phlex 2.4.0.beta2 → 2.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01002f30f11a82c8fce49ec63ce50cd3947c40a50d66c9fd02123c87a89f434c
-  data.tar.gz: 0b40acfa20d82bf9c7e6bb68c8aeca447731d56436b2876750bfc669e9ba52a4
+  metadata.gz: abdf62bcb21b9c00118dc8fa4f1c96d510caecc15eebf4539b5655c3ab94e057
+  data.tar.gz: e88808653a12b00adbb4980e07994b379bb871cabd4652c9e19bb76ef87dc0f0
 SHA512:
-  metadata.gz: 68d5a712386d7da44bb013ee956dde702d6e9f68e1cc237aac8a706a27cbff312dfd81a03405c9330f3109b87e7ff312711cf07a2e022ae1a256d984d60062cb
-  data.tar.gz: 9dd429c7d0a3d0b962ca1d6b653abd79260134c743f6322e87e90d3af200b188695cf8a2e3a6588ba2d731f6227f0c1ef1bb45b1bfd37f9ae2d6b02764a93d3a
+  metadata.gz: f6568b33898b323c45e86405f3369816262195e4da70b9b94405779fd6728307b7c785ee53392bc1717ee2de26dad5029ec47b2f6753cb80ed4880a4cd15c97e
+  data.tar.gz: '09cdec83ffabbe16b7e2895f1964f1cc29217c89b93a1a7848c982ec1d0329d101ad165b165f0c98638daf9c0b5bc3072cf671661e41d139a9ffe5f5069f9055'

data/lib/phlex/compiler/method_compiler.rb

@@ -462,7 +462,7 @@ module Phlex::Compiler
 			when Refract::AssocNode
 				(Refract::StringNode === value.key || Refract::SymbolNode === value.key) && static_attribute_value_literal?(value.value)
 			when Refract::CallNode
-				if value in { receiver: Prism::ConstantReadNode[name: :Set]| Prism::ConstantPathNode[name: :Set, parent: nil], name: :[] }
+				if value in { receiver: Prism::ConstantReadNode[name: :Set] | Prism::ConstantPathNode[name: :Set, parent: nil], name: :[] }
 					value.arguments.arguments.all? { |n| static_token_value_literal?(n) }
 				else
 					false

data/lib/phlex/compiler.rb

@@ -5,8 +5,6 @@ require "refract"
 
 module Phlex::Compiler
 	MAP = {}
-	DEPENDENCIES = {}
-
 	Error = Class.new(StandardError)
 
 	Concat = Data.define(:node) do

data/lib/phlex/fifo.rb

@@ -36,7 +36,7 @@ class Phlex::FIFO
 			@bytesize += value.bytesize
 
 			while @bytesize > @max_bytesize
-				k, v = @store.shift
+				_k, v = @store.shift
 				@bytesize -= v[1].bytesize
 			end
 		end

data/lib/phlex/html.rb

@@ -55,7 +55,7 @@ class Phlex::HTML < Phlex::SGML
 			raise Phlex::ArgumentError.new("Expected the tag name to be a Symbol.")
 		end
 
-		if (tag = StandardElements.__registered_elements__[name]) || (tag = name.name.tr("_", "-")).include?("-")
+			if (tag = StandardElements.__registered_elements__[name]) || ((tag = name.name.tr("_", "-")).include?("-") && tag.match?(/\A[a-z0-9-]+\z/))
 			if attributes.length > 0 # with attributes
 				if block_given # with content block
 					buffer << "<#{tag}" << (Phlex::ATTRIBUTE_CACHE[attributes] ||= Phlex::SGML::Attributes.generate_attributes(attributes)) << ">"

data/lib/phlex/kit.rb

@@ -63,8 +63,8 @@ module Phlex::Kit
 				end
 
 				define_singleton_method(name) do |*args, **kwargs, &block|
-					component, fiber_id = Thread.current[:__phlex_component__]
-					if (component && fiber_id == Fiber.current.object_id)
+					component = Thread.current[:__phlex_component__]
+					if component
 						component.instance_exec do
 							constant = me.const_get(name)
 							render(constant.new(*args, **kwargs), &block)

data/lib/phlex/sgml/attributes.rb

@@ -4,7 +4,13 @@ module Phlex::SGML::Attributes
 	extend self
 
 	UNSAFE_ATTRIBUTES = Set.new(%w[srcdoc sandbox http-equiv]).freeze
-	REF_ATTRIBUTES = Set.new(%w[href src action formaction lowsrc dynsrc background ping]).freeze
+	REF_ATTRIBUTES = Set.new(%w[href src action formaction lowsrc dynsrc background ping xlinkhref]).freeze
+	NAMED_CHARACTER_REFERENCES = {
+		"colon" => ":",
+		"tab" => "\t",
+		"newline" => "\n",
+	}.freeze
+	UNSAFE_ATTRIBUTE_NAME_CHARS = %r([<>&"'/=\s\x00])
 
 	def generate_attributes(attributes, buffer = +"")
 		attributes.each do |k, v|
@@ -53,7 +59,11 @@ module Phlex::SGML::Attributes
 			when Phlex::SGML::SafeObject
 				v.to_s.gsub('"', "&quot;")
 			else
-				raise Phlex::ArgumentError.new("Invalid attribute value for #{k}: #{v.inspect}.")
+				if v.respond_to?(:to_h)
+					generate_nested_attributes(v.to_h, "#{name}-", buffer)
+				else
+					raise Phlex::ArgumentError.new("Invalid attribute value for #{k}: #{v.inspect}.")
+				end
 			end
 
 			lower_name = name.downcase
@@ -64,7 +74,9 @@ module Phlex::SGML::Attributes
 				if value != true && REF_ATTRIBUTES.include?(normalized_name)
 					case value
 					when String
-						if value.downcase.delete("^a-z:").start_with?("javascript:")
+						decoded_value = decode_html_character_references(value)
+
+						if decoded_value.downcase.delete("^a-z:").start_with?("javascript:")
 							# We just ignore these because they were likely not specified by the developer.
 							next
 						end
@@ -82,7 +94,7 @@ module Phlex::SGML::Attributes
 				end
 			end
 
-			if name.match?(/[<>&"']/)
+			if name.match?(UNSAFE_ATTRIBUTE_NAME_CHARS)
 				raise Phlex::ArgumentError.new("Unsafe attribute name detected: #{k}.")
 			end
 
@@ -118,7 +130,7 @@ module Phlex::SGML::Attributes
 					else raise Phlex::ArgumentError.new("Attribute keys should be Strings or Symbols")
 				end
 
-				if name.match?(/[<>&"']/)
+				if name.match?(UNSAFE_ATTRIBUTE_NAME_CHARS)
 					raise Phlex::ArgumentError.new("Unsafe attribute name detected: #{k}.")
 				end
 			end
@@ -156,6 +168,27 @@ module Phlex::SGML::Attributes
 		end
 	end
 
+	def decode_html_character_references(value)
+		value
+			.gsub(/&#x([0-9a-f]+);?/i) {
+				begin
+					[$1.to_i(16)].pack("U*")
+				rescue
+					""
+				end
+			}
+			.gsub(/&#(\d+);?/) {
+				begin
+					[$1.to_i].pack("U*")
+				rescue
+					""
+				end
+			}
+			.gsub(/&([a-z][a-z0-9]+);?/i) {
+				NAMED_CHARACTER_REFERENCES[$1.downcase] || ""
+			}
+	end
+
 	def generate_nested_tokens(tokens, sep = " ", gsub_from = nil, gsub_to	= "")
 		buffer = +""
 

data/lib/phlex/sgml.rb

@@ -2,17 +2,6 @@
 
 # **Standard Generalized Markup Language** for behaviour common to {HTML} and {SVG}.
 class Phlex::SGML
-	ERBCompiler = ERB::Compiler.new("<>").tap do |compiler|
-		compiler.pre_cmd    = [""]
-		compiler.put_cmd    = "@_state.buffer.<<"
-		compiler.insert_cmd = "__implicit_output__"
-		compiler.post_cmd   = ["nil"]
-
-		def compiler.add_insert_cmd(out, content)
-			out.push("#{@insert_cmd}((#{content}))")
-		end
-	end
-
 	include Phlex::Helpers
 
 	class << self
@@ -32,40 +21,6 @@ class Phlex::SGML
 				super
 			end
 		end
-
-		def erb(method_name, erb = nil, locals: nil, &block)
-			loc = caller_locations(1, 1)[0]
-			path = loc.path.delete_suffix(".rb")
-			file = loc.path
-			line = loc.lineno - 1
-
-			unless erb
-				method_path = "#{path}/#{method_name}.html.erb"
-				sidecar_path = "#{path}.html.erb"
-
-				if File.exist?(method_path)
-					erb = File.read(method_path)
-					file = method_path
-					line = 1
-				elsif method_name == :view_template && File.exist?(sidecar_path)
-					erb = File.read(sidecar_path)
-					file = sidecar_path
-					line = 1
-				else
-					raise Phlex::RuntimeError.new(<<~MESSAGE)
-						No ERB template found for #{method_name}
-					MESSAGE
-				end
-			end
-
-			code, _enc = ERBCompiler.compile(erb)
-
-			class_eval(<<~RUBY, file, line)
-				def #{method_name} #{locals}
-					#{code}
-				end
-			RUBY
-		end
 	end
 
 	def view_template
@@ -105,7 +60,8 @@ class Phlex::SGML
 
 		block ||= @_content_block
 
-		Thread.current[:__phlex_component__] = [self, Fiber.current.object_id].freeze
+		previous_phlex_component = Thread.current[:__phlex_component__]
+		Thread.current[:__phlex_component__] = self
 
 		state.around_render(self) do
 			before_template(&block)
@@ -127,7 +83,7 @@ class Phlex::SGML
 			after_template(&block)
 		end
 	ensure
-		Thread.current[:__phlex_component__] = [parent, Fiber.current.object_id].freeze
+		Thread.current[:__phlex_component__] = previous_phlex_component
 	end
 
 	def context

data/lib/phlex/svg.rb

@@ -41,7 +41,7 @@ class Phlex::SVG < Phlex::SGML
 			raise Phlex::ArgumentError.new("Expected the tag name to be a Symbol.")
 		end
 
-		if (tag = StandardElements.__registered_elements__[name]) || (tag = name.name.tr("_", "-")).include?("-")
+			if (tag = StandardElements.__registered_elements__[name]) || ((tag = name.name.tr("_", "-")).include?("-") && tag.match?(/\A[a-z0-9-]+\z/))
 			if attributes.length > 0 # with attributes
 				if block_given # with content block
 					buffer << "<#{tag}" << (Phlex::ATTRIBUTE_CACHE[attributes] ||= Phlex::SGML::Attributes.generate_attributes(attributes)) << ">"

data/lib/phlex/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Phlex
-	VERSION = "2.4.0.beta2"
+	VERSION = "2.4.1"
 end

data/lib/ruby_lsp/phlex/addon.rb

@@ -41,6 +41,8 @@ module RubyLsp
 							RubyIndexer::Entry::BlockParameter.new(name: :content),
 						]),
 					], visibility: :public, comments: "Outputs a `<#{tag_name}>` tag.")
+				else
+					# no-op
 				end
 			end
 		end

metadata

@@ -1,14 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: phlex
 version: !ruby/object:Gem::Version
-  version: 2.4.0.beta2
+  version: 2.4.1
 platform: ruby
 authors:
 - Joel Drapper
 - Will Cosgrove
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-02-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: zeitwerk
@@ -85,6 +86,7 @@ metadata:
   changelog_uri: https://github.com/phlex-ruby/phlex/releases
   funding_uri: https://github.com/sponsors/joeldrapper
   rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -99,7 +101,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 3.5.3
+signing_key:
 specification_version: 4
 summary: Object-oriented views in Ruby.
 test_files: []