playbook_ui 16.12.0.pre.rc.0 → 16.12.0.pre.rc.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0eb3fc3a4c0be605e46bddb0ddc399e2b114d3184a53dc530259282e693b76c2
-  data.tar.gz: a5af5ef5beb4cf8be7953d349a3c7cad02d01d7a2b084dfd5cb6f51b8473d23b
+  metadata.gz: b0cbc758e63f9d4d5dbf201736dbd86f6c922ff025a8209c163264ce8a186f54
+  data.tar.gz: 87b94773628bf6591d5b7eb136ffa26441a8519b160afca6e4e6ea326a819b4b
 SHA512:
-  metadata.gz: 61904faf61da566b92ad6f526e76b71a2b7bab01670b374f82bbf8d3c690c0662f3246c876e17da7afc309ffee88947d79b523d53d9dbd1d1af1a5357c281f24
-  data.tar.gz: 2e44028845985f35348a63494bdeaeb947d777411f0a9b8dd1250859670b87baa5ffd948dab559bc6cec4c3baae28579fe023b6e264e2925b08385f5b320c713
+  metadata.gz: c91ae82e2bc2c6631192f52806cf76db101b0002a321012201b216ff928df6bf28a34692a85cfeb540191fc4d194807af8a653012e0bab25de93470dbd9e1891
+  data.tar.gz: c69a780ec1d5d6f71cfb7b6f1a33199874bb777929b850390040410e911e4c98b99ae50f60bac02488a3ec8e39b4eda25337703a884d0059aedc1f7f8aa518d6

data/app/pb_kits/playbook/pb_dropdown/_dropdown.scss

@@ -70,7 +70,7 @@
 .pb_dropdown_quickpick,
 .pb_dropdown_default_separators_hidden,
 .pb_dropdown_subtle_separators_hidden {
-  label {
+  label:not([class*="pb_radio_kit"]):not([class*="pb_checkbox_kit"]) {
     display: block !important;
   }
   .dropdown_wrapper {

data/app/pb_kits/playbook/pb_icon/icon.rb

@@ -3,6 +3,7 @@
 require "open-uri"
 require "json"
 require "digest"
+require "pathname"
 
 module Playbook
   module PbIcon
@@ -113,12 +114,9 @@ module Playbook
       end
 
       def render_svg
-        source = asset_path || icon || custom_icon
-        content = if source.to_s.include?("://")
-                    URI.open(source, "User-Agent" => "Playbook-Icon-Kit/1.0 (https://github.com/powerhome/playbook)", &:read) # rubocop:disable Security/Open
-                  else
-                    URI.open(source, &:read) # rubocop:disable Security/Open
-                  end
+        content = svg_content
+        return "" if content.blank?
+
         doc = Nokogiri::XML(content)
         svg = doc.at_css("svg")
         return "" unless svg
@@ -294,6 +292,93 @@ module Playbook
 
     private
 
+      def svg_content
+        return File.read(asset_path) if asset_path.present?
+
+        read_svg_content(icon || custom_icon)
+      end
+
+      def read_svg_content(source)
+        source = source.to_s
+        return "" if source.blank?
+
+        remote = remote_svg_uri(source)
+        return read_remote_svg(remote) if remote
+
+        path = allowed_svg_path(source)
+        return "" unless path
+
+        path.read
+      end
+
+      def remote_svg_uri(source)
+        uri = URI.parse(source)
+        uri if uri.is_a?(URI::HTTP)
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      def read_remote_svg(uri)
+        uri.open("User-Agent" => "Playbook-Icon-Kit/1.0 (https://github.com/powerhome/playbook)", redirect: false, &:read)
+      rescue OpenURI::HTTPError, StandardError
+        ""
+      end
+
+      def allowed_svg_path(source)
+        candidate = Pathname.new(source)
+        candidate = Rails.root.join(candidate) unless candidate.absolute?
+        resolved = candidate.expand_path
+        return nil unless svg_file?(resolved)
+        return nil unless path_within_allowed_root?(resolved)
+
+        resolved
+      end
+
+      # Only ever read real .svg files. This keeps non-svg files that happen to
+      # live inside an allowed root (config/master.key, credentials, .env, ...)
+      # structurally out of the read path rather than relying on the is_svg?
+      # gate to exclude them.
+      def svg_file?(path)
+        path.file? && path.extname.casecmp(".svg").zero?
+      end
+
+      def path_within_allowed_root?(path)
+        real = path.realpath
+        allowed_svg_roots.any? do |root|
+          real == root || real.to_s.start_with?("#{root}#{File::SEPARATOR}")
+        end
+      rescue
+        false
+      end
+
+      # An SVG may live in the host application or in any mounted engine
+      # (Playbook itself, or a host app's component engines), so every loaded
+      # engine root is allowed in addition to Rails.root.
+      def allowed_svg_roots
+        @allowed_svg_roots ||= svg_root_candidates.filter_map { |candidate| real_path(candidate) }.uniq
+      end
+
+      def svg_root_candidates
+        Rails::Engine.descendants
+                     .map { |engine| engine_root(engine) }
+                     .push(Playbook::Engine.root, Rails.root)
+                     .compact
+      end
+
+      def engine_root(engine)
+        engine.root
+      rescue
+        nil
+      end
+
+      def real_path(path)
+        return nil unless path
+
+        Pathname.new(path).realpath
+      rescue
+        nil
+      end
+
       def resolve_alias(icon)
         return icon unless icon_alias_map
         return icon if icon.nil?

data/app/pb_kits/playbook/pb_table/docs/_playground.json

@@ -255,5 +255,8 @@
         "react"
       ]
     }
+  },
+  "codegenDefaultProps": {
+    "size": "sm"
   }
 }

data/app/pb_kits/playbook/pb_table/docs/_playground.overrides.json

@@ -29,6 +29,9 @@
       "platforms": ["react"]
     }
   },
+  "codegenDefaultProps": {
+    "size": "sm"
+  },
   "groups": [
     {
       "name": "Layout",