phlex 1.10.3 → 1.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a86bca32b72f150179b586843c71432ebfea0d892ad70b426ef0f8ce6d58f3f
-  data.tar.gz: 235a24dc555ffcb1598660c9c5d539a5b050780a1ccec4d81b8b5115ea5b7f0e
+  metadata.gz: b009908cf2bca382857d9e6adaf26040bbc72df73b4227546e48888d508552f0
+  data.tar.gz: 560928a3386b32c8f0a94a31462d29b9ff73bcbeb9ecad1171399c1f749be871
 SHA512:
-  metadata.gz: 0b4ab7f24ba4955cc0622da21a363436a0b54cae4505ec0fd599dd2ddd53731175386b5fc9f62981807f7836d34edd7de851dd662a18b1e01c3935aa37956454
-  data.tar.gz: eb0b42b41d70b8fb28ae3c9134f0ecddcc517698ac812c2f1c69b05c4b41d7d9148aca244d88b1bb8e8d817abcfafa9ac6968342890584b9b6cf539b320e2b27
+  metadata.gz: eb282ecd7594914cd485309e270748d64e3b74bed6fd49ec98244ea34e1fb90cbba0ff542909ee59d3347dce6cde47604aeb67efae605ccfa554473ed8934f61
+  data.tar.gz: 05ff1300599f9360d07d249e27ee3ef84667c77268bbe25c92a0609686e594f45aa377068714690ca55ee925548d85406b84aa3b3bad26d2eb2c6beb2dd12bf4

data/lib/phlex/kit.rb

@@ -1,31 +1,38 @@
 # frozen_string_literal: true
 
 module Phlex::Kit
-	def self.extended(mod)
-		warn "⚠️ [WARNING] Phlex::Kit is experimental and may be removed from future versions of Phlex."
-		super
+	module LazyLoader
+		def method_missing(name, *args, **kwargs, &block)
+			if name[0] == name[0].upcase && __phlex_kit_constants__.include?(name) && __get_phlex_kit_constant__(name) && methods.include?(name)
+				public_send(name, *args, **kwargs, &block)
+			else
+				super
+			end
+		end
+
+		def respond_to_missing?(name, include_private = false)
+			if name[0] == name[0].upcase && __phlex_kit_constants__.include?(name) && __get_phlex_kit_constant__(name) && methods.include?(name)
+				true
+			else
+				super
+			end
+		end
 	end
 
-	# When a kit is included in a module, we need to load all of its components.
-	def included(mod)
-		constants.each { |c| const_get(c) if autoload?(c) }
-		super
+	include LazyLoader
+
+	def self.extended(mod)
+		mod.include(LazyLoader)
+		mod.define_method(:__phlex_kit_constants__) { mod.__phlex_kit_constants__ }
+		mod.define_method(:__get_phlex_kit_constant__) { |name| mod.__get_phlex_kit_constant__(name) }
 	end
 
-	def method_missing(name, *args, **kwargs, &block)
-		if name[0] == name[0].upcase && constants.include?(name) && const_get(name) && methods.include?(name)
-			public_send(name, *args, **kwargs, &block)
-		else
-			super
-		end
+	def __phlex_kit_constants__
+		constants
 	end
 
-	def respond_to_missing?(name, include_private = false)
-		if name[0] == name[0].upcase && constants.include?(name) && const_get(name) && methods.include?(name)
-			true
-		else
-			super
-		end
+	def __get_phlex_kit_constant__(name)
+		const_get(name)
 	end
 
 	def const_added(name)

data/lib/phlex/sgml.rb

@@ -4,6 +4,13 @@ module Phlex
 	# **Standard Generalized Markup Language** for behaviour common to {HTML} and {SVG}.
 	class SGML
 		include Helpers
+		REF_ATTRIBUTES = Set.new(%w[href src action formaction lowsrc dynsrc background ping xlinkhref]).freeze
+		NAMED_CHARACTER_REFERENCES = {
+			"colon" => ":",
+			"tab" => "\t",
+			"newline" => "\n",
+		}.freeze
+		UNSAFE_ATTRIBUTE_NAME_CHARS = %r([<>&"'/=\s\x00])
 
 		class << self
 			# Render the view to a String. Arguments are delegated to {.new}.
@@ -71,7 +78,7 @@ module Phlex
 
 		def self.method_added(method_name)
 			if method_name == :template
-				Kernel.warn "⚠️ [DEPRECATION] Defining the `template` method on a Phlex component will not be supported in Phlex 2.0. Please rename the method to `view_template` instead."
+				Kernel.warn "⚠️ [DEPRECATION] Defining the `template` method on a Phlex component will not be supported in Phlex 2.0. Please rename `#{name}#template` to `#{name}#view_template` instead."
 			end
 		end
 
@@ -105,6 +112,11 @@ module Phlex
 			@_context = context
 			@_view_context = view_context
 			@_parent = parent
+			if @_rendered
+			  warn "⚠️ [WARNING] You are rendering a component #{self.class.name} twice. This is not supported in Phlex 2.0."
+			end
+	    @_rendered = true
+
 			if fragments
 				warn "⚠️ [WARNING] Selective Rendering is experimental, incomplete, and may change in future versions."
 				@_context.target_fragments(fragments)
@@ -416,6 +428,27 @@ module Phlex
 			buffer
 		end
 
+		def decode_html_character_references(value)
+			value
+				.gsub(/&#x([0-9a-f]+);?/i) {
+					begin
+						[$1.to_i(16)].pack("U*")
+					rescue
+						""
+					end
+				}
+				.gsub(/&#(\d+);?/) {
+					begin
+						[$1.to_i].pack("U*")
+					rescue
+						""
+					end
+				}
+				.gsub(/&([a-z][a-z0-9]+);?/i) {
+					NAMED_CHARACTER_REFERENCES[$1.downcase] || ""
+				}
+		end
+
 		# @api private
 		def __build_attributes__(attributes, buffer:)
 			attributes.each do |k, v|
@@ -428,13 +461,28 @@ module Phlex
 				end
 
 				lower_name = name.downcase
-				next if lower_name == "href" && v.to_s.downcase.tr("^a-z:",	"").start_with?("javascript:")
+				normalized_name = lower_name.delete("^a-z")
+
+				if REF_ATTRIBUTES.include?(normalized_name)
+					decoded_value = case v
+						when String then decode_html_character_references(v)
+						when Symbol then decode_html_character_references(v.name)
+					end
+
+					if decoded_value && decoded_value.downcase.tr("^a-z:", "").start_with?("javascript:")
+						next
+					end
+				end
 
 				# Detect unsafe attribute names. Attribute names are considered unsafe if they match an event attribute or include unsafe characters.
-				if HTML::EVENT_ATTRIBUTES.include?(lower_name.tr("^a-z-", "")) || name.match?(/[<>&"']/)
+				if HTML::EVENT_ATTRIBUTES.include?(lower_name.tr("^a-z-", "")) || name.match?(UNSAFE_ATTRIBUTE_NAME_CHARS)
 					raise ArgumentError, "Unsafe attribute name detected: #{k}."
 				end
 
+				if lower_name.to_sym == :id && k != :id
+				  warn "⚠️ [WARNING] Starting 2.0 Phlex will raise on non lowercase or string :id attribute."
+				end
+
 				case v
 				when true
 					buffer << " " << name

data/lib/phlex/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Phlex
-	VERSION = "1.10.3"
+	VERSION = "1.11.1"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: phlex
 version: !ruby/object:Gem::Version
-  version: 1.10.3
+  version: 1.11.1
 platform: ruby
 authors:
 - Joel Drapper
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-01 00:00:00.000000000 Z
+date: 2026-02-06 00:00:00.000000000 Z
 dependencies: []
 description: A high-performance view framework optimised for fun.
 email:
@@ -47,7 +46,6 @@ metadata:
   changelog_uri: https://github.com/phlex-ruby/phlex/blob/main/CHANGELOG.md
   funding_uri: https://github.com/sponsors/joeldrapper
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -62,8 +60,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: A fun framework for building views in Ruby.
 test_files: []