ruby-exclaim 0.0.0 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23b0cbf8949adc14eff900789bf6e6e099179e8c06ddb36fd83092397466b653
-  data.tar.gz: d51958364005213af769660afa6d71a210203832b16fda5ee167164e0c080464
+  metadata.gz: c58fbe14b28a72c3f22279981f5f37c65a31120948f62acfaac8555944281c69
+  data.tar.gz: 478d295febd82bb1bd4137578983578cb3d105c38bbcf241c48d4abbc13849cf
 SHA512:
-  metadata.gz: 3bb5dee1daa8a139f034c0e08cb52cf32d3844a60f0d2f2761ae73bb0b031615e0ff28f35e9bb48577f7ddb11c96ecf340a6fd0937009291b0d33b9c7e40b4a0
-  data.tar.gz: f18f08e66dbf47ac312ec3958bce96bd25ab65045524f4d1b509de1b373381b3a4c06600edde85afddf46bba4a942c3ac7ef1c94be32ea6b76e40e8839346d18
+  metadata.gz: 7a8a70584a279e7c61d5aef6061c8a80095822f4526325278263b9bfca58ebf94a30e2893840eb98d73144baf1ea3be0d1d14330b0fd00ea05d5cca5724f2936
+  data.tar.gz: da68180e51ef7c3d919d177d70bf621eda9435d59bf216b2b366c3ae67cda2b20b599d05706e6ca42e9cdadcfd3610b5fa6335598ab03ce3154598797965259c

data/CHANGELOG.md

@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+## 0.1.0 - 2021-05-06
+### Added
+- Ability to disable all HTML escaping by setting the `should_escape_html` flag to `false` when instantiating
+  `Exclaim::Ui`, e.g. `Exclaim::Ui.new(implementation_map: my_implementation_map, should_escape_html: false)`
+
 ## 0.0.0 - 2021-02-12
 ### Added
 - Initial version

data/README.md

@@ -17,6 +17,7 @@
     + [Shorthand Properties and Configuration Defaults](#shorthand-properties-and-configuration-defaults)
     + [Security Considerations](#security-considerations)
       - [Script Injection](#script-injection)
+      - [Disable HTML escaping](#disable-html-escaping)
       - [Unintended Tracking/HTTP Requests](#unintended-trackinghttp-requests)
   * [Querying the Parsed UI](#querying-the-parsed-ui)
   * [Utilities](#utilities)
@@ -633,6 +634,19 @@ your implementation can call `CGI.unescape_html` or `CGI.unescape_element`.
 See [CGI::Util](https://ruby-doc.org/stdlib-3.0.0/libdoc/cgi/rdoc/CGI/Util.html)
 in the Ruby standard library for details.
 
+##### Disable HTML escaping
+
+You can disable HTML escaping altogether by setting the `should_escape_html` flag to `false` when instantiating
+`Exclaim::Ui`. You generally should only do this when the output will not be rendered directly to HTML as this could
+potentially allow script injection and other hazards of unescaped rendering of untrusted user input. If you use this
+flag and the output is ultimately destined for a browser, make sure something downstream between `Exclaim::Ui#render`
+and the browser will escape characters that have special meaning in HTML: `<` `>` `&` `"` `'`
+
+```
+exclaim_ui = Exclaim::Ui.new(implementation_map: my_implementation_map, should_escape_html: false)
+exclaim_ui.render(env: my_environment) # HTML characters will not be escaped
+```
+
 ##### Unintended Tracking/HTTP Requests
 
 If you don't need to implement components with configurable URLs, just avoid it completely.

data/lib/exclaim/renderer.rb

@@ -2,8 +2,9 @@
 
 module Exclaim
   class Renderer
-    def initialize(parsed_ui)
+    def initialize(parsed_ui, should_escape_html = true)
       @parsed_ui = parsed_ui
+      @should_escape_html = should_escape_html
     end
 
     def call(env: {})
@@ -25,7 +26,7 @@ module Exclaim
     end
 
     def resolve_component_config(component, env)
-      resolve(component.config, env).transform_values! { |value| escape_html!(value) }
+      resolve(component.config, env).transform_values! { |value| @should_escape_html ? escape_html!(value) : value }
     end
 
     def escape_html!(value)

data/lib/exclaim/ui.rb

@@ -4,8 +4,9 @@ module Exclaim
   class Ui
     attr_reader :implementation_map, :parsed_ui, :renderer
 
-    def initialize(implementation_map: Exclaim::Implementations.example_implementation_map)
+    def initialize(implementation_map: Exclaim::Implementations.example_implementation_map, should_escape_html: true)
       @implementation_map = Exclaim::ImplementationMap.parse!(implementation_map)
+      @should_escape_html = should_escape_html
     rescue Exclaim::Error
       raise
     rescue StandardError => e
@@ -66,7 +67,7 @@ module Exclaim
 
     def parsed_ui=(value)
       @parsed_ui = value
-      @renderer = Exclaim::Renderer.new(@parsed_ui)
+      @renderer = Exclaim::Renderer.new(@parsed_ui, @should_escape_html)
     end
 
     def bind_paths(config_value, accumulator)

data/lib/exclaim/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Exclaim
-  VERSION = '0.0.0'
+  VERSION = '0.1.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby-exclaim
 version: !ruby/object:Gem::Version
-  version: 0.0.0
+  version: 0.1.0
 platform: ruby
 authors:
 - Salsify, Inc
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-26 00:00:00.000000000 Z
+date: 2021-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler