phlex 1.0.0.rc2 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72f6baa9bd23ce981517a40897f2bb63a1cbd60fbc87bb127883e8eeb36cc302
-  data.tar.gz: 5abc8c59a81cdff51f5da9250a28d9cc42308b467aa662b155fb1d28eca4a1c2
+  metadata.gz: 959fa6b3416f8a2ad94a64379a8b23a1e2693f5990864584694dd8a83e25c03d
+  data.tar.gz: 9d7f1f895a8f814c502d8e3b39dc1634710accbcaa7652489186c64b4544d19f
 SHA512:
-  metadata.gz: 8db8f9df3da1f218bd2029ea22414ea53a910de8b1810d71c70a0e9022a1353dd69557c91eb1ffee5355733c0d8d6878aae9379a75ee0eaa76d05c6ee20abb8e
-  data.tar.gz: 8027722c6fd1592c86f5fa6150814206a007c12a810985c72231195dcb0089aa34fd91a5addbeb9c14a8137a5a2f3fe984c07f554ee6504a4b4c25d6dd216046
+  metadata.gz: 2aa7a0cc26cee6e3fa2fab8c6fb5072bcb55b8afb3e394491a039dc9243821fc60ebe4d479f2edd00f44d411da8227e4b2d7c3d231ebf08f05cd1fa3bd2c871d
+  data.tar.gz: 11ee27a58f2f9a1d5b19b8124648642db6162dd159c060fb6025274a24da28e6fcfb43d2e0e8e889713e658651ea795b07c4835fd9ada80933b1780431555205

data/.rubocop.yml

@@ -24,3 +24,7 @@ Style/MethodCallWithoutArgsParentheses:
 
 Style/MixinUsage:
   Enabled: false
+
+Style/AccessModifierDeclarations:
+  Enabled: true
+  EnforcedStyle: inline

data/.ruby-version

@@ -0,0 +1 @@
+3.3.0

data/SECURITY.md

@@ -1,5 +1,13 @@
 # Security Policy
 
-## Reporting a Vulnerability
+## Reporting a vulnerability
 
-If you found a possible security vulnerability in Phlex, please email security@phlex.fun.
+If you find a possible security vulnerability, please email security@phlex.fun. Do not create an issue or pull request either demonstrating or fixing the vulnerability.
+
+## Bug bounty
+
+[The Gem Foundation](https://ryanbigg.com/2022/11/the-gem-foundation) has kindly sponsored a $1 bug bounty to discover security vulnerabilities in Phlex.
+
+## Sponsoring a bug bounty
+
+If you wish to sponsor a bug bounty for Phlex, please get in touch with Joel at joel@drapper.me.

data/lib/phlex/collection.rb

@@ -17,9 +17,7 @@ module Phlex
 			@item ? item_template : collection_template { yield_items }
 		end
 
-		private
-
-		def yield_items
+		private def yield_items
 			if @item
 				raise ArgumentError, "You can only yield_items when rendering a collection. You are currently rendering an item."
 			end

data/lib/phlex/configuration.rb

@@ -2,6 +2,12 @@
 
 module Phlex
 	class Configuration
-		# Config coming soon.
+		attr_writer :experimental_warnings
+
+		def experimental_warnings
+			return @experimental_warnings if defined? @experimental_warnings
+
+			true
+		end
 	end
 end

data/lib/phlex/experimental.rb

@@ -3,7 +3,10 @@
 module Phlex
 	module Experimental
 		def before_template
-			puts "Warning: #{self.class.name} is experimental and subject to change."
+			if Phlex.configuration.experimental_warnings
+				puts "Warning: #{self.class.name} is experimental and subject to change."
+			end
+
 			super
 		end
 	end

data/lib/phlex/helpers.rb

@@ -5,7 +5,7 @@ if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("3.0")
 end
 
 module Phlex::Helpers
-	def tokens(*tokens, **conditional_tokens)
+	private def tokens(*tokens, **conditional_tokens)
 		conditional_tokens.each do |condition, token|
 			truthy = case condition
 				when Symbol then send(condition)
@@ -28,7 +28,7 @@ module Phlex::Helpers
 		tokens.join(" ")
 	end
 
-	def _append_token(tokens, token)
+	private def _append_token(tokens, token)
 		case token
 			when nil then nil
 			when String then tokens << token
@@ -39,7 +39,7 @@ module Phlex::Helpers
 		end
 	end
 
-	def classes(*tokens, **conditional_tokens)
+	private def classes(*tokens, **conditional_tokens)
 		tokens = self.tokens(*tokens, **conditional_tokens)
 
 		if tokens.empty?
@@ -49,7 +49,7 @@ module Phlex::Helpers
 		end
 	end
 
-	def mix(*args)
+	private def mix(*args)
 		args.each_with_object({}) do |object, result|
 			result.merge!(object) do |_key, old, new|
 				case new

data/lib/phlex/html.rb

@@ -136,14 +136,23 @@ module Phlex
 		def call(buffer = +"", view_context: nil, parent: nil, &block)
 			return buffer unless render?
 
-			raise "The same view instance shouldn't be rendered twice" if rendered?
-
-			@_rendered = true
 			@_target = buffer
 			@_view_context = view_context
 			@_parent = parent
 
-			around_template { template { yield_content(&block) } }
+			around_template do
+				if block_given?
+					template do |*args|
+						if args.length > 0
+							yield_content_with_args(*args, &block)
+						else
+							yield_content(&block)
+						end
+					end
+				else
+					template
+				end
+			end
 
 			self.class.rendered_at_least_once ||= true
 
@@ -151,10 +160,13 @@ module Phlex
 		end
 
 		def render(renderable, *args, **kwargs, &block)
-			if renderable.is_a?(Phlex::HTML)
+			case renderable
+			when Phlex::HTML
 				renderable.call(@_target, view_context: @_view_context, parent: self, &block)
-			elsif renderable.is_a?(Class) && renderable < Phlex::HTML
-				raise ArgumentError, "You tried to render the Phlex view class: #{renderable.name} but you probably meant to render an instance of that class instead."
+			when Class
+				if renderable < Phlex::HTML
+					renderable.new.call(@_target, view_context: @_view_context, parent: self, &block)
+				end
 			else
 				raise ArgumentError, "You can't render a #{renderable}."
 			end
@@ -166,14 +178,6 @@ module Phlex
 			:html
 		end
 
-		def rendered?
-			@_rendered ||= false
-		end
-
-		def render?
-			true
-		end
-
 		STANDARD_ELEMENTS.each do |method_name, tag|
 			register_element(method_name, tag: tag)
 		end
@@ -187,7 +191,8 @@ module Phlex
 				case content
 					when String then content
 					when Symbol then content.name
-					else content.to_s
+					when Integer, Float then content.to_s
+					else format_object(content) || content.to_s
 				end
 			)
 
@@ -237,23 +242,30 @@ module Phlex
 			new_buffer
 		end
 
-		private
+		# Default render predicate can be overridden to prevent rendering
+		private def render?
+			true
+		end
 
-		def around_template
+		private def format_object(oject)
+			nil
+		end
+
+		private def around_template
 			before_template
 			yield
 			after_template
 		end
 
-		def before_template
+		private def before_template
 			nil
 		end
 
-		def after_template
+		private def after_template
 			nil
 		end
 
-		def yield_content(&block)
+		private def yield_content(&block)
 			return unless block_given?
 
 			original_length = @_target.length
@@ -268,17 +280,42 @@ module Phlex
 					@_target << ERB::Util.html_escape(content.name)
 				when Integer, Float
 					@_target << ERB::Util.html_escape(content.to_s)
+				else
+					if (formatted_object = format_object(content))
+						@_target << ERB::Util.html_escape(formatted_object)
+					end
 				end
 			end
 
 			nil
 		end
 
-		def _attributes(**attributes)
-			if attributes[:href]&.start_with?(/\s*javascript/)
-				attributes[:href] = attributes[:href].sub(/^\s*(javascript:)+/, "")
+		private def yield_content_with_args(*args, &block)
+			return unless block_given?
+
+			original_length = @_target.length
+			content = yield(*args)
+			unchanged = (original_length == @_target.length)
+
+			if unchanged
+				case content
+				when String
+					@_target << ERB::Util.html_escape(content)
+				when Symbol
+					@_target << ERB::Util.html_escape(content.name)
+				when Integer, Float
+					@_target << ERB::Util.html_escape(content.to_s)
+				else
+					if (formatted_object = format_object(content))
+						@_target << ERB::Util.html_escape(formatted_object)
+					end
+				end
 			end
 
+			nil
+		end
+
+		private def _attributes(**attributes)
 			buffer = +""
 			_build_attributes(attributes, buffer: buffer)
 
@@ -289,7 +326,7 @@ module Phlex
 			buffer
 		end
 
-		def _build_attributes(attributes, buffer:)
+		private def _build_attributes(attributes, buffer:)
 			attributes.each do |k, v|
 				next unless v
 
@@ -299,8 +336,11 @@ module Phlex
 					else k.to_s
 				end
 
+				lower_name = name.downcase
+				next if lower_name == "href" && v.start_with?(/\s*javascript:/i)
+
 				# Detect unsafe attribute names. Attribute names are considered unsafe if they match an event attribute or include unsafe characters.
-				if HTML::EVENT_ATTRIBUTES[name] || name.match?(/[<>&"']/)
+				if HTML::EVENT_ATTRIBUTES[lower_name] || name.match?(/[<>&"']/)
 					raise ArgumentError, "Unsafe attribute name detected: #{k}."
 				end
 

data/lib/phlex/table.rb

@@ -50,13 +50,11 @@ module Phlex
 			child.alias_method :foot_cell, :cell
 		end
 
-		private
-
-		def properties
+		private def properties
 			self.class.properties
 		end
 
-		def collection_template(&block)
+		private def collection_template(&block)
 			table do
 				head_template
 				body_template(&block)
@@ -64,11 +62,11 @@ module Phlex
 			end
 		end
 
-		def item_template
+		private def item_template
 			row_template
 		end
 
-		def head_template
+		private def head_template
 			if self.class.properties.any? { |p| p[:header] }
 				head do
 					head_row do
@@ -85,14 +83,14 @@ module Phlex
 			end
 		end
 
-		def body_template
+		private def body_template
 			body { yield_items }
 		end
 
-		def foot_template
+		private def foot_template
 		end
 
-		def row_template
+		private def row_template
 			body_row do
 				self.class.properties.each do |property|
 					body_cell(**property[:attributes]) do

data/lib/phlex/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Phlex
-	VERSION = "1.0.0.rc2"
+	VERSION = "1.0.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: phlex
 version: !ruby/object:Gem::Version
-  version: 1.0.0.rc2
+  version: 1.0.1
 platform: ruby
 authors:
 - Joel Drapper
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-11-27 00:00:00.000000000 Z
+date: 2024-03-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: zeitwerk
@@ -33,6 +33,7 @@ extra_rdoc_files: []
 files:
 - ".editorconfig"
 - ".rubocop.yml"
+- ".ruby-version"
 - CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
 - Gemfile
@@ -81,11 +82,11 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '2.7'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
-rubygems_version: 3.3.25
+rubygems_version: 3.5.6
 signing_key:
 specification_version: 4
 summary: A framework for building views in Ruby.