form' && key == :method)

data/test/fixtures/markup_app/app.rb

@@ -42,6 +42,14 @@ class MarkupDemo < Sinatra::Base
       end
     end
 
+    def block_is_template_value(&block)
+      block_is_template?(block).inspect
+    end
+
+    def ruby_block_is_template_value
+      block_is_template_value { 'This not a template block' }
+    end
+
     def content_tag_with_block
       one = content_tag(:p) do
         'one'

data/test/fixtures/markup_app/views/block_is_template.erb

@@ -0,0 +1,5 @@
+<% value = block_is_template_value do %>
+  <span>This is erb</span>
+<% end %>
+<p class="template"><%= value %></p>
+<p class="ruby"><%= ruby_block_is_template_value %></p>

data/test/fixtures/markup_app/views/block_is_template.haml

@@ -0,0 +1,4 @@
+- value = block_is_template_value do
+  %span This is haml
+%p.template= value
+%p.ruby= ruby_block_is_template_value

data/test/fixtures/markup_app/views/block_is_template.slim

@@ -0,0 +1,4 @@
+- value = block_is_template_value do
+  span This is slim
+p.template = value
+p.ruby = ruby_block_is_template_value

data/test/test_format_helpers.rb

@@ -113,6 +113,53 @@ describe 'FormatHelpers' do
       actual_text = highlight('Lorem ipsum dolor sit amet', 'dolor', highlighter: '<span class="custom">\1</span>')
       assert_equal 'Lorem ipsum <span class="custom">dolor</span> sit amet', actual_text
     end
+
+    it 'should leave words inside html tags alone' do
+      actual_text = highlight('<b class="b">bold</b> <a href="/b">b</a>', 'b')
+      assert_equal '<b class="b"><strong class="highlight">b</strong>old</b> <a href="/b"><strong class="highlight">b</strong></a>', actual_text
+    end
+
+    it 'should leave a quoted attribute alone when it holds a >' do
+      actual_text = highlight('<a title="x > y">y</a>', 'y')
+      assert_equal '<a title="x > y"><strong class="highlight">y</strong></a>', actual_text
+    end
+
+    it 'should leave a quoted attribute alone when it holds a <' do
+      actual_text = highlight(%(<a title="x < y" data-y='y < x'>y</a>), 'y')
+      assert_equal %(<a title="x < y" data-y='y < x'><strong class="highlight">y</strong></a>), actual_text
+    end
+
+    it 'should highlight text around a < that does not start a tag' do
+      assert_equal 'if a < b then <strong class="highlight">y</strong>', highlight('if a < b then y', 'y')
+      assert_equal 'if <strong class="highlight">a < b</strong> then y', highlight('if a < b then y', 'a < b')
+      assert_equal "<\u212A <strong class=\"highlight\">b</strong>", highlight("<\u212A b", 'b')
+    end
+
+    it 'should read a quote in a tag as a value only after =' do
+      actual_text = highlight("<img alt=it's> Ruby isn't", 'ruby')
+      assert_equal %(<img alt=it's> <strong class="highlight">Ruby</strong> isn't), actual_text
+    end
+
+    it 'should not split a tag at its closing >' do
+      assert_equal '<b>x</b>', highlight('<b>x</b>', '>x')
+    end
+
+    it 'should highlight long text in linear time' do
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      actual_text = highlight('word ' * 20_000, 'word')
+      assert_operator Process.clock_gettime(Process::CLOCK_MONOTONIC) - started, :<, 2
+      assert_equal '<strong class="highlight">word</strong> ' * 20_000, actual_text
+    end
+
+    it 'should highlight html safe text' do
+      actual_text = highlight('<p>Lorem</p><p>ipsum dolor</p>'.html_safe, %w[lorem dolor])
+      assert_equal '<p><strong class="highlight">Lorem</strong></p><p>ipsum <strong class="highlight">dolor</strong></p>', actual_text
+    end
+
+    it 'should highlight several words across tags' do
+      actual_text = highlight('<p>Lorem</p><p>ipsum lorem</p>', %w[lorem ipsum])
+      assert_equal '<p><strong class="highlight">Lorem</strong></p><p><strong class="highlight">ipsum</strong> <strong class="highlight">lorem</strong></p>', actual_text
+    end
   end
 
   describe 'for #truncate method' do

data/test/test_helpers.rb

@@ -1,4 +1,5 @@
 require_relative 'helper'
+require 'padrino-core'
 
 describe 'Padrino::Helpers' do
   it 'should allow including without registering' do
@@ -15,4 +16,19 @@ describe 'Padrino::Helpers' do
     end
     assert_equal 'FancyBuilder', @app.default_builder
   end
+
+  it 'should write a form token that a later POST is accepted with' do
+    mock_app do
+      enable :sessions
+      disable :protection
+      set :protect_from_csrf, except: ['/signup']
+      get('/signup') { form_tag('/save') { '' } }
+      post('/save') { 'saved' }
+    end
+    get '/signup'
+    token = Nokogiri::HTML(last_response.body).at_css('input[name="authenticity_token"]')['value']
+    post '/save', authenticity_token: token
+    assert_equal 200, last_response.status
+    assert_equal 'saved', last_response.body
+  end
 end

data/test/test_number_helpers.rb

@@ -62,10 +62,20 @@ describe 'NumberHelpers' do
       assert_equal '0.78901',           number_with_delimiter(0.78901)
       assert_equal '123,456.78',        number_with_delimiter('123456.78')
       assert_equal 'x',                 number_with_delimiter('x')
+      assert_equal '-1,234,567,890,123', number_with_delimiter('-1234567890123')
+      assert_equal '1,234x5,678', number_with_delimiter('1234x5678')
+      assert_equal '1\\1234\\1567', number_with_delimiter(1_234_567, delimiter: '\\1')
 
       assert_nil number_with_delimiter(nil)
     end
 
+    it 'should display number_with_delimiter in linear time' do
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      actual = number_with_delimiter('1' * 100_000)
+      assert_operator Process.clock_gettime(Process::CLOCK_MONOTONIC) - started, :<, 2
+      assert_equal "1#{',111' * 33_333}", actual
+    end
+
     it 'should display number_with_delimiter with options' do
       assert_equal '12 345 678',    number_with_delimiter(12_345_678, delimiter: ' ')
       assert_equal '12,345,678-05', number_with_delimiter(12_345_678.05, separator: '-')
@@ -92,6 +102,25 @@ describe 'NumberHelpers' do
       assert_equal '1.231,83',  number_with_precision(1231.826, precision: 2, separator: ',', delimiter: '.')
     end
 
+    it 'should not look up the locale when every format option is given' do
+      I18n.backend.expects(:translate).never
+      assert_equal '1.234.567,89',  number_with_precision(1_234_567.891, precision: 2, separator: ',', delimiter: '.')
+      assert_equal '1.234.567,891', number_with_delimiter(1_234_567.891, separator: ',', delimiter: '.')
+      assert_equal '1.235',         number_with_precision(1234.5, precision: 0, separator: ',', delimiter: '.')
+      assert_equal '123457',        number_with_precision(1234.567, precision: 2, separator: '', delimiter: '')
+      assert_equal '1234567,5',     number_with_delimiter(1_234_567.5, separator: ',', delimiter: '')
+      assert_equal '1.234.5675',    number_with_delimiter(1_234_567.5, separator: '', delimiter: '.')
+    end
+
+    it 'should take the format options not given from the locale' do
+      assert_equal '1234567,89',    number_with_precision(1_234_567.891, precision: 2, locale: :de)
+      assert_equal '1234567.89',    number_with_precision(1_234_567.891, precision: 2, separator: '.', locale: :de)
+      assert_equal '1 234 567,89',  number_with_precision(1_234_567.891, separator: ',', delimiter: ' ', locale: :de)
+      assert_equal '1.234.567,891', number_with_delimiter(1_234_567.891, delimiter: '.', locale: :de)
+      assert_equal '1 234 567,891', number_with_delimiter(1_234_567.891, delimiter: ' ', locale: :de)
+      assert_equal '1.234.567;891', number_with_delimiter(1_234_567.891, separator: ';', locale: :de)
+    end
+
     it 'should display number_to_human_size' do
       assert_equal '0 Bytes',   number_to_human_size(0)
       assert_equal '1 Byte',    number_to_human_size(1)

data/test/test_output_helpers.rb

@@ -93,19 +93,28 @@ describe 'OutputHelpers' do
     it 'should work for erb templates' do
       get '/erb/capture_concat'
       assert_response_has_tag 'p', content: 'The erb block passed in is a template', class: 'is_template', count: 1
-      assert_response_has_no_tag 'p', content: 'The ruby block passed in is a template', class: 'is_template', count: 1
+      assert_response_has_no_tag 'p', content: 'The ruby block passed in is a template', class: 'is_template'
     end
 
     it 'should work for haml templates' do
       get '/haml/capture_concat'
       assert_response_has_tag 'p', content: 'The haml block passed in is a template', class: 'is_template', count: 1
-      assert_response_has_no_tag 'p', content: 'The ruby block passed in is a template', class: 'is_template', count: 1
+      assert_response_has_no_tag 'p', content: 'The ruby block passed in is a template', class: 'is_template'
     end
 
     it 'should work for slim templates' do
       get '/slim/capture_concat'
       assert_response_has_tag 'p', content: 'The slim block passed in is a template', class: 'is_template', count: 1
-      assert_response_has_no_tag 'p', content: 'The ruby block passed in is a template', class: 'is_template', count: 1
+      assert_response_has_no_tag 'p', content: 'The ruby block passed in is a template', class: 'is_template'
+    end
+
+    %w[erb haml slim].each do |engine|
+      it "should return true for a #{engine} template block and false for a Ruby block" do
+        get "/#{engine}/block_is_template"
+        html = Nokogiri::HTML(last_response.body)
+        assert_equal 'true', html.at_css('p.template').text
+        assert_equal 'false', html.at_css('p.ruby').text
+      end
     end
   end
 

data/test/test_render_helpers.rb

@@ -12,7 +12,7 @@ describe 'RenderHelpers' do
       assert_response_has_tag 'h1', content: 'User name is John'
     end
     it 'should have no counter index for single item' do
-      assert_response_has_no_tag 'p', content: 'My counter is 1', count: 1
+      assert_response_has_no_tag 'p', content: 'My counter is 1'
     end
     it 'should include extra locals information' do
       assert_response_has_tag 'p', content: 'Extra is bar'
@@ -47,7 +47,7 @@ describe 'RenderHelpers' do
       assert_response_has_tag 'h1', content: 'User name is John'
     end
     it 'should have no counter index for single item' do
-      assert_response_has_no_tag 'p', content: 'My counter is 1', count: 1
+      assert_response_has_no_tag 'p', content: 'My counter is 1'
     end
     it 'should include extra locals information' do
       assert_response_has_tag 'p', content: 'Extra is bar'

data/test/test_tag_helpers.rb

@@ -52,6 +52,49 @@ describe 'TagHelpers' do
       actual_html = tag(:p, data: { foo: %i[bar baz] })
       assert_html_has_tag(actual_html, 'p', 'data-foo': 'bar baz')
     end
+
+    it 'should build the exact attribute string' do
+      assert_equal '<div class="x" />', tag(:div, data: {}, class: 'x')
+      assert_equal '<br />', tag(:br, id: nil, hidden: false)
+      assert_equal '<input checked="checked" name="a" />', tag(:input, checked: true, 'name' => 'a')
+      assert_equal '<a href="/x" data-method="delete" rel="nofollow" data-confirm="Sure?" />',
+                   tag(:a, href: '/x', method: :delete, confirm: 'Sure?')
+    end
+
+    it 'should not change the options it is given' do
+      options = { class: 'btn', method: :delete }
+      2.times { assert_equal '<a class="btn" data-method="delete" rel="nofollow" />', tag(:a, options) }
+      assert_equal({ class: 'btn', method: :delete }, options)
+    end
+
+    it 'should escape the values that need it and leave the others as they are' do
+      assert_equal '<input name="user[name]" value="Tom &amp; &lt;Jerry&gt; &quot;TJ&quot;" class="input" />',
+                   tag(:input, name: 'user[name]', value: 'Tom & <Jerry> "TJ"', class: 'input')
+    end
+
+    it 'should escape a value whose only special character is a quote or an angle bracket' do
+      assert_equal '<a title="say &quot;hi&quot;" />', tag(:a, title: 'say "hi"')
+      assert_equal '<a title="&lt;b&gt;" />', tag(:a, title: '<b>')
+      assert_equal '<a title="a&lt;b" />', tag(:a, title: 'a<b')
+      assert_equal '<a title="a&gt;b" />', tag(:a, title: 'a>b')
+    end
+
+    it 'should write data attributes added to DATA_ATTRIBUTES' do
+      Padrino::Helpers::TagHelpers::DATA_ATTRIBUTES.push(:dialog)
+      assert_equal '<a data-dialog="true" />', tag(:a, dialog: true)
+    ensure
+      Padrino::Helpers::TagHelpers::DATA_ATTRIBUTES.delete(:dialog)
+    end
+
+    it 'should write Array, Symbol and Integer values' do
+      assert_equal '<td class="a &amp; b c" id="cell" colspan="2" />', tag(:td, class: ['a & b', :c], id: :cell, colspan: 2)
+    end
+
+    it 'should write data attributes only for the options that ask for them' do
+      assert_equal '<a href="/x" class="link" />', tag(:a, href: '/x', class: 'link')
+      assert_equal '<a href="/x" data-method="post" rel="nofollow" data-remote="true" data-confirm="Sure &amp; certain?" />',
+                   tag(:a, href: '/x', method: :post, remote: true, confirm: 'Sure & certain?')
+    end
   end
 
   describe 'for #content_tag method' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: padrino-helpers
 version: !ruby/object:Gem::Version
-  version: 0.18.2
+  version: 0.18.4
 platform: ruby
 authors:
 - Padrino Team
@@ -11,7 +11,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-01 00:00:00.000000000 Z
+date: 2026-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: padrino-support
@@ -19,14 +19,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.18.2
+        version: 0.18.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.18.2
+        version: 0.18.4
 - !ruby/object:Gem::Dependency
   name: tilt
   requirement: !ruby/object:Gem::Requirement
@@ -139,6 +139,9 @@ files:
 - test/fixtures/apps/views/test/post.erb
 - test/fixtures/layouts/layout.erb
 - test/fixtures/markup_app/app.rb
+- test/fixtures/markup_app/views/block_is_template.erb
+- test/fixtures/markup_app/views/block_is_template.haml
+- test/fixtures/markup_app/views/block_is_template.slim
 - test/fixtures/markup_app/views/button_to.erb
 - test/fixtures/markup_app/views/button_to.haml
 - test/fixtures/markup_app/views/button_to.slim