rubocop-neeto 0.1.20 → 0.1.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a80cf5441b3f2e8a557f1ab80f1c33f234fd0964051e0c4ba3082ed6ad4ec038
-  data.tar.gz: ed16bab4d596c2741d0205e1a3904c9207574564df4481b7aae7fac5541427f1
+  metadata.gz: 8f79480fcc020ba036f101838a8970627d0d6cee99fdf7db819c0eaf55430e8f
+  data.tar.gz: 510ea55903e4e085be783f0bfc618e5e28f725ac399c83d992ea03473b030dff
 SHA512:
-  metadata.gz: f34434c7395250edfac2c36e73f719bbcf80f37443945e9a6e1fc31958dc1736aba5c3705eeea4f5fd455e72022e2f1e7465ce9810fc72e32a757840aaed0840
-  data.tar.gz: 4c4e0f22d50814ceb614509f44218e0733a3466eccb7674d29cc200fed15e9bed465e99c1e8f0d91d2f0a548cccb5c060b3ab65cbf98011e0d7f6aed01f73869
+  metadata.gz: 8e93ef6aac8079e2a95f8994e63d34f826a3f5f56041d7285695323bcb3a1910c16027c6a1278c2a81c15d52454366f7a65e89619a14ef7c2592afcdbb499344
+  data.tar.gz: 266c32b005d5d7bfb3933f936dc27895e0d388db5e74dfbc4bcf52cfe3683ef58158c8a1f6240d5a7dbf680bd2631eea6fdac5ea949690de839c68a342295ef0

data/README.md

@@ -12,7 +12,7 @@
 8. [Neeto/DirectLiquidRender](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/DirectLiquidRender)
 9. [Neeto/HtmlTranslationInterpolation](https://rubocop-neeto.neetodeployapp.com/docs/RuboCop/Cop/Neeto/HtmlTranslationInterpolation)
 
-The HTML-safety cops (6 to 9) report at `Severity: info` while products migrate, so they show in editors and CI output without failing the build. They move to `Severity: error` once every product is migrated.
+The HTML-safety cops (6 to 9) report at `Severity: refactor`, like the other Neeto cops, so their offenses fail RuboCop and erb_lint at the default fail level.
 
 ## Installation
 

data/config/default.yml

@@ -74,7 +74,7 @@ Neeto/HtmlSafeOnDynamicString:
     or `safe_join` instead, or annotate a reviewed call with
     `# neeto:html-safe-reviewed <reason>`.
   Enabled: true
-  Severity: info
+  Severity: refactor
   VersionAdded: '0.1'
   Include:
     - app/**/*.rb
@@ -88,7 +88,7 @@ Neeto/HtmlInStringLiteral:
     markup outside views with `tag`, `content_tag`, `link_to`, `mail_to`,
     `safe_join` or a partial instead of string literals and heredocs.
   Enabled: true
-  Severity: info
+  Severity: refactor
   VersionAdded: '0.1'
   Include:
     - app/**/*.rb
@@ -104,11 +104,12 @@ Neeto/DirectLiquidRender:
     escapes every output and requires an explicit format (`:html` or `:text`).
     Check a template's syntax with `NeetoCommonsBackend::LiquidRenderer.validate!`.
   Enabled: true
-  Severity: info
+  Severity: refactor
   VersionAdded: '0.1'
   Include:
     - app/**/*.rb
     - lib/**/*.rb
+    - app/**/*.jbuilder
 
 Neeto/HtmlTranslationInterpolation:
   Description: >-
@@ -117,13 +118,15 @@ Neeto/HtmlTranslationInterpolation:
     Escape each value with `ERB::Util.html_escape`, or keep the markup out of
     the translation and build it with `tag` or `content_tag`.
   Enabled: true
-  Severity: info
+  Severity: refactor
   VersionAdded: '0.1'
   LocaleFiles:
-    - config/locales/en.yml
+    - config/locales/**/en.yml
+    - config/locales/**/*.en.yml
   Include:
     - app/**/*.rb
     - lib/**/*.rb
+    - app/views/**/*.erb
+    - app/views/**/*.inky
   Exclude:
-    - app/views/**/*
     - lib/tasks/**/*

data/lib/rubocop/cop/neeto/html_in_string_literal.rb

@@ -49,7 +49,7 @@ module RuboCop
         def on_dstr(node)
           return if part_of_another_literal?(node)
 
-          check(node, node.each_child_node(:str).map(&:value).join)
+          check(node, literal_text(node))
         end
 
         private
@@ -61,6 +61,10 @@ module RuboCop
             add_offense(node)
           end
 
+          def literal_text(node)
+            node.each_child_node(:str, :dstr).map { |child| child.str_type? ? child.value : literal_text(child) }.join
+          end
+
           def part_of_another_literal?(node)
             ENCLOSING_LITERAL_TYPES.include?(node.parent&.type)
           end

data/lib/rubocop/cop/neeto/html_safe_on_dynamic_string.rb

@@ -37,6 +37,10 @@ module RuboCop
 
         RESTRICT_ON_SEND = %i[html_safe raw safe_concat].freeze
 
+        def_node_matcher :view_helpers?, <<~PATTERN
+          (send _ {:helpers :view_context})
+        PATTERN
+
         def on_send(node)
           value = trusted_value(node)
           return if value.nil? || static_string?(value) || reviewed?(node)
@@ -52,7 +56,7 @@ module RuboCop
             when :html_safe
               node.receiver if node.arguments.none?
             when :raw
-              node.first_argument if node.receiver.nil? && node.arguments.one?
+              node.first_argument if (node.receiver.nil? || view_helpers?(node.receiver)) && node.arguments.one?
             when :safe_concat
               node.first_argument if node.arguments.one?
             end

data/lib/rubocop/cop/neeto/html_translation_interpolation.rb

@@ -7,8 +7,9 @@ module RuboCop
     module Neeto
       # `I18n.t` does not escape interpolated values, even for `_html` keys
       # (only the view helper `t` does). A translation that contains HTML and
-      # interpolates an unescaped value outside a view lets that value inject
-      # markup. The cop reads the translations from `LocaleFiles`.
+      # interpolates an unescaped value lets that value inject markup. In views,
+      # the `t` helper escapes the values of `_html` keys, so only those are
+      # allowed there. The cop reads the translations from `LocaleFiles`.
       #
       # @example HtmlTranslationInterpolation: true (default)
       #   # en.yml
@@ -24,6 +25,12 @@ module RuboCop
       #   # good
       #   tag.p(I18n.t("seed.description_text", name: user.name))
       #
+      #   # bad (in a view)
+      #   <%= sanitize t("seed.description", name: @name) %>
+      #
+      #   # good (in a view)
+      #   <%= t("seed.description_html", name: @name) %>
+      #
       class HtmlTranslationInterpolation < Base
         MSG = "Translation `%<key>s` contains HTML and interpolates %<variables>s, which `I18n.t` does not " \
               "escape. Escape each value with `ERB::Util.html_escape`, or keep the markup out of the translation " \
@@ -31,13 +38,19 @@ module RuboCop
 
         RESTRICT_ON_SEND = %i[t translate].freeze
         OPTIONS = %i[locale scope default raise throw count].freeze
+        VIEW_FILE = %r{(?:\A|/)app/views/}
 
         def_node_matcher :translation_call, <<~PATTERN
-          (send {nil? (const {nil? cbase} :I18n)} {:t :translate} (str $_) $...)
+          (send {nil? (const {nil? cbase} :I18n)} {:t :translate} ${str sym array} $...)
         PATTERN
 
         def_node_matcher :escaped_value?, <<~PATTERN
-          (send {nil? (const (const {nil? cbase} :ERB) :Util)} {:html_escape :h} _)
+          {
+            (send {nil? (const (const {nil? cbase} :ERB) :Util)} {:html_escape :h} _)
+            (send (const {nil? cbase} :CGI) :escapeHTML _)
+            (send _ {:link_to :content_tag :mail_to :safe_join} ...)
+            (send (send _ :tag) _ ...)
+          }
         PATTERN
 
         def self.translations_cache
@@ -45,10 +58,13 @@ module RuboCop
         end
 
         def on_send(node)
-          translation_call(node) do |key, arguments|
+          translation_call(node) do |key_node, arguments|
             options = arguments.last
             next unless options&.hash_type?
 
+            key = translation_key(key_node, options)
+            next if key.nil? || escaped_by_view_helper?(node, key)
+
             translation = translations[key]
             next unless translation.is_a?(String) && HtmlInStringLiteral::HTML_TAG.match?(translation)
 
@@ -61,6 +77,27 @@ module RuboCop
 
         private
 
+          def escaped_by_view_helper?(node, key)
+            node.receiver.nil? && VIEW_FILE.match?(processed_source.file_path.to_s) &&
+              (key.end_with?("_html") || key.split(".").last == "html")
+          end
+
+          def translation_key(key_node, options)
+            key = literal_path(key_node)
+            scope = options.pairs.find { |pair| pair.key.sym_type? && pair.key.value == :scope }&.value
+            return key if scope.nil? || key.nil?
+
+            scope_path = literal_path(scope)
+            "#{scope_path}.#{key}" if scope_path
+          end
+
+          def literal_path(node)
+            parts = node.array_type? ? node.values : [node]
+            return unless parts.all? { |part| %i[str sym].include?(part.type) }
+
+            parts.map { |part| part.value.to_s }.join(".")
+          end
+
           def unescaped_variables(options)
             options.pairs.filter_map do |pair|
               next unless pair.key.sym_type?
@@ -72,14 +109,14 @@ module RuboCop
 
           def translations
             self.class.translations_cache[locale_files] ||= locale_files.each_with_object({}) do |path, result|
-              next unless File.exist?(path)
-
               YAML.safe_load_file(path, aliases: true)&.each_value { |tree| flatten(tree, nil, result) }
             end
           end
 
           def locale_files
-            Array(cop_config["LocaleFiles"]).map { |path| File.expand_path(path, config.base_dir_for_path_parameters) }
+            Array(cop_config["LocaleFiles"]).flat_map do |pattern|
+              Dir.glob(File.expand_path(pattern, config.base_dir_for_path_parameters))
+            end.sort
           end
 
           def flatten(tree, prefix, result)

data/lib/rubocop/neeto/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Neeto
-    VERSION = "0.1.20"
+    VERSION = "0.1.21"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-neeto
 version: !ruby/object:Gem::Version
-  version: 0.1.20
+  version: 0.1.21
 platform: ruby
 authors:
 - Neeraj Singh
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-12 00:00:00.000000000 Z
+date: 2026-11-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop